BRCGS Certification Explained: What a Food and Packaging Audit Actually Checks

Home / Guides / BRCGS certification explained

GFSI Certification · BRCGS

By Mthokozisi Nkosi, food scientist, registered Lead Auditor with Exemplar Global and IRCA, and one of four SAATCA registered R638:2018 Lead Implementers. Founder of ASC Food Safety Consultants. Last updated 9 September 2026.

What is BRCGS, and who owns it?

BRCGS stands for BRC Global Standards. It writes and owns a family of supply chain assurance standards that began with the British Retail Consortium’s work on retailer own-brand supplier assurance, and the business is now owned by LGC, which acquired BRC Global Standards in November 2016. BRCGS itself does not audit anyone.

That last point is where most first-time applicants go wrong. BRCGS writes the standard, sets the audit protocol, licenses certification bodies, trains and approves auditors, and runs the BRCGS Directory, where certificates are listed and audit reports are made available to authorised parties. The audit is carried out by a licensed certification body that is itself accredited by a national accreditation body. You buy the standard from BRCGS and you buy the audit from someone else. If a consultant offers to “certify” your site, that consultant is either a certification body or is misdescribing what they do.

When you put this to your managing director, the number that lands is the buyer in Rotterdam who already knows how to read the certificate. On BRCGS’s own count the Food Safety standard has been adopted by over 22,000 sites in more than 130 countries. For a South African manufacturer that is the practical value of the document: it travels.

Which BRCGS standards exist, and which are GFSI recognised?

BRCGS publishes nine standards plus the START programme. Four of them are GFSI recognised: Food Safety, Packaging Materials, Storage and Distribution, and Agents and Brokers. The rest are legitimate certification programmes but sit outside the GFSI benchmark. GFSI is hosted by The Consumer Goods Forum, and it benchmarks schemes rather than certifying sites, so there is no such thing as “GFSI certification”.

If your customer’s specification says “a GFSI recognised scheme”, BRCGS Food Safety, Packaging Materials, Storage and Distribution and Agents and Brokers all satisfy it, and so do the alternatives such as FSSC 22000 and the GFS edition of GLOBALG.A.P. IFA v6. ISO 22000 on its own is not GFSI recognised, which is why FSSC 22000 exists as a scheme built on top of it. We cover that comparison in the FSSC 22000 Version 7 changes guide.

What does the Food Safety standard require, section by section?

Global Standard Food Safety Issue 9 sets its requirements in nine numbered sections, from senior management commitment through to requirements for traded products. Each section opens with a statement of intent, which is the outcome the auditor must be satisfied about, followed by numbered clauses that describe how that outcome is evidenced. The auditor grades against the clauses but fails you against the statement of intent.

1. Senior management commitment

The section that most sites underestimate. It covers the food safety and quality policy, the resourcing of the system, the objectives that senior management sets and reviews, management review with a defined agenda and actions, the confidential reporting mechanism for staff, and the requirement for a documented plan for developing and continually improving food safety and quality culture. Culture is not a poster exercise here. The auditor looks for a plan with activities, owners, timescales and measured outcomes. Our Food Safety and Quality Culture for Management and Supervisors course, R1,195 exists because this clause set is where a lot of otherwise clean sites collect findings, and there is a fuller treatment in the food safety and quality culture guide.

2. The food safety plan, HACCP

Section 2 is HACCP built on the Codex Alimentarius sequence, which means CXC 1-1969, General Principles of Food Hygiene, revised 2022. Twelve steps, seven principles, a multidisciplinary team, product descriptions, intended use, a verified flow diagram, hazard analysis, critical control points, validated critical limits, monitoring, corrective action, verification and records. Issue 9 tightened the validation expectations, and an auditor who asks “where is the validation for that critical limit” is asking a Section 2 question. If your HACCP team was assembled by job title rather than by competence, start with HACCP for Supervisors and HACCP Teams, R2,730, and read which HACCP course you actually need before you buy.

3. Food safety and quality management system

The paperwork spine: the quality manual, document and record control, internal audits, supplier approval and performance monitoring, outsourced processing, specifications, corrective and preventive action, control of non-conforming product, traceability, complaints, and the management of incidents, withdrawal and recall. Traceability has to be tested, not merely described, and the test has to reconcile quantities.

