A dairy packer outside Mooi River booked its first BRCGS audit for March because a British buyer wanted a certificate by the end of the quarter. The site had a manual, a procedure for almost everything and a HACCP study signed off by a consultant. What it did not have was a year of internal audit reports, a supplier approval file with evidence in it, or one traceability test with a mass balance. It took a C, a six-month audit frequency, and lost the listing anyway. BRCGS Issue 9 implementation is a dated project in which the twelve fundamentals are closed by months of accumulated records, and those records, not your procedures, decide your earliest audit date.
In short
- Issue 9 of the Global Standard Food Safety was published on 1 August 2022 and is the current issue. It has nine sections; sections 8 and 9 apply only to sites with production risk zones or traded products.
- A site starting from nothing needs 8 to 12 months. A site transitioning from FSSC 22000, IFS or SQF needs 4 to 6 months.
- The twelve fundamentals set the earliest audit date. Six are closed by a history of records rather than a procedure: internal audits, supplier approval, corrective action, traceability, management review and the culture plan. The internal audit programme alone needs four audit dates across the year (clause 3.4.1).
- Scope, certification body and audit programme are decided before anything is built, because they determine which clauses apply.
- A major against any one fundamental means certification is not granted at that audit, whatever the rest of the arithmetic says.
- Corrective action evidence is due within 28 calendar days, and the certificate follows within 42 calendar days of the certification decision.
What the Standard asks of a manufacturing site, section by section
Sections 1 to 7 apply to every manufacturer. Section 8 applies only where high-risk, high-care or ambient high-care zones exist, section 9 only to products stored but not made on site.
| Section | What the Standard asks of the site |
|---|---|
| 1 Senior management commitment | Signed policy, measurable objectives, a documented culture plan (1.1.2), management review at least annually, monthly escalation meetings and resources. |
| 2 The food safety plan (HACCP) | A Codex study per product and process: trained team, verified flow diagrams, hazard analysis, CCPs with validated limits, monitoring and verification. |
| 3 Food safety and quality management system | Manual, document and record control, internal audits, supplier approval, specifications, corrective action, traceability, complaints and incidents. |
| 4 Site standards | External areas, food defence, layout and product flow, fabric, utilities, equipment, maintenance, staff facilities, contamination and foreign-body control, cleaning, waste, pest, storage, dispatch. |
| 5 Product control | Product development and shelf life, labelling, allergens, authenticity, packaging, inspection and testing, product release. |
| 6 Process control | Process specifications at the line, equipment settings, monitoring, labelling and pack control, quantity control, calibration. |
| 7 Personnel | Training and documented competency, hygiene, medical screening, protective clothing and laundry, with induction before anyone enters production. |
| 8 Production risk zones (if applicable) | Segregation, filtered air, drainage, equipment, facilities, clothing and hygiene rules for high-risk, high-care and ambient high-care areas. |
| 9 Traded products (if applicable) | A food safety plan covering receipt, storage and dispatch, approval of the manufacturer, specifications, testing, legality and traceability. |
Roughly a third of the Standard is physical rather than paper, and most sections cannot be finished in the month they start, because their evidence accumulates. The clause-by-clause build is the substance of the implementation of BRCGS Issue 9 course.
Why the twelve fundamentals set your earliest audit date
A major against any one of the twelve fundamentals means certification is not granted at that audit, however well the site scores elsewhere. The planning point is not their severity but their evidence: half cannot be closed by writing anything. An auditor who sees an internal audit procedure dated three weeks ago and one completed report raises a major, because the programme in clause 3.4.1 has not been implemented.
| Fundamental | Evidence that closes it | Calendar time |
|---|---|---|
| 1.1 Senior management commitment and continual improvement | Objectives reported quarterly, review minutes with closed actions, escalation records, culture plan activities completed. | 9 to 12 months |
| 2 The food safety plan (HACCP) | Verified signed flow diagrams, validated critical limits, CCP monitoring records, documented annual review. | 3 to 4 months, then continuous |
| 3.4 Internal audits | Four audit dates across the year, full scope covered annually, findings with objective evidence, independent auditors, actions closed. | 9 to 12 months |
| 3.5.1 Suppliers of raw materials and packaging | Risk assessment per material or group, approval applied to every current supplier, live list, performance reviews. | 4 to 6 months |
| 3.7 Corrective and preventive actions | A log of real findings from audits, complaints and floor checks, with root cause, owner, date and verified close-out. | 6 months of entries |
| 3.9 Traceability | Forward and backward tests across the range at least annually with a mass balance, achievable within four hours. | 3 to 9 months; test quarterly |
| 4.3 Layout, product flow and segregation | Current site map with product, people, waste, packaging and air flows, zoning and controls at crossing points. | 1 to 6 months |
| 4.11 Housekeeping and hygiene | Cleaning procedures stating chemical, concentration, contact time and owner; signed schedules; validation of critical cleans. | 3 to 6 months |
| 5.3 Management of allergens | Risk assessment covering materials, carryover, rework and storage; segregation or scheduling; validated changeover cleaning. | 3 to 4 months |
| 6.1 Control of operations | Specifications at the line, controlled settings, monitoring at the stated frequency, action on deviation. | 3 to 6 months |
| 6.2 Labelling and pack control | Controlled allocation and reconciliation of packaging and labels, start-up and changeover checks. | 3 to 6 months, all lines |
| 7.1 Training in handling, preparation, processing, packing and storage | Training matrix by role, induction before production work, records naming trainer, content and date. | 2 to 4 months |
Count backwards from the longest row. If your first internal audit is in month two and four are spread across the year, the earliest honest audit month is ten or eleven: three or four audits done, the full scope covered once, actions verified closed, and a management review that has considered the results.
