Your first supermarket audit: what to expect, week by week
A plain-English run-up to your first Coles, Woolworths or Aldi supplier audit: what the audit actually is, a 12-week plan, what happens on the day, and how findings are handled afterwards.
By Jamid Dewani, Founder, EthicalHub · 7 min read
Your first supermarket audit is usually a certification audit against a GFSI-recognised scheme such as SQF, BRCGS or FSSC 22000, often with the retailer’s own requirements checked at the same time. Plan for about 12 weeks if your HACCP system already runs day to day. Most of that time goes into finding gaps in your records and closing them. On the day, the auditor checks your documents, walks the floor, runs a traceability test and talks to your staff.
What a “supermarket audit” actually is
Most people expect the supermarket to send its own auditor. In practice, your first audit is usually run by an independent certification body that you choose and pay. It has two layers:
The scheme audit
A full audit of your food safety system against a GFSI-recognised standard. SQF, BRCGS and FSSC 22000 all sit at the same level. Pick the one your buyer accepts and that fits how your site runs.
The retailer layer
Each retailer adds its own requirements on top. Coles checks its supplier requirements, Woolworths runs its Supplier Excellence program, and fresh produce suppliers add HARPS.
Retailer requirements change, so get the current version from your buyer before you start. Our guides cover each one: Coles, Woolworths and Aldi.
Your 12-week run-up
This assumes your HACCP plan and prerequisite programs already run every day. Starting a GFSI system from scratch usually takes much longer.
Get the right documents
Ask your buyer which scheme and retailer requirements apply, and get the current versions. Choose a certification body and book a date. Buy the standard itself; you’ll be audited against its exact wording.
Run a gap check
Go through the standard clause by clause and note what you can’t prove with a record today. Our free 59-point checklist covers the areas auditors test most.
Close the gaps
Fix the critical items first: HACCP review, CCP validation, supplier certificates, allergen controls, traceability. Give each gap an owner and a date. This is where most of the 12 weeks goes.
Run a mock recall
Pick a finished batch and trace it back to raw material lots and forward to every customer. Time it and do a mass balance. Auditors often run the same exercise on the day.
Internal audit and management review
Audit your own system against the standard, record what you find and close it. Hold a management review with minutes. Both are requirements in their own right, not just practice runs.
Train and brief staff
Make sure everyone who monitors a CCP can explain what they check, the limit, and what they do when it fails. Refresh hygiene and allergen training and record it.
Final walk and retrieval test
Walk the site as an auditor would. Re-check calibration and certificate expiry dates. Then ask a colleague to name ten random records and time how long it takes to find each one.
What happens during the audit
The order varies by auditor and scheme, and so does the length: it depends on your site size and the scope of the audit. These are the parts you can expect.
| Part | What the auditor does | What to have ready |
|---|---|---|
| Opening meeting | Confirms the scope, the plan for the day and who they’ll talk to. | Your key people in the room, and a desk with access to every record. |
| Document review | Reads your HACCP plan, prerequisite programs, procedures and policies, then samples the records behind them. | Current versions only. Records findable by date, product or batch. |
| Site walk | Checks that what’s written matches the floor: hygiene, pest control, allergen segregation, maintenance, storage. | A clean, normal production day. Don’t stage it; auditors can tell. |
| Traceability test | Picks a product and asks you to trace it back to raw materials and forward to customers, against the clock. | Batch records that link goods-in, production and dispatch. |
| Staff interviews | Asks operators what they check, why, and what they do when something goes wrong. | Staff who can explain their own CCPs in their own words. |
| Closing meeting | Presents the findings and how serious each one is. You confirm you understand them. | Someone taking notes, with the close-out deadlines written down. |
Findings, scores and deadlines
Almost every first audit raises some non-conformances. What matters is how serious they are and how quickly you close them with evidence. Each scheme handles this differently:
| Scheme | How the result is reported | Closing findings |
|---|---|---|
| SQF (Edition 9) | A score out of 100: E (96–100), G (86–95), C (70–85). Below 70 fails and no certificate is issued. | Minor and major findings closed within 30 calendar days. A critical finding at an initial audit fails the audit. |
| BRCGS (Issue 9) | A grade from AA down to D, based on the number and seriousness of findings. A “+” marks an unannounced audit. | Documented corrective action, with evidence, generally within 28 calendar days. |
| FSSC 22000 | Certified or not, with findings graded by severity. | Deadlines are set by the scheme rules and your certification body. Confirm them at the closing meeting. |
Once you’re certified, plan for unannounced audits. SQF requires one unannounced audit in every three-year cycle. BRCGS sites must have at least one unannounced audit in every three.
Sources: SQF Food Safety Code: Food Manufacturing, Edition 9 (sections 9.2, 9.4, 11.4); GoAudits summary of BRCGS Issue 9. Your certification body’s rules take precedence.
Six mistakes that cost first-timers points
- Records that exist but can’t be found. An auditor who waits ten minutes for one record starts sampling harder.
- Flow diagrams that don’t match the floor. If the line changed and the HACCP plan didn’t, expect a finding.
- Expired supplier certificates. One lapsed certificate on file is one of the easiest findings to avoid.
- Backfilled logs. Identical handwriting and pen across a month of checks is a red flag.
- Corrective actions with no root cause. “Retrained staff” on its own rarely closes a finding.
- Using the old version of the standard or retailer requirements. Check versions before you start, not the week before.
The hard part is proving it on the day
On audit day, the food safety system is rarely the hardest part. Showing the evidence quickly is. EthicalHub keeps your HACCP plan, CCP monitoring, all 18 prerequisite programs, supplier certificates and corrective actions in one place, linked to each other. When the auditor asks for a record, you export it in about a minute, organised by requirement.
Free: 59-point Retailer Audit Readiness Checklist
Every check, the evidence to have ready, and an 8-week countdown. PDF and Excel.
Related guides
First supermarket audit: common questions
Who carries out a supermarket supplier audit?
How long does it take to prepare for a first supermarket audit?
What do auditors look at first?
What happens if I get a non-conformance?
Will my first audit be unannounced?
Walk into your first audit ready.
Check where you stand in three minutes, or see how EthicalHub keeps every record ready to show.