Frequently Asked Questions Regarding the Global Food Safety Initiative (GFSI).

What exactly is a “GFSI Audit”?

There have been a lot of questions about the “GFSI Audits”.  There actually aren't any “GFSI Audits”.  There are currently four fully approved Global Food Safety Initiative benchmarked standards.  Included are the BRC Global Standard for Food Safety, the Safe Quality Food (SQF) level 1000 and level 2000, the International Food Standard (IFS) and the Dutch HACCP standard.  There is currently one ”conditionally approved” standard, the FSSC 22000 [ISO 22000, BSI PAS 220].  These are all certification audits and only certification bodies accredited to EN45011/ ISO Guide 65 and/or ISO 17021 can conduct audits. 

How is a BRC audit conducted and how long does it take?

The BRC audit is conducted against the BRC Global Standard for Food Safety.  Version # 5 is currently in use.  Audits conducted against version # 5 generally require 2.0 days plus 1.0 day of report writing.  The audit is designed to be 75% documentation review and 25% physical inspection that also includes talking to key employees.  The desktop audit is performed first when the facility audit is initiated but at the time of the facility audit.

How is a SQF audit conducted and how long does it take?

The SQF audit is conducted against the SQF 1000 Code and 2000 Code.  The 1000 Code is a HACCP-based supplier assurance code for primary producers, such as grain suppliers for a flour mill or produce growers for a fresh-cut produce facility.  These primary producers may form part of a network of sub-sites of food manufacturers.  The SQF 2000 Code for food manufacturers, retailers, agents and exporters has three different levels and the company being audited, or its customers, can choose which level to be evaluated/audited against. 

Level 1 contains the food safety fundamental requirements, Level 2 contains the requirements for a Certified HACCP Food Safety Plan and Level 3 contains the requirements for a full Food Safety and Quality Management System.  Only sites certified to Level 3 for both codes are eligible to use the SQF Trade Mark.  Each audited company is required to have a trained, in-house SQF facilitator (called an SQF Practitioner), or an external consultant that plays that role, to get the company and its sites up to speed on the audit process.

In the case, of the multi-site operations where there are primary production sites under direct control, certification is centered upon the SQF 2000 central site, while primary sites will be sampled for compliance to SQF 1000.  The onsite certification audit (this follows a document review audit) is designed to be 75% physical inspection that centers on talking to employees and includes a short walkthrough in the plant and 25% documentation. 
The audit protocol for the 2000 code requires a documentation or desktop review a certification audit of 1.5-3.0 days, and a surveillance audit of 1.0 or more days within the first year, as long as the facility does not get any Critical non-conformances.  The facility is required to have a recertification audit of at least two days and a surveillance audit of one day each year for the next two years.  If there are no Critical or Major non-conformances for three years and a grade of at least G (Good) is achieved, the facility can move to single yearly audits in the fourth year.

How is a FSSC 22000 audit conducted and how long does it take?

The FSSC 22000 audit is conducted against the ISO 22000 standard and against the British Standard Institute PAS 220 standard.  This audit also requires a desktop or documentation audit performed prior to the actual facility audit.  This requires 1 day.  The physical audit at the site will require 2-3 days to complete including report writing. 

Can you explain a little more about the three different levels of the SQF 2000 Code?

The three levels are as follows:

Level 1: Food Safety Fundamentals- This includes the basic pre-requisite programs for Food Safety

Level 2: Certified HACCP Food Safety Plans-This covers food manufacturers who have all the Level 1 pre-requisite program plus CCP's determined from their HACCP studies.

Level 3: Quality Management Systems Development- This requires compliance to level 1 and 2, and introduces quality aspects and associated controls required for a Comprehensive Food Safety and Quality Management System. 

What is the assurance process leading to either a BRC or SQF or FSSC 22000 certification?  Is the process similar for either audit?

The process is similar for both audits and consists of four stages:

  1. Pre-assessment or Preliminary Assessment Audit (GAP). This is optional and is used to gauge the robustness of an organization's system.  It is used to provide an advance indication of any issues before the certification assessment.
  2. Audit and Certification Stage.  Each format requires a system review desk audit, followed by a certification audit at the site to assess the system's effectiveness against the standard's requirements and the company's quality policy documents.  The desk audit is carried out at the same time as the site evaluation for the BRC audit and is included in the single report.  The desk audit is performed prior to the site audit for both SQF and FSSC 22000 and two reports are required.
  3. Surveillance Audit.  Certification is for a set time period.  The audit frequency and certification time for BRC audits is determined by the number of non-conformances.  The audit frequency varies from six months to one year.  For the SQF process, a Surveillance audit is conducted after six months to review the ongoing effectiveness of the system in achieving the policy commitments.  The FSSC standard requires a Surveillance audit within one year of the original audit.

How do I get my facility ready for a BRC, SQF, or FSSC 22000 audit?

You will need to obtain a copy of the relevant standard, review its requirements and ensure you can demonstrate compliance with each and have the documents and records as evidence of this.  In the case of SQF Practitioner or use a SQF approved consultant.

The three standards require auditors to undergo a series of observation (watching) audits and then witnessed (doing) audits.  Some of this work will be carried out by the Accreditation Bodies that accredit us to do the audits.  These are UKAS for BRC and FSSC and ANSI for SQF.

The Standards break down the range of food products into category fields; an auditor must be competent in that field to perform the audit.

What is the difference between a BRC, SQF, and FSSC 22000 audit schemes?

We have not yet conducted a full cross reference across the three schemes, although all of the GFSI-certified audit schemes are benchmarked against the same criteria.  The schemes are owned/ operated by different organizations and are run differently.  For example, with SQF the client can select which level of certification they wish to achieve, the grading and the frequency of audit differ and the use of a trained SQF Practitioner or consultant is required.  The BRC scheme includes the desktop documentation audit in the same final report.  The desktop documentation audit and the PAS 220 audit in the final report.  The FSSC 22000 scheme includes the ISO 22000 audit and the PAS 220 audit in the final report.  The desktop documentation audit is performed separately from the site audit, similar to the SQF audit scheme.  Since all three schemes are benchmarked by GFSI against the same standards, the contents of the audits are similar.  The time required for each scheme is similar, but is determined by the type of facility, the scope of the audit, the size of the facility, and the number of HACCP systems included in the audit. 

SQF resource and food safety expert - call 219.926.1150 or email