Key takeaways

• A non-conformity in the food industry is any deviation from legal requirements, standards (IFS, BRC, FSSC 22000) or internal rules - whether it originates from a product, a process, a document or a supplier.

• Supplier non-conformities are a category of their own: they are often detected late, hard to trace, and directly tied to the quality of the documentation available.

• Non-conformity management follows a 6-step process: detect, qualify, treat, analyze root causes, implement corrective actions, then verify effectiveness.

• Excel remains the most widely used tool, but its limits become critical as soon as the volume of deviations grows or several departments are involved.

• Centralizing supplier data upstream is one of the most effective levers to reduce the frequency of non-conformities before they reach production.

In the food industry, a non-conformity is never a simple administrative incident. It can mean a batch blocked on receipt, a product recall, a points deduction during an IFS audit, or a loss of trust with a retail customer. Quality teams know it well: quality deviations keep piling up, and handling them takes a considerable amount of time.

What gets analyzed less often is where these non-conformities actually come from. A significant share of them doesn't originate on the production line: it starts further upstream, in supplier data - an incomplete technical data sheet, an expired certificate of analysis, an unsigned specification sheet, an allergen not declared in the documentation. In other words, non-conformity management starts well before goods are even received.

This guide is aimed at Quality, Purchasing and R&D managers in food companies. It covers the full non-conformity handling process, the specifics of the food sector, and concrete levers to reduce their frequency and impact.

What is a non-conformity in the food industry?

Definition and sector-specific stakes

A non-conformity is a deviation observed between an actual situation and a reference requirement. That requirement can be legal (EC Regulation 178/2002, the "hygiene package"), a standard (IFS Food, BRC Food, FSSC 22000, ISO 22000), contractual (customer or supplier specification), or internal (procedure, product specification, HACCP plan).

In the food industry, the stakes are particularly high for three reasons:

• Consumer safety is directly at stake. An undetected deviation can lead to microbiological contamination, an undeclared allergen, or an MRL (maximum residue limit) being exceeded.

• Legal obligations are strict. EC Regulation 178/2002 requires every food business operator to be able to identify its suppliers, withdraw non-conforming products from the market, and inform the competent authorities without delay.

• Certification standards are demanding. IFS Food v8, BRC Food v9 and FSSC 22000 require not only that non-conformities be treated, but that root-cause analysis and the effectiveness of corrective actions be proven - within set deadlines.

The different types of non-conformities

In a food industry context, it is useful to distinguish four broad categories of quality deviations:

1. Product non-conformity: the finished product or raw material does not meet specifications (organoleptic, microbiological, physico-chemical parameters, labeling, weight, best-before date).

2. Supplier non-conformity: the supplier fails to meet the requirements of the specification sheet, delivery deadlines, transport conditions, or documentation obligations (certificates, technical data sheets, allergen declarations).

3. Documentation non-conformity: a required document is missing, expired, incomplete or non-compliant - a missing supplier non-conformity report, a certificate of analysis not provided, an outdated HACCP plan.

4. Process non-conformity: a deviation is observed in manufacturing or control processes - pasteurization temperature out of range, cooking time not respected, a CCP control point not recorded.

This classification matters: it determines who should handle the deviation, within what timeframe, and with what evidence.

Minor, major, critical non-conformities: how to classify them

The classification of non-conformities determines treatment priority and the consequences during an audit. Food industry standards generally use three levels:

• Minor: a limited deviation, with no immediate impact on product safety or legal compliance. Example: an incomplete control record on a non-critical point.

• Major: a significant failure to meet a standard's requirement, potentially affecting product safety or legal compliance. Under IFS Food v8, a major non-conformity results in a 15% deduction of the total score - which can jeopardize obtaining or renewing certification.

• Critical (or KO): in IFS Food, certain requirements are classified as "Knock Out" (KO). A D score on a KO point is a deal-breaker: it automatically results in audit failure, regardless of the overall score. These requirements notably concern CCP control, traceability, and the management of foreign bodies.

