How to Prepare for an SQF Audit: Steps, Scoring & Checklist

SQF Audit Preparation at a Glance

An SQF audit checks two things. First, that your written food safety system meets the SQF code you're being audited against. Second, that your people follow it every day, with records to prove it. SQFI sums it up as "say what you do" and "do what you say."^[1] The auditor checks both, and a gap in either costs points, so preparation means having the documents and the records that show you follow them.

• 90 daysMinimum records SQFI recommends before an initial certification auditSQF Code, Part A^[2][3]
• 70Lowest passing score under Editions 9 and 10SQF Code, Part A^[2][3]
• 30 daysTo close every minor and major finding under Edition 9 (40 days under Edition 10)SQF Code, Part A^[2][3]
• Jan 2, 2027Earliest date Edition 10 audits can start, depending on GFSI benchmarkingSQFI Edition 10 FAQ^[4]

Sources checked as of October 13, 2026, against the SQF Food Safety Code: Food Manufacturing (Edition 9), the Edition 10 Part A (updated September 1, 2026) and Food Manufacturing checklist, SQFI's Edition 9 code amendments, and SQFI guidance pages. Clause numbers are from the Food Manufacturing code. Other SQF food safety codes follow the same Part A process with their own Good Industry Practice module.

Which SQF Edition Will Your Audit Use?

It depends on the audit date. SQFI expects Edition 10 audits to begin on January 2, 2027, but that date depends on GFSI benchmarking and could move later. It won't move earlier. Until GFSI recognizes Edition 10, Edition 9 is the only GFSI-recognized SQF edition, and audits before the start date are to Edition 9.^[4][6]

Benchmarking is still under way. GFSI opened its public consultation on SQF Edition 10 on September 29, 2026, which is a required step before recognition.^[7] Two more rules help with planning. A surveillance audit that follows an Edition 9 audit stays on Edition 9, even if it happens after the Edition 10 start date. And certification bodies won't mix requirements from both editions in one audit.^[5]

If you're working toward your first certification, build your system to Edition 10. SQFI says to prepare for Edition 10 if you're scheduling a new certification audit during the transition.^[5] A site that starts keeping records in mid-October 2026 won't have SQFI's recommended 90 days of records until mid-January 2027, after the earliest Edition 10 start date. If benchmarking runs late and your audit falls before Edition 10 audits begin, it will be to Edition 9, so confirm the edition with your certification body when you book. Edition 10 renumbers many clauses, but SQFI doesn't require your own procedures to follow the code's numbering.^[4]

What Does an SQF Audit Check?

An SQF audit is a third-party assessment by an auditor from an SQFI-licensed certification body. It checks that your documented system meets the SQF code for your food sector categories, and that your site actually works that way. For a food manufacturer, the code is Module 2 (system elements) plus Module 11 (good manufacturing practices). Mandatory clauses can't be marked "not applicable" or excluded. Other clauses can be marked not applicable only when you can justify it. Under Edition 10, a justification or risk assessment must be available during the audit, and the same applies to any clause where you use alternative controls. Have these ready before audit day.^[2][3]

Part of an announced audit can be done remotely by agreement, but at least half of the audit time must be on site, and the on-site part happens only while your main processes are running. Unannounced audits are entirely on site. When part of an audit is remote, SQFI expects the auditor to spend 80% of the on-site time observing and interviewing, under both editions, so prepare your floor and your people, not just your paperwork. For a food manufacturer, a certification or re-certification audit lasts at least two days, counting remote and on-site work. Under Edition 10, an initial audit may add half a day. Your certification body sets the actual length based on site size, staff numbers, process complexity and risk.^[2][3]

How Do You Prepare for an SQF Audit, Step by Step?

