Skip to content
Close
Illustration of a certification-body auditor with a clipboard and a dairy plant quality director at a pasteurizer control panel in front of stainless steel milk silos, with a plant operator checking pipework, everyone in hairnets
Josh ClauserOct 5, 2026, 9:13:25 AM44 min read

BRCGS for Dairy Processors: A Quality Director's Guide

BRCGS has no separate dairy standard. A dairy plant is audited against the Global Standard Food Safety, Issue 9, by an auditor qualified in BRCGS product category 7, dairy and liquid egg. The clauses that decide a dairy audit cover pasteurization, Listeria control after the kill step, cleaning in place, raw milk intake, allergens and label control. This guide maps each one to what the auditor will ask to see, and shows where BRCGS sits beside the PMO and FDA rules.

At a glance

BRCGS for Dairy at a Glance

If you run quality at a dairy plant and a customer has asked for BRCGS certification, much of the standard will look familiar from your Grade “A” or Part 117 program. The difference is how much written evidence the auditor expects for each control, plus a few programs the law doesn't require. The certificate also carries a grade, AA to D, that your customer will read.[1]

  • Category 7BRCGS product category for dairy and liquid egg. Your auditor must be qualified in itIssue 9, Part III and Appendix 6[1][2]
  • 12Fundamental requirements, including HACCP, hygiene (4.11), allergens (5.3) and label control (6.2)Issue 9, Part II[3]
  • AA to DAudit grades. AA, A and B sites are re-audited every 12 months, C and D sites every 6 monthsIssue 9, Part III[1]
  • 28 daysCalendar days to send evidence of correction, a root cause analysis and a preventive action plan for each non-conformityIssue 9, Part III[1]

Key takeaways

  • There's no BRCGS dairy standard. Dairy processors are audited to Food Safety Issue 9, by an auditor qualified in product category 7.[1][2]
  • Pasteurization is normally a critical control point in a dairy HACCP plan. Expect to show validated critical limits, signed and verified monitoring records, routinely tested failure alarms on in-line devices, and calibrated thermometers (clauses 2.9, 2.10, 6.1 and 6.4).[3][4]
  • After pasteurization, the risk to control is recontamination of product that is exposed before packaging. In the audit, that puts the focus on production risk zoning (4.3), environmental monitoring (4.11.8) and validated cleaning in place (4.11.7).[3][5]
  • BRCGS doesn't replace the PMO or FDA rules. For Grade “A” products, the PMO and your plant's own written procedures make up the Part 117 food safety plan to the extent they cover the hazards you identify (PMO Appendix T). Cheese (other than cottage cheese), butter and ice cream fall under Part 117 directly, even in a Grade “A” plant, unless the facility is exempt.[4][6][7]
  • Milk is a major allergen, and FDA says that, of the major food allergens, milk is the most common cause of recalls for undeclared allergens. Label and pack control (6.2) is a fundamental requirement.[8][3]

Updated October 5, 2026. Checked against BRCGS Global Standard Food Safety Issue 9 (Parts II and III and appendices), the BRCGS position statements in force from August 10, 2026, the 2025 Revision of the Pasteurized Milk Ordinance and the current text of 21 CFR Parts 117 and 1240.

Scope

Is There a BRCGS Standard for Dairy?

No. BRCGS has no dairy-specific standard. Its core food manufacturing standard is the Global Standard Food Safety, and dairy plants are audited against Issue 9 like any other processor.[9][2] What makes the audit a dairy audit is the scope and the auditor. Before the audit you agree the products and processes in scope with the certification body, and it must send an auditor qualified in the right product category.[1] BRCGS puts dairy in category 7, “Dairy, liquid egg,” among processed foods and liquids heat-treated by pasteurization, UHT or similar technology. Its examples include liquid milk and milk drinks, cream, yogurt and other fermented milk products, butter, ice cream, cheeses (hard, soft, mold-ripened, unpasteurized, processed and cheese food), long-life milks, soy milk, and dried milk and whey powders. The auditor is expected to know dairy technology, including pasteurization, separation and fermentation. BRCGS says the examples are guidance, not a complete list, and a few dairy-based products sit elsewhere: ghee, for example, is listed under category 18, oils and fats.[2]

  • Processing and packing plants use Food Safety Issue 9.[2] The certificate lists the products and processes covered, and excluding products is allowed only by exception, when they are clearly different and made in a physically segregated area.[1] BRCGS's scope guideline asks for dairy scopes to name the product types, such as yogurt, cream, ice cream, soft cheese or milk, rather than the bare word “dairy.”[10]
  • Cold stores and distributors that only store or distribute packaged dairy products use the BRCGS Storage and Distribution standard instead, which has a chilled and frozen food category.[2][11]
  • Plants making several kinds of product, such as ice cream with bakery inclusions, need an auditor, or audit team, with the right category and product knowledge for everything in scope. Tell the certification body everything you make when you ask for a quote.[1]
Why a dairy plant ends up with BRCGS

No U.S. law requires BRCGS. It is voluntary, so a dairy plant usually gets certified because a customer, such as a retailer, a food manufacturer buying dairy ingredients or an export buyer, asks for it. If a customer just asks for “GFSI certification,” BRCGS Food Safety, SQF, FSSC 22000 and IFS Food are all on GFSI's recognized list. If the customer names one, use that one.[12]

Clause map

Which BRCGS Clauses Matter Most in a Dairy Plant?

