Ysterhout Trading, a Mbombela broker of macadamia nuts, dried mango and litchi products, had held an A grade for two years when its recertification audit closed with one major and twelve minors. The major was a dried mango packer approved on a questionnaire although the company’s own risk assessment rated the product high risk. The auditor would not say what grade that meant, because auditors may not predict the outcome, so the managing director told the board to expect a B. The certificate came back as a C, because one major alongside eleven to fifteen minors lands there, and a C brings the next audit forward to six months instead of twelve. Nothing about it was unpredictable. A BRCGS Agents and Brokers audit is graded by arithmetic a trading business can do for itself, and managers who plan for it largely choose their grade before the auditor arrives.
In short
- There are three audit options: announced, blended announced (part remote, part on site) and unannounced. When Issue 3 was published, blended audits were open to recertification audits only.
- Findings are graded critical, major or minor. Announced and blended audits are graded AA, A, B or C; unannounced audits carry a plus: AA+ to C+.
- Any critical, three or more majors or 21 or more minors means no certificate. One major caps the grade at B and two majors cap it at C.
- Evidence that every non-conformity is corrected is due within 28 calendar days, or 90 calendar days for a company new to the Standard.
- AA, A and B are audited every 12 months, a C every 6 months. Recertification falls in a 28-day window that closes on the due date. An announced audit that slips past the due date without a justifiable reason earns a major against clause 1.1.10.
Three ways to be audited: announced, blended and unannounced
This is a management decision: it sets your notice, how the audit runs and the grade format.
| Announced | Blended announced | Unannounced | |
|---|---|---|---|
| Who can use it | New and existing companies | Recertification only at publication, if the certification body’s risk assessment allows | All companies, including first-timers |
| Date | Agreed in advance | Agreed in advance; remote part first | Chosen by the certification body, unannounced |
| How it runs | On site | Records reviewed remotely, the rest on site | On site, starting on arrival |
| Grades | AA, A, B, C | AA, A, B, C from both parts combined | AA+, A+, B+, C+ |
| What it asks of you | Preparation for a known date | Electronic records, working video and agreed data protection | Readiness every day, and real deputies |
Blended. The certification body assesses your audit history, whether your records are electronic and shareable, and whether both sides can work the technology. If data protection arrangements cannot be agreed, or the technology cannot be made to work, the audit is done on site. Video calls are allowed but are never recorded, and screenshots of your documents need your permission first. The remote session normally comes first, no earlier than 56 days ahead of the due date, and the site visit follows no more than 28 days after it. Anything raised remotely stays on the count, even if it is put right before the site visit.
Unannounced. You opt in within three months of your last audit, or say so when applying for a first certificate, accepting the audit may take up to a year. The certification body picks the day, usually late in the cycle, and it replaces your scheduled audit. You may nominate up to 15 days when the business is unavailable, with at least four weeks’ notice and a reason. Turn the auditor away and you pay for the wasted visit, go back to announced audits and may lose the certificate, by suspension or withdrawal.
Remote staff and virtual companies are audited through the blended protocol, which at publication was limited to recertification, so if you have home-based staff or no traditional office, ask your certification body how a first audit is handled.
Scope, offices and the certification body: decisions before you book
Scope. The certificate describes the product categories you trade and whether you act as a broker, an agent or both, and it must let a reader see whether a given product is covered. All in-scope products and all applicable requirements are audited. You can leave out a whole office or a whole product type (food, packaging or consumer products), but not a slice of one: keeping frozen and chilled food in while leaving shelf-stable food out does not work. Any exclusion also removes the right to use the BRCGS logo.
Offices and duration. The minimum audit is one working day at the primary office. The certification body sets the duration with the BRCGS calculator from your number of suppliers, products or product groups and offices, adding time for a first audit, poor pre-audit information or many findings last time. Each additional office adds at least two to three hours. Offices on a common system with electronic records can be audited remotely alongside head office; otherwise they need a separate audit. However many offices are visited, you get a single report and a single grade.
Certification body. Only BRCGS-approved bodies count. BRCGS will not recommend one, but the Directory shows each body’s star rating, and you should confirm your customers accept your choice. No auditor may audit you on more than three consecutive occasions, and you may turn down a particular auditor. Unpaid BRCGS or certification body fees also leave the certificate and report without validity.
