BRCGS Food Safety Issue 9: Section Guide and Common Nonconformances

If you are preparing for a BRCGS audit, the standard itself is easy to read and surprisingly hard to satisfy. Most nonconformances are not exotic. They come from a clause that a site believes it meets because a procedure exists, while the records, the floor practice, or the verification behind it tell a different story.

This guide walks through the nine sections of BRCGS Standard for Food Safety Issue 9, says what auditors are looking for in each, and lists the findings that come up again and again. This is an overview, not a substitute for the standard: it paraphrases requirements and refers to clause numbers only where they are well established. Always check your licensed copy of the standard and the BRCGS interpretation guideline before you write procedures or respond to a finding.

What Is BRCGS Food Safety Issue 9?

BRCGS published Issue 9 of the Global Standard Food Safety in August 2022, and audits against it began on 1 February 2023 (dates as announced by BRCGS on its website at brcgs.com and stated in the introduction to the standard). It is a GFSI-benchmarked standard, so a certificate can be accepted by retailers and manufacturers that require GFSI recognition. If you are comparing schemes, see our breakdown of BRC vs SQF vs HACCP before you commit.

The standard is organized into nine sections:

Section	Title	What it covers
1	Senior management commitment	Policy, culture, structure, management review
2	The food safety plan (HACCP)	Codex-based hazard analysis and control
3	Food safety and quality management system	Documents, audits, suppliers, traceability, incidents
4	Site standards	Buildings, equipment, hygiene, pests, storage
5	Product control	Design, allergens, authenticity, testing, release
6	Process control	Operations, labelling, weights, calibration
7	Personnel	Training, hygiene, medical screening, clothing
8	Production risk zones	High-risk, high-care and ambient high-care areas
9	Traded products	Products bought and sold without site manufacture

A site is graded by the number and severity of nonconformities (critical, major, minor), and certain clauses are designated as fundamental, which means a nonconformity against them has heavier consequences. The fundamental clauses are 1.1.1 (senior management commitment), 3.4 (internal audits), 3.5.1 (approval and monitoring of suppliers), 3.7 (corrective and preventive actions), 3.9 (traceability), 5.3 (allergen management), 6.1 (control of operations) and 7.1 (training). Read the grading and fundamental clause rules in Part III of the standard, because they decide your certificate duration and audit frequency.

Section 1: Senior Management Commitment

Clause 1.1 (with 1.1.1 as the fundamental requirement) asks for a documented food safety and quality policy, measurable objectives, and a food safety and quality culture plan. Since Issue 8 the culture requirement has been a documented plan with defined activities, timeframes and a way of measuring whether the plan works. Issue 9 kept that expectation and auditors now test it harder.

Clause 1.1 also covers management review, which must happen at least annually and look at things like audit results, complaints, incidents, supplier performance and resource needs. Clause 1.2 covers organizational structure, responsibilities, and deputies when key people are away.

Common nonconformances

A culture plan that lists posters and newsletters but has no measurement. Auditors ask how you know the activities changed behaviour.
Management review minutes that read like a calendar entry, with no inputs reviewed and no decisions or actions recorded.
Objectives that are not measurable, or that nobody has tracked since they were written.
No documented deputy arrangement for the HACCP team leader or the person responsible for traceability.
Senior management who cannot explain the food safety policy when the auditor asks them. Because clause 1.1.1 is fundamental, this gap can put it at risk.

Section 2: The Food Safety Plan (HACCP)

Section 2 sets out the HACCP requirements. It requires a trained, multidisciplinary HACCP team, documented prerequisite programmes (the basic hygiene and operating controls that sit beneath the plan), product descriptions and intended use, process flow diagrams verified on site, hazard analysis, critical control points (CCPs, the steps where a hazard must be controlled) identified through a defined method, validated critical limits, monitoring, corrective action and verification. It follows the Codex Alimentarius HACCP principles, and the standard expects the plan to be reviewed at least annually and whenever there is a change in product, process or ingredient.

Common nonconformances

Flow diagrams that do not match what the line actually does, including rework loops, hold points and shared equipment.
Hazard analyses that screen out allergens, foreign bodies or chemical hazards without a written rationale.
Critical limits with no validation evidence. "We have always used this temperature" is not validation.
Monitoring records signed off by someone who was not on shift, or filled in at the end of the day.
HACCP not reviewed after a new product, supplier or equipment change.
Prerequisite programs that exist as paper but are not linked to the hazard analysis.

If your plan is the weak spot, our HACCP consulting page covers how a rebuild typically goes.

Section 3: Food Safety and Quality Management System

This is the largest source of findings in most audits, because it is the part that depends on discipline rather than infrastructure.

3.1 to 3.3: Manual, document control, records

Documents must be controlled, current, legible and available where they are used. Records must be completed in ink or an equivalent, corrections must be authorized and the original entry still legible, and retention must cover shelf life plus a stated period.

Typical findings: obsolete forms still in use on the floor, records with blank fields, uncorrected pen overwrites, and retention periods that nobody has defined.