Most of the work happens months before the auditor arrives. These steps are drawn from Part A of the code and SQFI's "Get Certified" pages. The timing labels are a practical guide, not SQF requirements. The 90-day label follows SQFI's advice, in both editions, to have at least 90 days of records before the audit. SQFI recommends this but doesn't require it. For a sense of scale, our SQF certification page puts most first-time sites at six to twelve months from SQFI registration to certificate.^[18]

1. 01Confirm your code and scopeUse SQFI's Code Selector and its food sector category list to find the code and food sector categories (FSCs) for your products. Agree the scope with your certification body before the audit: the premises, FSCs, products and processes. Any exclusion must be requested in writing before the audit, and it can't be promoted as certified. The scope can't change once the audit has started.^{[1][3][11][12]}First
2. 02Name a primary and substitute SQF PractitionerBoth must work at the site, have completed HACCP training and be able to run your food safety plans. Under Edition 9, the HACCP course must be at least two days long and assessed. Edition 10 defines HACCP training as a course based on Codex HACCP principles, recognized and widely used in the country, delivered by a recognized institution, with the person's knowledge assessed. The substitute needs the same qualifications as the primary and must be trained and ready to step in. SQFI's Implementing SQF Systems course is strongly recommended but not required.^{[2][8][13][14]}First
3. 03Register and choose a certification bodyRegister the site in the SQFI Assessment Database before any audit and renew each year. SQFI's posted registration fee for one Edition 9 Food Manufacturing code is $650 (rate in effect as of April 1, 2024). Then sign an agreement with an SQFI-licensed certification body that covers scope, audit length, fees and close-out costs. SQFI suggests choosing early so your preferred audit dates are open.^[2][12][15]Before booking
4. 04Document the systemWrite the policies, procedures, work instructions and specifications that meet Module 2 and your Good Industry Practice module (Module 11 for food manufacturing). Build your HACCP-based food safety plan from a hazard analysis of every product and process.^[1][2]Say what you do
5. 05Run it and build recordsFollow the procedures and keep the records. SQFI recommends at least 90 days of records before the audit. Book the yearly activities in the table below so they're done before audit day.^[1][3]90 days or more
6. 06Do a full internal auditAudit every applicable clause against SQFI's checklist or a similar tool, with trained auditors who are independent of the area where practical. This is required at least once a year anyway, and SQFI says it can be split into pieces through the year as long as everything is covered.^[2][16][17]Before the audit
7. 07Fix gaps at the rootTreat every internal finding as a non-conformity: find the root cause, act on it, and check that the fix worked. Those records are evidence too.^[2]Before the audit
8. 08Hold the management reviewSenior site management must review the whole SQF System at least once a year, including food safety culture performance, objectives, audit and complaint trends, and actions from the last review.^[2]Before the audit
9. 09RehearseTrace one product up and down the chain, check that interviewees know their tasks, and walk the whole site, including the exterior. Each SQFI guidance document includes a "RIO: Road to Audits" list of the records, interviews and observations an auditor uses for that topic, which makes a good rehearsal script. SQFI also allows an optional pre-assessment, which your own Practitioner can run.^[1][2][17]Final weeks
10. 10Set up audit weekSchedule production so the main processes are running, make sure the Practitioner and key staff are on site, and invite senior management and the food safety team to the opening meeting.^[2][9]Audit week

Which Yearly Records Will the Auditor Ask For?

Yearly activities are easy to postpone, and an auditor will ask for the latest record of each. SQFI lists management review and internal audits among the common minor findings under Edition 9.^[19] Under Edition 10, SQFI recommends at least 90 days of records, including every activity done at least once a year, before an initial audit and before a re-certification audit at an edition change, such as your first Edition 10 audit.^[3] The table lists the main yearly activities with their Edition 9 Food Manufacturing clause numbers. The note below it covers Edition 10.

Edition 9 Food Manufacturing clause numbers. Edition 10 keeps these activities. In a single clause (2.2.3.3), it requires records for every yearly activity and names the main ones, such as management review, internal audit, and the recall, trace and crisis tests. It adds others, such as a yearly evaluation of the environmental monitoring program (2.4.8.1) and a yearly review of GMP risk assessments (11.1.1.1).^[2][8]

SQF Audit Preparation Checklist

Use this list to check readiness, then run your full internal audit against SQFI's official checklist for your code. SQFI publishes free Excel checklists for most Edition 9 and Edition 10 codes, including Food Manufacturing, on its Guidance & Checklists page.^[16] SQFI's Edition 9 code amendments are audited with the Edition 9 codes, so they're included.^[20] Clause numbers below are from the Edition 9 Food Manufacturing code, except the last group, which is Edition 10. If your audit will be to Edition 10, use SQFI's Edition 10 checklist and give the last group extra time.^[2][8]

Registration and scope

• SQFI registration is current. The site is registered in the SQFI Assessment Database and the scope shown there matches your agreement with the certification body (Part A).
• Exclusions are approved in writing. Anything excluded from scope was agreed before the audit and isn't promoted as certified.

