The Costco Food Safety Audit Version 3.0 for CPG Brands 2026: What Changed, What It Means and How to Prepare
Costco released Version 3.0 of its Global Food Safety Audit Expectations in September 2025 — the most significant revision to the supplier food safety audit framework since the 2023 changes that mandated annual unannounced audits for all Costco suppliers.
Version 3.0 contains specific operational changes that every CPG brand currently supplying Costco — and every brand in the vendor approval process — needs to understand and integrate into their quality management system before their next certification audit. The changes are not cosmetic. Several of them materially affect audit scheduling, foreign material control program requirements, corrective action obligations for repeat non-conformances, and the pathway available to smaller suppliers entering the Costco vendor program for the first time.
This guide covers every significant Version 3.0 change, what each change means operationally for CPG brands and their co-manufacturers, and the specific quality management system updates that the Version 3.0 changes require.
Background: The Costco Food Safety Audit Framework in 2026
Before the specific Version 3.0 changes, the framework context: Costco's position is straightforward. Their brand sits on the shelf above yours, and if anything goes wrong, they will be in the headline with you.
This statement — from Costco's food safety audit expectations documentation — communicates why Costco's supplier food safety requirements exceed the GFSI baseline that most food safety professionals use as their standard. Costco's institutional brand is on every product sold through the warehouse, regardless of whether the product carries the Kirkland Signature label or the brand's own label. A food safety failure at any supplier affects Costco's institutional reputation — which is why Costco treats GFSI-benchmarked certification as the minimum entry ticket, not the full program.
The Version 3.0 framework in 2026 operates through two parallel compliance pathways:
Pathway 1: Costco GMP Audit — Costco's proprietary Good Manufacturing Practices audit conducted by Costco-approved certification bodies (Eurofins, DNV, QIMA, and others). The GMP audit covers Costco's specific requirements for HACCP, allergen control, environmental monitoring, traceability, foreign material control, and the Costco Addendum elements that go beyond GFSI standards.
Pathway 2: GFSI Certification with Costco Addendum — A GFSI-benchmarked certification audit (BRCGS, FSSC 22000, SQF, IFS) conducted simultaneously with the Costco
Addendum by an approved certification body. DNV is one of the few certification bodies approved by Costco to conduct the Costco Addendum alongside GFSI certifications in a single integrated process — the most operationally and financially efficient compliance pathway for most CPG suppliers.
The Version 3.0 changes affect both pathways — updating specific requirements, adjusting audit mechanics, and introducing new escalation provisions for repeat non-conformances.
The Version 3.0 Changes: What's Different From Version 2.0
Change 1: The Audit Window Reduced From 90 Days to 60 Days
The most operationally significant calendar change in Version 3.0: the unannounced audit window has been reduced from 90 days to 60 days. The audit must be conducted within a 60-day audit window from the date of the previous audit — 30 days before to 30 days after the audit anniversary date.
Version 2.0 allowed a 90-day window — 45 days before to 45 days after the audit anniversary date. The Version 3.0 reduction to 60 days compresses the scheduling window significantly, with two specific operational consequences:
The blackout date management becomes more critical. Version 3.0 specifies that during the scheduling process, the certification body will ask the site to provide blackout dates — periods when the site will not be operational or producing a Costco product or like product.
Blackout dates are strictly limited to non-production days and will not be granted for any other reason. The sites that plan their blackout calendar carefully — ensuring that non-production days are clearly defined and defensible — have more flexibility within the 60-day window. Sites that attempt to use blackout dates to narrow the unannounced audit window to a comfortable period are operating in conflict with the standard's intent.
The audit-readiness discipline becomes continuous. A 60-day window means the facility must maintain audit-ready conditions for approximately one sixth of the year on a rolling basis around the anniversary date. This is a meaningfully more demanding standard than the 90-day window — but operationally, it reinforces the continuous audit readiness discipline that the unannounced audit model was designed to require.
Unless blackout dates are provided by the site, all days within the 60-day audit window will be considered audit-ready dates. This provision communicates the default expectation: full availability throughout the window, with blackout dates as the exception rather than the norm.
Change 2: The X-Ray Requirement Removed — Metal Detector Minimum Standard
Version 2.0 of the Costco food safety audit expectations included mandatory x-ray inspection as a foreign material control requirement for certain product categories and processing environments. Version 3.0 removes the mandatory x-ray requirement and replaces it with a minimum standard of metal detector or detector capability.
The practical implication for CPG brands and co-manufacturers: facilities that had invested in x-ray inspection equipment specifically to meet the Version 2.0 mandatory requirement are not required to remove or decommission that equipment — x-ray continues to satisfy the foreign material detection requirement. But facilities that were planning x-ray capital investment specifically to meet the Costco requirement should revisit the requirement against Version 3.0's metal detector minimum standard before committing the capital.
