An audit is a sampling exercise against a written standard. The auditor cannot see everything, so they follow evidence trails: pick a finished product, trace it backwards, and see whether the system holds. Understanding that method is worth more than any last-minute cleaning campaign. This page describes how a BRCGS Food Safety audit runs in practice.
Scheme requirements change between issues. Confirm the current issue of the standard and its transition dates with your certification body before planning an audit; this page describes the method, not a specific issue’s clause numbering.
How the day is structured
- Opening meeting. Scope confirmation, plan, who is available. The scope discussion matters: it decides what the certificate will say.
- Document review. HACCP study, prerequisite programmes, management review, internal audit records, training records, complaint records.
- Site tour. Usually the longest element. Fabrication, flow, segregation, hygiene practice, maintenance, foreign body controls.
- Vertical traceability exercise. One product, traced from finished pallet back to raw material and forward to customers, against a clock.
- Follow-up on the trail. Whatever the tour raised gets tested against records.
- Closing meeting. Non-conformities presented, grading explained, timescales set.
Where non-conformities concentrate
Across food sites, the same areas generate most findings:
- HACCP study currency. The study exists but does not reflect the line as it runs today. New equipment, a changed step, a new allergen.
- Root cause analysis. Corrective actions that fix the instance and not the cause. Auditors test this by looking for repeats.
- Fabrication and maintenance. Damaged surfaces, temporary repairs that became permanent, condensation over open product.
- Foreign body control. Glass and hard plastic registers not maintained; metal detector challenge records incomplete or the challenge pieces not verified.
- Supplier approval. An approved supplier list with no evidence behind the approvals. See the supplier approval pack.
- Traceability against a clock. The records exist but nobody has rehearsed pulling them together.
- Internal audit. Scheduled but not covering the whole standard within the cycle, or performed by people auditing their own area.
- Training and competence. Attendance recorded, competence not assessed.
The traceability exercise
This is the exercise that most reliably exposes whether a system is real. The auditor picks a finished product and asks for full forward and backward traceability, usually within a defined time limit, including a mass balance.
Rehearse it. Pick a lot at random, run the exercise with a stopwatch, and note where people had to phone someone. Those phone calls are the finding.
Grading and what it means to a buyer
Non-conformities are graded by severity, and the accumulation determines the audit grade. For a buyer reading a certificate, three things matter more than the letter on it:
- The scope statement. Site, activities, product categories. A certificate outside your product category is not evidence for your product.
- Announced or unannounced. Unannounced audits carry more assurance.
- The date of the audit, not the expiry of the certificate.
Preparing without theatre
- Run an internal audit against the full standard, not a checklist someone wrote three years ago.
- Close out the previous audit’s non-conformities with evidence of effectiveness, not just of action.
- Rehearse traceability and a mock recall.
- Walk the site as an auditor would: follow the product flow, look up at the ceiling, open the maintenance workshop.
- Make sure the people who own each system are in the building on the day.
- Do not repaint. Auditors have seen paint.
A practical example
A site failed to close a repeat finding on metal detector challenge records. The records were being completed, but the challenge pieces had never been verified against a certificate, so the entire year of records proved nothing. The corrective action from the previous audit had addressed record completion, which was the symptom. Root cause analysis would have found the missing verification step in the first cycle. Repeat findings are read by auditors as a management system failure, not a technical one, and they are graded accordingly.
FAQ
How long does a BRCGS audit take?
It depends on site size, complexity and the number of product categories in scope. Your certification body sets the audit duration from the scheme rules; ask for it early, because it drives the cost.
What is the difference between announced and unannounced?
An announced audit is scheduled; an unannounced audit arrives within a window. Unannounced results carry more weight with customers precisely because nothing could be staged.
Can a buyer see the full audit report?
Reports are the site’s property, and access is usually granted through the scheme’s directory with the supplier’s permission. Ask for it as part of supplier approval rather than assuming it is public.
Does certification transfer to a second site?
No. Certification is site-specific. A group with several plants needs a certificate per site.