Management commitment (2.1)

• Food safety policy is signed and posted. It covers food safety culture and is communicated in languages staff understand (2.1.1.1).
• Primary and substitute Practitioners are named. Both have HACCP training on file and job descriptions that match what they actually do (2.1.1.3 to 2.1.1.5).
• Management review is done and recorded. It covers food safety culture performance and trends, and the monthly Practitioner updates are documented (2.1.2).
• Complaints are trended. Adverse trends have a root cause and a corrective action (2.1.3).
• Blackout dates went in on time. For an unannounced re-certification audit, the dates and reasons reach your certification body at least one month before the 60-day re-certification window (2.1.1.8).

Documents and records (2.2)

• Only current versions are in use. Obsolete documents are out of the work areas (2.2.2).
• Records are complete and signed. Each is legible, confirmed by the person who did the monitoring, verified where required, and retrievable (2.2.3, 2.5.2).

Suppliers and specifications (2.3)

• Specifications are current. Raw material, packaging and finished product specs are on file (2.3).
• Approved supplier program is risk-based. Supplier approval and monitoring records are up to date, and the approved supplier register lists contact details for every approved and emergency supplier (2.3.4, Edition 9 Amendment 002).

Food safety plan and verification (2.4, 2.5)

• Hazard analysis covers every product and process. Including ingredients, rework and new lines (2.4.3).
• CCPs are monitored, verified and validated. Critical limits were reviewed this year and deviations have recorded actions (2.4.3, 2.5.1, 2.5.2).
• A verification schedule exists and is followed. It says who verifies what and how often (2.5.2.2).
• Environmental monitoring is risk-based and trended. The sampling schedule names the pathogens or indicator organisms, the number of samples and how often they're taken, and results are tracked and trended, with preventive action on poor results (2.4.8).
• Internal audit and inspections are complete. Every finding has a root cause and a closed corrective action (2.5.3, 2.5.4).

Traceability, recall, defense and fraud (2.6, 2.7)

• This year's recall test passed. One step back and one step forward, with products from different shifts (2.6.3.2).
• Crisis, food defense and food fraud plans were reviewed this year. Tests and reviews are recorded (2.6.4, 2.7.1, 2.7.2).
• Staff know the 24-hour notice rule. Your recall plan lists SQFI, your certification body and the regulatory authority as essential contacts. SQFI and your certification body must be told in writing within 24 hours of a regulatory warning or event, or a food safety event that needs public notice (2.4.1.3, 2.6.3.1, 2.6.3.4).

Allergens and training (2.8, 2.9)

• Allergen cleaning is validated and verified. Changeovers and label checks are recorded (2.6.1.2, 2.8.1).
• Training records show competence. Each record names the skill, date and trainer and confirms the person is competent. Refresher needs are identified (2.9.2).

Good manufacturing practices (Module 11)

• Pest prevention is managed, not outsourced and forgotten. The site map, device list, contractor reports, trend reviews and follow-up actions are current (11.2.4).
• Cleaning is documented and verified. Procedures say what is cleaned, how, when and by whom, and records show it happened (11.2.5).
• The site is in good repair. Floors, walls, ceilings, drains and equipment are maintained (11.1, 11.2).
• Measuring and inspection equipment is calibrated. There's a list of equipment that needs calibration, current calibration records, and a procedure for product checked with equipment later found out of calibration (11.2.3).
• Foreign matter controls work. Glass and brittle items in food zones are on an inventory and inspected, glass instrument dial covers and mercury-in-glass thermometers are checked at the start of each shift, and metal detectors or other detection equipment are monitored, validated and verified (11.7.3, 11.7.4).
• Medical screening includes visitors and contractors. The site has a medical screening procedure for all employees, visitors and contractors who handle exposed product or food contact surfaces (11.3.1.1, Edition 9 Amendment 001).
• Water, ice and air testing is current. Including backflow testing where possible and ambient air in high-risk areas (11.5, 11.7.1.2).