Decisions you make before anything is built: scope, certification body, audit programme
Scope. Write down the products, processes and lines to be certificated and anything excluded, because exclusions are printed on the audit report. If the site stores food it does not manufacture, either bring all of it into scope under section 9 or exclude the category: partial inclusion is not permitted. If any product needs a high-risk, high-care or ambient high-care zone, section 8 applies and the capital budget changes.
Certification body. Approved bodies are listed on the BRCGS Directory, but ask your customers first, because some retailers name acceptable bodies or expect a certain star rating. Auditor days are scarce in South Africa outside Gauteng, KwaZulu-Natal and the Western Cape, so budget travel time and hold a window six months out.
Audit programme. Three exist: announced, unannounced, and blended announced, which splits the audit into a remote assessment of systems and an on-site assessment of the facility. Whichever you choose, every certificated site has one unannounced audit in every three years, and the certification body tells you the year, not the day. Put the three decisions on one signed page. If the team needs the vocabulary first, the introduction to BRCGS for Food Safety Issue 9 course covers the structure, grading and audit process.
The gap assessment that becomes your project plan
A gap assessment that produces a percentage is useless. One that produces a dated task list with an owner per clause is the project plan. Score every applicable clause on four levels.
| Score | What it means | Likely audit outcome | Action |
|---|---|---|---|
| 0 | Nothing exists. | Major. | Assign owner and build month. If it is a fundamental, it sets the audit date. |
| 1 | Documented, not implemented. | Major on a fundamental, minor elsewhere. | Train and implement, then start the record trail. Add three months. |
| 2 | Implemented, no evidence history. | Minor, and several. This is where C grades come from. | Do not rebuild it. Run it and file it. Add two to six months. |
| 3 | Implemented and evidenced over the required period. | Conformity. | Maintain and verify through the internal audit programme. |
Turn the scores into one row per clause: clause, score, what is missing, owner, target month and the evidence to be presented at audit. Sort by fundamentals first, then physical work with a lead time. The fundamentals scoring 0 or 1 give your earliest audit month; the section 4 items scoring 0 give your capital request. Review it monthly, and let scores fall as well as rise.
A twelve month BRCGS Issue 9 implementation plan, month by month
This assumes a single site with a working food safety system and no third-party certification, audited in month twelve. A site transitioning from FSSC 22000, IFS or SQF runs the same sequence in 4 to 6 months by joining at month four and carrying across its existing audit, supplier and review history.
| Month | Build | Evidence that starts running |
|---|---|---|
| 1 | Scope, certification body shortlist, audit programme and team confirmed. Gap assessment. Policy signed, culture plan drafted (1.1.2). | Internal audit schedule published, corrective action log opened, meetings diarised. |
| 2 | HACCP team trained, flow diagrams verified on the floor, document and record control live (3.2, 3.3). | First internal audit. First corrective actions with root cause. |
| 3 | Hazard analysis, CCP determination, validated critical limits. Raw material risk assessments started (3.5.1.1). | CCP monitoring records begin. Supplier questionnaires and certificates chased. |
| 4 | Site map with all flows (4.3.2). Contamination and foreign-body review (4.9, 4.10). Capital list priced. | Glass and brittle plastic register, detector checks, chemical register. |
| 5 | Allergen risk assessment and controls (5.3). Cleaning procedures, schedules and validation plan (4.11). | Signed cleaning schedules, allergen changeover records, first swab or ATP results. |
| 6 | Process specifications, line checks, quantity control (6.1 to 6.3). Calibration schedule and first round (6.4). | Line check sheets on every line and shift. Calibration certificates. Second internal audit. |
| 7 | Specifications (3.6), supplier approval decisions recorded, product release rules (5.7). | Approved supplier list live, first performance review, first timed traceability test. |
| 8 | Training matrix and first full training round (7.1). Hygiene, medical screening and clothing controls (7.2 to 7.4). | Training and induction records naming trainer, content and date. |
| 9 | Food defence and food fraud assessments (4.2, 5.4). Recall procedure tested (3.10). Complaint trending live (3.8). | Recall test report with timings. Complaint trend analysis. Third internal audit. |
| 10 | Capital work completed: segregation, drainage, air handling, fabric, facilities. Section 8 controls signed off where they apply. | Verification records, air pressure and filter records, revised site map. |
| 11 | Fourth internal audit covering remaining scope. Full management review (1.1.4). Two-day internal mock audit. | Review minutes with actions. Verified close-out of every finding. Second traceability test. |
| 12 | Readiness check, audit logistics, document pack staged, senior management and the senior operations manager available. | Certification audit. Corrective action evidence within 28 calendar days. |
One rule matters more than the sequence: nothing in the right-hand column ever stops. A site that runs line checks hard in month six and lets them lapse in month nine leaves a gap an auditor finds by sampling.
