You Passed Your Audit.
Now the Real Work Starts.
Getting your SQF certificate is the milestone everyone talks about.
Keeping it is the part that actually matters, and the part most sites underestimate when the auditor walks out the door.
Maintaining SQF certification is an ongoing operational commitment, not a once-a-year scramble.
If your food safety system only gets attention in the weeks before recertification, you already have a problem.
This post covers what ongoing compliance looks like under SQF Edition 9, the current version.
Edition 10 is in transition.
If someone is telling you otherwise, ask them to show you the published standard.
Edition 9 Is the Current Standard
SQF Edition 9 was published by the Safe Quality Food Institute and remains the active version of the standard.
If you are building or maintaining your food safety system, you are working to Edition 9.
If your first audit is going to be after 02 February 2027, you will be audited under Edition 10.
That matters because some consultants and some training materials are not always clear on versioning, and working to the wrong edition, or a transitional draft that doesn’t exist, creates real compliance risk.
When in doubt, go directly to sqfi.com and download the current published code.
Do not rely on third-party summaries as your primary reference.
What SQF Edition 9 Actually Requires Between Audits
Recertification audits are typically annual.
The period between audits is not downtime, it is the system operating as intended.
Here is what Edition 9 expects to see functioning continuously:
Internal Audits
SQF requires documented internal audits conducted at a frequency that reflects the risk profile of your operation.
This is not a tickbox exercise.
Internal audits should be identifying genuine gaps, if every internal audit comes back clean and your external audit finds non-conformances, your internal audit process is not working.
Auditors will look at who conducted the internal audits, when, what was found, and what was done about it.
A complete record with no findings is a red flag, not a gold star.
Corrective and Preventive Actions
Every non-conformance, internal or external, requires a documented corrective action.
Edition 9 is explicit that corrective actions need to address root cause, not just the immediate symptom.
A corrective action that says “retrained staff” without identifying why the failure occurred in the first place is unlikely to satisfy a competent auditor.
Your corrective action register should be active, up to date, and showing closure of actions within reasonable timeframes.
A register full of overdue open items tells the auditor your management system is not functioning.
Management Reviews
Senior management is required to conduct formal reviews of the food safety system at planned intervals.
Edition 9 specifies what those reviews need to cover: audit results, customer complaints, corrective actions, changes that could affect food safety, and resource requirements, among others.
The management review must be documented.
A verbal discussion at a team meeting does not satisfy this requirement.
Minutes, attendance records, and action items need to exist.
Document and Record Control
Your food safety documentation must remain current.
Procedures that were written for certification and have not been reviewed since are a compliance liability.
If your operation has changed, new equipment, new products, new suppliers, new staff structure, your documentation needs to reflect that.
Records must be retained for the period specified in your system.
For most operations this is a minimum of two years, though longer retention may be required depending on product type and market requirements.
Supplier Approval and Monitoring
SQF Edition 9 requires an active supplier approval program.
Approved supplier lists need to be maintained and reviewed.
If a supplier’s certification has lapsed or their risk profile has changed, your system should be catching that, not waiting for an auditor to ask.
Training Records
Staff competency must be documented.
New starters need to be inducted into the food safety system.
Refresher training needs to be delivered and recorded at appropriate intervals.
When staff change roles, their food safety training needs to reflect the new responsibilities.
A high staff turnover environment is a higher-risk environment from a training compliance perspective.
Build your induction process to handle that reality, not an idealised low-turnover scenario.
The Recertification Audit Is Not a Surprise
Annual recertification audits are announced.
Your certification body will schedule the audit in advance.
The scope will be familiar.
There is no excuse for being underprepared, and yet sites routinely are.
The sites that pass recertification consistently are not the ones that work hardest in the two weeks before the audit.
They are the ones whose systems are genuinely operational year-round.
The audit is a verification exercise, not a discovery exercise.
If the auditor is finding things you were not aware of, your system is not working between audits.
Common Maintenance Failures
In my experience working with food businesses across Victoria, the most common reasons sites struggle at recertification are predictable:
- Internal audits completed on paper only: scheduled, signed off, and filed without meaningful examination of the operation.
- Corrective actions raised and forgotten: especially when the person responsible has since left the business.
- Documents that don’t reflect current practice: procedures written for certification that were never updated after the operation changed.
- Management reviews that exist as a formality: conducted because they are required, not because senior management is genuinely engaged with the outputs.
- Supplier registers not maintained: approved suppliers whose certifications have since lapsed, or new suppliers added informally without going through the approval process.
None of these are complex problems.
They are all maintenance problems, systems that were set up adequately and then allowed to drift.
If You Are Working With a Consultant
If you have external support for your SQF system, make sure that support extends to maintenance, not just implementation.
A consultant who helped you achieve certification and then disappeared is not necessarily providing ongoing value.
Specifically, confirm that whoever is advising you is working to Edition 9.
Ask them directly.
If they cannot tell you which edition they are working to, or if they reference Edition 10 as the current standard, that is worth probing further.
A Note on Certification Bodies
Your certification body is a licensed third-party auditing organisation, not a consultancy.
They can identify non-conformances and verify compliance, they cannot advise you on how to fix your system without creating a conflict of interest.
The advice in this post is general guidance.
For specific implementation questions relating to your operation, engage a food safety professional who is independent of your certification body.
This post is written for food businesses working to SQF Edition 9 in Australia. If your situation is complex or you are unsure how specific clauses apply to your operation, feel free to get in touch.