Timing a first audit. Leave time to prepare: the Standard warns that a business operating for less than three months will rarely be able to demonstrate full compliance. Self-assess first; the certification body may run an optional pre-assessment, but the body that certifies you cannot also consult for you. If your team needs the clause-by-clause picture before it self-assesses, the Introduction to BRCGS for Agents and Brokers Issue 3 course covers it.
What happens on audit day
An Agents and Brokers audit happens in an office, so the day is built around records, systems and conversations rather than a factory walk.
| Stage | What the auditor does | What management should have ready |
|---|---|---|
| Opening meeting | Confirms the scope and how the audit will run | Your most senior manager, or the deputy named in your organisation chart, with the authority to sign up to corrective action (1.1.11) |
| Document review | Reviews the hazard and risk assessment and the quality management system | A current system that matches what staff actually do |
| Traceability challenge | Picks a lot and asks you to follow it back to its maker and on to its buyer | Linked purchase, shipping, storage and sales records, including those held by cold stores, hauliers and relabellers |
| Review of records and final review | Samples approvals, complaints, incidents, internal audits, training and the management review, then consolidates the findings | Files that can be found without the one person who usually knows where they are |
| Closing meeting | Presents every non-conformity and explains close-out and timescales, but does not predict the outcome | The same senior manager or deputy, and a person writing each finding down word for word |
You receive the findings in writing on the day, or by the end of the next working day at the latest. Certification body management then verifies the findings, and the decision is taken independently after a technical review; you are told if the count or severity changes. Ask for the evidence behind any unclear finding while the auditor is still there.
Critical, major and minor: how findings are classified
Every finding sits at one of three levels, and the level drives what follows. These definitions are paraphrased; check the wording in your own copy.
- Critical: the business has failed badly on product safety or on a legal requirement. A single one ends the audit without a certificate.
- Major: the business falls well short of a clause or of the intent of a whole section, or the auditor has evidence that seriously calls into question whether what you supply or arrange is as it should be. A procedure that exists on paper but is not followed in practice can end up here.
- Minor: something in a clause is missing or incomplete, but the evidence gives no reason to doubt the product itself.
The same minor gap repeated under one clause can become a major, but a string of minors cannot be folded into one to flatter the count, and over 20 minors with one major or none must be explained in the report. The Standard marks no clauses as fundamental, so the level of each finding, not its clause, decides the grade.
From findings to grade: the BRCGS Agents and Brokers grading table
The grade depends only on the number and level of findings after the certification body’s technical review. Count criticals, then majors, then read the minors across the right row.
| Announced or blended grade | Unannounced grade | Findings at the audit | Audit frequency |
|---|---|---|---|
| AA | AA+ | No majors, 5 minors or fewer | 12 months |
| A | A+ | No majors, 6 to 10 minors | 12 months |
| B | B+ | No majors and 11 to 15 minors, or 1 major with 10 minors or fewer | 12 months |
| C | C+ | No majors and 16 to 20 minors, or 1 major with 11 to 15 minors, or 2 majors with 10 minors or fewer | 6 months |
| Not certificated | Not certificated | Any critical; or 21 or more minors; or 1 major with 16 or more minors; or 2 majors with 11 or more minors; or 3 or more majors | A full new audit, timed with the certification body |
The scale stops at C. In short: a critical or a third major fails the audit, one major means the best grade is B, two majors mean the best is C, and minors alone fail at 21. Try these before reading the answers.
| Audit result | Grade | Why |
|---|---|---|
| Announced, 1 major, 12 minors | C | With one major the minor bands shift: 11 to 15 minors is a C. Without the major, 12 minors would have been a B. |
| Unannounced, no majors, 17 minors | C+ | 16 to 20 minors is a C, and the plus records that the audit was unannounced. Next audit in 6 months. |
| Blended: 4 minors raised in the remote session and closed before the site visit, then 3 more on site | A | Both parts feed one grade, and the four put right early stay on the count: 7 minors. |
| Announced, 2 majors, 11 minors | Not certificated | Two majors allow 10 minors at most. One more minor and the audit fails. |
The 28-day clock, the report and the certificate
Each finding needs three answers: the immediate fix, the underlying cause, and a dated plan to stop it happening again. That plan is printed in the audit report, so only promise what you will deliver. Findings are closed by objective evidence, such as revised procedures, records or invoices, or by a further visit, and no certificate is issued until every one is put right, either for good or with an interim fix the certification body is willing to accept.