In practice, the criticality of a non-conformity is assessed against two criteria: the severity of the deviation (potential impact on safety or compliance) and its frequency (observed recurrence or risk of repetition).

Where do non-conformities in the food industry come from?

Non-conformities linked to suppliers and their documents

This is the angle least covered in generic guides on non-conformity management - and yet one of the most common in the food industry. A significant share of deviations detected at goods receipt or during production originates from supplier documentation failures:

• Incomplete or outdated technical data sheet: information on allergens, nutritional values or storage conditions no longer matches the actual formulation.

• Missing or expired certificate of analysis: the raw material is received without proof of microbiological or chemical compliance.

• Unsigned or outdated specification sheet: the supplier delivers according to its own specifications, not the buyer's.

• Missing declaration of compliance: for materials in contact with food, the absence of this declaration is itself a documentation non-conformity.

These documentation gaps are particularly insidious: they aren't always visible at the physical receipt of goods, and they can go undetected until an audit or, worse, until a consumer incident.

Non-conformities detected at receipt or during production

Goods receipt is the first physical filter. This is where the most visible product non-conformities are detected: damaged packaging, delivery temperature out of range, too-short shelf life, incorrect net weight. During production, process deviations are identified through self-checks, in-line controls, or lab analyses.

A concrete example: A ready-meal manufacturer receives a delivery of fresh cream. The delivery note is compliant, but the attached certificate of analysis corresponds to an earlier batch. The Quality manager has to decide: block the batch while waiting for the correct certificate, or accept it with reservations? Without a clear procedure and without a documented history of the supplier, this decision gets made under pressure - and the risk of error increases.

Non-conformities revealed during an IFS, BRC or FSSC 22000 audit

Certification audits are a major source of detection for systemic non-conformities - the ones that have existed for a long time but were never formally recorded. IFS and BRC auditors specifically check:

• The existence and upkeep of non-conformity management procedures

• The traceability of corrective actions and their effectiveness

• The control of supplier non-conformities (qualification, monitoring, evaluation)

• The availability and validity of supplier documents (technical data sheets, certificates, specification sheets)

A non-conformity revealed during an audit costs twice as much: it generates an action plan that must be submitted within a set deadline (four weeks maximum for IFS Food v8), and it can weigh on the final certification score.

The non-conformity management process, step by step

A structured non-conformity handling process includes six steps. Each one must be documented and traceable to meet food industry standard requirements.

1. Detect and record the non-conformity

Detection can occur at different points: raw material receipt, self-checks during production, a customer complaint, a lab analysis result, an internal or external audit. Recording must be immediate and precise.

A non-conformity report must contain, at a minimum:

• The date and location of detection

• A precise description of the deviation observed

• The product or batch concerned (with batch number for traceability)

• The supplier or department at the origin of the deviation

• The name of the person who detected the non-conformity

2. Qualify and assess criticality

Before taking any action, the deviation must be qualified: is it a minor, major or critical non-conformity? This qualification determines how urgently it must be handled and what immediate decisions need to be made (blocking the batch, quarantine, customer alert).

Qualification relies on two criteria: severity (potential impact on food safety, legal compliance or customer satisfaction) and detectability (could the deviation have propagated downstream?).

3. Treat immediately (containment action)

The containment action aims to correct the immediate effect of the non-conformity, without necessarily addressing its cause. It can take several forms:

• Blocking and quarantining the batch concerned

• Returning it to the supplier or destroying it

• Withdrawing the product from the market if it has already shipped

• Reprocessing or downgrading the product

This step must be documented with the decisions made, the quantities involved, and the people responsible.

4. Analyze root causes (5M method, 5 whys)

This is the step most often rushed through - and the most important one for preventing recurrence. Root-cause analysis seeks to identify why the deviation happened, not just what happened.

Two methods are commonly used in the food industry:

• The 5 Whys: you trace the causal chain by asking "why" five times. Example: why was the batch received without a certificate of analysis? → Because the supplier didn't send it. → Why? → Because the receiving procedure doesn't require blocking the batch automatically when the document is missing. → Why? → Because the specification sheet isn't built into the receiving system.