Every applicable Issue 9 requirement is audited, but a handful of clauses carry a dairy audit.[1] The table maps the dairy risks auditors focus on to the clauses behind them and the evidence that satisfies them.[3]

Dairy risks mapped to BRCGS Food Safety Issue 9 clauses
Dairy riskIssue 9 clausesWhat the auditor will want to see
Pasteurization not achieved2.9 validated critical limits; 2.10 CCP monitoring; 2.11 corrective action; 6.1.3 process monitoring; 6.1.4 in-line devices with failure alerts; 6.4 calibrationValidated critical limits for each CCP, set per product where they differ (in the U.S., no lower than the PMO or 21 CFR 1240.61 minimums), monitoring records signed by the operator and verified where appropriate, routine tests of the failure alerts on in-line devices (and, under the PMO, the flow diversion device), and thermometers checked against a traceable reference.
Recontamination after pasteurization (Listeria and other environmental pathogens)4.3 production risk zones and site map; 4.11.8 environmental monitoring; 5.6.4 pathogen testingA zoned site map, a written environmental monitoring program with sampling sites, target organisms and action limits, trend reviews, the action you took on every result over a limit or trending up, and pathogen tests run by an external lab or a fully segregated on-site lab.
Cleaning in place (CIP) failure4.11.7 cleaning in place; 4.11.1 hygieneA current CIP schematic, validation that the system is designed and working correctly, validated limits for the time of each stage, detergent concentration, flow rate and pressure, and temperature, and monitoring records at a risk-based frequency.
Raw milk quality, drug residues and fraud3.5.1 raw material risk assessment and supplier approval; 3.5.2 acceptance on receipt; 5.4 authenticityA risk assessment for raw milk and every dairy ingredient, the acceptance tests and how often you run them, and a vulnerability assessment for fraud such as substitution.
Undeclared allergens (milk and others, such as nuts, eggs, soy or wheat in inclusions)5.3 allergen management; 6.2 labelling and pack controlAn allergen risk assessment, production scheduling or segregation, validated cleaning between allergen changes, rework controls, line clearance checks at changeover and label reconciliation.
Temperature abuse in storage and dispatch4.15 storage; 4.16 dispatch and transportCold store temperature records with alarms, or recorded manual checks frequent enough to act before product goes out of limits, and vehicles that hold temperature under load, with data loggers or recorded checks.
Foreign bodies4.10 foreign-body detection and removalMetal detection, unless a written risk assessment shows it wouldn't improve food safety, which normally means a more effective alternative such as X-ray, fine sieves or filtration.
Shelf life and product release5.6 product testing and laboratory analysis; 5.7 product releaseA testing schedule, shelf-life validation and ongoing verification, accredited (or ISO/IEC 17025-based) labs for safety-critical tests, and positive release where product is held for results.
Water and steam4.5 utilitiesPotable water, ice and steam at the point of use wherever they go into product or are used for hand-washing or cleaning, with microbiological and chemical tests as the law requires or at least once a year.

Clause numbers from Issue 9, Part II. The evidence column combines the clause requirements with what a dairy plant is typically asked to show, including PMO records. It is not a substitute for reading the standard.

Seven of these areas sit under fundamental requirements: the food safety plan (section 2), supplier and raw material approval (3.5.1), layout, product flow and segregation, including production risk zones (4.3), housekeeping and hygiene (4.11), allergen management (5.3), control of operations (6.1) and labelling and pack control (6.2). A major non-conformity against the statement of intent of any fundamental requirement means no certificate from that audit, and a site that is already certificated has its certificate withdrawn.[3][1]

Pasteurization

How Do You Validate and Monitor Pasteurization for BRCGS?

BRCGS doesn't set pasteurization times and temperatures. It requires critical limits that are measurable wherever possible and validated (2.9.1, 2.9.2), and it lists food safety law among the information sources for your hazard analysis (2.3.2). The numbers come from your HACCP team and U.S. regulations.[3] In the U.S. the legal minimums come from the Pasteurized Milk Ordinance (PMO), which states adopt for Grade “A” products, and, for milk products shipped across state lines, 21 CFR 1240.61. That rule requires milk and milk products in final package form for direct human consumption to be pasteurized or made from pasteurized dairy ingredients. Other regulations set the exceptions, such as raw-milk cheddar cured at 35°F or above for at least 60 days.[4][13][14]

Minimum pasteurization times and temperatures (PMO, 2025 Revision)
MethodMinimum
Batch (vat)145°F (63°C) for 30 minutes
Continuous flow (HTST)161°F (72°C) for 15 seconds
Higher-heat shorter-time (HHST)191°F (89°C) for 1.0 second, up to 212°F (100°C) for 0.01 second
Higher fat, solids or sweetenersAdd 5°F (3°C) to the vat and HTST temperatures when the product has 10% or more fat, 18% or more total solids, or added sweeteners
Eggnog155°F (69°C) for 30 minutes, 175°F (80°C) for 25 seconds or 180°F (83°C) for 15 seconds
Ultra-pasteurization (UP)At or above 280°F (138°C) for at least 2 seconds, for an extended shelf life under refrigeration

From the PMO's definitions of pasteurization and ultra-pasteurization. The 5°F increase for products with added sweeteners or 10% or more fat also appears in 21 CFR 1240.61; the 18% total-solids trigger is the PMO's. Ice cream is outside the PMO, but 1240.61 still covers it, because FDA's definition of milk products includes ice cream and other frozen dairy desserts.[4][13]

At the audit, expect the auditor to check your pasteurization CCP and its monitoring records.[1] Have these ready:

  • Validated limits. Critical limits for each CCP, set per product where they differ (for example, the PMO's higher temperatures for high-fat, high-solids or sweetened products), with documented evidence that they control the hazard. The plan must be validated before any change that could affect product safety (2.9.1, 2.9.2, 2.12.1).[3]
  • Monitoring that catches a loss of control. A monitoring procedure for the CCP, such as continuous temperature recording, with records that show the date, time and result, signed by the person monitoring and verified by an authorized person where appropriate (2.10.1, 2.10.2, 6.1.3).[3] PMO recording charts that are reviewed, dated and signed already go most of the way.[4]
  • Alarms that are tested. Where an in-line device controls the process, it must be linked to a failure alert that is routinely tested (6.1.4). On an HTST, expect the auditor to apply this to the flow diversion device and its alarms. Under the PMO, Grade “A” pasteurizer instruments and devices are tested at least every three months and holding times every six months, and the plant keeps the results for two years. Bring those records.[3][4]
  • Calibration with uncertainty. Thermometers and recorders on the list of controlled equipment, checked against a calibrated reference traceable to a national or international standard, with calibration uncertainty allowed for whenever a device is used to judge a critical limit (6.4.1 to 6.4.3).[3]
  • A plan for deviations. What happens to product made while the process was out of control, who decides, and the records that prove it (2.11.1, 6.1.6, 6.4.4).[3]
  • Restricted settings. Only trained, authorized people can change settings that are critical to safety, with password protection where it applies (6.1.2).[3]

If your team mixes up validation and verification, the auditor will notice. Our guide to validation vs. verification walks through the difference with examples.