4. Site standards

The largest section and the one that generates the most findings. External standards and site security, building fabric, utilities including water, air and compressed gases, equipment design and construction, maintenance, staff facilities, chemical and physical contamination control, foreign body detection and removal, housekeeping and hygiene, waste, pest management, and storage and transport.

5. Product control

Product design and development, management of allergens, provenance and claims, product packaging, product inspection and laboratory testing, product release, and the additional requirements for pet food and animal primary conversion. Allergen management here is a risk assessment plus documented controls plus validated cleaning plus labelling accuracy, not a “may contain” statement bolted onto artwork. Sites exporting from South Africa should note that the allergen list they must declare is set by the destination market, and our Allergen Management in Food Supply Chain course, R1,450 works through those differences.

6. Process control

Control of operations, labelling and pack control, quantity control, and calibration of measuring and monitoring devices. Labelling and pack control is where line changeover discipline gets tested: the auditor will ask to see the pack checks at start-up, at changeover and at the end of the run, and will look for the reconciliation of printed packaging.

7. Personnel

Training, personal hygiene, medical screening, and protective clothing for employees and visitors. Training records must show competence, not attendance. A signature on an induction register is not evidence that a person can carry out a task correctly.

8. Production risk zones

The high-risk, high-care and ambient high-care requirements. Only applicable to sites handling products in those categories, and where it applies it is demanding: physical segregation, dedicated equipment, controlled personnel and material flow, air handling with pressure differentials, and separate cleaning regimes.

9. Requirements for traded products

A voluntary module for sites that buy in finished product they do not manufacture themselves and sell it under their own name or through their own supply chain. It brings hazard analysis, manufacturer approval, specifications, product inspection and testing into scope for those products. If your site manufactures and also trades, and the traded lines are not in your certificate scope, expect your customer to ask why.

This is the section nobody on site believes applies to them. On a site I audited, the commercial team bought in a finished line from another manufacturer, relabelled it and sold it under the site’s own brand, and everyone from the QA manager down described it as not really theirs. It carried their name, their barcode and their recall obligation. There was no hazard analysis for it, no approval of the manufacturer beyond a certificate somebody had emailed across, and no agreed specification. That is a scope conversation to have with your certification body before the audit rather than during it.

What are the fundamental requirements, and why does one failure end the audit?

Twelve clauses in Issue 9 are designated fundamental. They are the requirements BRCGS considers so central that failing one costs you the certificate, regardless of how well the rest of the audit went. A fundamental failure is not a heavier minor. It is a major raised against the statement of intent, and the consequence is non-certification or withdrawal.

The Packaging Materials standard uses the same mechanism and states the consequence plainly:

Failure to comply with the statement of intent of a fundamental requirement (i.e. a major non-conformity) leads to non-certification at an initial audit or withdrawal of certification at subsequent audits. This will require a further full audit to demonstrate evidence of compliance.Global Standard Packaging Materials Issue 7, BRCGS

Read that carefully, because “a further full audit” is the expensive part. You do not clear a fundamental failure with a corrective action plan and a photograph. You buy the whole audit again, and in the meantime your customer sees the withdrawal on the BRCGS Directory. Internal audit at clause 3.4 is the cheapest insurance against this, which is why we teach it as a discipline rather than a form in Internal and Supplier Auditing Practices based on FSMS, R3,500, with the longer argument set out in the internal and supplier auditing guide.

I have sat in the closing meeting where a major was raised against the statement of intent of the traceability clause. The site had a written traceability procedure and had never once run it end to end against a real batch. We asked for a mass balance on a single lot of finished product, and the reconciliation would not close. Nobody in the room could account for the difference. The technical manager had been in post a few months and had inherited the file as it stood. What that cost the site was not the finding itself. It was the full audit they had to buy again, the certification body’s travel, and a customer who wanted a written explanation of why the directory entry had changed.

How does BRCGS grading work, and what does AA down to D mean commercially?

BRCGS grades the audit on the number and severity of non-conformities raised. Minors are counted, majors carry weight, and one critical means no certificate. Grades run AA, A, B, C and D, with uncertified below that. Evidence of corrective action must be submitted within the period set in the Issue 9 audit protocol, 28 calendar days for an announced audit, and grades C and D pull the site onto a six-monthly audit frequency instead of twelve-monthly.

Bands are as set out in Part III of the Standard. Confirm the current table against your own copy of Issue 9.