• The 5M method (Ishikawa diagram): it explores causes across five families - Material, Method, Environment ("Milieu"), Machine, Manpower - to identify systemic factors.

5. Implement corrective and preventive actions

Once the cause has been identified, corrective actions (CAPA - Corrective and Preventive Actions) need to be defined to eliminate the cause and prevent recurrence. Each action must be:

• Clearly defined (what needs to be done?)

• Assigned to an owner (who?)

• Scheduled in time (by when?)

• Documented in the quality system

Preventive actions, for their part, aim to anticipate potential non-conformities identified through risk analysis or through the history of past deviations.

6. Verify effectiveness and close the non-conformity

Verifying effectiveness is an explicit requirement of the IFS, BRC and ISO 22000 standards. It consists of making sure, after a defined period, that the corrective action has indeed removed the cause and that the deviation has not recurred.

Closing a non-conformity must be formalized with:

• Proof that the corrective action was implemented

• The result of the effectiveness check

• The closing date and the name of the Quality manager

These are exactly the pieces of evidence an IFS or BRC auditor will ask for during the next visit.

Common challenges in non-conformity management

Tracking in Excel: the limits of a non-dedicated tool

Excel remains the most widely used tool for tracking non-conformities in small and mid-sized food companies. It has real advantages: accessibility, flexibility, zero cost. But its limits become critical as soon as the volume of deviations grows or several departments need to collaborate.

The most common problems:

• No built-in workflow: no automatic alert when a corrective action deadline is approaching.

• No traceability of changes: who changed what, and when? Impossible to audit.

• No link to supplier data: the non-conformity is recorded in one file, supplier documents in another, evaluations in a third.

• High risk of human error: copy-paste mistakes, wrong version, an unsynced shared file.

• Difficult reporting: producing a non-conformity dashboard by supplier, type or period requires significant manual work.

The question isn't whether Excel is "bad", but at what point it becomes a risk in itself. For an IFS- or BRC-certified company managing dozens of suppliers, that threshold has often already been crossed.

Scattered supplier data and expired documents

In many food companies, supplier data is scattered across several tools and several teams: technical data sheets in a shared folder, certificates in emails, supplier evaluations in a Purchasing file, specification sheets in another system. This fragmentation has direct consequences on non-conformity management:

• It is hard to know, at the moment a non-conformity occurs, whether the supplier concerned has submitted all its up-to-date documents.

• Expired documents (supplier IFS/BRC certificates, certificates of analysis, allergen declarations) go undetected until an auditor flags them.

• Putting together a complete supplier file for an audit takes several days of manual work.

Lack of cross-team visibility between Quality, Purchasing and R&D

Non-conformity management isn't the Quality department's job alone. A supplier non-conformity involves Purchasing (return decision, penalty, change of supplier), R&D (reformulation if the ingredient is unavailable), Production (managing the blocked batch), and sometimes Sales (informing the customer). Yet in most organizations, these departments don't have access to the same information in real time.

The result: decisions made in silos, longer handling times, and non-conformities that keep recurring because information didn't circulate.

Supplier non-conformity management: a special case

Why supplier non-conformities are hard to handle

A supplier non-conformity has characteristics that set it apart from other types of deviations:

• It involves a third party: unlike an internal process non-conformity, handling it depends on the supplier's responsiveness and willingness to cooperate.

• It is often detected late: a documentation gap can go unnoticed for weeks if receiving checks aren't systematic.

• It affects the business relationship: opening a supplier non-conformity report also sends a signal about the quality of the relationship - which can make some Purchasing teams hesitant.

• It is hard to track over time: without a dedicated tool, it's difficult to know whether a supplier had three non-conformities in six months or just one in two years.

The role of documentation data in prevention

Preventing supplier non-conformities largely depends on the quality of the documentation data available before and during the business relationship. A supplier whose file is complete, up to date and regularly checked presents a much lower documentation risk than one whose certificates have expired and whose technical data sheets are never updated.

