Unannounced audits: how to be ready on any day
What BRCGS, SQF, FSSC 22000 and HARPS actually require, what happens in the first 30 minutes, and the weekly habits that make a surprise audit uneventful.
If you hold BRCGS, SQF or FSSC 22000 certification, expect at least one unannounced audit every three years. You won’t be told the date, and refusing entry gets your certificate suspended. You can’t prepare for the day, so prepare for every day: records completed when the work is done, verification signed weekly, and a named person at reception who knows who to call.
What each scheme requires
Current scheme versions as of October 2026. Your certification body confirms the details for your site.
| Scheme | How often | What notice you get | If you refuse entry |
|---|---|---|---|
| BRCGS Food Safety Issue 9 | At least one unannounced audit every three years, in place of a scheduled audit | Told the year, not the date. Up to 10 blackout days, with reasons, at least four weeks ahead | Suspension, a major non-conformity, and a new unannounced audit within four months |
| SQF Edition 9 | One unannounced audit every three years: a re-certification audit | It falls within your 60-day re-certification window (anniversary date ± 30 days) | Certificate suspended |
| FSSC 22000 Version 6 | At least one unannounced surveillance audit in each three-year period. The initial audit is always announced | Blackout dates can be agreed with your certification body | Suspended within three working days; withdrawn if the audit isn’t done within six months |
| HARPS Version 2.0 | Not routine. A retailer can request an unannounced HARPS audit if it has strong justification | None | Ask your certification body; the HARPS rules summary doesn’t spell it out |
Sources: BRCGS unannounced audit protocol (v6, July 2024), SQF Edition 9 and FSSC 22000 V6 certification body service descriptions, HARPS V2.0 scheme rules. SQF Edition 10 audits start on 1 January 2027 and FSSC 22000 Version 7 applies from 1 May 2027, so check for changes then. New to these schemes? See SQF vs BRCGS vs FSSC 22000.
The first hour, minute by minute
Under BRCGS, the auditor should start the production inspection within 30 minutes of arriving. Plan for that.
Reception
Whoever is at the front desk checks ID, signs the auditor in and calls the QA lead, or the named deputy if they’re away. Nobody asks the auditor to come back later.
Opening meeting
Short and in a ready room. Confirm the scope, the production running today, and who the auditor can talk to. Have PPE and the visitor rules ready.
Onto the floor
The auditor walks production as it runs. Supervisors carry on as normal; staff answer for their own tasks. Don’t stage anything.
Records requested
Expect today’s CCP records, the cleaning schedule and recent corrective actions. Anyone who fetches records should be able to find them in minutes, not hunt through folders.
Six habits that keep you ready any day
Record as you go
CCP checks, temperatures and cleaning are recorded when they’re done, not filled in at the end of the shift. Gaps and identical handwriting are what auditors notice first.
Verify weekly
A supervisor reviews and signs off the week’s records every week. An auditor arriving mid-month should find verification up to date.
Keep corrective actions moving
Every open action has an owner and a due date, and nothing is overdue. How to close findings on time.
Watch expiry dates
Supplier certificates, calibration, staff training and pest control reports. Check what expires in the next 60 days, every month.
Name a deputy for everything
If one person holds the records, the audit stalls when they’re on leave. Every key role needs a trained back-up.
Use your blackout days well
Under BRCGS you get up to 10, with reasons. Use them for genuine shutdowns or major works, not for the QA lead’s leave; one person’s absence isn’t an accepted reason.
The ten-minute check
Pick a random day this week and try to find these in ten minutes, with your QA lead out of the room:
- Today’s CCP monitoring records, complete and signed.
- Last week’s verification sign-off.
- The current certificate for your three highest-risk suppliers.
- Every corrective action opened in the last month, and its status.
- The training record for whoever is running the line right now.
Anything you can’t find is what an unannounced auditor finds first. The full list is in the 10 records auditors ask for first.
Ready on a Tuesday, not just in audit week
EthicalHub records CCP checks on the floor as they happen, reminds supervisors when verification is due, flags certificates before they expire, and keeps every corrective action tied to its evidence. When the auditor arrives, the audit pack is already up to date.
Would you pass if the auditor came tomorrow?
Answer 11 questions and get a readiness score with your biggest gaps.
Related guides
Unannounced audits: common questions
How often are unannounced food safety audits?
Do I get any warning before an unannounced audit?
What happens if we refuse entry to an unannounced auditor?
Is an unannounced audit harder than an announced one?
Audit-ready. Every day.
See how EthicalHub keeps your records current between audits.