Commercially, the gap that matters is not AA versus A. It is B versus C. Crossing into C doubles your audit cost for the year, puts you in front of your customer’s supplier risk process, and in most retailer programmes triggers a review that a purchasing manager has to sign off. Sites that sit at C for two cycles usually lose the listing on price grounds long before anyone mentions the grade out loud.

A grade earned on an unannounced audit is published with a plus, so AA becomes AA+. Some buyers now specify the plus, because it is the only grade that certifies what your site looks like when nobody is expecting a visitor.

What happens in an unannounced BRCGS audit?

A site chooses one of three audit programmes: announced, blended announced with a remote document review followed by an on-site visit, or fully unannounced. Sites on the announced and blended routes must still take a mandatory unannounced audit at least every three years.

The auditor arrives inside an agreed window without notice, and the visit starts with production. There is no opening meeting to warm up on and no time to pull the missing records together. The auditor watches the process running, then works backwards into the documentation. If there is no relevant production on site, the unannounced audit cannot go ahead and has to be rescheduled, which is treated as a protocol matter, not a free pass.

The practical preparation for an unannounced audit is not a checklist, it is a habit. Records completed at the time, not at the end of the shift. Cleaning verified before production, not signed off afterwards. Calibration certificates filed the week they arrive. Allergen changeover cleaning validated once and monitored every time.

What are packaging material manufacturers audited on, and how does it differ from food?

Global Standard Packaging Materials Issue 7 was published on 28 October 2024 and audits against it commenced on 28 April 2025. It sets requirements in seven sections, not nine, and it has nine fundamental requirements, not twelve. The section numbers do not map onto the food standard, which is why a packaging converter who studies the food standard arrives at the audit with the wrong mental index.

The nine fundamental requirements in Packaging Materials Issue 7 are 1.1 senior management commitment and continual improvement, 2 hazard analysis and risk assessment, 3.4 specifications, 3.5 internal audits, 3.10 traceability, 3.13 corrective and preventive action, 4.8 housekeeping and cleaning, 5.4 manufacturing process control, and 6.1 training and competence. Section 2 states its intent in terms a food practitioner will recognise but a packaging engineer has to translate:

A hazard analysis and risk assessment (HARA) shall be implemented and maintained to ensure that all hazards to product safety and legality are identified, and appropriate controls established.Section 2, Global Standard Packaging Materials Issue 7

The word that changes everything is “product”. In the food standard the product is food and the hazard is to the person who eats it. In the packaging standard the product is the packaging material, and the hazard is what that material does to the food it will later contain: a migrating component, a solvent retained from ink, a fragment shed from a slitting blade, a seal that does not hold, a printed date code that is wrong. Issue 7 also aligns HARA more closely with the Codex hazard analysis sequence, which narrows the old gap where packaging sites ran a generic risk register instead of a proper hazard analysis.

Site standards in Issue 7 run from external standards at 4.1 through building fabric, utilities, site security and product defence, layout, equipment, maintenance, housekeeping and cleaning at 4.8, product contamination control at 4.9, waste, and pest management at 4.11. Product and process control covers development, artwork and print, manufacturing process control at 5.4, calibration, inspection and testing, incoming goods, storage and dispatch. Graphic design and artwork control at 5.2 and print control at 5.3 have no equivalent in the food standard at all, and they are where printers lose grades.

Issue 7 also widened the scope to include single-use disposable items such as paper cups and plates made on packaging processes, added an allergen risk assessment requirement with controls and personnel training where allergens are identified, and strengthened the product safety culture requirements in section 1.

What does a BRCGS auditor check on foreign body control?

Product contamination control sits at clause 4.9 in Packaging Materials Issue 7, and BRCGS treats foreign body control seriously enough to publish a separate best practice guideline on it. On the floor, the auditor is testing whether you know where a fragment could come from, whether you have removed the source, and whether you would detect the fragment if the removal failed.

The sources are predictable once you go looking. Blades and knives on slitters, rewinders, guillotines and die cutters, which need a controlled issue and return system with a serial number per blade and an investigation when one comes back chipped. Brittle materials on the production floor, held on a register, inspected on a schedule, with a breakage procedure that quarantines product either side of the event. Wood, which has no place in a converting hall without a stated exclusion or a controlled exception. Loose fixings on machinery, which is why maintenance sign-off includes a tool and parts reconciliation. Dust and trim from slitting, which is an extraction and housekeeping problem before it is a detection problem. Insects around reel storage and warm drying tunnels, which brings pest management at 4.11 into the same conversation.

