I'm playing devils advocate here..........because I personally have some issues with "GFSI" audits, and your auditor is another example of why I feel this way.
What does "a business continuity plan" or "fulfilling customer orders" have to do with food safety?????
If your auditor wanted to question you on something, it should have been how you will determine the safety of your product if say the roof of the plant was ripped off during a tornado
No where is the code does it talk about fufulling orders so I would remove that from your crisis plan altogether and send your revised crisis plan that ONLY speaks to the actual requirements.
If your customers need an back up plan for production; that is a business decision and not a food safety decision at all (other than agreeing on a co packer if needed) but those decisions have nothing to do with your food SAFETY crisis plan
2.1.5.2 The crisis management plan shall include as a minimum:
i. A senior manager responsible for decision making, oversight and initiating actions arising from a crisis
management incident;
ii. The nomination and training of a crisis management team;
iii. The controls implemented to ensure a response does not compromise product safety;
iv. The measures to isolate and identify product affected by a response to a crisis;
v. The measures taken to verify the acceptability of food prior to release;
vi. The preparation and maintenance of a current crisis alert contact list, including supply chain customers;
vii. Sources of legal and expert advice; and
viii. The responsibility for internal communications and communicating with authorities, external organizations
and media.
2.1.5.3 The crisis management plan shall be reviewed, tested and verified at least annually.
2.1.5.4 Records of reviews of the crisis management plan shall be maintained.
I would push back hard on this one; the code does not ask for it, but in the auditing guidance it says
"Evidence may include:"
"Records of business continuity plan reviews and their corrective actions are available"..........................it says MAY include, so I would just remove it (it's none of SQFs business what your business plans are)