A practical, Indonesia-focused blueprint to set up a BAP-compliant Internal Control System (ICS) for shrimp farm groups in 90 days. What to prepare, who does what, how traceability works, common audit pitfalls, costs, timelines, and a week-by-week plan.
We took a 42-pond shrimp cluster from zero documentation to BAP-audit ready in 90 days using the exact approach below. If you’re looking to organize smallholders into a BAP farm group in Indonesia in 2025, here’s the blueprint we wish we’d had on day one.
The three pillars of a strong BAP group (and why groups fail)
In our experience, successful BAP group certifications rest on three pillars:
- A disciplined Internal Control System. The ICS is the brain of the group. It lays out how members are enrolled, audited, trained, corrected, and tracked. If it’s unclear, your group will drift and auditors will find gaps.
- Practical traceability and mass balance. Every kilogram from every pond needs a paper trail that matches what arrives at the buyer or processor. Sloppy lot definitions and mixed loads cause most major nonconformities.
- A hands-on group manager. Groups often appoint a nominal leader and hope for the best. That backfires. You need someone who lives in spreadsheets and on farm roads, not just in meetings.
What’s interesting is how often groups over-focus on pond water quality and underinvest in the ICS. Farm practices matter, but the ICS is how you prove consistency to an auditor. This leads us to the core questions we’re asked every week.
What is an Internal Control System (ICS) in BAP farm group certification?
Think of the ICS as your internal “mini-BAP.” It’s the documented system that governs how the group runs. It covers member eligibility, onboarding, risk assessment, internal audits, training, product identification, traceability, corrective actions, and management review. The ICS must be implemented before the external BAP audit and demonstrated with records.
Practical takeaway: Treat your ICS manual like an operating playbook, not a shelf document. Auditors will want to see that you actually use it. For example, your risk rating should drive audit frequency and training focus, not just sit in a binder.
Who can serve as the group manager and what do they do day to day?
We recommend a full-time group manager with farm ops and documentation experience. They report to the certificate holder and lead:
- Member enrollment and contracts
- Risk assessment and annual plan
- Internal audit scheduling and oversight
- Corrective action follow-up and verification
- Traceability system and lot definitions
- Training calendar and attendance tracking
- Pre-audit management review
We’ve found ex-QC supervisors from hatcheries or processors make excellent group managers. They understand records and nonconformities, and they’re comfortable being the “bad cop” when SOPs are ignored.
How many farms can join and who’s eligible?
There’s no hard universal cap. Eligibility is about manageability and commonality. Farms should be similar enough in geography, inputs, and risk profile that one ICS can realistically control them. The external auditor will sample a subset of farms based on risk and size, so the more diverse the group, the stronger your risk controls must be.
Eligibility basics we apply:
- Legal farm status and basic permits in place
- Commitment to follow the ICS and allow inspections
- No history of serious non-compliance that can’t be corrected
- Willingness to segregate BAP and non-BAP product if needed
Tip: Start tight. Onboard 10–20 committed members first. Expand after you pass the initial audit and your ICS is proven.
Which documents must each member farm keep?
Here’s the minimum bundle we audit internally before we invite an external auditor:
- Member agreement with roles, rights, and consequences
- Pond layout and ID map with GPS pins
- Stocking records: PL source, dates, quantities, health documents
- Feed records: invoices, supplier details, batch numbers. If the buyer needs 2-star or higher, feed from BAP-certified mills may be required.
- Chemical and veterinary inputs: product names, doses, approvals, dates
- Daily logs: mortality, water exchange, treatments, FCR estimates
- Harvest plan and actual harvest logs with lot IDs and weights
- Transport logs: weighbridge tickets, vehicle IDs, temperature checks
- Worker records: age verification, contracts, basic OHS training
- Environmental records: sludge handling and effluent disposal SOPs
- Corrective actions and training attendance linked to audit findings
Our rule of thumb: if it moves, measure it. If you decide it, document it.
How often should internal audits be done before the external BAP audit?
Before your first certification audit, complete at least one full internal audit of all members against the applicable BAP farm standard and your ICS. Close corrective actions and run a management review two to four weeks before the external audit. Higher-risk members may need a follow-up audit.
After certification, plan a full internal audit annually. Add targeted spot checks on critical controls during stocking and harvest seasons.
How do traceability and mass balance work in a shrimp group?
The key is clear lots and segregation. We recommend:
- Assign a unique lot code at first harvest action per pond or per harvest session. The code should follow to the buyer or processor.
- Separate transport documentation for each lot. No mixed paperwork.
- Record net weights at farm and at intake. Investigate variances beyond your tolerance.
- Maintain a mass balance sheet by month. Total harvested by lot must equal what’s shipped. If some product is sold locally, record that destination and weight too.