If your audit is to Edition 10, also check

• A food safety culture assessment plan is in place. It covers communication, training for all staff including management, staff feedback, and regular measurement (2.1.1.3).
• Changes go through a change management procedure. Including temporary and emergency changes (2.3.5).
• Environmental monitoring starts from a risk-based assessment. Target organisms come from your own hazard analysis, and the program is evaluated each year (2.4.8).
• Key training includes a documented assessment. For example, for staff who monitor CCPs, run corrective actions or do internal audits (2.9.1.2).
• Blackout dates reach your certification body early. At least 90 days before the audit window opens (2.1.1.5).
• Both yearly tests are on file. A traceability test on products from different shifts and on shared or bulk materials (2.6.2.1), and a recall test that covers the whole recall program (2.6.3.2).

What Happens on Audit Day?

An SQF audit follows a set pattern. Here's what to expect.

1. 01Opening meetingAt least the food safety team and senior site management attend. The auditor confirms the scope and agenda.^[9]
2. 02Document and record reviewThe auditor reviews the food safety plan, CCP records and validation and verification records, and checks that required records are up to date and signed.^[9]
3. 03Site inspectionThe whole site: buildings inside and out, grounds, docks and storage, plus operating and cleaning shifts and pre-operational inspections where they apply.^[2][9]
4. 04Interviews and observationStaff at every level are asked open-ended questions while the auditor watches whether SOPs and GMPs are followed and monitoring is done correctly.^[9]
5. 05Closing meetingThe auditor goes over every non-conformity before the audit closes, along with the deadlines for closing them. Under Edition 10, the auditor must give them to you in writing.^[2][3][9]

If the auditor finds a critical non-conformity, they tell you right away and notify the certification body. Edition 10 adds that the audit then continues as scheduled.^[2][3] Your auditor can explain what a finding means, but can't tell you how to fix it. That keeps the certification impartial.

How Is an SQF Audit Scored?

The score is 100 minus the points deducted for each non-conformity. A minor is a random or occasional lapse. A major is a failed system element, a systemic breakdown, a serious deviation, or no evidence of compliance. A critical is a breakdown of control at a CCP, prerequisite program or other process step that's likely to cause a significant public health risk or contamination. It also covers systemic falsification of records.^[2][3]

Edition 9: Part A 9.2, 11.2 and Step 13. Edition 10: Part A A2:19, A2:24 and A2:28 (updated September 1, 2026).

Here's how the math works. Four minors and two majors cost 14 points, for a score of 86. That's a G under Edition 9 and Certified under Edition 10. Under Edition 10, say one of those minors and one of those majors were against Core Clauses. The three regular minors cost 3 points, the Core Clause minor 2, the regular major 5 and the Core Clause major 7. That's 17 points, for a score of 83, still Certified with a 12-month cycle. Three Core Clause majors on their own cost 21 points, for a score of 79, which brings a 6-month surveillance audit. A single critical takes 50 points, so even an otherwise perfect audit scores 50. That fails an initial audit, and at a re-certification audit it means immediate suspension.

Which Findings Do SQF Auditors Write Most?

SQFI's own analysis of Edition 9 audits points to pest prevention, the food safety plan, and cleaning and sanitation as the biggest problem areas, with management review and internal audits common among minor findings.^[19]

Source: SQFI's July 2023 analysis of Edition 9 audit findings. SQFI didn't publish the number of audits or the period covered. SQFI showed the same top three in a January 2024 presentation, and we found nothing newer as of October 2026.^[21]

Edition 10 weights three of these five areas more heavily: the food safety plan, cleaning and sanitation, and management review. Its Food Manufacturing Core Clauses, which cost more points, are management responsibility, management review, complaint management, the approved supplier program, the food safety plan, environmental monitoring, corrective and preventive action, product identification, allergen management, cleaning and sanitation, and foreign matter control.^[8] Pest prevention and internal audits aren't on that list, so those findings keep the standard 1 and 5 point deductions.

For help writing corrective actions that hold up, see our guide to root cause analysis in SQF audits.

What Happens After the Audit?

