Your client’s first GFSI audit: a 90-day plan
A 13-week plan for taking a client to their first SQF, BRCGS or FSSC 22000 certification audit, with who does what each week.
Once the client’s system is written, the run-up to a first GFSI audit is mostly time: SQFI recommends at least 90 days of records before the audit, and every scheme’s auditor wants to see the system working, not just written. Use those 13 weeks in three phases: launch the system and train the team, run it while you review records weekly, then test it with an internal audit and a mock audit. The client keeps the records; you verify and coach.
Thirteen weeks, three phases
Our suggested structure. It assumes the gap analysis is done and the system is written. If not, do that first.
| Weeks | Client does | You do |
|---|---|---|
| 1–2: Launch | Names the practitioner and backup, starts every record on the agreed system, books the audit with a certification body | Kick-off with the site team, confirm scope and scheme edition, train supervisors on each record and procedure |
| 3–4: Settle | Keeps records daily, raises corrective actions as issues come up | Weekly remote review of exceptions; fix forms or procedures that don’t work on the floor |
| 5–8: Run | Keeps records, runs a traceability test and a recall test, completes supplier approvals | Weekly review; one site visit; check supplier approval and certificates (a fundamental requirement under BRCGS) |
| 9: Internal audit | Runs or supports an internal audit of the whole system | Coach the internal auditor; review findings and root causes |
| 10: Mock audit | Hosts the mock audit as if it were real | Run a mock audit, independent of the area, with findings graded |
| 11–12: Close gaps | Closes mock audit findings with evidence; management review held and minuted | Verify closures; check the management review and food safety culture evidence |
| 13: Ready | Final record check; team briefed on audit day | Audit-day briefing: who meets the auditor, where records are, how to answer questions |
Confirm the scheme edition before week 1
Two schemes change in 2027. SQF Edition 10 audits are expected from early January 2027, and FSSC 22000 Version 7 applies from 1 May 2027. A client whose first audit falls after those dates should be built to the new edition from the start. Confirm with the certification body when you book. Comparing schemes? See SQF vs BRCGS vs FSSC 22000.
Your role on the day
Let the site answer
The auditor is assessing the client’s system. Staff answering for themselves shows it works; you answering for them suggests it doesn’t.
Be reachable
Attend the opening and closing meetings if agreed, or stay on the phone for questions about why something was designed the way it was.
Write down every finding
At the closing meeting, record each finding, its grade and the deadline. Close-out starts the next day.
Close-out, then keep it running
The client usually has about four weeks to close findings: SQF Edition 9 allows 30 calendar days, and BRCGS generally 28 days to submit evidence. Use the four-week close-out plan, then move the client onto a monthly service so the system doesn’t drift before next year. See turning projects into retainers.
Watch the 90 days build, week by week
With the client’s records in EthicalHub, your weekly review takes minutes: the Consultant Dashboard shows their readiness score, open corrective actions and expiring certificates, and you sign off CAPAs remotely. When the auditor arrives, the audit pack is ready. The dashboard is free for consultants; clients subscribe from $69 a month per site.
Get the free Consultant Dashboard
Invite the client you’re preparing and track their run-in from your desk.
First GFSI audits: common questions
How long does it take to prepare a client for a GFSI audit?
What does a consultant do in the run-up to a GFSI audit?
Should the consultant attend the client’s certification audit?
What happens after the first GFSI audit?
Ninety days. One dashboard.
The Consultant Dashboard is free. Track every client’s run-in from one screen.