Zoning

How Do Production Risk Zones Apply to a Dairy Plant?

It depends on what happens to the product after the kill step. Clause 4.3.1 requires you to assess the production risk zones your products need using BRCGS's definitions, and to mark them on your site map with the routes people, materials and waste take (4.3.2).[3] BRCGS's definitions name several dairy products as examples.[2]

BRCGS production risk zones and how they apply to dairy
ZoneBRCGS definition (summarized)Dairy examples
Enclosed product areaProduct fully enclosed in packaging, pipework or enclosed equipment, including aseptic fillers.Milk moving through closed pipework from the pasteurizer to a closed filler; packaged product in cold storage. Opening the line for cleaning, maintenance or sampling needs a documented process to restore the enclosed status.
High care (chilled and frozen)Chilled or frozen ready-to-eat products vulnerable to pathogens, whose susceptible components have had a reduction process (typically 1–2 log, for organisms such as Listeria) before entering.Product pasteurized at the HTST minimum that is exposed to the room before it is packed may fall here, because by our reading of BRCGS's equivalence table a 72°C, 15-second hold is well short of a full cook (see below). Your documented zoning assessment decides it.
High risk (chilled and frozen)A physically segregated area for chilled or frozen ready-to-eat products whose components have all had a full cook (70°C for 2 minutes or equivalent).By our reading of BRCGS's table, an HTST hold at the legal minimum (161°F/72°C for 15 seconds) doesn't reach it. A 15-second hold at about 171°F (77°C) or a 30-minute vat hold at 145°F (63°C) does, so check your actual settings before you zone open product.
Ambient high careAmbient ready-to-eat products, with a kill step, made from a raw material prone to a pathogen such as Salmonella that can survive on the product.BRCGS's own example: producing milk powder from raw liquid milk.
Low riskProducts that don't support pathogen growth or survival, or that get a later kill step.BRCGS's example of a ready-to-eat chilled product with other controls is hard cheese. Raw milk before pasteurization is also handled in low-risk areas. Low risk can still need tight microbiological control: BRCGS names yeasts in yogurt and molds on hard cheese.

Definitions and the milk powder, hard cheese and yogurt examples from Issue 9, Appendix 2. Where a dairy example is not BRCGS's own, it shows how the definition would usually apply; your documented assessment under clause 4.3.1 decides.[2]

The key number is BRCGS's full cook: a process designed to give typically a 6-log reduction in Listeria monocytogenes, equivalent to 70°C for 2 minutes. BRCGS says alternative cooking processes may be accepted where they meet recognized national guidelines and are validated by scientific data, and it doesn't say whether PMO pasteurization qualifies. Its illustrative equivalence table says it takes about 1.08 minutes at 72°C to match that, so an HTST hold at the legal minimum, 15 seconds at 72°C (161°F), falls well short by our arithmetic, while a 15-second hold at 77°C (about 171°F) or a 30-minute vat hold at 63°C (145°F) clears it.[2] That doesn't make HTST milk unsafe. It means product pasteurized at the HTST minimum that is chilled, ready to eat and handled open is normally assessed against the high-care criteria rather than high risk, and closed pipework from pasteurizer to filler can be an enclosed product area. Extending the same arithmetic past the table's 80°C limit, ultra-pasteurization and most HHST settings would clear the full-cook equivalent; the shortest HHST option, 212°F for 0.01 second, comes out just short. BRCGS notes that z values change with temperature, so treat this as a rough guide.[2][4] The zoning assessment is yours (4.3.1).[3] If a product doesn't fit a typical zone, raise it with your certification body before the audit.

Raw-milk cheese. A cheese made from raw milk with no step that reduces pathogens can't meet the high-care or high-risk definitions, which both require a reduction process before product enters the area. BRCGS says products like this still need high standards of microbiological control.[2] Expect your zoning assessment, environmental monitoring and the validation of your curing step, for example at least 60 days at 35°F or above for raw-milk cheddar, to carry that weight.[14]

Inclusions and rework. Fruit preparations, nuts, cookie pieces and sauces added after pasteurization skip your kill step. In a high-care area, every microbiologically susceptible component must have had its own reduction process before it enters.[2] Cover inclusions in your raw material risk assessment (3.5.1) and specifications (3.6.1), show rework routes on your site map (4.3.2) and keep rework traceable (3.9.4).[3]

Where you have high-care or high-risk areas, section 8 of the standard adds requirements. For high care there should be physical segregation; without it you need a documented risk assessment and validated controls, including for changeovers from low risk (8.1.3). For high-risk and high-care areas, section 8 also covers a drain map, entry through changing facilities, dedicated cleaning equipment, microbiological limits for cleaning performance, and CIP that is either dedicated to the area or designed and controlled so it can't contaminate the area, for example by controlling flow direction and not reusing rinse solutions between areas (8.2.1, 8.4.1, 8.5.2 to 8.5.4).[3] Ambient high-care areas, such as milk powder, have only two section 8 clauses: show the pathogen control step on the site map, and keep a documented cross-contamination risk assessment with effective controls in place (8.1.1, 8.1.4).[2][3] Each section 8 area adds 2 hours to the audit.[15]

Hygiene

What Does BRCGS Expect for Listeria, Monitoring and CIP?