3.4 Internal audits (fundamental)

The site needs a scheduled program of internal audits covering the whole standard across the year, with frequency set by risk. Auditors must be competent and independent of the area they audit. Separate from that, the standard expects documented inspections (for example hygiene and fabrication) at a defined frequency.

Typical findings: an audit schedule that covers the site but not every clause, audits performed by the person who owns the area, findings closed without root cause, and a program that has slipped behind its own dates.

3.5 Supplier and raw material approval

Clause 3.5.1 is where many sites stumble. You need a documented, risk-based approval process for suppliers of raw materials and packaging, with ongoing performance monitoring. That includes a documented raw material risk assessment covering allergens, foreign bodies, microbiological risk, chemical contamination, and fraud or substitution. Where a supplier is not certified to a GFSI-recognized scheme, you need other evidence such as your own audit or a questionnaire backed by verification.

Typical findings: an approved supplier list with no approval evidence behind it, raw material risk assessments that were never updated, supplier certificates that expired, and no process for approving a change of supplier in an emergency.

3.6 Specifications

Specifications for raw materials, packaging, finished products and services that affect product safety must be documented, agreed, and reviewed. Findings are usually missing signatures, specifications that predate a formulation change, or no review at the stated interval.

3.7 Corrective and preventive actions (fundamental)

Findings need root cause analysis, a correction, a corrective action and a check that it worked. This clause is fundamental, so sloppy closure can escalate.

Typical findings: "retrained operator" as the root cause for everything, no date or owner on actions, and repeat issues with no evidence that the previous action was checked for effectiveness.

3.8 Control of nonconforming product

Nonconforming product must be identified, segregated or controlled, and released only by authorized people. Findings include held product with no tag, rework with no traceability link to the original batch, and no record of who made the disposition decision.

3.9 Traceability (fundamental)

You must be able to trace raw materials, packaging and processing aids from supplier to finished product and on to the customer, including rework. The system must be tested at least annually, and the test should include a mass balance (a reconciliation of the quantity of raw material received against finished product and waste) and be completed within four hours. Auditors will also run their own trace during the audit.

Typical findings: traceability that works for the main product but not for rework, packaging lots not recorded, mass balance outside the tolerance with no explanation, and a trace test that was done once for a single product.

3.10 Complaint handling

Complaints need to be recorded, investigated and trended, with action taken on significant ones. Findings include complaints closed as "isolated" without investigation and no trend analysis.

3.11 Management of incidents, withdrawal and recall

You need a documented procedure for incidents, withdrawal and recall, with a current contact list and a way to test it. The recall procedure should be tested at least annually. Findings: contact lists with departed employees, recall tests that only cover the paperwork, and no decision criteria for when to withdraw versus recall.

Section 4: Site Standards

Section 4 is the walk-around section. The auditor will spend a large share of audit time on the floor, and findings here are the easiest to see.

Clause	Topic	Frequent findings
4.1	External areas	Standing water, vegetation near walls, uncontrolled waste storage
4.2	Security	No visitor controls, unlocked access points
4.3	Layout, flow, segregation	Cross-flow between raw and finished product, poorly defined zones
4.4	Building fabric	Damaged floors, flaking paint, gaps under doors, open roof voids
4.5	Utilities	Compressed air or water not risk assessed or tested
4.6 to 4.7	Equipment, maintenance	Poor hygienic design, temporary repairs left in place, no post-maintenance clean and release
4.8	Staff facilities	Handwash stations without a hands-free tap, food in changing rooms
4.9	Chemical and physical contamination	Glass and brittle plastic registers out of date, knife control lapses
4.10	Foreign-body detection	Metal detector challenge tests not covering ferrous, non-ferrous and stainless
4.11	Housekeeping and hygiene	Cleaning without verification, weak environmental monitoring
4.12 to 4.13	Waste, surplus food	Waste build-up, no control of products sent for animal feed
4.14	Pest control	No trend analysis, bait stations not mapped, proofing gaps
4.15 to 4.16	Storage, dispatch	Temperature excursions in storage, unclean trailers, no loading checks

Three points deserve more detail.

Foreign-body detection (4.10). The site must have a documented assessment of where detection or removal equipment is needed, then challenge-test it at a defined frequency with test pieces that represent the realistic contaminants. A frequent finding is a test that only uses one material type, or a rejection system whose failure mode was never tested, such as a belt stop with no lock-out so an operator can restart it.

Environmental monitoring (4.11). The standard expects an environmental monitoring programme based on risk, with defined sample sites, frequencies, targets and actions on results. Sites that treat this as swabbing without a map or a trend chart get written up. A swab result you did not act on is worse than no swab, because it shows you knew.

Pest control (4.14). The standard expects a documented program, a competent provider or trained staff, bait station mapping, and trend analysis of activity. Findings come from missing trend data and from proofing issues the pest contractor reported months ago and nobody fixed.

