Tafelkop Biscuits in Middelburg, Mpumalanga, makes wheat-based ginger biscuits and a gluten-free oat and coconut crunchie on the same depositor, oven and flow-wrapper, on different days. When a routine test on a batch of crunchies came back above the level the law of its market allows, the production manager went looking for one big mistake. There wasn’t one. During a shortage, buying had switched to a new oat supplier after a phone call and a price list. Broken crunchies had gone back into the next day’s mix from a rework bin that had held ginger biscuit crumb the week before. And on the day in question, the dust extraction in the wheat mixing room was off for a repair. Gluten cross-contact is rarely one dramatic failure. It is a handful of small, ordinary routes, and gluten-free production controls exist to close each one and to prove it stays closed.
In short
- Gluten reaches gluten-free product through materials (ingredients, oats, blends and inputs), shared lines, people, tools and air, rework and the wrong pack or label.
- BRCGS Gluten-Free Issue 4 starts with a documented risk assessment of every ingredient and input, hidden sources included (clause 3.4.2). Oats count as a gluten source unless they are verifiable gluten-free oats.
- Every supplier, emergency suppliers included, is approved by one of three routes, and the document route needs all four of its documents (clause 3.4.4).
- Cleaning and other gluten controls must be validated, with data showing routine checks would catch a failure before product leaves the site (clause 3.9.1).
- Testing follows a risk-based sampling plan, with internal testing verified by an ISO 17025-accredited laboratory at least once a year (clauses 4.7.1, 4.7.2). The pass level is set by the law of the country of sale.
- Issue 4’s new section 5 asks for controlled packaging issue, documented line clearance and label checks through every run.
Where gluten gets in: a map of the routes
People new to gluten-free production picture the risk as a sack of wheat flour going into the wrong mixer. That happens, but it is the easiest failure to spot. Most gluten cross-contact is quieter: a carrier in a seasoning that changed without notice, a scoop moved between bins, dough lodged in a depositor, crumbs on a contractor’s toolbox. Each route has a different control and a different owner, which is why the Standard’s requirements reach purchasing, production, engineering, hygiene, the laboratory and the packing hall, and why our Introduction to BRCGS Gluten-Free Issue 4 course is written for all of those teams, not only QA.
| Route | Everyday example | Main control | Clauses |
|---|---|---|---|
| Ingredients and hidden sources | A spice blend with a wheat-based carrier | Risk assessment, supplier approval, specifications to sub-component level | 3.4.1 to 3.4.4 |
| Oats | Oats grown in rotation with wheat or cleaned on shared equipment | Treat as gluten unless verified | Glossary; 3.4 |
| Inputs | A dusting agent, release spray or coated packaging | Include processing aids, packaging and cleaning materials in the risk assessment | 3.4.2 |
| Deliveries and outsourced steps | The old version of a material accepted; product seasoned by a co-packer | Acceptance checks; approval and testing of outsourced processing | 3.4.5 to 3.4.7; 3.5 |
| Shared lines, people, tools and air | Dough residue; flour dust; an engineer’s spanner | Scheduling, dedicated PPE and tools, airflow, cleaning between runs | 4.4.1 |
| Rework and formulation | Gluten-containing crumb in a gluten-free batch | Right ingredient, right product; compatible, marked rework | 4.5.1, 4.5.2 |
| Packing and labels | Gluten-free product in a wheat product’s film | Label approval, obsolete label disposal, section 5 controls | 4.2, 4.6.1, 5 |
A control only counts if the site can show it was designed properly, carried out and checked. That is what an auditor tests, and it is what protects the person with coeliac disease who will never see your factory.
Raw materials, hidden gluten and oats
The Standard puts a documented risk assessment of every ingredient and every input at the centre of gluten control (clause 3.4.2). Inputs are the materials a process needs that are not ingredients, such as processing aids, packaging and cleaning materials, any of which could bring gluten in. The assessment looks for hidden sources as well as obvious ones, and its scores decide three things: acceptance criteria, testing frequency, and how each supplier is approved and watched. Any laboratory method you rely on to confirm a material’s status must be shown to suit that material (clause 3.4.1).
Hidden gluten usually sits in compound ingredients: seasonings, flavourings, coatings, inclusions and blends. Ask how a material is made, not only what it contains; a rice flour milled in a plant that also mills wheat is a very different risk from salt. Keep the assessment current, and revisit it at least when a supplier changes, when a supplier changes how a gluten-free material is processed, when a new contamination risk emerges, or when a recall involves a material you use (clause 3.4.3).