BRCGS expects a risk-based environmental monitoring program, documented and reviewed every year, and validated cleaning in place.[3] In a dairy plant, these programs, together with zoning and hygiene, are how you show that Listeria and other environmental pathogens aren't reaching product after pasteurization.

Environmental monitoring (4.11.8)

BRCGS requires risk-based environmental monitoring for relevant pathogens or spoilage organisms, covering at least every production area with open or ready-to-eat product. Clause 4.11.8 doesn't name Listeria; your risk assessment sets the target organisms.[3]

  • Design it on risk. Sampling procedures, sample locations, test frequency, target organisms (pathogens, spoilage or indicator organisms), test methods and how results are recorded and evaluated must all be written down.[3]
  • Set limits and act on trends. Define control or action limits, and the corrective action to take when a result fails a limit or when positives trend upward toward a limit.[3]
  • Review it at least once a year, and whenever process conditions, flow or equipment change in ways that could affect the program, new scientific information appears, the program misses a significant issue (for example, a regulator finds a positive your program didn't), product tests positive, or results have been negative for so long that you should ask whether you are testing the right places.[3]
  • Keep pathogen testing away from production. Pathogen tests, including environmental ones, go to an external lab or to an internal lab that is fully segregated from production and storage (5.6.4). Labs running analyses critical to safety, authenticity or legality need recognized accreditation or must operate to ISO/IEC 17025, including proficiency testing where applicable (5.6.6).[3]

FDA rules point the same way. Under Part 117, a plant's hazard evaluation must consider environmental pathogens whenever a ready-to-eat food is exposed to the environment before packaging and gets no later treatment or control measure, such as a lethal formulation, that significantly minimizes the pathogen (117.130(c)(1)(ii)). Where that contamination is a hazard requiring a preventive control, environmental monitoring is part of verification, as appropriate (117.165).[7] For Grade “A” plants, PMO Appendix T requires a written environmental monitoring program in the same situation.[4] FDA's Listeria guidance for ready-to-eat foods is still a nonbinding draft from January 2017, but it sets out the controls FDA recommends when ready-to-eat food is exposed before packaging.[5]

Why auditors spend time on Listeria

Two outbreak investigations show the stakes. In 2022, Florida health officials, working with FDA and CDC, linked Listeria in ice cream from Big Olaf Creamery of Sarasota, Florida, to 28 illnesses in 11 states, with 27 hospitalizations and one death.[16] In 2026, FDA and CDC linked requesón, a soft ricotta-style cheese made by Clover Hill Dairy of Mechanicsville, Maryland, to 15 illnesses in four states going back to 2023, with 14 hospitalizations and one death.[17]

Cleaning in place (4.11.7)

  • Validate the system. Confirm the CIP system is designed and works correctly, keep an up-to-date schematic of its layout, and where rinse solutions are recovered and reused, assess the cross-contamination risk, for example from carrying an allergen or crossing production risk zones.[3]
  • Control changes. A competent person authorizes changes before they are made, changes are recorded, and the system is revalidated after changes and at a risk-based frequency.[3]
  • Set and validate limits. At a minimum: time for each stage, detergent concentration, flow rate and pressure, and temperature, set to remove the target hazards (soil, allergens, micro-organisms, spores).[3]
Raw milk

How Should Raw Milk Intake Be Handled Under BRCGS?

BRCGS treats raw milk like any other raw material: risk-assess it, approve its suppliers, and define what has to be checked before it is accepted. The standard also makes allowances for raw materials that don't fit a normal supplier-approval model, such as bulk agricultural commodities and materials received directly from a farm, both of which can describe raw milk.[3]

  • Risk assessment (3.5.1.1). Cover allergens, foreign bodies, microbiological and chemical contamination, variety or species cross-contamination (for example, cow's milk in a goat-milk product), substitution or fraud, and anything subject to legal control or customer requirements.[3]
  • Supplier approval (3.5.1.2). Approval is by valid certification to a BRCGS or GFSI-benchmarked standard that covers the material, by a supplier audit, or, only for a supplier assessed as low risk with a documented justification, by a questionnaire for initial approval. Where approval information isn't available, as with bulk agricultural commodities, or a customer dictates the supplier, your procedure must say what you do instead, and product testing verifies quality and safety (3.5.1.7).[3]
  • Farm traceability (3.5.1.6). Where a raw material comes directly from a farm, further verification of the farm's traceability system isn't mandatory. You still need traceability through your own site.[3]
  • Acceptance on receipt (3.5.2.1). Define the acceptance tests, visual checks or certificates for each raw material and how often you test.[3] For Grade “A” milk, the PMO already requires every bulk milk pickup tanker to be screened for beta-lactam drug residues, with the test finished before the milk is processed, so those records can serve as part of your acceptance evidence.[4]
  • Fraud (5.4). Keep a documented vulnerability assessment for all food raw materials or groups of raw materials, using information on historical and emerging fraud threats, and make sure all product descriptions and claims are legal, accurate and verified.[3]

Traceability gets harder once milk is separated and standardized. Issue 9 requires a traceability test at least once a year across your product groups, from raw material supplier to finished product and back, including a quantity check or mass balance, and BRCGS expects traceability to be achievable within 4 hours (3.9.3). Plan how you will account for cream, skim and returned product before the auditor picks a lot.[3]

Allergens

How Should Dairy Plants Handle Allergens and Labels?

Treat milk itself as an allergen to control, not just an ingredient. Milk is one of the nine major food allergens in U.S. law, and FDA says that, of the major food allergens, milk is the most common cause of recalls for undeclared allergens.[8] For allergen labeling, FDA considers “milk” to include milk from domesticated cows, goats, sheep or other ruminants, so goat-milk whey should be declared too, for example as “whey (goat milk).”[18] In a dairy plant, much of the risk comes from running many products on shared lines: flavored milks, yogurts and ice creams that add nuts, egg, soy or wheat, and non-dairy products made on dairy equipment.

