Second-Party Audits vs GFSI Certificates for Coconut Plants
A GFSI-recognised certificate proves one thing: an accredited certification body audited the site against a scheme and issued a certificate. A second-party audit proves a different thing: your own auditor, or one you appointed, looked at your product on your lines. For a coconut plant, buyers usually need both, and the mix depends on the hazard and the volume.
The distinction matters in money and weeks. A certificate costs a buyer a register check. A second-party audit costs auditor days, travel and a corrective-action cycle. Skip the audit on a high-risk product and the file may not satisfy US rules. Repeat it on a low-risk one and the budget goes to duplication.
What does a GFSI certificate actually prove?
It proves the plant’s food safety system met a recognised scheme on the audit dates. It does not prove the same on the days between.
GFSI does not certify anyone. Its own guidance states that the Benchmarking Requirements are not a standard a business can be certified against; GFSI recognises the certification programmes that do that work. The current edition, Benchmarking Requirements v2024, was announced on 20 December 2024. It adds food safety culture content and clearer multi-site guidance.
Behind the certificate sits an accreditation chain. The certification body should be accredited to ISO/IEC 17021-1 with ISO 22003-1, by an accreditation body that is a signatory to the IAF Multilateral Recognition Arrangement. A certificate from a body outside that chain carries the scheme logo and little else.
What does a second-party audit prove?
It proves what a party with an interest in the plant, normally a customer, observed against the criteria that customer set. ISO 19011:2018 distinguishes second-party audits, run by customers or on their behalf, from third-party audits run by independent bodies. It is guidance, not a certification standard.
That freedom is the point. A scheme audit covers the scheme. A second-party audit can follow your spec, your allergen rules and your lot.
| GFSI-recognised certificate | Second-party audit | |
|---|---|---|
| Who audits | Accredited certification body | Buyer or the buyer’s appointed auditor |
| Criteria | Scheme standard, same for every client | Buyer’s spec, contract and risk list |
| Cadence | Set by the scheme’s audit cycle | Whenever the buyer schedules it |
| Scope | Defined site and product scope on the certificate | Whatever the buyer asks to see |
| Verification cost to the buyer | Register lookup | Auditor days, travel, follow-up |
| Weak point | Scope line and audit dates | Cost, and the buyer’s own auditor skill |
How often is the certified plant actually watched?
Less often than buyers assume. Under FSSC 22000 Version 6, at least one surveillance audit must be unannounced in each three-year period. In the first cycle it can be either the first or the second surveillance audit. Version 6 audits began on 1 April 2024, and remaining Version 5.1 certificates were withdrawn after 31 May 2025.
Version 7 followed. UKAS reports it was published in May 2026 with a twelve-month transition. Check which version a certificate was issued under before treating it as current.
So a supplier can hold a valid certificate and go most of a year without an auditor on site. For a plant making desiccated coconut, that is a long gap in which a kill step can drift. Our kill-step validation guide covers what the validation file must show.
When does US law require the audit?
When the hazard is serious. Under 21 CFR 1.506(d)(2), if a foreign supplier controls a hazard with a reasonable probability of causing serious adverse health consequences or death, the importer must default to an onsite audit before first import and at least annually after. The importer can instead document an adequate written determination that other verification, or less frequent audits, is appropriate.
The audit must be done by a qualified auditor. An audit by an accredited certification body’s agent, conducted to meet this requirement, fits that role. FDA’s third-party audit standards page says onsite audits for these programmes need not go through its accredited certification programme. The importer remains responsible for the auditor’s qualification.
A certificate is therefore evidence, not a safe harbour. Our FSVP records guide lists what US buyers hold on file, and the supplier qualification checklist shows how hazard class sets the audit load.
Why does coconut make the gap visible?
Because coconut products have a documented Salmonella record. The Canadian Food Inspection Agency recalled Captain’s Choice shredded coconut on 17 April 2025 for possible Salmonella, after test results, with associated illnesses reported. In August 2024 it recalled frozen shredded young coconut for the same cause. These are retail products, not industrial parcels, but the organism is the one an ingredient buyer’s kill-step file must address.
Neither a certificate nor a one-off audit prevents that. Both only show whether the controls were in place when someone looked.
Which one do you need for which risk?
Use the certificate to screen and the audit to resolve. A practical split:
- New supplier, low-moisture ingredient such as desiccated coconut: certificate verified on the public register, plus an onsite second-party audit before the first container.
- Established supplier, clean history, same line: certificate check each year, with an audit on a trigger such as a failed lot, a process change or a new line.
- Supplier with no certificate: the audit is the only evidence you will have, so scope it to the kill step, traceability and the COA methods.
Read the certificate scope line every time. A certificate covering coconut oil refining does not cover a desiccated coconut line.
What this means for buyers
- Procurement managers (A): verify the certificate, its scope and its version. Then decide the audit on hazard, not on habit.
- Importers and distributors (B): if you are the US importer, the audit decision and the qualified-auditor record are yours, not the mill’s.
- Brand owners (C): a co-packer’s certificate does not cover the raw coconut supplier behind it. Ask who audited that plant.
- Traders and brokers (D): carry the certificate copy and its scope line with every offer; buyers will ask for both before price.
FAQ
Does GFSI certify coconut suppliers? No. GFSI recognises certification programmes such as FSSC 22000. An accredited certification body audits the plant and issues the certificate.
Is a certificate enough for FSVP? Not by itself. For serious hazards the default is an annual onsite audit by a qualified auditor, unless the importer documents a justified alternative.
What is a second-party audit? An audit by a customer or its appointed auditor, against the customer’s criteria. ISO 19011:2018 separates it from independent third-party audits.
How often are certified plants audited unannounced? Under FSSC 22000 Version 6, at least one unannounced surveillance audit in each three-year period.
Need a plant audited against your spec before the first container? Send the desk an RFQ through the contact page.