These finished containers have product descriptions on them too, or just the company name? I think it's 10x worse if it has your internal product descriptions on it. And then if it is just your company logo, nothing prevents this outside party from adding their product description and making it look like it came from you, a fully equipped SQF compliant facility. The magnitude of upper management's failure to grasp the liabilities of this action is stunning.
Just a few of the SQF codes I think might be relevant:
2.6.1.1 The methods and responsibility for identifying raw materials, ingredients, packaging, work-in-progress, process inputs, and finished products during all stages of production and storage shall be documented and implemented to ensure:
ii. Finished product is labeled to the customer specification and/or regulatory requirements.
You have no control over what finished product is being placed in this packaging.
2.7.1.2 A food defense plan shall be documented, implemented, and maintained based on the threat assessment (refer to 2.7.1.1). The food defense plan shall meet legislative requirements as applicable and shall include at a minimum:
vi. The measures implemented to ensure raw materials, ingredients, packaging (including labels), work-in-progress, process inputs, and finished products are held under secure storage and transportation conditions;
You can't account for proper food defense if your managers are going to sell your marked finished product containers out the back door.
2.7.2 Food Fraud (Mandatory)
2.7.2.1 The methods, responsibility, and criteria for identifying the site's vulnerability to food fraud, including susceptibility to raw material or ingredient substitution, finished product mislabeling, dilution, or counterfeiting, shall be documented, implemented, and maintained.
IIRC you're at a seafood type plant. They could stuff a package that says fish with fresh banana muffins and now your company is on the hook for fraud. That'd be a laughable case, but if they could easily claim it's a premium fish and replace it with cheap tilapia at triple the price (counterfeiting) and that absolutely comes back as fraud.
2.8.1.9 The site shall document and implement methods to control the accuracy of finished product labels (or consumer information where applicable) and assure work-in progress and finished product are true to label with regard to allergens. Measures may include label approvals at receipt, label reconciliations during production, destruction of obsolete labels, verification of labels on finished product as appropriate, and product change over procedures.
You can't verify what they're filling the packages with. They fill the package with an allergen incorrectly labeled, and not only are you stuck with this GFSI violation, but that's getting into broken Federal laws.
11.8.1.6 Where applicable, a documented procedure shall be in place for the controlled disposal of trademarked materials waste considered high-risk for handling or other reasons. Where a contracted disposal service is used, the disposal process shall be reviewed regularly to confirm compliance.
While management could argue this wasn't disposal of a trademarked material, you again are not in control of trademarked material. And if it came down to a court battle over a food fraud case, the third party can argue you failed to control the packaging and bring you in equal liability.