Oats need a word of their own. Under the Standard’s definition, oats are treated as gluten unless they are verifiable gluten-free oats, which puts the burden of proof on the site: approval, specification and test results. Beyond that, and the AOECS rule that Crossed Grain products containing oats show “OATS” under the symbol, the Standard sets no oat-specific controls. Finding out how the oats were farmed, harvested, moved and cleaned goes beyond what BRCGS requires, but without it “verifiable” is hard to show. Gluten-free claim rules are set market by market (clause 4.3.1), so check how each market you sell into treats oats. At Tafelkop, the risk assessment rated oats high risk but was never updated for the replacement supplier, and the system review that should come before a change (clause 2.3.1) never happened.
Supplier approval and goods-in: the checks at the gate
Clause 3.4.4 wants a written, risk-based approval procedure for every supplier of gluten-free ingredients and inputs, and the stand-in supplier you call during a shortage is no exception. Approval rests on at least one of three routes. On the audit and document routes a competent member of the gluten-free management system (GFMS) team reviews and verifies the evidence, so a questionnaire filed unread is not an approval.
| Route | What you hold | Where it usually goes wrong |
|---|---|---|
| A: certificate | The supplier’s valid BRCGS Gluten-Free certificate, with your item in its scope | Expired, or the scope covers a different product |
| B: supplier audit | An audit that included gluten control, by a competent auditor, with the full report reviewed | Only a summary page on file, or no proof of the auditor’s competence |
| C: documents | All four: a gluten control questionnaire, an allergen questionnaire giving each item’s gluten status, a specification to sub-component level, and a written guarantee to meet your specification and not change a blend without notice and your prior approval | One of the four missing, usually the guarantee or the sub-component detail |
If your team audits suppliers itself under route B, the Internal and Supplier Auditing Practices course covers how to plan and run those audits. Keep the approved supplier list for gluten-free materials where deliveries arrive (clause 3.4.5), and accept each delivery as the risk assessment directs (clause 3.4.6): sampling and testing, visual checks, comparing the bag’s ingredient list with the specification, or certificates of analysis. A certificate of analysis counts only if it is specific to the consignment and from an accredited laboratory, or comes from a supplier that has validated its own approved method, as the BRCGS gluten sampling and testing guideline describes, and takes part in proficiency testing. A blanket “gluten-free” letter does not qualify. When an approved change goes ahead, goods-in is told so that only the correct version is accepted (clause 3.4.7).
Outsourced steps are now in scope. Where product leaves for an intermediate step, such as seasoning, and comes back, that step belongs in your HACCP plan, the processor’s gluten controls are reviewed, and you can show it holds BRCGS Gluten-Free certification or was audited within the last 12 months against the relevant requirements. Returning product is inspected, tested or both, as the risk demands (clauses 3.5.1 to 3.5.4).
Shared lines, people, tools and air
Clause 4.4.1 asks for procedures that stop gluten reaching gluten-free product through substitution or cross-contamination. It applies as appropriate, so each site decides which points fit its layout. They range from scheduling on shared lines and how people and gluten materials move around, through dedicated clothing, storage, containers, utensils and maintenance tools, to hygienic design, cleaning on shared equipment, airflow, rework, and food brought on site by staff, visitors and contractors. Because it is assessed largely on the floor, a walk-round tells you more than the procedure.
| Area | What good looks like (our experience) | What an auditor may pick up |
|---|---|---|
| Production plan | Gluten-free runs in a set slot, usually first after a full validated clean | A gluten-free run after a wheat run with only a dry wipe |
| People and clothing | A different coloured coat for the gluten-free area, changed before entry | Operators crossing between lines in the same coat |
| Storage | Wheat flour stored apart and never above gluten-free stock; bins labelled and cleaned | An unlabelled bin, or wheat racked over gluten-free ingredients |
| Utensils and tools | Colour-coded scoops and brushes; a separate engineering toolkit | A flour-dusted toolbox on a gluten-free conveyor |
| Air and dust | Wheat flour tipping kept away from gluten-free areas, with working extraction | Flour dust on surfaces near the gluten-free line |
| Food on site | Eating only in the canteen, handwashing before returning, for visitors too | A sandwich on the packing table |
At Tafelkop, nobody had linked the wheat room’s extraction fan to the gluten-free cooling conveyor. Engineering now treats the fan as a gluten control: a repair that takes it out of service triggers a decision on whether gluten-free production runs that day. A hazard analysis that names gluten at every step (clause 2.1.1) should raise exactly that kind of question.
Rework, recipes and obsolete materials
Procedures must put the right ingredient into the right product (clause 4.5.1); weigh-up checks and barcode scanning are common evidence. Rework must never introduce gluten into a gluten-free product, must be compatible with the receiving product and must be clearly marked (clause 4.5.2). The simplest rule to follow and audit is that gluten-free rework goes back only into the same or a compatible gluten-free product, from a dedicated, labelled container, recorded in a register. Tafelkop’s shared, unlabelled rework bin failed on both counts. Our article on rework, packaging and line clearance shows why these points sit behind so many allergen recalls, and gluten is no different.