Concretely, the documentation data that helps prevent supplier non-conformities includes:

• Product technical data sheets (with last-updated date)

• Certificates of analysis (per batch or per period)

• Certification certificates (IFS, BRC, Organic, etc.) with validity dates

• Allergen declarations and material compliance declarations

• Signed and dated specification sheets

• Results of periodic supplier evaluations

When these documents are scattered, undated or uncontrolled, the risk of non-conformity increases mechanically.

How to structure supplier non-conformity tracking

Effective tracking of supplier non-conformities relies on four elements:

1. Systematic recording: every supplier non-conformity, even a minor one, must be recorded with the supplier's name, the product reference, the date, and the nature of the deviation.

2. A searchable history: being able to display, within seconds, every non-conformity for a given supplier over the past 12 months is essential for purchasing decisions and supplier re-evaluations.

3. A link to the supplier file: the non-conformity should be connected to the relevant supplier's documents - to check whether the deviation is linked to a missing or expired document.

4. A formalized communication process: how is the supplier informed? Within what timeframe must they respond? Who signs off on closure?

How a supplier data management tool can help

Centralizing supplier documents and data

The first condition for better managing supplier non-conformities is having a centralized, up-to-date view of all supplier data and documents. That sounds obvious - but in practice, it rarely is.

Tracklab centralizes supplier, product and document information to make tracking and using it easier. In concrete terms, this means that the moment a non-conformity arises, the Quality team can immediately access the supplier's complete file: technical data sheets, certificates, specification sheets, exchange history - without having to go through Purchasing or dig through emails.

Detecting deviations before they become non-conformities

One of the most effective levers for reducing the number of non-conformities isn't handling them better after the fact, but anticipating them. That means regularly checking the validity of supplier documents: an IFS certificate expiring in 30 days, a technical data sheet that hasn't been updated in two years, a missing certificate of analysis for a high-risk ingredient.

Tracklab makes it possible to collect, check and turn supplier documents into structured, usable data. Tracklab's AI can extract and check information found in supplier documents - making it possible to detect documentation gaps before they turn into non-conformities during an audit or a production incident.

Making audit preparation and quality reporting easier

Preparing for an IFS or BRC audit often takes several days of work to gather documentary evidence: action plans from previous non-conformities, proof of effectiveness, up-to-date supplier files, evaluation history. With centralized, structured data, that workload is considerably reduced.

Tracklab complements existing systems such as ERPs or PLMs rather than trying to replace them. It fits into a company's existing ecosystem to provide the supplier document management layer that is often missing between the quality management system and operational tools.

Best practices for effective non-conformity management

Here are seven concrete practices that Quality teams in the food industry can apply directly:

1. Standardize the non-conformity report. A single format, used by every department, prevents omissions and makes statistical analysis easier. It should include, at a minimum: date, nature of the deviation, product/batch, supplier or department concerned, criticality, immediate containment action.

2. Systematically classify every deviation. Minor, major, critical - this classification should be done at the time of recording, not afterwards. It determines treatment priority and response deadlines.

3. Don't confuse containment and corrective action. The containment action treats the symptom (blocking the batch). The corrective action treats the cause (changing the receiving procedure). Both are necessary, but only the second one prevents recurrence.

4. Set treatment deadlines and stick to them. IFS Food v8 requires an action plan to be submitted within four weeks after an audit. Internally, setting deadlines by criticality level (e.g., 48 hours for a critical non-conformity, 15 days for a minor one) helps structure the process.

5. Analyze trends, not just incidents. A monthly non-conformity dashboard broken down by type, supplier and department makes it possible to spot recurring issues before they worsen. It's also proof of continuous improvement during audits.

6. Feed supplier non-conformities into supplier evaluation. The number and nature of recorded non-conformities should feed into periodic supplier re-evaluation - and therefore into purchasing decisions. This feedback loop is often missing in organizations where Quality and Purchasing don't share the same data.

7. Check the validity of supplier documents before receipt, not after. An expired certificate detected at receipt generates a non-conformity. The same certificate detected three weeks before it expires generates a renewal request - with no incident. The difference comes down to the quality of upstream document tracking.

