IFS Food 2025: What the Most Common Findings Tell Us

First, a quick refresher:

The same requirement on every list

• Cleaning and disinfection This is the first thing that stands out in the tables. It appears on the global C list, the global D list, the Türkiye C and D lists, and even on both the global and Türkiye Major lists. Cleaning is the topic every site claims to have covered (“we already do that”), so it is no accident that it produces findings at every level. The auditor is not looking for the cleaning plan. They are looking for proof that the plan works. Who cleaned what, with which chemical, how often, and how was effectiveness verified? Most sites cannot answer all of that. There is a plan, but records are missing. There are records, but no verification. There is verification, but when the result is bad, nobody can show what was done about it. Break any link in that chain and the requirement turns into a deviation.
• Equipment suitability This one also appears on all four lists. The issue is mostly hygienic design: corners that cannot be cleaned, rusted surfaces, worn seals, food-contact materials with no documented suitability. Sites buy equipment for capacity, not for how easy it is to clean. The maintenance team then keeps that equipment running for years, and when the auditor arrives, a deviation comes up.
• Protection against physical contamination during processing Unprotected light fittings above open product flow, wooden materials on the line, and gaps in breakable glass control all fall under this requirement. Its presence on both the C and D lists shows that sites see the risk but cannot apply controls consistently across the whole line.
• Storage This requirement holds a steady place on the global lists: raw materials, packaging and semi-finished products must be stored in a way that reduces contamination risk. The classic mistakes pile up here, such as allergen-containing materials on the top shelf, packaging touching the floor, and returned product kept in the same area as sound product.

Where Türkiye differs

Put the global list next to the Türkiye list and something interesting appears. In Türkiye, infrastructure requirements dominate the C and D levels.

• 4.9.3.1: Floors
• 4.9.6.2: External doors
• 4.9.4.1: Dirt buildup and condensation on ceilings and overhead fixtures

None of these findings can be closed by writing a procedure. These are findings that require investment: cracked epoxy, a door that does not close, a ceiling that collects condensation. The auditor sees them on the first walk-through and the score drops.

Türkiye’s C list has two more system requirements: 4.4.1, supplier approval and monitoring, and 4.21.2, the food defense procedure and plan. Supplier approval in Türkiye still often stops at “we collected the certificates and filed them.” What the standard asks for is a risk-based assessment and regular monitoring. Food defense, meanwhile, is still a plan on paper at many sites: no threat analysis, no identification of the site’s real weak points, a plan copied from a generic template. The auditor can tell with one question.

Majors: two different worlds

The Major lists offer the most striking comparison.

Global Major

System and control requirements

• 4.3.2 Labeling that complies with legislation and customer requirements
• 5.5.1 Quantity control of batches
• 5.4.1 Calibration of measuring and monitoring devices
• 5.6.1 Internal and external analysis plans

Türkiye Major

Site design and physical conditions

• 4.13.1 Site and equipment design that prevents pest infestation
• 4.9.1.1 Design of food processing areas
• 4.12.2 Protection against physical contamination
• 4.19.2 A risk-based approach to allergen cross-contamination

The global Major list is mostly about documentation, verification and legal compliance. Worldwide, sites have largely solved physical infrastructure. The struggle is with the depth of their control systems.

The Türkiye Major list paints a very different picture. Three of the four requirements relate directly to site design and physical conditions. In other words, findings that reach Major level in Türkiye mostly come from the production environment itself. If a building cannot keep pests out, the auditor treats it not as a system gap but as a direct threat to food safety.

The allergen requirement: 4.19.2 making the Türkiye Major list deserves attention on its own. At many sites, allergen management still amounts to printing “may contain” on the label. The standard asks for line-by-line risk assessment, cleaning verification and a segregation you can prove. A site that cannot show this gets a Major.

KO requirements: a management problem

A D on a KO requirement means losing the certificate. The requirements that stand out on the global list:

• 5.11.3: Corrective actions
• 4.18.1: Traceability
• 2.3.9.1: CCP monitoring system
• 5.1.1: Internal audits
• 4.12.1: Foreign material risk mitigation

One point needs care here. A D at KO level does not come from a requirement being applied incompletely or weakly. It comes from the requirement not being met at all, or not being effective.

The same logic applies to corrective action. If there is no system, or it does not work, the auditor treats that as a deficiency that directly affects the certificate. The presence of these requirements on the list shows that at some sites these basic systems are not actually running, even on paper.

The Türkiye KO list shares most of these requirements but differs on two: 1.2.1 (KO N°1), management and commitment, and 4.1.3 (KO N°4), the customer contract. This is where the real conversation needs to happen.

A D on management commitment means the auditor has clearly found that senior management does not own the food safety system. This finding usually comes from resource requests being postponed again and again, or from the quality team being left on its own at the site. The customer contract requirement points to a similar problem: customer specifications were never obtained, revisions were not tracked, and the product is made the way the site is used to making it, not to the customer’s requirements.

In Türkiye, the food safety system often rests on the shoulders of a single quality manager. When the system depends on one person, the auditor sees it.

So what should you do?

After reading the data, a few clear takeaways remain.

• A cleaning plan is not enough Effectiveness verification, disciplined record-keeping and a trail of what was done when results were bad: that is where the auditor actually looks.
• In Türkiye, Major risk comes from infrastructure Floors, doors, ceilings and pest barriers need budget, and that budget comes from management. The quality manager has to explain these issues not in technical terms but in terms of the risk of losing the certificate.
• KO requirements show a site’s real maturity A corrective action system that actually works, internal audits that are carried out and produce results, and traceability that works in both directions are not things you can postpone.
• Management commitment KO N°1 appearing on the Türkiye list says the problem is not in the quality department but on the management floor. Food safety culture is not a clause in a procedure. It is a management choice.

The 2025 data tells a familiar story. While the rest of the world works on the depth of its control systems, Türkiye is still talking about site conditions and management ownership. For any site preparing for its next audit, this data makes a good self-assessment checklist.

Knowing which requirement we fall short on is cheaper than hearing it from the auditor.