Food Supplier Audits and Technical Due Diligence in Brazil

The buyer defines the decision, the product and the requirements the supplier must meet, then engages a qualified auditor to evaluate the facility against those criteria. In practice this means a pre-audit document review, an agreed scope and agenda, an on-site visit covering the relevant areas, record sampling, interviews and a documented report. Travelling from abroad for every assessment is expensive and slow, so many buyers use an independent Brazil-based technical partner who can plan, conduct and report the audit locally in English.

Yes. InspectIQ performs on-site supplier audits, focused technical visits, corrective-action verification and broader technical due diligence at Brazilian food and ingredient manufacturers. The work is designed around the buyer's criteria and the decision being made rather than a generic checklist. InspectIQ is an independent consulting business: it does not certify suppliers, issue government approval or grant supplier-approval status on the buyer's behalf.

Depending on the agreed scope, an audit may include legal and facility identity, registered and actual activities, the food safety system, Good Manufacturing Practices, hazard controls, product and process capability, traceability, raw-material and supplier controls, laboratory evidence, authenticity risks, complaint and incident history, corrective actions and buyer-specific requirements. The scope should be proportional to the product, the hazards and the commercial significance of the decision, and it should be agreed in writing before the visit.

Verification confirms information: identity, registrations, certificate scope, documents, laboratory evidence and declared capability, often remotely. An audit evaluates implementation at the facility, comparing what is documented with what is actually done, using observation, record sampling and interviews. Verification frequently precedes an audit and can show whether an audit is needed at all. An audit provides stronger evidence for a specific facility and time period, but it is more costly and cannot be repeated as easily.

An audit assesses a facility against defined criteria at a point in time. Technical due diligence is broader: it integrates supplier identity, regulatory status, facility and system assessment, product capability, capacity, quality history, laboratory evidence, traceability, authenticity risk, dependency, subcontracting and management capability into an overall risk view for a strategic decision. Due diligence usually requires more preparation and may combine document analysis, interviews and one or more site visits.

No. An on-site audit should answer a defined decision question. For low-risk products, preliminary screening, or where strong recent independent evidence already exists, document review and remote verification may be adequate. Auditing every supplier the same way spends budget where risk is low and often leaves the highest-consequence relationships under-evaluated. The right question is what uncertainty remains and whether only physical observation can resolve it.

Partially. Document review, regulatory checks, certificate scope analysis, technical interviews, laboratory-evidence review and live video walkthroughs can be performed remotely and are often sufficient for screening or narrow questions. Remote work cannot fully replicate observation of hygiene practice, actual product flow, unselected records or informal operating behaviour. Where remote evidence is used, its limitations should be stated explicitly in the report so the buyer's decision reflects what was, and was not, verified.

The scope starts with the decision the buyer needs to make, then adds the product, intended use, destination market, hazards, specification, certification expectations, legal and customer requirements, prior findings and any known concerns. From these inputs the criteria, duration, areas to visit, records to sample and report format are agreed. Exclusions are recorded as clearly as inclusions, so the report is not later read as covering areas that were never assessed.

Yes, where the buyer is entitled to share it and the standard is appropriate for the product and facility. Many companies maintain their own supplier-approval questionnaire or audit protocol, and using it keeps findings aligned with internal approval procedures. Proprietary certification-scheme checklists are only used where authorised by their owner. Where the buyer has no standard, an audit protocol can be built from the buyer's specification, applicable requirements and recognised principles such as GMP and HACCP.

Yes. Assessment may cover building condition, layout, zoning, personnel practices, sanitation, pest management, utilities, equipment, maintenance, calibration, chemical control, foreign-material prevention, allergen management, storage and training, together with the hazard analysis and the monitoring, corrective action, verification and validation supporting it. Observation is combined with record review, because a clean facility and an effective food safety system are related but not the same thing.

Yes. Traceability is best evaluated by testing an actual lot rather than reading a procedure. A finished-product lot is selected and traced backward to raw materials and suppliers, quantities are reconciled, production records are confirmed, and affected lots and customers are traced forward. Mock-recall performance, response time and subcontractor traceability may also be reviewed. The exercise reveals gaps such as reused lot codes, undocumented rework, commingling or mass-balance differences.