The GFMS team leader reviews and agrees every new or changed recipe before approval (clause 4.1.1). After a change, old labels and pre-printed film carrying the previous ingredient list, together with obsolete ingredients and product, are kept apart and disposed of safely (clause 4.6.1).
Cleaning validation: proving the changeover clean works
On a shared line, the clean between a wheat run and a gluten-free run is often the most important control on site, and the Standard requires gluten controls to be validated (clause 3.9.1). It is fine to manage gluten with a prerequisite programme like cleaning instead of a CCP, provided the site states that openly and can prove the programme does the job. The file needs scientific, technical or regulatory support for the method, and data showing that monitoring would detect a loss of control before product leaves the site. Validation proves in advance that a control works; verification keeps checking that it still does. A practical validation, in our experience:
- Write the method step by step, including any strip-down, tools and chemicals.
- Test the worst case: the stickiest, most gluten-rich product and the hardest-to-clean equipment.
- Test after the clean on several separate occasions, on surfaces and on the first gluten-free batch, and keep the numeric results.
- Show routine monitoring would catch a failure while the product is still on site.
- Revalidate after a change of product, equipment or method (clause 2.3.1).
Swabs, ELISA and lateral-flow tests are common sources of data. Outside the Crossed Grain route the Standard does not name a test method, so agree one with your laboratory that suits the surface and product. The commonest gap is a single good swab filed as validation; our article on allergen cleaning validation explains how to build a study that survives an audit.
Sampling and testing: plan before you sample
Under clause 4.7.1 the site writes and runs a sampling and gluten-testing programme whose purpose is to show that ingredients and finished products are not picking up undeclared gluten. Before designing it, the site assesses its gluten risk for all incoming materials and every process step, following the BRCGS Guideline on Sampling and Testing for Gluten. The plan then sets sample numbers, acceptance and rejection criteria and the statistical confidence behind them.
| What to sample (good practice) | Why | When, typically |
|---|---|---|
| High-risk raw materials, such as oats and gluten-free flours | Confirms supplier controls and the risk rating | On receipt, at a frequency set by risk and supplier history |
| The first gluten-free product after a changeover | Verifies the validated clean still works | Regularly, and after any change to the line, product or method |
| Finished gluten-free products | Confirms the product meets the claim in its market | Across products, lines and shifts, weighted by risk |
| Product returning from an outsourced step | Checks the processor’s controls | As the risk assessment requires (clause 3.5.4) |
The pass level is not a BRCGS number. Under sections 1 to 7 it is whatever the law of the country of sale requires (clause 4.3.1). Only the AOECS Crossed Grain route fixes a figure: no more than 20 mg/kg in the food as sold, tested with the R5 ELISA (Mendez method), or competitive R5 ELISA for fermented or partly hydrolysed gluten (clauses 8.1.1, 8.6.1). Either way, ask whether your laboratory’s method suits fermented products such as sourdough. At least once a year an ISO 17025-accredited laboratory verifies your internal testing, with gluten in its accreditation scope and the method validated for your matrix (clause 4.7.2). Records should show measured values where a control calls for them (clause 3.2.2); “pass” on its own is weak evidence.
Packing and labels: section 5 on the floor
A clean line is wasted if a gluten-free biscuit goes into a wheat biscuit’s film. Every new or changed label is approved, re-approved after a recipe change, communicated, and checked against the approved version on delivery (clause 4.2.1), and customers who own artwork are told of changes that affect it (clause 4.2.2). Our Allergen Labelling and Artwork Control course covers that approval workflow. Section 5, new in Issue 4, then sets four habits on the line.
| Check | When | Evidence usually asked for |
|---|---|---|
| Packaging signed out and back; only the current job’s packaging at the machine; offline coder settings changed only by authorised people (5.1.1) | Every run | An issue and return log, and a label reconciliation with variances investigated |
| Line clearance: nothing left from the previous run (5.2.1) | Before start-up and after every product change | A checklist signed by a named person |
| Pack and label checked against the approved label, codes included (5.3.1) | At the start, at set intervals, when new packaging arrives, and at packaging batch changes | Timed, signed check records |
| Scanner challenged with a deliberately wrong pack (5.3.2) | Start and end of each run, and as often as risk requires | Challenge records and a trained manual back-up procedure |
Reconciliation is the check most often skipped. If labels issued do not match packs made plus labels returned, some are somewhere they should not be, possibly on the wrong product.