The honest caveat: the removal of the mandatory x-ray requirement does not mean Costco is reducing its foreign material control expectations. It means the auditable control method is product and process-specific rather than uniformly mandated. The Version 3.0 language of "must have a minimum metal detector or detector" communicates the floor — and facilities whose specific product or process characteristics make metal detection inadequate will need to justify their foreign material control approach against the specific risk profile the audit team assesses.
For food products where metal contamination is not the primary foreign material risk — glass, hard plastic, stone — the metal detector minimum standard may not address the actual risk profile. Facilities processing these product types should ensure their HACCP plan addresses the specific foreign material risks relevant to their products with appropriate validated controls, even if x-ray is not technically required by Version 3.0.
Change 3: The GMP Audit Duration Updated to 1-2 Days
Version 3.0 clarifies that the Costco GMP audit will be completed in 1-2 onsite audit days — an update from the Version 2.0 description of the audit as a single-day event.
The 1-2 day format reflects the audit's scope comprehensiveness: the Costco GMP audit covers HACCP plan review, environmental monitoring program review, allergen management verification, foreign material control program, traceability and mock recall capability assessment, pest control documentation, supplier verification program, and food defense plan — all of which require sufficient time to verify documentation, interview personnel, and observe actual practices against documented procedures.
Facilities that have previously planned their GMP audit around a single-day calendar commitment should update their operational planning for the 1-2 day window. The specific audit duration within the 1-2 day range is determined by the facility's size, complexity, and product scope — not by the facility's preference for a shorter audit.
The production continuity consideration: a 2-day audit creates a more significant production disruption than a single-day event. Facilities where the quality manager and the production manager are required to accompany the auditor simultaneously need to plan the audit scheduling to minimize production disruption while maintaining the auditor access that a comprehensive audit requires.
Change 4: The Small Supplier Audit Pathway — Announced, One-Time Only
Version 3.0 introduces a specific clarification about the small supplier audit pathway that is operationally important for brands entering the Costco vendor program for the first time.
Small Supplier Audits are always announced — unlike the main Costco GMP audit and the GFSI with Addendum pathway, which are unannounced annually. Small Supplier Audits are intended as an introduction to Costco's food safety program and are to be performed on a one-time-basis only.
The one-time nature of the small supplier audit pathway is the critical operational detail: a facility that completes the small supplier audit as its entry into the Costco food safety program does not continue on the small supplier pathway for subsequent audit cycles. All subsequent audits must be either a Costco GMP audit or GFSI Certification with Costco Addendum — both of which are unannounced annually.
The small supplier audit's announced format is commercially significant for facilities whose operational capacity to manage an unannounced audit is limited at the time of initial vendor approval. The one-time announced entry allows the facility to prepare for the first Costco food safety audit with full knowledge of the audit date — but the facility must immediately begin building the continuous audit-readiness infrastructure that the subsequent unannounced annual audits require, rather than treating the announced first audit as the ongoing compliance model.
Change 5: The Repeat Non-Conformance Escalation
Version 3.0 introduces a specific escalation provision for repeat non-conformances: previous audit non-conformances that are not corrected by the time of the anniversary audit will each receive escalated scoring as repeat non-conformances.
This provision addresses the most common quality management system failure mode in the Costco audit context: a non-conformance identified in one audit cycle is documented and a corrective action plan is submitted — but the corrective action is not fully implemented, verified, or sustained before the next audit cycle. The Version 3.0 escalation communicates that the incomplete corrective action is more serious than the original non-conformance — because it demonstrates a quality management system that identifies problems but fails to resolve them.
The practical implication for CPG brand quality teams and co-manufacturer quality managers: every non-conformance from the most recent audit cycle must be fully corrected, verified, and documented before the audit anniversary window — not in the weeks immediately before the scheduled audit date, since the audit is unannounced and the window is 60 days, making pre-audit scrambles structurally impossible.
The corrective action closure verification system that Version 3.0 implicitly requires: each non-conformance from the prior audit cycle should have a documented corrective action — the root cause, the specific corrective measure, the implementation date, and the verification method that confirms the correction was implemented and is being sustained. This documentation must be current and accessible on any day within the 60-day audit window.
Change 6: Produce Facility Audit Consolidated Into Produce Addendum
Version 3.0 consolidates the Costco Produce Facility Audit into a single Produce Addendum — streamlining the produce-specific compliance pathway for suppliers who were previously navigating separate audit tracks for the produce category.
For non-produce CPG suppliers, this change has no direct operational impact. For produce suppliers — fresh, minimally processed, or raw agricultural commodity suppliers — the consolidation simplifies the audit framework without reducing the standards that the produce category requires.
Change 7: Allergen and Labeling Requirements Updated
Version 3.0 includes updated allergen and labeling requirements in Appendix I — reflecting the regulatory environment changes that have occurred since Version 2.0, including the sesame allergen addition to U.S. mandatory labeling requirements.