  • Know your allergens. List every allergen-containing material handled on site, including raw materials, processing aids, intermediate and finished products, and new product development ingredients (5.3.2), and review raw material specifications for cross-contact risk (5.3.1).[3]
  • Assess each route of cross-contact through the process flow, including liquid and powder forms, and put controls in place: scheduling, segregation, dedicated equipment or extra protective clothing (5.3.3, 5.3.4).[3]
  • Control rework. Rework containing an allergen can only go into products that already contain it (5.3.5).[3]
  • Validate cleaning between allergens and verify it routinely (5.3.8). If your CIP system recovers and reuses rinse solutions, assess the risk of reintroducing an allergen (4.11.7.1).[3]
  • Back up any claim. A precautionary allergen statement needs a justified risk assessment (5.3.6), and a free-from claim needs a fully validated process that is routinely verified (5.3.7).[3]

Labelling and pack control (6.2) is a fundamental requirement. Only the packaging for immediate use may be available at the packing machines. Where packaging is coded or printed offline, only authorized staff may set or change printer settings such as date codes. Label use must be reconciled, and the line must be checked clear of the previous product's packaging at every changeover.[3] On a filler that runs many flavors, a wrong film or lid can become an undeclared-allergen recall.

U.S. rules

Does BRCGS Replace the PMO or FDA Rules?

No. BRCGS is a private standard your customers ask for; FDA's rules, and the PMO as your state has adopted it, are legal requirements.[4] A BRCGS audit isn't a regulatory inspection, but the auditor will check that you have a system to keep up with the law where your product is sold (1.1.8).[3] Which U.S. rules apply depends on the product.

BRCGS compared with the PMO and FDA rules for dairy
TopicGrade “A” products (PMO)Other dairy products (Part 117)BRCGS Issue 9
Who applies itState regulatory agencies, under the PMO, a model ordinance that FDA publishes, states adopt and the National Conference on Interstate Milk Shipments (NCIMS) helps revise[4]FDA, under 21 CFR Part 117[7]Your customer asks for it; a BRCGS-approved certification body audits you[1]
ProductsGrade “A” milk and milk products, such as fluid milk, cream, yogurt, sour cream, cottage cheese and Grade “A” dry milk and whey[4]Dairy products outside the PMO, such as cheese other than cottage cheese, butter, ice cream and other frozen desserts, even when made in a Grade “A” plant[4][6]Everything in the certificate scope
Food safety planPMO Appendix T: the Ordinance and the plant's own procedures serve as the plant's Part 117 food safety plan to the extent they address the hazards the plant identifies. The plan still needs a written hazard analysis, a recall plan and controls for hazards the PMO doesn't cover, and a PCQI must prepare or oversee it[4]A written food safety plan with hazard analysis and preventive controls, prepared or overseen by a PCQI[7]A Codex-based HACCP plan covering every product and process in scope (section 2)[3]
PasteurizationPMO time and temperature table and required equipment tests[4]21 CFR 1240.61: milk products in final package form for direct human consumption must be pasteurized to ship interstate, except cheeses cured under Part 133[13]Validated critical limits, monitored at each CCP (2.9, 2.10); the legal minimums come from the PMO or 1240.61[3]
Environmental monitoringPMO Appendix T requires a written, recorded program for ready-to-eat products exposed to the environment before packaging, unless the packaged product later gets a treatment or includes a control measure, such as a lethal formulation, that significantly minimizes the pathogen[4]Required, as appropriate, when a ready-to-eat food could be contaminated by an environmental pathogen and that hazard needs a preventive control (117.165(a)(3))[7]Risk-based program for every site, reviewed at least once a year (4.11.8)[3]
Food Traceability ListFluid milk, cream, sour cream and yogurt aren't on the list, and IMS-listed Grade “A” cottage cheese is exempt[19]Butter and ice cream aren't on the list. Fresh soft, soft ripened and semi-soft cheeses, and unpasteurized cheeses other than hard cheese, need extra records unless frozen, shelf stable or aseptically processed and packaged; FDA won't enforce the rule before July 20, 2028[19][20]Annual traceability test with mass balance (3.9.3)[3]

PMO references are to the 2025 Revision; states adopt PMO revisions on their own schedules. FDA references are to 21 CFR as published on eCFR, accessed October 5, 2026.

Grade “A” plants got an extended compliance date for Part 117's hazard analysis and preventive controls requirements, September 17, 2018, while the PMO was updated to include them. FDA was clear that the extension covered only Grade “A” products under the PMO, not other food made in the same plant.[6][21] If you make butter or cheese alongside fluid milk, the PMO route doesn't cover those products, so your food safety plan must address them directly under Part 117, unless the facility is exempt, for example as a qualified facility.[7]

On traceability, BRCGS requires your system to meet the law where the product is sold (3.9.1), but its annual trace test isn't built around the Food Traceability Rule's critical tracking events and key data elements. If you make cheese on FDA's Food Traceability List, plan for both.[3][19][20]

Ultra-pasteurized (UP) and aseptic products have their own PMO definitions, and aseptic lines follow extra rules. The PMO defines ultra-pasteurization as heating to at least 280°F (138°C) for at least 2 seconds, giving an extended shelf life under refrigeration. Aseptically processed and packaged Grade “A” low-acid milk products must meet 21 CFR Parts 108, 113 and 117, and the aseptic system is inspected by FDA or a regulatory agency FDA designates.[4] Part 117's hazard analysis and preventive controls don't apply to the microbiological hazards Part 113 regulates, if you comply with Part 113, but they still apply to other hazards, such as allergens (117.5(d)).[7] For BRCGS, an aseptic filler is the standard's own example of an enclosed product area.[2]

BRCGS also offers Module 13: Meeting FSMA Requirements for Food, an optional add-on audited alongside Issue 9. It is pass or fail rather than graded, and BRCGS says the module isn't a certification of FSMA compliance and doesn't guarantee that every part of a site's operations will be found fully compliant with the regulations.[1][22]

Findings

What Do BRCGS Auditors Find Most Often?