At the processor, insist your lots are booked in under the same lot code. That allows end-to-end traceability. When we process shrimp and finfish, we mirror farm lot codes in our intake and production records so buyers can verify the chain. If you’re consolidating with a processor, align on labels, dockets, and intake sheets well before harvest. Need help tailoring this for your cluster? You can Contact us on whatsapp.
What does ICS setup cost in Indonesia and how long does it take?
Timelines vary, but for groups that already keep basic records we see:
- 60–90 days to become audit-ready. 30–45 days if you’re moving from iBAP and have strong records.
- External audit scheduling can add 2–6 weeks depending on the certifier’s calendar.
Typical cost ranges we’ve seen in Indonesia:
- ICS creation and training: IDR 50–150 million, depending on travel and group size
- External audit: USD 4,000–8,000 plus auditor travel
- Lab testing (feed/antibiotic residues/water where applicable): IDR 10–30 million per cycle
- Ongoing admin and internal audits: IDR 2–5 million per member per year
Costs swing with geography, language support, and how much templating you can reuse. Budget conservatively and avoid rushing the first audit.
A 90-day action plan that actually works (Week 1–12)
Weeks 1–2: Map the group and lock the rules
- Define certificate holder, group manager, and internal auditors. Write job descriptions and authority lines.
- Draft your ICS manual. Use the BAP farm standard as the backbone. Keep SOPs short and specific.
- Enroll members. Sign agreements and collect permits. Risk-rate each farm and build your audit plan.
- Design your lot coding and traceability flow. Dry-run with one farm’s last harvest data.
Quick win: Create a one-page farm wall poster with the 10 records each pond must maintain. Visual reminders work.
Weeks 3–6: Train, implement, and start auditing
- Train members on records, worker rights, chemical controls, and harvest documentation.
- Roll out forms. We often use WhatsApp for geo-tagged photos and Google Sheets for lot and transport logs. Simple beats perfect.
- Conduct internal audits for all members. Log nonconformities and issue corrective actions with deadlines.
- Align with your buyer or processor on labels and intake documentation. If you export, make sure your processor can preserve your lot codes. Our team does this routinely for shrimp and for value-added finfish like Frozen Shrimp (Black Tiger, Vannamei & Wild Caught) and IQF fillets.
Weeks 7–12: Close gaps and book the external audit
- Verify corrective actions on site. Don’t accept photo-only closures for high-risk issues.
- Run a mock traceability test from pond to intake and back. Fix any breaks.
- Conduct a management review. Approve the group status and members in-scope.
- Confirm scope details with the certifier. Schedule the audit and brief your members on interview etiquette and record presentation.
Common nonconformities we see (and how to avoid them)
- Mixed lots without updated paperwork. Solution: one lot, one set of documents. Train transporters.
- Internal audits done, but corrective actions left open. Solution: set due dates and verify closure in person.
- Inconsistent worker records. Solution: standardize forms and assign a single person per farm to maintain them.
- Feed traceability gaps for buyers requiring 2-star or higher. Solution: clarify buyer star requirements early and lock qualified suppliers.
- Management review skipped. Solution: run a formal review with minutes, decisions, and sign-off.
iBAP as a stepping stone
If the group is new to formal documentation, iBAP can be a smart start. It lets you build capacity and gradually meet the full BAP requirements with structured oversight. We’ve transitioned several Indonesian clusters from iBAP to BAP by keeping the same forms and simply tightening verification and traceability.
What do buyers expect in 2025?
We’re seeing more requests for verified social compliance and tighter residue control. Some retail buyers want 2-star or higher, which brings feed or hatchery certification into the equation. Export customers also expect real-time trace-back on request. If you can produce a pond-to-pallet trace in under an hour, you’ll stand out. Questions about your buyer’s star requirements? Call us.
Quick answers to the big questions
- ICS definition: Your internal governance system for enrollment, audits, training, traceability, and corrective actions.
- Group manager role: Full-time lead for the ICS. Manages audits, traceability, CAPAs, and member compliance.
- Group size and eligibility: No fixed cap. Keep farms manageable and similar in risk profile. The auditor will sample based on risk.
- Member documents: Agreements, pond map, stocking/feed/chemical logs, harvest and transport records, worker files, environmental SOPs, and CAPA records.
- Internal audit frequency: One full audit of all members before certification. Annually thereafter, with risk-based spot checks.
- Traceability and mass balance: Unique lot codes per harvest, segregated paperwork, reconciled weights, and aligned intake at the processor.
- Costs and timelines: 60–90 days to audit-ready, with cost ranges listed above. Add scheduling time for the external audit.
If you build your ICS around these realities and keep it practical, your audit becomes a confirmation of good control, not a firefight. And that’s exactly what buyers want to see in 2025.