Conclusion

Non-conformity management in the food industry is a demanding process, sitting at the intersection of legal obligations, certification standards, and operational realities. It's not just about filling out deviation reports: it requires rigorous root-cause analysis, documented corrective actions, and systematic verification of their effectiveness.

What generic guides on quality non-conformity tracking often leave out is that, in the food industry, a significant share of deviations originate in supplier data - missing documents, outdated information, unmet specifications. Handling non-conformities without addressing this source amounts to treating the symptoms without treating the cause.

That's exactly where a platform like Tracklab adds value: by centralizing supplier data and documents, by making it possible to detect documentation gaps before they turn into non-conformities, and by making audit preparation easier. Not to replace existing tools, but to fill the missing link between quality management and supplier data management.

FAQ - Frequently asked questions about non-conformity management

What is a non-conformity in the food industry? A non-conformity is any deviation observed between an actual situation and a reference requirement - legal, standard-based (IFS, BRC, FSSC 22000, HACCP), contractual (specification sheet) or internal (procedure, specification). In the food industry, it can concern a product, a process, a document, or a supplier.

What are the different types of non-conformities in the food industry? There are generally four types: product non-conformities (out-of-spec parameters), process non-conformities (a deviation in manufacturing processes), documentation non-conformities (a missing, expired or incomplete document) and supplier non-conformities (failure to meet the specification sheet or documentation obligations). This last category is often underestimated in quality management systems.

What are the steps in handling non-conformities? Handling non-conformities follows six steps: (1) detect and record the deviation, (2) qualify its criticality (minor, major, critical), (3) implement an immediate containment action, (4) analyze root causes (5 Whys, 5M), (5) define and implement corrective and preventive actions (CAPA), (6) verify effectiveness and close the non-conformity with documented evidence.

What are the regulatory obligations in the event of a food non-conformity? EC Regulation 178/2002 requires every food business operator to identify its suppliers, withdraw non-conforming products presenting a safety risk from the market, inform the competent authorities without delay and, if necessary, recall products already reaching consumers. These obligations apply across the entire food chain.

Can non-conformities be managed with Excel? Excel can get a non-conformity tracking system started, but it quickly hits its limits: no automated workflow, no deadline alerts, high risk of human error, no way to link non-conformities to supplier files, and time-consuming manual reporting. For an IFS- or BRC-certified company managing dozens of suppliers, a dedicated tool or a supplier data management platform delivers significantly greater reliability and traceability.

What is a supplier non-conformity and how should it be managed? A supplier non-conformity is a deviation attributable to a supplier: failure to meet the specification sheet, an out-of-spec delivery, a missing or expired document. Managing it involves systematic recording, formalized communication with the supplier, tracking of corrective actions, and integration into the supplier's periodic evaluation. A supplier's non-conformity history should feed into purchasing decisions.

How do you prepare for an IFS or BRC audit on non-conformity management? The IFS or BRC auditor will check that a non-conformity management procedure exists, review records of detected deviations, root-cause analyses, corrective action plans with owners and deadlines, and proof of effectiveness verification. They will also check the control of supplier non-conformities and the validity of supplier documents. Having a centralized, up-to-date supplier file is a major asset for responding quickly to auditor requests.

What is the difference between a minor and a major non-conformity? A minor non-conformity is a limited deviation, with no immediate impact on product safety or legal compliance. A major non-conformity is a significant failure to meet a standard's requirement, potentially affecting food safety or regulatory compliance. Under IFS Food v8, a major results in a 15% deduction of the total score. KO (Knock Out) requirements form a third level: a D score on a KO point automatically results in audit failure.

Useful sources

• Regulation (EC) No 178/2002 - General food law (EUR-Lex)

• Food safety - European Commission

• EFSA - European Food Safety Authority

• Food - U.S. Food and Drug Administration (FDA)

• IFS Food v8 - Official standard (PDF, IFS Certification)

• IFS Scoring System v2.3 - Official brochure (PDF)