BRCGS's annual reports don't break non-conformity data down by product category, so there are no dairy-only figures. In its 2024-25 annual report, the latest with counts, the five most-cited Food Safety Issue 9 clauses were all in section 4, Site Standards.[23] Its 2025-26 report names the same five, with walls listed ahead of doors.[24]

Most-cited BRCGS Food Safety Issue 9 clauses, 2024-25
ClauseTopicNon-conformities
4.11.1Premises and equipment kept clean and hygienic4,715
4.6.2Equipment designed and built, based on risk, to prevent contamination3,322
4.9.1.1Control of chemicals3,284
4.4.8Doors, internal and external3,007
4.4.1Walls2,933

From BRCGS Annual Report 2024-25, p. 14. Topic wording paraphrased from Issue 9, Part II.

Wet cleaning every day is hard on a building. Clause 4.4.1, for example, requires walls finished and maintained to minimize condensation and mold growth, so it is worth walking your own site against these five before the auditor does.[3] Our guide to the most common BRCGS non-conformities covers the top ten and the evidence that closes each one.

Prepare

How Should a Quality Director Prepare?

Start with the scope and your existing programs, then fill the gaps. A plant with a working Grade “A” or Part 117 system already has a written hazard analysis, preventive controls including sanitation, and a recall plan. BRCGS section 2 still expects a plan built on the Codex HACCP principles, and the plant will need a few BRCGS-specific programs, such as a food safety culture plan (1.1.2), a confidential reporting system (1.1.6), internal audits on at least four dates a year plus monthly hygiene and fabrication inspections of open product areas (3.4), and a fraud vulnerability assessment for raw materials (5.4), along with the written risk assessments, validations and records BRCGS expects.[3] BRCGS says a new site is unlikely to show full compliance at an audit less than 3 months after it starts operating.[1]

  1. Confirm the scopeList every product and process to be certificated, and confirm the certification body can send an auditor qualified in category 7 and any other category in scope.[1]
  2. Map what you already haveMatch your PMO or Part 117 programs to Issue 9 clause by clause, and note every requirement your current system doesn't cover.[3]
  3. Revalidate the critical controlsPasteurization limits, alarms and calibration; CIP limits; allergen cleaning. Make sure each validation is current and on file.[3]
  4. Zone the site and test the programDraw the production risk zones on your site map and check your environmental monitoring sites, organisms and limits against them.[3]
  5. Write the culture planClause 1.1.2 requires a plan to develop and improve the site's food safety and quality culture, with activities, timescales and a way to measure it.[3]
  6. Run internal audits and a trace testInternal audits on at least four dates spread across the year, covering every activity at least once, plus a traceability test with mass balance.[3]
  7. Close the gapsStart with a self-assessment against the standard; BRCGS offers a downloadable self-assessment tool. Use your own team or any outside reviewer to close what you find. The certification body that will audit you can't provide consultancy.[1] For outside help, an optional gap assessment is also available through ASI Training and Consulting, LLC, which operates separately from the certification body and has no effect on audit outcomes. Using it isn't required for certification.[25]
  8. Book the auditPick an audit option, send the information needed to set the audit length, and agree the audit date. For an unannounced audit, settle contract terms before the 4-month window opens and nominate any non-audit days (up to 10, or 5 if you're on a 6-month schedule after a C or D grade).[1][26]
  9. Close non-conformities within 28 daysEvidence of correction, root cause and a preventive action plan for every finding. A C grade with two majors, or any D grade, also needs a revisit, on site or remote, within those 28 days.[1]

Be ready to show

  • Flow diagrams and HACCP review: flow diagrams verified on site within the last year (2.6.1) and a HACCP plan review within the last year (2.12.3).[3]
  • Pasteurization records for the runs the auditor picks, with deviations and what happened to the product.
  • Calibration checks for every CCP thermometer and recorder against a reference traceable to a national or international standard (6.4).[3]
  • CIP validation and monitoring records at the frequency your risk assessment sets.
  • Environmental monitoring results and trends for the last 12 months, with corrective actions.
  • Allergen risk assessment and cleaning validations for each allergen changeover.
  • Raw milk acceptance records and supplier approval files.
  • Last traceability test with mass balance, and your recall test.
  • Food safety culture plan with progress against it.
The audit

How Long Is the Audit, and How Is It Graded?

A typical BRCGS audit takes 2 to 3 days on site, longer for large plants. The certification body sets the length with BRCGS's audit duration calculator, which starts from full-time-equivalent employees per main shift, floor area and the number of HACCP plans; its base table runs from 18 to 34 hours on site for one to three HACCP plans. More HACCP plans add time (4 hours for 4 to 6 plans, 8 hours for 7 or more), as do high-risk, high-care and ambient high-care areas (2 hours each) and add-on modules, and other factors can move the total by up to 30%.[1][15]

For most sites, about half the audit is spent in production and other site areas, including talking to staff and checking records on the floor.[15] Expect the auditor to watch a changeover, check line start-up, follow a traceability challenge from raw milk intake to finished product, and review CCP records and labels.[1]

BRCGS Issue 9 grades and audit frequency
GradeNon-conformitiesNext audit
AA / AA+Up to 5 minors12 months
A / A+6 to 10 minors12 months
B / B+11 to 16 minors, or 1 major and up to 10 minors12 months
C / C+17 to 24 minors, or 1 major and 11 to 16 minors, or 2 majors and up to 10 minors6 months
D / D+25 to 30 minors, or 1 major and 17 to 24 minors, or 2 majors and 11 to 16 minors6 months
Not certificatedAny critical; a major against the statement of intent of a fundamental requirement; 31 or more minors; 1 major and 25 or more minors; 2 majors and 17 or more minors; or 3 or more majorsA new full audit, no sooner than 28 days later

The plus sign marks an unannounced audit. From Issue 9, Part III, Table 2.