Detection is the second line, not the first. Where metal detection, X-ray, in-line cameras or web inspection systems are used, the auditor will ask for the specification the system was set to, the evidence that the setting was justified, the frequency and results of the operational checks, the test pieces used, and what happened to the product made since the last successful check when a check failed. A detection system with no failure procedure is a finding, not a control.

The version of this I see most often is a site that tells me confidently that its metal detector is checked every hour, and then cannot produce the record of what happened the one time a check failed. On one audit the operator handed me a clean sheet of ticks going back three months. I asked what the procedure said to do with product made since the last good check, and the answer was that it had never come up. It had come up. The maintenance log showed the head had been swapped mid-shift, and there was no revalidation afterwards and no hold on the product that ran in between. The claim was not dishonest. It had simply never been tested by anybody inside the business.

Packaging integrity is the other half. For a converter, integrity means the finished material performs the barrier and containment function the customer specified: seal strength on films and laminates, coefficient of friction where the material has to run on a filling line, closure torque and dimensional tolerance on rigid formats, delamination resistance, and the absence of pinholes. These are section 5.6 questions, and the auditor will want them tied back to the customer specification held under 3.4, a fundamental requirement in the packaging standard.

Ink, solvent and adhesive control deserves its own paragraph because it is where packaging causes food safety incidents that are found downstream. Retained solvent in a printed laminate becomes a taint in the packed food. Uncured ink components can migrate through a substrate. The controls are supplier declarations of compliance for every ink, varnish, adhesive and resin used on food contact work, verification that the destination market’s food contact legislation is met, curing and drying validated as a process parameter under 5.4, and residual solvent testing where the risk assessment identifies it. Artwork and print control completes the loop: obsolete artwork withdrawn and destroyed, printed reels reconciled, and a check that the barcode, the allergen text and the date code panel you printed are the ones your customer approved.

How do you get BRCGS certified in South Africa?

Start by confirming which standard applies to your site and what your customer has actually specified, because those are two different questions. Then get one competent person inside the standard before you spend money on a gap assessment or a certification body. Certification is a twelve to eighteen month project for most sites starting from a working GMP and HACCP base, and considerably longer without one.

Prerequisite programmes are the thing South African sites underestimate first. A BRCGS audit assumes GMP is already working, and a site with weak GMP collects section 4 findings in volume. Supplier approval under 3.5.1 is the second, which for an importer of ingredients means a documented risk based approval process rather than a certificate on file. If GMP is your weak point, Implementation of Good Manufacturing Practices, R1,950 and the GMP training page are the right starting point, ahead of any BRCGS course.

What are the most common BRCGS non-conformities?

Non-conformities across Issue 9 audits are dominated by site standards rather than by management system clauses. In our own audit practice the recurring section 4 findings cluster around housekeeping and hygiene at 4.11, equipment design and construction at 4.6.2, chemical control at 4.9.1.1, doors at 4.4.8 and walls at 4.4.1.

Clause 4.6.2 requires equipment design and construction to be based on risk, so that the equipment itself does not become a route of product contamination. In practice the auditor reads that clause against your seals, your surfaces and your welds.BRCGS Global Standard Food Safety Issue 9, clause 4.6.2, paraphrased

The management system findings that recur are narrower and more serious: corrective actions that close symptoms without reaching root cause, internal audits that cover the easy clauses and skip section 4, and traceability tests that are described but never run against a real batch with a quantity reconciliation. All three are fundamental clauses. All three are fixable in-house by a competent person with a method, which is the entire argument for the Root Cause Analysis One-Day course, R1,250, covered in more depth in the root cause analysis course guide.

Food fraud and food defence findings are also rising, because both moved from a bolt-on to a documented, reviewed assessment with controls. If your VACCP and TACCP assessments were written once and never reviewed, take Food Fraud (VACCP) and Food Defence (TACCP), R1,450, and read the VACCP and TACCP guide.

Frequently asked questions

ASC Food Safety Training · Leading with Science. Ensuring Food Safety. · Fully online, serving all of South Africa and beyond · info@ascfoodsafety.com · WhatsApp +27 61 483 0381 · SAATCA registered training centre (TC No. 065) · FoodBev SETA accredited provider No. 587/00337/1900 · B-BBEE Level 1 · Registered Lead Auditor (Exemplar Global and IRCA) · Consulting and document toolkits at ascfoodsafety.com