When a result fails, and the people who make the controls work
Tafelkop’s first move was right: hold the batch and everything made on that line since the last good result. Then trace the oats, coconut and rework that went in, the clean that came before and where product went, with a mass balance. Record the result and actions (clause 3.2.2) and take it to the GFMS team as a trigger for review (clauses 1.4.1, 2.3.1). Look for the system weakness, not someone to blame: Tafelkop’s three causes were all system gaps.
| If | The Standard expects | Timing |
|---|---|---|
| A consumer reports a suspected reaction | Record and investigate, with action proportionate to the seriousness (3.7.1) | Promptly |
| The complaint is substantiated and the product very likely fails the Standard | Notify the certification body and BRCGS (3.7.2) | Once substantiated |
| A gluten-free product is recalled or withdrawn | Notify the national competent authority, the certification body and BRCGS (3.8.1) | BRCGS within 24 hours of the official notice |
| After the recall or withdrawal | Corrective action, root cause analysis and preventive action plan to the certification body (3.8.1) | Within 21 calendar days |
Rehearse with a mock recall on one gluten-free product at least once a year (clause 3.8.2). And train everyone who can affect the claim: engineers, contractors, agency and temporary staff all need gluten-free training for their role (clause 7.1.1), people running gluten controls have their competence assessed (clause 7.1.2), training is in a language trainees understand (clause 7.2.1), and records cover training an agency delivered for you (clause 7.4.1).
Five things to do this week
- Pull the raw material risk assessment and check it covers every ingredient and input, compound ingredients to sub-component level, and every supplier change this year.
- List every emergency or replacement supplier used in the last 12 months and check each was approved by one of the three routes before its first delivery.
- Walk the gluten-free line during a changeover with the hygiene lead and an engineer, and look at coats, tools, rework bins and dust.
- Open the cleaning validation file for each shared line. If it holds one result, or used a different product, plan a proper study.
- Reconcile the labels on the last gluten-free run, and challenge the scanner with a wrong pack.
Related course: Introduction to BRCGS Gluten-Free Issue 4
Five hours, self-paced, in three modules and twelve lessons. Module 2 covers the controls in this article, from supplier approval and contamination control to validated cleaning, testing and section 5 pack control, with South African worked examples. Module tests and a 25-question final lead to an ASC course certificate. It does not meet clause 1.2.3, which requires the GFMS team leader to pass BRCGS’s own Issue 4 Sites Training course.
See the Introduction to BRCGS Gluten-Free Issue 4 course (5 hours, online, R1,195). Training a team? Choose “EFT or company invoice” at checkout, or WhatsApp us for a quote.
Common questions
What is gluten cross-contact?
It is gluten reaching a gluten-free product indirectly rather than as a listed ingredient, for example flour dust settling on open product, residue in shared equipment, a scoop moved between bins, or a carrier in a seasoning blend. The Standard’s glossary treats cross-contact and cross-contamination as the same thing.
Are oats gluten-free under the BRCGS Gluten-Free Standard?
Not by default. The Standard’s definition of gluten includes oats unless they are verifiable gluten-free oats, so the site must prove their status through supplier approval, specifications and testing. Gluten-free claims must meet the law of each country of sale, so check how every market an oat product is sold into treats oats.
Can we rely on a supplier’s certificate of analysis instead of testing?
Sometimes. Clause 3.4.6 accepts a gluten certificate of analysis specific to the consignment from an accredited laboratory, or one from a supplier using a validated method with proficiency testing. A general gluten-free letter does not count, and your risk assessment still decides when you test.
How do we validate cleaning between wheat and gluten-free runs?
Write the method step by step, test it against the worst-case product and equipment on several separate occasions, keep the numeric results, and show that routine monitoring would detect a failed clean before product leaves the site. Revalidate when the product, equipment or method changes.
Which gluten test method does the Standard require?
On the AOECS Crossed Grain route, two methods are allowed: the R5 sandwich ELISA (Mendez method), and the competitive R5 ELISA where gluten has been fermented or partly hydrolysed. Outside that route no method is named, but methods must be fit for purpose and an ISO 17025-accredited laboratory must verify internal testing at least once a year.
Next step. To give goods-in, production, hygiene, engineering and the packing hall the same picture of where gluten gets in, the Introduction to BRCGS Gluten-Free Issue 4 course works through every section of the Standard with South African examples and a test after each module. For the wider BRCGS family, see our BRCGS certification and training hub for South Africa.
This article is general guidance written for South African food manufacturers. It is not a substitute for the Standard: a site is audited against the BRCGS Global Standard Gluten-Free (Issue 4) together with any position statements in force, and the Standard requires the site to hold a genuine current copy. Check brcgs.com for the current issue, position statements and sampling guidance, and confirm the gluten-free claim rules of every market you sell into. Clause numbers are given so you can navigate your own copy. ASC Food Safety Training is independent of BRCGS: this article and our courses explain the Standard in our own words, are not endorsed by BRCGS, and lead to an ASC course certificate, not a BRCGS qualification.