CPG brands whose products contain sesame — or whose manufacturing facilities process sesame alongside other products — need to ensure their allergen management program and their labeling reflect the updated mandatory allergen disclosure. The FASTER Act's sesame addition became effective January 1, 2023, and the Costco Version 3.0 update confirms that the allergen labeling review includes sesame compliance verification.
The Approved Certification Body Selection: Why It Matters More Under Version 3.0
Under Version 3.0, the selection of an approved certification body is more commercially significant than it was under the previous version — because the 60-day unannounced audit window requires the certification body to operate with the scheduling agility and the Costco-specific audit team training that not every GFSI certification body has invested in.
DNV is one of the few certification bodies approved by Costco to conduct the Costco Addendum alongside GFSI certifications — completing BRCGS, FSSC 22000, or SQF certification and the Costco Addendum in one integrated process. Eurofins Assurance and QIMA are also approved providers for the Costco GMP Supplier Audit and Addendum.
The combined audit efficiency matters more under the 60-day window: a facility that must manage separate GFSI certification audit scheduling and Costco Addendum scheduling within a 60-day window faces a more complex scheduling challenge than a facility using a combined-audit certification body that coordinates both elements in a single site visit.
The practical recommendation: if a co-manufacturer is not currently using a Costco-approved certification body for their GFSI audit, the Version 3.0 implementation is the appropriate moment to evaluate switching to an approved body that can provide the combined GFSI plus Costco Addendum audit — reducing administrative complexity, audit scheduling risk, and the cost of separate audit visits for the annual compliance cycle.
The Implementation Timeline: What to Do Now
For CPG brands and co-manufacturers currently in the Costco vendor program, the Version 3.0 changes require the following immediate actions:
Audit window recalibration. If the current audit anniversary falls within the next six months, the 60-day window replaces the 90-day window for the next audit cycle. Update the quality team's audit calendar to reflect the 60-day window and ensure the audit-readiness infrastructure is operational throughout that compressed window.
Blackout date review. Review the facility's production calendar and confirm which days qualify as legitimate blackout dates under Version 3.0's strict non-production day definition. Remove any blackout date proposals that would be characterized as attempts to narrow the unannounced window rather than reflecting genuine non-production periods.
Corrective action closure audit. Review every non-conformance from the most recent audit cycle and confirm that each one has been fully corrected, verified, and documented. Any non-conformance that is not closed before the next audit anniversary is a Version 3.0 escalation risk.
Foreign material control program review. Review the facility's foreign material control program against Version 3.0's metal detector minimum standard — confirming that the current control methods address the specific foreign material risks relevant to the product and process, and that the HACCP plan documents the control method rationale.
For CPG brands currently in the vendor approval process, confirm that the target co-manufacturer is using a Costco-approved certification body and that the audit schedule is aligned with the 60-day window requirement.
At Fractional Brand Managers, we guide CPG brands through Costco food safety audit compliance — Version 3.0 gap analysis, co-manufacturer audit preparation, certification body selection, corrective action documentation, and the quality management system updates that maintain continuous audit readiness throughout the 60-day unannounced window.
Contact us at 732-433-7873 or info@fractionalbrandmanagers.com.
Costco Food Safety Audit Version 3.0 — Change Summary:
Change | Version 2.0 | Version 3.0 | Operational Impact |
Unannounced audit window | 90 days (±45 from anniversary) | 60 days (±30 from anniversary) | Compressed window = stricter continuous readiness |
Foreign material control | Mandatory x-ray for certain categories | Minimum metal detector or detector | X-ray optional; HACCP must address specific risk |
GMP audit duration | Single day | 1-2 onsite days | Plan for 2-day audit scheduling impact |
Small supplier audit | Not clearly defined | Announced, one-time only | Entry pathway exists; subsequent audits unannounced |
Repeat non-conformances | Standard scoring | Escalated scoring for uncorrected prior NCs | Full corrective action closure before anniversary required |
Produce facility audit | Separate audit track | Consolidated into Produce Addendum | Simplified for produce suppliers |
Allergen labeling | Pre-FASTER Act | Updated including sesame | Sesame allergen management verification added |
Approved certification bodies (Costco GMP + Addendum): DNV, Eurofins Assurance, QIMA
Combined audit advantage: GFSI + Costco Addendum in single site visit — most efficient under 60-day window
#CostcoFoodSafetyAuditVersion3CPG2026 #CostcoFoodSafetyV3 #CostcoFoodSafety2026 #CostcoAuditVersion3 #CostcoGFSI2026 #CostcoAddendum2026
#CostcoUnannoucedAudit #Costco60DayWindow #CostcoGMPAudit2026 #CostcoDNVAudit #CostcoFoodSafetyChanges #FractionalBrandManagers #CostcoChannel2026 #CPGBrands2026 #CostcoVendor2026 #FoodSafetyCompliance2026
Comments