| What | Timescale |
|---|---|
| Written summary of non-conformities | At the closing meeting or within 1 working day |
| Evidence of correction, company already certificated | Within 28 calendar days of the audit; miss it and certification is not granted, so a full new audit is needed |
| Evidence of correction, company new to the Standard | Within 90 calendar days |
| Audit report and certificate issued | Within 42 calendar days, or 104 for initial audits that need extra close-out time |
| Appeal against a certification decision | In writing within 7 calendar days of receiving it; finalised within 30 calendar days |
Calendar days include weekends and holidays, and an appeal does not stop the clock. The auditor looks again at last year’s findings, and if a fix has not held, the new finding goes against clause 1.1.12, a senior management clause, so the root cause matters more than the quick fix. Our guide to closing an audit finding so it stays closed shows how, and the root cause analysis course teaches the methods in depth.
Audit frequency and the recertification window
Your grade sets the gap between audits: 12 months for AA, A and B, 6 months for C. The due date is calculated from your initial audit date, not the certificate issue date or a follow-up visit, and recertification must take place in the 28-day window that closes on that date, which leaves time to close findings without a gap in certification.
- Late audits. An announced audit held after the due date without a justifiable reason earns a major against clause 1.1.10. The Standard accepts only narrow reasons, such as government advice against travel to the area or a disaster preventing a visit, where no suitable remote option exists. Combining audits or staff being unavailable do not qualify.
- Early audits. You may bring an audit forward, for example to align with another scheme; the new audit date then becomes the anchor for the next due date, and the certificate runs for 6 or 12 months plus 42 days from it.
- Changing certification body after a poor result. An early re-audit is normally done by the body that issued your current certificate; another body needs a concession agreed in advance by BRCGS, or the re-audit is void.
- Unannounced audits. Because the certification body sets the timing, the late-audit rule in clause 1.1.10 does not apply.
Between audits, the certification body or BRCGS may visit at any time, announced or not. Tell the certification body without delay about changes that could affect certification, such as new owners or the loss of key staff, and within three working days of a significant incident, a recall or a regulatory safety finding such as an enforcement notice (3.11.4).
What the grade means commercially
A grade changes what you pay, what customers see and, if things go badly, whether you can supply customers who require the certificate.
| Outcome | What it means for the business |
|---|---|
| AA, A or B | One audit a year, and a certificate customers can verify on the BRCGS Directory. |
| C | An audit every six months, so twice as many audits to pay for and prepare for, and a lower grade on the certificate customers check. One that accepted your certificate instead of auditing you may decide to look for itself. |
| A plus grade | The same thresholds, earned without notice: proof of readiness on an ordinary day. |
| Not certificated | No certificate from this audit, and a full new audit to arrange. A company already certificated has its certificate withdrawn immediately, and where customers require it they must be told at once, with the planned corrective actions. |
| Suspended or withdrawn later | Customers must be informed immediately, the logo and any claim of certification must stop, and getting a withdrawn certificate back takes a complete new audit. |
The audit report is your company’s property. It goes onto the Directory even if no certificate follows, but you decide which customers may open it, and you can keep your listing out of public view. If a customer sets a minimum grade, find out which before you plan, because it tells you how many findings you can afford. The management course works through this arithmetic with South African case studies. Whatever the grade, the logo may only be used by a company with no scope exclusions, on stationery and marketing, and never on products or product packaging.
A readiness plan for the next audit
The timings below are ASC suggestions, not requirements of the Standard. If this will be your first audit of any kind, our general guide on how to prepare for a food safety audit covers the basics.