What to start in month one, and why those systems first
- The internal audit schedule (3.4.1). Publish twelve months of dates before you have much to audit, starting with document control and records.
- The corrective action log (3.7). One log, every source: audits, complaints, out-of-specification results, floor observations, supplier failures. Sixty verified entries show a working system; four show nobody is looking.
- Raw material risk assessment and supplier approval (3.5.1). The work is not hard, the waiting is. Questionnaires, certificates and specifications take weeks, and smaller local suppliers often need help producing them.
- Traceability testing (3.9). Run one test now, before the system is ready, and time it. It will run long, which tells you which links are missing. Then test quarterly.
- Management review and monthly escalation meetings (1.1.4, 1.1.5). Diarise the year and hold them even when there is little to review. The agenda is set by the Standard, from previous actions and audit results to complaints, incidents, the effectiveness of HACCP and the culture plan.
- The culture plan (1.1.2). Four activities you can genuinely run, the behaviours you expect, and how you will measure them. The plan is reviewed annually, so one written in month eleven reads like one.
What changes if Section 8 or Section 9 applies
Section 8, production risk zones. If handling follows a pathogen control step, you are in high-risk, high-care or ambient high-care territory and sections 1 to 7 still apply in full. The pathogen control step goes on the site map (8.1.1). High-risk areas need physical segregation covering product, materials, equipment, people, chemicals, waste, air and utilities including drains (8.1.2). High-care areas should be segregated, and where barriers are absent you need a documented cross-contamination risk assessment and validated controls, including the low-risk to high-care changeover (8.1.3). Ambient high-care needs its own risk assessment (8.1.4). Add a drainage map (8.2.1), filtered air at a documented change rate under positive pressure (8.2.2), dedicated equipment and clothing, and environmental monitoring that drives action.
The consequence is money and lead time. Air handling units, hygienic doors, finishes, drainage falls and change rooms are quoted, ordered, sometimes imported, and installed on someone else’s schedule. A site that discovers in month eight that it needs a positive-pressure high-care room has an eighteen month project, not a twelve month one.
Section 9, traded products. These are food products within the scope of the Standard stored at the site but not manufactured, processed, reworked, packed or labelled there. If you certificate them, all of them come into scope. You need a food safety plan covering at minimum goods receipt, storage and dispatch (9.1.1), approval of each manufacturer or packer, specifications, testing, legality checks and traceability. Section 9 findings count towards your grade like any other.
Who needs training, and on what
Training is a fundamental (7.1) and the cheapest way to stop minors. The requirement is not that everyone attended an induction. It is that each person is competent for the activity they perform, that induction happens before they enter production, and that competency is reviewed.
- Senior management: the structure of the Standard, grading and non-conformities, the management review agenda, and attendance at the opening and closing meetings.
- Food safety manager, FSMS coordinator and HACCP team: clause-level implementation, Codex principles, hazard analysis, validation and verification, food defence and food fraud.
- Internal auditors: audit methodology, evidence-based findings and independence. An auditor may not audit their own work (3.4.2), which at a small site means training people outside the quality team.
- Supervisors and team leaders: line checks (6.1), labelling and pack control including reconciliation (6.2), allergen changeover (5.3), and signing only for checks they did.
- All food handlers: hygiene and health reporting (7.2, 7.3), protective clothing (7.4), allergen awareness (7.1.4) and foreign-body control.
- Engineering, cleaning and dispatch teams: hygienic maintenance and permits to work, cleaning at chemical and contact-time level, and traceability records at both ends.
Keep the two records auditors ask for and sites rarely have: proof that agency and seasonal staff got the same induction as permanent staff, and the competency review. The implementation course follows the documents above, while the introduction course suits general awareness.
