If you work in food manufacturing or processing and your site is either pursuing SQF certification or already holds it, you have probably heard the word “audit” used as a catch-all for everything from a routine internal inspection to the formal third-party assessment that determines whether your certificate lives or dies.
This post is about the latter.
Specifically, it walks through the SQF audit process as it exists under SQF Edition 9, the current published standard, so that anyone stepping into this process for the first time has a clear picture of what actually happens and in what order.
One important note before we start: SQF Edition 10 has been released and audits conducted under it will work differently in several respects.
If your site is transitioning to Edition 10 or your next audit is scheduled under that version, treat this post as useful background rather than a current procedural guide.
I’ll cover Edition 10 audit changes separately once the transition timelines become clearer on the ground.
What SQF Is and Why the Audit Matters
SQF, Safe Quality Food, is a food safety and quality management certification scheme owned and managed by the Safe Quality Food Institute (SQFI), a division of the Food Marketing Institute (FMI).
It is recognised under the Global Food Safety Initiative (GFSI) benchmarking framework, which means retailers and food service buyers who require GFSI-recognised certification will generally accept SQF as meeting that requirement.
The audit is the mechanism by which an independent, SQFI-approved certification body formally assesses whether your site’s food safety and quality management system meets the requirements of the SQF Code.
Pass, and your site receives a certificate with a rating.
Fail, and it does not.
The rating matters because it appears on the public SQF database and is visible to your buyers.
This is not a tick-box exercise for internal purposes alone, the outcome has commercial consequences.
The Two Types of SQF Audit
Under Edition 9, SQF audits fall into two main categories.
Initial certification audits apply to sites seeking SQF certification for the first time, or to sites that have had their certificate suspended or withdrawn and are re-entering the scheme.
An initial certification audit has two stages.
The first stage is a document review, sometimes called a desktop audit.
The second stage is the full on-site assessment.
Both stages must be completed before certification can be granted.
Recertification audits apply to sites that already hold a current SQF certificate.
These are conducted annually and consist of a single on-site visit.
There is no separate desktop stage for a recertification audit, though the auditor will still review documentation as part of the on-site assessment.
Stage 1. The Document Review
The document review is the auditor’s first formal look at your food safety management system.
Its purpose is to assess whether your documented system, your food safety plan, prerequisite programs, policies, and procedures, meets the requirements of the SQF Code before anyone sets foot on your production floor.
The review is typically conducted off-site.
You submit your documentation package to the certification body, and the auditor works through it against the applicable SQF module for your food sector category.
The auditor is looking for completeness, internal consistency, and alignment with the Code requirements.
They are not yet verifying implementation, that comes at Stage 2.
At this stage, they are checking that your system, on paper, is capable of meeting the standard.
If the document review reveals significant gaps, the auditor will raise these as findings.
Some gaps can be addressed before Stage 2 proceeds.
Others may require the Stage 2 audit to be rescheduled.
This is one of the more under appreciated functions of the Stage 1 process, it gives a first-time site the opportunity to identify and correct systemic documentation problems before they translate into non-conformances on the floor.
Stage 2. The On-Site Audit
The on-site audit is where most of the real work happens.
For a first-time certification audit, this follows a successful Stage 1.
For a recertification audit, this is the entire process.
The structure is consistent across both scenarios.
Opening Meeting
The audit begins with a formal opening meeting.
The auditor introduces themselves, confirms their credentials and the scope of the audit, outlines the audit agenda and expected timeline.
This is where the key personnel who will accompany them through different sections of the audit are identified.
This is also the point at which any last-minute scope questions or logistical issues are resolved.
The opening meeting is not a formality to rush through, it sets the tone for the day and gives your team the opportunity to flag anything the auditor should know before they start.
Facility Walk-Through
After the opening meeting, the auditor will conduct a walk-through of your facility.
This is not a brief tour.
It is a detailed physical inspection of your premises, production areas, storage areas, utilities, staff amenities, waste handling areas, and any other spaces relevant to the scope of the audit.
The auditor is looking at physical controls, hygiene conditions, equipment maintenance, pest management evidence, glass and brittle plastic management, and the practical implementation of your prerequisite programs.
They are also watching how your staff behave, are people following documented procedures, or are the procedures filed away and ignored?
The walk-through often generates a significant portion of the audit’s findings, particularly minor non-conformances related to housekeeping, equipment condition, and signage.
These are the kinds of issues that can accumulate quietly between audits and only become visible to fresh eyes on the day.
Record Review
Running parallel with, or immediately following, the walk-through, the auditor will review your records.
This means monitoring logs, corrective action records, supplier verification records, internal audit records, calibration logs, training records, traceability records, and any other documented evidence that your system is operating as described.
The record review is where the gap between your documented procedures and your actual practice becomes apparent.
A procedure that says temperature checks are recorded every two hours means nothing if the records show three-hour gaps on twelve different dates.
The depth of the record review will vary depending on the auditor, the size of your operation, and the scope of the audit.
Experienced auditors generally know which records are worth scrutinising and which sections of your operation carry higher risk.
Do not assume that because a record exists it will not be examined closely.
Staff Interviews
The auditor will speak with staff at various levels of the organisation.
This typically includes production operators, supervisors, quality or food safety personnel, and senior management.
The questions are straightforward:
what is your role in the food safety system,
what do you do when you identify a non-conformance,
where is your food safety plan,
who is your SQF Practitioner.
These conversations are a cross-check against your documented system.
If your team cannot describe the procedures they are supposed to follow, that is a finding, even if the procedures themselves are perfectly written.
Prepare your staff honestly.
Scripted, rehearsed answers are easy to spot, and auditors have seen every version of them.
A team that genuinely understands why they follow food safety procedures is a far stronger signal of an effective system than one that has memorised responses to anticipated questions.