Yes. Review may include the testing plan, sampling and sample identification, method suitability for the matrix, laboratory competence and accreditation scope, equipment control, data review, specification management, handling of out-of-specification results, retesting practice, trend analysis and lot release, including contract laboratories. A certificate of analysis is one piece of evidence; its reliability depends on the sample, method, laboratory, specification and release process behind it.

Yes, where the product or supply chain justifies it. Assessment may include supplier mapping, raw-material origin, approved-supplier criteria, vulnerability assessment, specifications, authenticity testing, mass balance, yield analysis, purchasing anomalies and escalation of incidents. This identifies where additional verification may be justified. Vulnerability is not an accusation: it indicates where a control or test would reduce uncertainty, not that fraud has occurred at a specific supplier.

Yes. Private-label production usually increases the buyer's exposure, because the product carries the buyer's brand while manufacturing controls sit with the supplier. Assessment typically emphasises formulation and specification control, change notification, allergen management, packaging and coding, capacity, subcontracting, complaint handling and traceability, in addition to general food safety controls. The scope should reflect the fact that the buyer, not the manufacturer, will answer to consumers and regulators.

It can, when the audit is designed for that purpose. Under FDA's FSVP rule, importers determine appropriate risk-based verification activities, which can include on-site audits, sampling and testing and review of supplier food safety records. An audit intended to support FSVP must address the relevant food, hazard and control, be conducted by a qualified individual and generate records the importer can review. A generic GMP visit should not automatically be treated as adequate FSVP verification.

No. The FSVP importer is defined by the regulation and remains the responsible party. InspectIQ can perform a verification activity such as an on-site audit and provide records for the importer's programme, but it does not assume the importer's legal obligations, does not make the importer's compliance determination and does not decide whether FSVP applies to a given entry. Those determinations, and the review of resulting records, remain with the importer.

No. An audit produces evidence and findings; approval is a buyer decision, and certification is issued only by accredited certification bodies under their own schemes. InspectIQ is neither. The report may recommend conditions, corrective actions or follow-up, and may state that no significant gaps were identified within the assessed scope, but it does not issue an approval certificate or a government-style authorisation.

Yes. Follow-up may involve document review, a technical meeting, live remote verification, a targeted site visit or a full re-audit, depending on the risk and the nature of the finding. Verification looks for evidence of effectiveness rather than administrative closure: a photograph may show a correction, and a revised procedure may show intent, but neither alone demonstrates that the underlying cause has been resolved and sustained.

It depends on scope. A focused technical visit addressing one question may require less than a day on site, while a buyer-specific audit of a complex facility, or an audit including a traceability exercise and laboratory review, generally requires more time plus preparation and reporting. Travel within Brazil can add a day or more. A duration is proposed only after the scope, product and criteria are known; a fixed number of days quoted without scope is not meaningful.

Pricing depends on facility location, scope, duration, preparation, travel, product complexity, report requirements, whether a specialist must participate and whether follow-up verification is included. For that reason InspectIQ does not publish a universal price. A defined proposal is provided once the supplier, product, destination market, criteria and decision are known, so the buyer can compare the cost against the commercial exposure the audit is intended to reduce.

Normally the buyer commissioning the assessment, which keeps the engagement aligned with the buyer's decision. Supplier-paid arrangements exist commercially, but any supplier payment or other potential conflict must be disclosed and addressed before work begins, and the report must state who engaged the auditor. The engagement terms should also define who receives the report, what may be disclosed to the supplier and who owns the work product.

That depends on the engagement and confidentiality terms agreed before the audit. Suppliers commonly receive the findings and corrective-action requests relevant to them, since they cannot act on gaps they have not seen, while commercially sensitive interpretation prepared for the buyer may remain confidential. Distribution should be decided in advance and communicated at the opening meeting so expectations are clear on both sides.

No. An audit evaluates a defined scope, using sampled evidence, at a point in time. It cannot observe every activity, guarantee future conduct, eliminate fraud risk or assure every shipment. A well-designed audit reduces uncertainty and improves the quality of the buyer's decision; it does not remove the need for specification control, incoming verification, complaint monitoring and periodic reassessment throughout the relationship.

Typically the supplier name and facility location, the product or ingredient, the destination market, the decision being made, the relationship stage, the commercial importance, whether audit criteria or a previous audit report exist, any known concerns, certification held, desired timing and the required audit and report language. Confidential records should not be sent before a secure channel and an engagement are in place.