| When | What to do | Why |
|---|---|---|
| Today | Diarise the due date and the 28-day window, with an owner. For unannounced audits, list your non-audit days now. | A late announced audit is a major against 1.1.10. Non-audit days need at least four weeks’ notice. |
| Three months before | Check the evidence that runs on a calendar: internal audits on at least two dates with every activity covered in the year, management review within 12 months, the annual traceability and recall tests, the vulnerability assessment and service provider reviews. | These cannot be produced in the week before, and missing ones are easy for the auditor to find. |
| Two months before | Re-check every non-conformity from the last audit: did the root cause fix hold? Check supplier certificates for scope and expiry, and questionnaire approvals for their three-year reissue. | Repeat findings are raised against a senior management clause (1.1.12). |
| Six weeks before | Send the pre-audit information: overview and offices, organisation chart, products and services, a hazard and risk summary, and recent complaints, incidents or withdrawals. | It helps set the right duration and auditor. |
| Two weeks before | Confirm the senior manager and deputy for both meetings, make records reachable without their usual custodian, and for blended audits test the video link. | Absent managers and unreachable files turn small gaps into findings. |
| Closing meeting to day 28 | Write each finding down word for word, then for each one: correction, root cause, preventive action plan and evidence, submitted with time to spare. | Evidence is due within 28 calendar days, or 90 for a company new to the Standard. |
Five things to do this week
- Find your certificate and work out the next due date from the initial audit date, then put the 28-day window in the diary of the person who books the audit and of their deputy.
- Pull last year’s audit report and check, for each non-conformity, that the root cause was addressed and the preventive action is still working.
- Grade your own last internal audit. Classify its findings as critical, major or minor and read them across the grading table. If the answer is a C, you have a plan to make.
- Run a traceability test both ways on a lot that passed through a cold store or relabeller, with a quantity reconciliation, and time it against the four-hour expected target.
- Name the deputy who will open and close the audit if the managing director is away, and check the organisation chart says so.
Related course: BRCGS Agents and Brokers Issue 3 for Management
A four-hour, self-paced course for the directors and managers who will face the auditor. Module 5 covers the audit options, the three levels of non-conformity, the grading table, the 28-day response and keeping the certificate, and the other four modules cover the commitment, supplier, service provider, traceability and recall systems the grade depends on. Case studies, knowledge checks and scenario games run throughout, with a final assessment and an ASC course certificate on passing.
See the BRCGS Agents and Brokers Issue 3 for Management course (4 hours, online, R1,195). Training a team? Choose “EFT or company invoice” at checkout, or WhatsApp us for a quote.
Common questions
What grades can a BRCGS Agents and Brokers audit give?
AA, A, B and C for announced and blended audits, and AA+, A+, B+ and C+ for unannounced audits. The grade comes from the number of critical, major and minor non-conformities. Any critical, three or more majors, or 21 or more minors means no certificate is issued.
How long do we have to close non-conformities after the audit?
A company that already holds a certificate has 28 calendar days to submit evidence that each non-conformity has been corrected. A company new to the Standard has 90 calendar days. If the evidence arrives late, no certificate is issued and a full new audit is needed.
Can our first Agents and Brokers audit be blended or unannounced?
When Issue 3 was published, blended audits were available for recertification only, not for a first audit, so check the current BRCGS position with your certification body. A first audit can be unannounced if you say so when you apply, but the audit may then take up to a year to happen.
What happens if our recertification audit is late?
An announced audit that slips past the due date without a justifiable reason earns a major non-conformity against clause 1.1.10. Only narrow reasons count, such as travel advice or a disaster with no remote option; combining audits or staff absence do not. The rule does not apply to unannounced audits.
Will the auditor tell us our grade at the closing meeting?
No. The auditor presents every non-conformity and explains close-out and timescales but must not predict the outcome, which is decided independently after review. Work the grade out yourself from the grading table.
How long does an Agents and Brokers audit take?
The minimum is one full working day at your main office. The certification body sets the duration with the BRCGS calculator, based on the number of suppliers, products or product groups and offices in scope. Each additional office adds at least two to three hours.
Next step. If you are planning an audit or recovering a grade, the BRCGS Agents and Brokers Issue 3 for Management course takes your leadership team through the options, the grading table and the 28-day response with South African case studies. For the wider BRCGS family and the courses that support it, see our BRCGS certification and training hub for South Africa.
This article is general guidance written for South African trading, import, export and brokerage businesses. It is not a substitute for the Standard: a company is audited against the Global Standard for Agents and Brokers (Issue 3) together with any position statements in force, and the Standard requires you to hold a genuine current copy. Before you plan an audit, look on brcgs.com and BRCGS Participate for the latest issue and any position statements, particularly on blended audits. Clause numbers are given so you can navigate your own copy. ASC Food Safety Training is independent of BRCGS: this article and our courses explain the Standard in our own words, are not endorsed by BRCGS, and lead to an ASC course certificate, not a BRCGS qualification.