After the closing meeting, the clock starts. Under Edition 9, every minor and major must have a documented root cause analysis and corrective action that the auditor verifies and closes within 30 calendar days. If you miss it at an initial audit, the certification body can't certify the site and you have to reapply. If the site is already certified, the certificate is suspended right away.^[2]

More time is possible when a fix takes longer. For a minor, that's when there's no immediate threat to product safety and temporary controls are in place. For a major, that's when the fix needs structural work, depends on the season, or has long lead times, with interim controls in place. Either way, the finding is still closed in the database on time, with the plan and completion date recorded.^[2][3]

You submit corrective actions in the SQF Assessment Database. The site's primary contact goes to Action Items, reassigns the corrective action plans to themselves, then opens each one, describes the action taken and uploads evidence such as documents, photos or logs. Once every finding is entered, they select Submit.^[22] Under both editions, the evidence for every minor and major finding must include a documented root cause analysis.^[2][3] The certification body reviews each one and can send it back for more information, so submit early enough to allow a second round. If you can't meet the deadline, contact your certification body right away.^[22]

Edition 9: Part A Steps 9 to 12. Edition 10: Part A A2:11, A2:14 and A2:20 to A2:26 (updated September 1, 2026).^[2][3]

Under Edition 10, if a non-conformity repeats from the last audit, the auditor may add non-conformities under the corrective and preventive action clause, which is a Core Clause. Missing the 40-day deadline makes a site ineligible for certification, and a certified site that misses it is suspended.^[3] SQFI says the unannounced audit requirement hasn't changed with Edition 10, but the Edition 10 text counts the first three-year cycle from the first re-certification audit, so confirm the timing with your certification body.^[3][4]

How Does Edition 10 Change Audit Prep?

Edition 10 keeps the same audit process but raises the stakes in a few places. These are the changes that matter most for preparation:

• Core Clauses. Findings against Core Clauses cost 2 points for a minor and 7 for a major, instead of 1 and 5.^[3]
• New scoring bands. A score of 80 or more earns a 12-month cycle. Scores from 70 to 79 bring a 6-month surveillance audit.^[3]
• Food safety culture assessment plan. Every site needs a documented plan covering communication, training for all staff including management, a way to collect staff feedback, and regular measurement (2.1.1.3). It sits inside Core Clause 2.1.1, Management Responsibility, so a finding here costs 2 points for a minor or 7 for a major.^[4][8]
• Change management. A new clause requires a procedure to evaluate changes, including temporary and emergency ones, to formulations, materials, equipment, specifications and the food safety plan (2.3.5).^[8]
• Environmental monitoring. It's now a Core Clause, and the program must be evaluated each year or when trends or changes affect product safety (2.4.8).^[8]
• Longer close-out, stricter follow-up. Corrective actions get 40 days instead of 30, but a repeat finding can bring extra non-conformities.^[3]
• Earlier blackout dates. The Practitioner must send blackout dates to the certification body at least 90 days before the audit window opens (2.1.1.5).^[8]
• Training with a documented assessment. Training for key roles, such as CCP monitoring, corrective action and internal auditing, must include a documented assessment (2.9.1.2).^[8]
• More triggers for regulatory notice. Edition 9 already requires written notice to SQFI and the certification body within 24 hours of a regulatory warning or event. Edition 10 keeps the 24 hours and adds a regulatory action or the site being named in an outbreak. Notice to SQFI now goes through sqfi.com/regulatory instead of email (2.4.1.3).^[2][8]

SQFI offers an Edition 10 conversion course, and licensed training centers teach the changes too.^[4] Kiwa ASI, an SQFI Licensed Training Center, teaches an SQF Edition 10 conversion course. It's offered through ASI Training and Consulting, LLC, which operates separately from the certification body and has no effect on audit outcomes. For a deeper look at the changes in one code, see our SQF Edition 10 Storage and Distribution guide.

How Kiwa ASI Can Help

Kiwa ASI provides SQF certification audits through ASI Food Safety, LLC, an SQFI-licensed, ANAB-accredited certification body. See our SQF certification page for audit options and to request a quote.

To build your team's skills, training includes Implementing SQF Systems, SQF Advanced Practitioner, the Edition 10 conversion course, Principles of Internal Auditing and HACCP training. Training is offered through ASI Training and Consulting, LLC, which operates separately from the certification body and has no effect on audit outcomes.

Frequently Asked Questions