Closing Meeting
At the end of the on-site assessment, the auditor conducts a closing meeting.
They will present their findings verbally, summarise any non-conformances identified, and give an indicative sense of the audit outcome.
This is not the final result, the formal audit report and score come later, and the closing meeting gives you the opportunity to seek clarification on any findings before the auditor leaves the site.
If a finding has been recorded based on a misunderstanding or missing information, the closing meeting is the time to address it.
Once the auditor has left and the report is drafted, it is much harder to have findings reconsidered.
Non-Conformances and What They Mean
SQF Edition 9 uses three categories of non-conformance.
Critical non-conformances represent an immediate or serious risk to food safety or product integrity.
A single critical finding results in automatic audit failure.
There is no averaging it out with strong performance elsewhere.
Critical non-conformances require immediate corrective action before recertification can proceed.
Major non-conformances represent a significant failure to meet a Code requirement, or a pattern of minor issues that collectively indicate a systemic breakdown.
Major non-conformances do not automatically cause failure, and their precise impact on your score depends on how many are raised and how the scoring formula applies.
They require documented corrective action and root cause analysis within a defined timeframe after the audit.
Minor non-conformances represent partial compliance or isolated lapses that do not constitute a systemic failure.
Minor findings accumulate and affect your score, so a clean audit with a large number of minors will still produce a lower result than one with very few.
They require corrective action documentation, though the urgency is lower than for majors.
How SQF Scoring Works
SQF Edition 9 produces a percentage score that translates into one of four certification ratings.
| Rating | Score Range | What It Signals |
|---|---|---|
| Excellent | 96 – 100 | Recertification every 12 months |
| Good | 86 – 95 | Recertification every 12 months |
| Complies | 70 – 85 | Surveillance audit every 6 months |
| Fail to comply | Below 69 | Re-audit required |
It is worth noting that a score just above the Complies threshold is not a comfortable position to be in year after year.
Buyers can see your rating on the SQFI database, and a consistent Complies result with no upward trend is a signal that your system is doing the minimum required rather than genuinely improving.
The score matters, and so does the trajectory of that score across multiple audit cycles.
After the Audit. Corrective Action Requirements
Once the formal audit report is issued by the certification body, the clock starts on your corrective action responses.
Under SQF Edition 9, the timelines are as follows:
For major non-conformances, you are required to submit evidence of corrective action, including root cause analysis, within 30 calendar days of receiving the audit report.
This is not a soft deadline.
Failure to respond within the required timeframe may result in your certification being withheld or suspended.
For minor non-conformances, the response timeframe is typically 60 calendar days, though you should confirm the specific requirements with your certification body, as there can be variation in how this is administered.
The quality of your corrective action responses matters.
An auditor reviewing your CAR (Corrective Action Request) responses can generally tell within the first paragraph whether the root cause analysis is genuine or whether it is being completed as a bureaucratic obligation.
Shallow responses, “staff retrained” as the corrective action for a systemic record-keeping failure, for example, raise more questions than they answer and can trigger follow-up verification requirements.
The Role of the SQF Practitioner
SQF Edition 9 requires every certified site to designate an SQF Practitioner, a person who is responsible for implementing, reviewing, and maintaining the SQF system.
The Practitioner must hold a recognised food safety qualification, and their details are registered with SQFI.
During the audit, the Practitioner is typically the primary point of contact for the auditor and the person who fields the majority of the system-level questions.
Whether your Practitioner is an internal employee or an external consultant engaged on a contract basis, their familiarity with your specific operation matters enormously on audit day.
An SQF Practitioner who understands your site, your processes, your risks, and your corrective action history is a genuine asset.
One who has been brought in three weeks before the audit to tidy up the documentation is a liability.
What the Audit Is Not
This is worth stating plainly because the confusion is common.
The SQF certification audit is not a comprehensive assessment of whether your food is safe.
It is an assessment of whether your management system meets the requirements of the SQF Code.
Those two things are related, and a strong system does reduce food safety risk, that is the entire premise of the scheme.
They are not, however, the same thing.
A site can achieve a Good rating in a single audit cycle while still having underlying cultural or operational problems that are not visible to an auditor who is on site for one or two days.
The certification is a credential, and like any credential, its value depends on what sits behind it.
I’ve written about the limits of the audit model separately, if that is a topic you want to explore, the piece on audit-for-hire conflicts and checkbox compliance is worth reading alongside this one.
SQF Edition 10 Note:
This post describes the SQF audit process as it operates under Edition 9.
SQF Edition 10 introduces changes to how audits are structured and conducted.
If your certification body has confirmed your next audit will be assessed under Edition 10, the process described here will not fully apply.
I will cover the Edition 10 audit framework in a separate post as transition timelines become clearer in practice.
Summary
The SQF audit process under Edition 9 follows a predictable structure: a document review stage for initial certifications, followed by an on-site assessment that covers a physical walk-through, record review, staff interviews, and formal opening and closing meetings.
Non-conformances are categorised as critical, major, or minor, and they determine the final score and rating.
The corrective action process after the audit is as important as the audit itself.
And the SQF Practitioner’s genuine familiarity with the site determines, to a significant degree, how well the system holds up under scrutiny.
If your site is preparing for its first SQF certification audit and you have questions about what a functional food safety management system actually looks like in practice, or where most sites fall short before they have been through the process once, feel free to reach out.
I work with food businesses at various stages of SQF readiness and I am happy to have a straightforward conversation about where you stand before you commit to a certification timeline.
Cameron Blewett is a Victorian-based food safety consultant. This post covers SQF Edition 9 as published by the Safe Quality Food Institute. For current audit requirements under Edition 10, consult your certification body directly.