  • Unannounced audits. Every site has at least one unannounced audit every three years, held at some point in the 4 months before the audit due date. The site must have the arrangements in place, including contract terms agreed before the window opens. If it doesn't, the due date moves, the certificate may lapse and a major non-conformity is raised (1.1.10).[1][26]
  • Certificate. Issued within 42 days of the audit and recorded in the BRCGS Directory, where customers can check it.[1]
  • Cost. BRCGS doesn't set the price; each site agrees its rate with its certification body.[27] You also pay a BRCGS fee for each audit, plus your own implementation costs. A C or D grade doubles the number of audits each year.[1]

For more on audit options, grades and costs, see our guide What Is BRCGS Certification?

What's next

What's Changing for BRCGS in 2026?

Two things. BRCGS's updated Issue 9 position statements took effect for audits from August 10, 2026. For a dairy plant the change to watch is clause 7.4.2: protective clothing must now include suitable protective footwear where it's needed to prevent product contamination.[26] High-risk and high-care areas already had stricter rules under clause 8.4.1: dedicated site footwear, effective footwear control at the entrance (a barrier or bench system, or a managed boot-wash that demonstrably works) and environmental monitoring to check that the controls work.[3] The same document carries an earlier rule: since May 1, 2024, a site can't change certification body in the 4 months before its re-audit due date without BRCGS's written agreement.[26]

Second, Issue 10 is being written. BRCGS's consultation on Issue 9 closed on February 15, 2026.[28] BRCGS's August 11, 2026 update says Issue 10 “continues to be developed,” and its 2025-26 annual report says it is planned for publication in 2027, with no exact date announced. Until Issue 10 audits begin, you'll be audited against Issue 9 and its current position statements.[29][24] For reference, Issue 9 was published on August 1, 2022, and audits against it started on February 1, 2023.[9][30][2]

Support

How Kiwa ASI Can Help

Kiwa ASI delivers BRCGS audits in the United States as a listed office of Kiwa's BRCGS-approved certification bodies, Kiwa Agri Food (UKAS-accredited, UK) and Kiwa España (ENAC-accredited).[31][32][33] Our St. Ann, Missouri offices are listed in the BRCGS Directory for Food Safety, Storage and Distribution, Gluten-Free and START!.[31] When you ask for a quote, we'll confirm auditor availability for dairy (BRCGS category 7) and any other category in your scope before we schedule. The certification body that audits your site can't also provide it with consultancy, which keeps the audit independent. See our BRCGS certification page for audit options and a quote.

BRCGS internal auditor training, HACCP training, PCQI training, environmental monitoring training, allergen management training and FSMA 204 traceability training are offered through ASI Training and Consulting, LLC, which operates separately from the certification body and has no effect on audit outcomes.

FAQ

Frequently Asked Questions

Is there a BRCGS standard specifically for dairy?

No. Dairy processors are certificated to the BRCGS Global Standard Food Safety, Issue 9, the same standard used by other food manufacturers. The audit is scoped to your products and processes, and the auditor must be qualified in BRCGS product category 7, dairy and liquid egg.

Which BRCGS product category covers dairy?

Category 7, “Dairy, liquid egg.” BRCGS's examples include liquid milk, cream, yogurt and other fermented milk products, butter, ice cream, hard, soft, mold-ripened, unpasteurized and processed cheeses, long-life milks, soy milk, and dried milk and whey powders. It also covers liquid egg and fruit juices.

Does BRCGS set pasteurization times and temperatures?

No. BRCGS requires validated critical limits that are measurable wherever possible, and leaves the numbers to your HACCP team and the law. In the U.S. the minimums come from the PMO and 21 CFR 1240.61. For example, HTST is 161°F for 15 seconds, 5°F higher for products with 10% or more fat or added sweeteners. Under the PMO, the 5°F increase also applies at 18% or more total solids.

Is a BRCGS audit the same as a Grade “A” inspection?

No. PMO inspections are regulatory, carried out by your state regulatory agency (and, for aseptic systems, by FDA or an agency it designates). A BRCGS audit is a private, voluntary audit by a certification body your customer recognizes. Holding one doesn't replace the other, but the records you keep for the PMO, such as pasteurizer equipment tests, are good evidence at a BRCGS audit.

Do Grade “A” dairy plants need a Part 117 food safety plan?

Yes, unless the facility is exempt, for example as a qualified facility, which has modified requirements instead. For Grade “A” products, PMO Appendix T makes the Ordinance and the plant's own procedures the Part 117 food safety plan to the extent they address the hazards the plant identifies, prepared or overseen by a PCQI. Butter, cheese other than cottage cheese and ice cream are covered under Part 117 directly.

Does BRCGS require environmental monitoring?

Yes. Clause 4.11.8 requires a risk-based program for relevant pathogens or spoilage organisms in every production area with open or ready-to-eat product, reviewed at least once a year. The clause doesn't name a target organism, but in a dairy plant handling ready-to-eat product after pasteurization, Listeria is the obvious one.

Does BRCGS require metal detection on liquid milk lines?

Metal detection is required unless your risk assessment shows it doesn't improve food safety, and the justification must be written down. BRCGS says that would normally rest on a more effective alternative, such as X-ray, fine sieves or filtration.

Are dairy products on FDA's Food Traceability List?

Some cheeses are: fresh soft or soft unripened and soft ripened or semi-soft cheeses made from pasteurized milk, and cheeses other than hard cheeses made from unpasteurized milk. Frozen, shelf-stable and aseptically processed and packaged cheeses are excluded, and IMS-listed Grade “A” cottage cheese is exempt. Fluid milk, yogurt, butter and ice cream aren't on the list. FDA won't enforce the rule before July 20, 2028.

