SQF audit checklist for food manufacturers (Edition 9 and the move to Edition 10)

Edition 9 or Edition 10?

SQFI announced on March 2, 2026 that Edition 10 of the code is available. According to SQFI, Edition 10 audits are expected to begin January 2, 2027 and will not start before that date; the date depends on the GFSI benchmarking process and may move later. Until GFSI recognizes Edition 10, Edition 9 is the only GFSI-recognized SQF program.

If your audit happens before the mandatory Edition 10 date, you are audited to Edition 9, and certification bodies do not mix requirements from both editions in one audit. If an Edition 9 audit leads to a surveillance audit scheduled after that date, the surveillance audit is also against Edition 9. SQFI says you do not need to renumber your policies to match Edition 10, though you may need to review them, and that Edition 10 adds a requirement for every site to have a food safety culture assessment plan.

The section numbers in this checklist are from Edition 9. Elements marked "mandatory" cannot be declared "not applicable" or exempt.

2.1 Management commitment

• 2.1.1 (mandatory): food safety policy signed by senior management; food safety culture leadership; organization chart; designated primary SQF practitioner and substitute.
• 2.1.2 (mandatory): management review of the system at least once a year, and a monthly update from the SQF practitioner to management.
• 2.1.3 (mandatory): complaint management, trend analysis and corrective actions.

2.2 Document control and records

• 2.2.1 (mandatory): a documented food safety manual or system.
• 2.2.2 (mandatory): document control; staff use the current version.
• 2.2.3 (mandatory): records that are legible, confirmed by the person who did the activity, accessible, retrievable and stored securely; retention per customer and legal requirements, and at least the product's shelf life.

2.3 Specifications, formulation and suppliers

• 2.3.1: product design and development; validation of formulation, shelf life and labeling.
• 2.3.2: specifications for raw materials, packaging, services and finished product; labels accurate and compliant with the law.
• 2.3.3: agreements with contract manufacturers and third-party warehouses.
• 2.3.4 (mandatory): a risk-based approved supplier program, raw material verification and supplier audits based on risk.

2.4 Food safety system

• 2.4.1 (mandatory): legal compliance; notify SQFI and the certification body in writing within 24 hours of a regulatory warning or event.
• 2.4.2 (mandatory): Module 11 good manufacturing practices applied, or exempted based on a written risk assessment.
• 2.4.3 (mandatory): a food safety plan following the 12 HACCP steps: team, product description and intended use, flow diagram, hazard analysis, CCPs, critical limits, monitoring, deviations, verification and records.
• 2.4.4: sampling, inspection and analysis; laboratories.
• 2.4.5 and 2.4.6: nonconforming product and rework.
• 2.4.7 (mandatory): product release, including label verification.
• 2.4.8: a risk-based environmental monitoring program, with results recorded and trended.

2.5 System verification

• 2.5.1 (mandatory): validation and effectiveness of critical limits and controls.
• 2.5.2 (mandatory): verification schedule and review of monitoring records.
• 2.5.3 (mandatory): corrective and preventive actions with root cause analysis, and their records.
• 2.5.4 (mandatory): internal audits by trained staff, and regular inspections of the plant and equipment.

2.6 to 2.9: traceability, crisis, defense, allergens and training

• 2.6.1 (mandatory): identification of raw materials, work in progress and finished product; controls at product and label changeovers.
• 2.6.2 (mandatory): one-up, one-back traceability, receipt dates of materials and an annual review of the system.
• 2.6.3 (mandatory): a recall procedure tested at least once a year; written notice to SQFI and the certification body within 24 hours of an event that requires public notification.
• 2.6.4: crisis management plan.
• 2.7.1 and 2.7.2 (mandatory): food defense plan, and food fraud vulnerability assessment with its plan.
• 2.8.1 (mandatory): allergen management.
• 2.9 (2.9.2 mandatory): training program and its records.

Module 11: good manufacturing practices

Walk the plant with these Edition 9 Module 11 topics:

• 11.1 Site location and premises: materials, lighting, dust, insect and pest proofing, ventilation, equipment and utensils, and grounds.
• 11.2 Site operation: maintenance and repairs, maintenance staff and contractors, calibration, pest prevention, cleaning and sanitation.
• 11.3 Personnel hygiene: handwashing, clothing and personal effects, visitors and staff amenities.
• 11.4 Personnel processing practices.
• 11.5 Water, ice and air: supply, treatment and quality.
• 11.6 Receipt, storage and transport: chilled and frozen storage, dry storage, hazardous chemicals, loading and unloading.
• 11.7 Separation of functions: high-risk processes, thawing, foreign matter control and detection.
• 11.8 Waste disposal.

How you are scored and how long you have to fix findings

In Edition 9, each clause deducts 0 if compliant, 1 for a minor nonconformance, 5 for a major and 50 for a critical, and the score is 100 minus that total. 96 to 100 is Excellent and 86 to 95 is Good (recertification every 12 months); 70 to 85 is Complies (surveillance audit at 6 months); 0 to 69 fails to comply and no certificate is issued. A critical nonconformance at an initial audit is an automatic failure.

Minor and major nonconformances are closed in the SQFI database within 30 calendar days of the end of the audit, with a documented root cause analysis. The certification body can allow more time in certain cases, such as structural changes, if temporary measures are in place.

The certification body conducts one unannounced audit every three years, within the 60-day recertification window.

What changes in scoring and deadlines with Edition 10

The Edition 10 food manufacturing code published on sqfi.com changes the scoring (A2:19). It keeps the formula of 100 minus total deductions but adds core clauses: 1 point for a minor nonconformance, 2 for a core clause minor, 5 for a major, 7 for a core clause major and 50 for a critical. A score of 80 to 100 is certified with a 12-month audit, and 70 to 79 is certified with a 6-month surveillance audit.

The deadline to close nonconformances goes up to 40 calendar days: corrective actions for minor and major nonconformances must eliminate the root cause, be approved by the auditor and be closed in the SQFI Assessment Database within 40 calendar days of the end of the audit (A2:21). If they are not submitted in time, the site is ineligible for certification. The certification body can grant extensions (for minors, when there is no immediate threat to product safety and temporary controls are in place; for majors, for structural changes, seasonal constraints or long lead-time installations, with interim controls), but the nonconformance must still be marked closed in the database within the 40 days.

The unannounced audit is still once every three years, and the first cycle starts with the site's first recertification audit. A site can instead choose unannounced recertification audits every year, which SQFI recognizes as an "SQFI Select Site" (A2:14).