Regulation 2.1.17
Regulation 2.1.17: inspection and audit
The March 2026 amendment inserted a risk-based inspection and audit framework. A food business should maintain records and be prepared to provide access if the Food Authority or Commissioner directs a recognised third-party audit.
Need advice on Regulation 2.1.17?
This article is for general information. Check the notified Regulations and later amendments. For advice specific to your business, contact Bizeneed.
Introduction
Regulation 2.1.17 describes how the Food Authority and Commissioners of Food Safety arrange periodic inspections and food-safety audits of registered or licensed food businesses. Frequency and nature may depend on a dynamic risk-based mechanism, business type, compliance history, third-party audit results and food risk category.
It does not say that every food business must buy an annual private audit. The specific third-party audit duty in clause (5) follows a direction from the Commissioner or Food Authority.
Key takeaways
Inspection is risk-based
The authority may set inspection frequency and nature using the listed risk factors, including business type and compliance history.
A direction triggers the third-party audit duty
On direction from the Commissioner of Food Safety or Food Authority, the FBO must obtain an audit from an FSSAI-recognised third-party auditing agency or auditor at its own cost.
Provide access and records
For that directed audit, the FBO must make itself available to the auditor and provide records requested by the auditor.
Maintain audit-ready records
Keep food-safety, hygiene, training, traceability and corrective-action records relevant to the establishment and food handled. Use the applicable Schedule 4 and licence conditions as the working compliance baseline.
Respond to an inspection plan
Identify the jurisdictional Food Safety Officer and any notice or instruction issued by the Commissioner. Make the premises and relevant records available for a lawful inspection, and record findings and follow-up actions.
If a third-party audit is directed
Confirm the direction and scope, engage an FSSAI-recognised agency or auditor, arrange access, provide requested records, pay the audit cost and document corrective actions. Do not substitute an unrecognised provider where the regulation calls for recognition.
Practical checklist
Do
- Keep current hygiene and safety records suited to the business.
- Check the recognition status of an auditor after a direction.
- Retain the direction, audit report and corrective-action evidence.
Avoid
- Do not describe Regulation 2.1.17 as a universal annual paid-audit requirement.
- Do not ignore a direction for a recognised third-party audit.
Official sources
Need help applying this provision?
Discuss food-safety compliance