Third Party explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Part III of the Food Safety Auditing Regulations, 2018 (regulations 8 to 12) deals with the audit itself. It says which businesses must be audited, how an audit is carried out and evidenced, what an auditor must do, how major and minor non-conformities are reported, and what the auditing agency must declare about conflict of interest.
These Regulations are read as amended up to 28 August 2018 (the Regulations as notified; FSSAI lists no amendment as at 2 October 2026). The Gazette text prevails. Later notifications should be checked on fssai.gov.in. Food businesses preparing for an audit can begin with FSSAI compliance support.
The Food Authority specifies which categories of food business must be audited, on a risk classification, and at what intervals; others may opt to be audited. A major non-conformity is reported to the licensing authority within twenty four hours; a minor one gets a rectification timeframe of not more than 30 days. The audit report goes to the licensing authority within fifteen days. Before accepting an audit, the agency gives a Form C declaration on conflict of interest.
Regulation 8: the audit process
- 8(1) The Food Authority specifies the category or type of food businesses subject to mandatory food safety auditing, on the basis of risk classification.
- 8(2) The classification is made having regard to major risk factors including food type, intended customer use, nature of activity, volume of business, method of processing and other factors the Food Authority deems necessary.
- 8(3) A business subject to mandatory auditing gets itself audited by a recognised auditing agency at such intervals as the Food Authority specifies by order.
- 8(4) A business not subject to mandatory auditing but desirous of being audited by a recognised agency may opt for it.
- 8(5) A business with satisfactory audit reports "may be subject to less frequent inspections" by the Central or State licensing authority. A proviso says that on complaints, or where public health and safety is at risk, the Food Authority shall undertake more frequent inspections.
- 8(6) The audit process for assessing the food safety management system of a food business operator shall be based on IS/ISO 19011:2011 (Guidelines for auditing management systems).
Note the wording in 8(5): satisfactory audits "may" lead to less frequent inspection. It is a possibility, not an entitlement. For the hygiene requirements that audits typically test, see our article on Schedule 4, Part II: management, testing, audit and sanitation.
Regulation 9: audit examination
- 9(1) An audit examination includes collection of objective evidence and recording of audit observations through interviews, examination of documents and activities.
- 9(2) Deficiencies or non-conformities are recorded clearly and concisely, pointing out the regulatory requirements contravened.
- 9(3) The agency verifies compliance with the food safety measures and with the Act, rules and regulations, "except those which require specific sampling and laboratory analysis of the products", and also verifies relevant documents on laboratory reports kept by the food business operator.
Regulation 10: duties of auditors
The auditor shall: conduct the food safety audit; verify compliance with the Act, rules and regulations; conduct a pre-commissioning inspection of a newly established unit as and when directed by the Food Authority; maintain confidentiality of commercial-in-confidence materials (process and product formulation, food safety programme information and audit outcomes); forward the audit report to the Food Authority within fifteen days of the audit; carry out follow-up, including further audits, to verify corrective action; maintain confidentiality of the audit; and perform such other duties as the Food Authority directs.
Regulation 11: the audit report
| Sub-regulation | What the text says |
|---|---|
| 11(1) | After the audit the auditor informs the food business operator of deficiencies or non-conformities and gives an opportunity to provide further information or clarification, to be reflected in the report |
| 11(2) | A major non-conformity, a serious failure in the food safety management system that may result in adverse health consequence "possibly even fatal", is reported to the Central or State Licensing Authority within twenty four hours |
| 11(3) | For a minor non-conformity, a shortcoming that may not cause adverse health consequence, the auditor sets a timeframe of not more than 30 days for rectification and follow up |
| 11(4) | Failure to rectify a minor non-conformity in the timeframe is referred to the Central or State Licensing Authorities |
| 11(5) | The agency gives a copy of the audit report to the food business operator immediately after the audit and forwards it to the licensing authority within fifteen days, bringing out findings, non-conformities, concerns and observations for improvement |
| 11(6) | The auditor may recommend in writing the reasons for a change in audit frequency to the licensing authority |
Two periods in the text are for the auditor and the agency, not for the food business: twenty four hours for major non-conformities and fifteen days for the report. Regulation 10(v) speaks of forwarding the report to the Food Authority, while 11(5) speaks of forwarding it to the Central or State licensing authority; both are printed as they stand.
Regulation 12: conflict of interest
Regulation 12(1) requires the auditing agency to give a declaration in Form C before accepting the food safety audit of a food business operator. Regulation 12(2) says recognition "shall be suspended or cancelled immediately" if false information on conflict of interest is provided. Form C is headed "Declaration" and covers whether the agency or its personnel gave training, guidance, certification or consultancy, held financial interest or control, were employed by the operator, or carried out the operator's audit more than three consecutive times.
An invented example: Brightway Audits is asked to audit Madhur Sweets. Before accepting the work Brightway checks that it has not trained or advised Madhur Sweets and files Form C. During the audit it finds a serious failure in the food safety management system that could cause fatal harm; it must report to the licensing authority within twenty four hours. A smaller lapse, such as an out-of-date calibration record, gets a rectification timeframe of not more than 30 days set by the auditor.
How this fits with the rest
Recognition of agencies is in regulations 1 to 3 and regulations 4 to 7. Monitoring, disputes, record keeping and the forms are in regulations 13 to 15.
Need help with a food safety audit?
An audit tests documents and practice at the same time, so preparation pays off. Our FSSAI compliance support team can run a pre-audit review and help close the gaps before the recognised agency arrives.
Key takeaways
- The Food Authority decides, on risk classification, which businesses must be audited and how often; others may opt in.
- Satisfactory reports may lead to less frequent inspection; complaints or risk can bring more.
- Major non-conformity: report within twenty four hours. Minor: rectify within a timeframe of not more than 30 days.
- The audit report goes to the licensing authority within fifteen days; the food business gets a copy immediately.
- A Form C declaration on conflict of interest comes before the audit is accepted.
Read next
- Regulations 13–15: monitoring, disputes, records and forms
- Regulations 4–7: recognition, renewal and cancellation
- Third party food safety auditing under FSSAI
- Schedule 4, Part II: management, testing, audit and sanitation
Disclaimer: Based on the FSSAI regulations named above as consolidated in FSSAI's compendium versions or as published in the Gazette, with the later notifications the article names (consulted on fssai.gov.in on 2-3 October 2026). Later notifications and the Food Safety and Standards Act, 2006 provisions referred to should be checked. This article is general information, not legal advice; check the official text before acting.