Managing the Distribution of IFS Audit Reports

When your food business completes an IFS audit, the final report contains sensitive information about your operations, non-conformities, and corrective actions. Understanding who owns this report and how it should be distributed is critical for maintaining confidentiality while meeting transparency requirements with your clients and certification bodies.

Who owns the IFS audit report? 🔗

The audit report belongs to the audited company. This ownership structure ensures that businesses maintain control over sensitive operational details, proprietary information, and findings that could be commercially sensitive. Unlike public records, these reports contain details on findings and corrective actions that are specific to your facility’s performance and compliance status.

This ownership principle protects your business in several important ways. First, it prevents unauthorized access to your operational details and food safety practices. Second, it gives you control over who sees information about any non-conformities identified during the audit. Third, it allows you to manage how your audit performance is communicated to different stakeholders.

How IFS audit reports are distributed 🔗

While you own the report, distribution isn’t entirely at your discretion. The final audit report is distributed to relevant stakeholders within your organization and possibly shared with clients, depending on your agreements. The certification body that conducted your audit also maintains records as required by accreditation standards.

Internal distribution requirements 🔗

Within your organization, the audit report should be accessible to key personnel who need to understand audit findings and implement corrective actions. This typically includes quality assurance managers, food safety teams, senior management, and department heads responsible for areas where non-conformities were identified. The report must be securely stored to maintain transparency and facilitate future audits.

External sharing considerations 🔗

Sharing your IFS audit report with external parties requires careful consideration. In the food industry, it’s increasingly common for clients and potential customers to request full audit reports rather than just certificates. In the UK particularly, sharing complete reports has become routine practice, with some customers receiving direct access to reports simultaneously with the audited company.

However, you’re not obligated to share your full report with every party that requests it. Many businesses choose to share only their certification status and score with prospective clients initially, providing the complete report only when necessary for business relationships. Some companies opt for on-site review only, allowing interested parties to examine the report at their facility rather than distributing copies.

Managing confidential information in audit reports 🔗

IFS audit reports often contain information that businesses reasonably consider confidential. This might include specific production processes, formulations, supplier relationships, or detailed descriptions of security measures. The challenge lies in balancing transparency with protection of proprietary information.

When third-party auditors conduct IFS assessments, certification bodies and auditees must sign agreements covering data security and confidentiality. These agreements establish the ground rules for how sensitive information will be handled throughout the audit process and in the resulting reports.

The IFS database and controlled access 🔗

The IFS database provides a structured system for managing audit information. Certification bodies upload reports to this database, where access is controlled and limited to authorized parties. This system helps maintain confidentiality while ensuring that certification status can be verified by legitimate stakeholders such as retailers and food service companies.

Companies can designate which users have access to their information in the database, providing another layer of control over report distribution. This digital infrastructure supports both confidentiality and verification needs in modern food supply chains.

Legal and contractual considerations 🔗

Your contracts with clients, retailers, or distributors may include specific clauses about audit report sharing. Some agreements explicitly require you to provide full audit reports upon request, while others may only require certificate sharing. Review these contractual obligations carefully to understand your legal responsibilities.

When negotiating new contracts, consider including clear language about what audit information will be shared, how often, and under what circumstances. Some businesses successfully negotiate non-disclosure agreements to protect sensitive information when full reports must be shared.

Best practices for audit report management 🔗

Develop a clear internal policy for audit report distribution that addresses who internally can access reports, how long reports should be retained, what security measures protect stored reports, and under what circumstances reports will be shared externally. This policy should align with your broader data protection and information security protocols.

Establish a decision-making framework for external sharing requests. Consider factors such as the requesting party’s legitimate business need, your contractual obligations, whether a non-disclosure agreement is in place, and what competitive or security risks might arise from sharing.

Communicate transparently with potential clients about your audit performance and certification status. Many businesses find that being open about their commitment to food safety builds trust, even if they choose not to share complete reports initially. Consider offering alternatives such as summary reports highlighting key compliance areas, facility tours for serious prospects, or on-site report review for qualified parties.

Handling requests from customers and regulators 🔗

When customers request your audit report, respond professionally and promptly. Acknowledge their request, explain your company’s policy on report sharing, and offer alternatives if you’re not comfortable sharing the complete report immediately. Many customers will accept a certificate and score initially, with full report access granted once a business relationship is established.

Regulatory authorities may have different rights to access audit reports depending on jurisdiction and circumstances. Legal requirements for disclosure to government agencies typically override confidentiality concerns. Consult with legal counsel when facing regulatory requests to ensure compliance with applicable laws while protecting your interests to the extent possible.

Maintaining audit report integrity 🔗

However you choose to distribute your audit reports, maintaining their integrity is essential. Never alter, redact, or selectively edit audit reports before sharing them. If you share a report, share it complete and unchanged. Tampering with audit documentation undermines the entire certification process and could result in certificate withdrawal.

Similarly, ensure that shared reports are current and reflect your most recent audit results. Sharing outdated reports, even inadvertently, misrepresents your current compliance status and creates confusion in your business relationships.

What do you think? How does your organization balance transparency with the need to protect confidential information in IFS audit reports? Have you found effective ways to satisfy customer requests while maintaining appropriate control over sensitive operational details?

References

1. https://goaudits.com/blog/ifs-audits/
2. https://www.ifsqn.com/forum/index.php/topic/36455-potential-clients-asking-for-the-entire-audit/
3. https://www.ifs-certification.com/images/ifs_documents/IFS_Broker_v3.2_remote_audit_protocol_v3_EN.pdf