How long does a BRCGS audit take for a dairy plant?

Typically 2 to 3 days on site, longer for large plants. The certification body calculates it from full-time-equivalent staff per main shift, floor area and the number of HACCP plans, adds time for extra HACCP plans, section 8 areas and modules, and can adjust the total by up to 30%.

Can the certification body help us prepare?

Not with consulting. Under BRCGS rules, the certification body may run an optional pre-assessment, with a different auditor from your certification audit, but it can't consult on how to close your gaps. Start with BRCGS's self-assessment tool. For outside help, training and an optional gap assessment are available through ASI Training and Consulting, LLC, which operates separately from the certification body and has no effect on audit outcomes. Using it isn't required for certification.

Plan your BRCGS audit

Talk to our team about BRCGS Food Safety audits delivered through Kiwa's BRCGS-approved certification bodies. We'll confirm auditor availability for category 7 and anything else in your scope before we schedule.

Questions? Email US.Info@kiwa-asi.com or call 1 (800) 477-0778.

Keep reading

Sources

  1. BRCGS. Global Standard Food Safety, Issue 9, Part III: Audit Protocol (Issue 9 text published for the Issue 10 consultation). brcgs.com (Word)
  2. BRCGS. Global Standard Food Safety, Issue 9 (August 2022): Part I, scope; Appendix 1, Other BRCGS standards; Appendix 2, Production risk zones; Appendix 3, Equivalent processes to achieve 70°C for 2 minutes; Appendix 6, Product categories. Free PDF from the BRCGS Store. brcgs.com
  3. BRCGS. Global Standard Food Safety, Issue 9, Part II: Requirements (Issue 9 text published for the Issue 10 consultation). brcgs.com (Word)
  4. U.S. FDA / NCIMS. Grade “A” Pasteurized Milk Ordinance, 2025 Revision (Section 1 definitions; pasteurization table; Appendix N; Appendix T). fda.gov
  5. U.S. FDA. Draft Guidance for Industry: Control of Listeria monocytogenes in Ready-To-Eat Foods (January 2017; still draft). fda.gov
  6. U.S. FDA. Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food; Clarification of Compliance Date for Certain Food Establishments, 80 FR 71934 (November 18, 2015). federalregister.gov
  7. U.S. FDA. 21 CFR Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food (§§ 117.5, 117.126, 117.130, 117.135, 117.165, 117.180). ecfr.gov
  8. U.S. FDA. Food Allergies (accessed October 5, 2026). fda.gov
  9. BRCGS Store. Global Standard Food Safety, Issue 9 (published August 1, 2022; free PDF format; accessed October 5, 2026). brcgs.com
  10. BRCGS. F931: Guideline for designing the certification scope, version 2 (July 22, 2025). brcgs.com (PDF)
  11. BRCGS. Storage and Distribution Issue 4 FAQs (product categories). brcgs.com (PDF)
  12. GFSI. Recognised Certification Programme Owners (accessed October 5, 2026). mygfsi.com
  13. U.S. FDA. 21 CFR 1240.61, Mandatory pasteurization for all milk and milk products in final package form intended for direct human consumption, and § 1240.3 (definitions). ecfr.gov
  14. U.S. FDA. 21 CFR 133.113, Cheddar cheese (curing of cheese made from unpasteurized milk). ecfr.gov
  15. BRCGS. F929: Audit duration calculator for Issue 9, version 3 (March 28, 2025). brcgs.com (PDF)
  16. U.S. FDA. Outbreak Investigation of Listeria monocytogenes: Ice Cream (July 2022). fda.gov
  17. U.S. FDA. Outbreak Investigation of Listeria monocytogenes: Soft Cheese (June 2026; updated August 26, 2026). fda.gov
  18. U.S. FDA. Guidance for Industry: Questions and Answers Regarding Food Allergen Labeling (Edition 5, January 2025), questions C.1 and C.2. fda.gov
  19. U.S. FDA. Food Traceability List (accessed October 5, 2026). fda.gov
  20. U.S. FDA. FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods (accessed October 5, 2026). fda.gov
  21. U.S. FDA. FSMA Final Rule for Preventive Controls for Human Food (compliance dates; accessed October 5, 2026). fda.gov
  22. BRCGS Store. Module 13: Meeting FSMA Requirements for Food (accessed October 5, 2026). brcgs.com
  23. BRCGS. Annual Report 2024-25 (“Top five non-conformities of 2024-25”, p. 14). brcgs.com (PDF)
  24. BRCGS. Annual Report 2025-26 (top Food Safety Issue 9 non-conformities, p. 12). brcgs.com (PDF)
  25. Kiwa ASI. BRCGS Certification (accessed October 5, 2026). asifood.com
  26. BRCGS. F926: Position Statements for Issue 9, version 4 (April 27, 2026; effective August 10, 2026). brcgs.com (PDF)
  27. BRCGS. FAQs: General questions (“How much does it cost?”; accessed October 5, 2026). brcgs.com
  28. BRCGS. Public consultation: Global Standard Food Safety, Issue 9 (January 9, 2026). brcgs.com
  29. BRCGS. Behind the scenes of Food Safety Issue 10 (August 11, 2026). brcgs.com
  30. BRCGS. PUBLISHED: Issue 9 – Leading the way in global food safety (2022). brcgs.com
  31. BRCGS Directory, public certification body and office listings for Kiwa Agri Food (UK) and Kiwa España, including the ASI offices in St. Ann, Missouri (accessed October 5, 2026). directory.brcgs.com
  32. UKAS. Schedule of Accreditation 0072, Kiwa Ltd t/a Kiwa Agri Food, product certification (issue 096, October 1, 2026), BRCGS Food Safety Issue 9 product categories. ukas.com (PDF)
  33. ENAC. Anexo Técnico 14/C-PR035, Kiwa España S.L.U., revision 76 (September 11, 2026), including BRCGS Global Standard Food Safety (version 9). enac.es (PDF)