ISO 22000:2018 food safety management system controls are designed for moments exactly like the ButtaNutt peanut butter recall in South Africa. Aflatoxin is not a minor quality defect. It is a regulated food safety hazard that can enter through raw material sourcing, storage, and supplier handling. The key lesson is simple: if your supplier approval, incoming verification, and batch release controls are not strong enough, your brand can become the last checkpoint and the one that fails publicly. This article unpacks what happened, why aflatoxin matters, and how ISO 22000:2018 helps you build a practical testing and supplier quality programme that reduces risk and supports audit ready evidence.
What happened in the ButtaNutt recall
In February 2026, the National Consumer Commission (NCC) published a recall notice for specific ButtaNutt peanut butter products after higher than legally acceptable levels of aflatoxin were detected. The NCC stated the affected products did not meet South Africa’s Department of Health Regulation R.1145 tolerances and advised consumers to stop consumption and return products for a refund.
Key recall facts reported publicly:
- The NCC notice lists affected batches manufactured on 15 January 2026, with “best before” dates in July 2027, distributed through retailers in Gauteng, KwaZulu-Natal, Eastern Cape, and Western Cape.
- The NCC notice also includes quantities dispatched and secured, with outstanding units at the time of publication.
- ButtaNutt’s own recall notice states its internal routine testing found results above the 10 ppb regulatory limit, with the highest batch reporting an initial result of 46 ppb and a retest of 28 ppb.
- ButtaNutt also stated most stock was secured before reaching the market and that 83 units remained with consumers at the time of its notice.
This is not an isolated category problem. South Africa has seen multiple peanut and peanut based recalls linked to aflatoxin in recent years, including a major 2024 case involving Clover’s Go Nuts Peanut Butter.
Why aflatoxin is a serious food safety hazard
Aflatoxins are toxins produced by certain moulds that can contaminate crops, such as peanuts, especially where heat, humidity, and poor storage conditions allow mould growth. Public health authorities note that mycotoxins, including aflatoxins, can cause acute illness at high doses and are linked to long-term health impacts, including liver cancer risk.
The South African legal thresholds matter
South Africa’s Regulation R.1145 sets maximum tolerances for fungus produced toxins. It states that:
- Foodstuffs ready for human consumption are deemed contaminated if they contain more than 10 μg/kg total aflatoxin, with aflatoxin B1 more than 5 μg/kg.
- Peanuts intended for further processing are deemed contaminated if they contain more than 15 μg/kg total aflatoxin.
In practice, your Food Safety Management System needs to translate these limits into specifications, acceptance criteria, sampling plans, and release rules that production teams can execute consistently.
Why this matters in ISO 22000:2018 terms
ISO 22000:2018 combines management system thinking (Plan, Do, Check, Act) with HACCP principles. It expects you to:
- Identify hazards and implement control measures through PRPs, OPRPs, and CCPs.
- Verify that controls work through monitoring, measurement, and verification.
- Control externally provided products and services, because suppliers are part of your food safety reality.
When aflatoxin shows up in finished product testing, it is usually a sign that at least one of these layers was not strong enough, not fast enough, or not evidence-based.
Why ISO 22000 supplier controls matter
ISO 22000:2018 explicitly links food safety outcomes to how you manage suppliers and outsourced activities. BSI’s mapping guide highlights “control of externally provided processes, products or services” as part of Clause 7 support.
Risk reduction
If you treat peanuts as a high-risk raw material (which they often are for aflatoxin), your supplier’s programme must match that risk. One-size supplier approval does not work.
Audit-ready formatting
Auditors will look for a traceable line from hazard identification to supplier controls, to testing evidence, to release decisions, to recall readiness.
Faster decision-making
A defined “hold, test, release” workflow reduces debate when results are borderline or when a supplier changes origin, season, or storage method.
Knowledge transfer
Documented sampling, lab methods, and acceptance criteria prevent tribal knowledge from becoming your only control.
Where ISO 22000:2018 controls should catch aflatoxin risk
1) PRPs and storage discipline (prevention)
Aflatoxin risk increases when peanuts are stored with uncontrolled moisture, temperature, pests, and poor stock rotation. PRPs should cover receiving conditions, storage conditions, segregation, cleaning, and pest control.
2) Hazard analysis and control planning (control)
BSI’s mapping guide shows the operational elements expected in Clause 8, including PRPs, traceability, emergency preparedness, hazard analysis, validation, verification planning, and the hazard control plan.
For peanuts, aflatoxin is usually controlled through a combination of:
- Supplier controls (pre-harvest and post-harvest handling)
- Incoming testing (verification)
- Controlled storage (prevention)
- Positive release rules (containment)
3) Traceability and recall readiness (containment)
ISO 22000 expects an operational traceability system and a recall capability. The mapping guide lists traceability systems and emergency preparedness and response as core operational elements.
When a recall happens, traceability determines whether it is a limited batch event or a brand-wide crisis.
Testing and verification that actually reduces risk
Testing is not a marketing statement. It is a controlled process that must be designed to detect hazards reliably.
What “good” looks like for aflatoxin testing
- Risk-based sampling plan (more sampling for higher-risk origins, seasons, or suppliers)
- Representative sampling (composite samples where appropriate, controlled chain of custody)
- Defined test method and lab competence (use accredited labs where possible, confirm method suitability)
- Clear acceptance criteria aligned to Regulation R.1145 and your own stricter internal limits if applicable
- Positive release for high-risk materials or finished batches: no release until results are verified
ButtaNutt’s stated move toward a batch specific release decision based on an independent certificate of analysis is aligned with a “positive release” mindset.
The key is consistency: positive release must be systematic, not occasional.
Example: A practical aflatoxin control plan for peanut butter
Use this as a mini template your ISO 22000 team can adapt.
Supplier approval controls
- Supplier risk rating (origin, storage conditions, historical results)
- Documented specifications for peanuts (including aflatoxin limits)
- Supplier certificates of analysis requirements (frequency, lot linkage)
- Supplier audit schedule (on-site or remote, risk-based)
- Change control rule: any change in origin, storage, or process triggers re-evaluation
Incoming goods controls
- Receiving checklist: packaging integrity, moisture indicators, temperature exposure, infestation signs
- Quarantine rule: “hold” status until verification is complete
- Sampling plan: lot size, sample points, composite method, retention samples
- Test rule: rapid screen plus confirmatory lab testing where needed
Batch release controls
- Release authority and criteria (who signs off, what evidence is required)
- Decision tree for borderline results
- Corrective action triggers (supplier notification, increased sampling, suspension)
Records to retain
- Incoming inspection records
- Lab reports and certificates of analysis
- Batch release record
- Trend analysis report (monthly or quarterly)
- Supplier performance scorecard
A word from the auditor’s perspective
Most supplier-related nonconformities are not about missing documents. They are about weak logic.
Common auditor concerns include:
- Supplier approval exists on paper but does not reflect ingredient risk.
- Certificates of analysis are collected but not verified against lots and traceability.
- Testing frequency is fixed, even when risk changes by season or supplier.
- Quarantine is not enforced, so “test and release” becomes “release and hope”.
A recall notice becomes public proof of what the system could not prevent. The objective is not to eliminate all risk. The objective is to make risk visible, controlled, and evidenced.