What the first audit actually looks like, hour by hour
Most single-site audits run two to three days, the duration being set by the certification body from site size, employee numbers, product range and the number of HACCP studies.
| When | What happens on site |
|---|---|
| Day 1, 08:00 | Opening meeting. Scope confirmed and programme explained. Senior management and the most senior operations manager on site must attend. |
| Day 1, 08:30 to 12:30 | Production facility inspection. The auditor walks the process in flow order, talking to operators and looking at fabric, hygiene, contamination controls, foreign-body devices, allergen practice and records at the line. Most findings are raised here. |
| Day 1, 13:30 to 17:00 | Document review begins: HACCP, prerequisite programmes, internal audits, corrective actions, supplier approval, training. |
| Day 2, 08:00 to 11:00 | Vertical audit of one batch from intake to dispatch through every record that touched it, with the traceability challenge and mass balance run against that batch. |
| Day 2, 11:00 to 15:00 | Labelling review, allergen verification, calibration, complaints, incident and recall records, staff interviews, and verification of the food safety plan against the floor. |
| Day 2, 15:00 to 16:30 | Review of the facility findings, re-inspection of anything unresolved, and non-conformities drafted with clause references and objective evidence. |
| Final afternoon | Closing meeting. Every non-conformity is read out with its level and clause, the likely grade indicated, and the 28 calendar day corrective action timetable explained. |
Two habits change the outcome. Ask for the objective evidence behind each finding while there is still time to correct a misunderstanding, and write every non-conformity down verbatim, because your corrective action evidence must answer what was written. An unannounced audit differs only in its short opening meeting and immediate start.
Five things to do this week
- Write the scope on one page and have the site director sign it, including exclusions and whether sections 8 and 9 apply.
- Publish twelve months of internal audit dates and run the first audit. Half a day on document control and records starts the longest clock in the project.
- Open the corrective action log and enter the first ten real findings. They already exist. Root cause, action, owner, due date, verification.
- Run a traceability test today and time it. One finished batch back to every raw material and primary packaging component, forward to every delivery, with the mass balance. Record the time and the links that broke.
- Book the certification body conversation and hold an audit window, after asking customers which bodies they accept. The site that books late audits late.
Common questions
How long does BRCGS Issue 9 implementation take?
A site starting from nothing needs 8 to 12 months. A site transitioning from FSSC 22000, IFS or SQF needs 4 to 6 months, because the management system already exists and the work is mapping it to Issue 9 and filling evidence gaps. The limit is not writing speed but the record history the fundamentals require.
What are the twelve fundamental requirements in BRCGS Issue 9?
They are 1.1 senior management commitment and continual improvement, 2 the food safety plan or HACCP, 3.4 internal audits, 3.5.1 management of suppliers of raw materials and packaging, 3.7 corrective and preventive actions, 3.9 traceability, 4.3 layout, product flow and segregation, 4.11 housekeeping and hygiene, 5.3 management of allergens, 6.1 control of operations, 6.2 labelling and pack control, and 7.1 training. A major against any one means certification is not granted at that audit.
Can a site be audited before it has twelve months of records?
Yes, but the grade suffers. The Standard sets no fixed minimum record period for a first audit, so the test is whether the system is demonstrably implemented. In practice a site needs most of a year of internal audit, corrective action, traceability, management review and line-check records before the fundamentals can be evidenced.
Do sections 8 and 9 apply to every site?
No. Section 8 applies only where the site operates high-risk, high-care or ambient high-care zones, typically where handling follows a pathogen control step. Section 9 applies only where the site stores food products it does not manufacture, process, rework, pack or label, and it is all or nothing: include every traded product or record the category as an exclusion.
What should we start in the first month of a BRCGS project?
Start the six systems that run on calendar time: the internal audit schedule, the corrective action log, raw material risk assessment and supplier approval, traceability testing, the management review calendar, and the food safety culture plan. Each needs months of accumulated evidence, so the date you start them sets your earliest audit date.
What happens if we get a major against a fundamental requirement?
Certification is not granted at that audit, regardless of how few other non-conformities were raised. For a first audit that means a full re-audit before certification can be considered, and for a certificated site the certificate is not reissued. This is why the fundamentals drive both the project plan and the audit date.
Next step. If you are building the system, the Implementation of BRCGS Issue 9 for Food Manufacturing course works through all nine sections at the level of documents, records and owners used above. If you are earlier in the journey, start with the Introduction to BRCGS for Food Safety Issue 9 course. Both appear on the ASC courses page.
This article is general guidance written for South African food manufacturers. It is not a substitute for the Standard: a site is audited against the Global Standard Food Safety (Issue 9) together with the position statements in force, and both the site and the auditor need an official copy. Clause numbers are given so you can navigate your own copy.