Section 5: Product Control

Section 5 covers product design and development, labelling, allergens, authenticity and claims, packaging, product testing and release.

Allergen management (5.3) carries the highest consequence, since an allergen failure can lead to a recall. The site needs an allergen risk assessment, documented segregation of allergenic raw materials, cleaning validated to remove allergens, controlled rework and validated label checks. Typical findings:

Allergen cleaning validated once, years ago, with no verification swabs or rapid tests since.
Rework containing allergens fed back into products that do not declare them.
No allergen changeover documentation between runs.
Precautionary "may contain" labelling used without a risk assessment behind it.

Product authenticity, claims and chain of custody (5.4) requires a documented vulnerability assessment for fraud and a plan to mitigate it. Findings: a vulnerability assessment that is a copy of a template with no ingredient-level detail, and "origin" or "organic" claims with no evidence trail.

Product labelling (5.2) and product inspection and testing (5.6) are checked against legal requirements and shelf-life validation. Findings include shelf-life claims with no supporting data and test methods that are not accredited or verified.

Product release (5.7) needs a defined release procedure for any site that holds product pending test results. Findings include products shipped before results were reviewed.

Section 6: Process Control

Clause 6.1 (control of operations) is fundamental. The requirement is that operations affecting safety, legality and quality are controlled through documented procedures or instructions, and in practice auditors check whether the line actually runs according to them. They also check start-up and changeover, line clearance (the check that a line is free of the previous product, packaging and labels before a new run), and the checks that prevent a wrong label or wrong pack.

Clause 6.2 covers labelling and pack control, 6.3 covers quantity checks, and 6.4 covers calibration of measuring devices critical to safety and legality.

Common nonconformances

Line clearance records signed without evidence the line was checked.
Packaging from a previous run found on the line during the audit.
Thermometers, scales or pH meters that are in use but not on the calibration register, or are calibrated against a reference that is itself out of date.
No defined action when a device is found out of calibration, including what happens to the product measured with it.

Section 7: Personnel

Clause 7.1 covers training and is fundamental. Everyone who affects product safety needs training that matches their role, including temporary staff and agency workers, and competence has to be assessed rather than assumed. Clause 7.2 covers personal hygiene (hand washing, jewellery, nails, hair, illness reporting), 7.3 covers medical screening and 7.4 covers protective clothing.

Common nonconformances

Training matrices with signatures but no competency assessment, especially for CCP monitors.
Agency staff who started on the line before induction.
Staff able to walk from a toilet or canteen area into production wearing the same protective clothing.
Laundering arrangements that are not verified, so the site cannot show clothing is clean.
Visitors and contractors who are not told the illness reporting rules.

Section 8: High-Risk, High-Care and Ambient High-Care Zones

If your site has a production risk zone (high-risk, high-care or ambient high-care, meaning areas where ready-to-eat product is handled under increasing levels of control, ambient high-care being for shelf-stable product), Section 8 adds stricter requirements on physical separation, personnel entry, equipment, and air and surface controls. It covers layout, building fabric, equipment, staff facilities, housekeeping, waste and protective clothing in those zones.

The clause numbers for this section are set out in the standard, so check them in your licensed copy.

Common nonconformances

A changing room that does not enforce a clear barrier between low-risk and high-care.
Shared equipment that crosses zones without a validated clean.
Drainage or air flow that moves from the low-risk side towards the high-care side.
Protective clothing that is not distinct by zone, or staff who can move between zones without changing it.
Hand-wash and footwear controls at zone entry points that are not monitored or verified.

If you are unsure whether a zone qualifies, the definitions in the standard should drive the decision, and a gap assessment is cheap compared with a major nonconformity.

Section 9: Traded Products

Section 9 applies when a site buys and sells products without manufacturing them. It requires approval of the traded product supplier, specifications, traceability and labelling checks, and inspection arrangements. The clause numbers for this section are set out in the standard, so check them in your licensed copy.

Common nonconformances

Missing supplier approval evidence for traded product suppliers.
No way to trace traded product at the same standard as manufactured product.
Specifications that are missing, unsigned or out of date.
Labelling checks on incoming traded product that are not recorded.
No defined inspection or testing arrangement for traded product, or no record of the results.

How the Audit Is Graded and What Follows It

Nonconformities are raised as critical, major or minor. A critical nonconformity means no certificate is issued or an existing one is suspended. A major nonconformity prevents certification until it is addressed and accepted by the certification body. Minors are accepted subject to evidence and affect the audit grade. The definitions and exact handling are set out in Part III of the standard. Under the BRCGS certification process, corrective action evidence for nonconformities is due within 28 days of the audit date, so confirm current deadlines in Part III of the standard and with your certification body.

Issue 9 also includes the option of an unannounced audit program. Sites that choose unannounced audits earn a "+" on the grade; check Part III for any effect on audit frequency. If you take that route, your daily systems have to hold up without a preparation window.

A Practical Readiness Checklist

Use this as a starting point before a gap assessment or certification audit.

Read the culture plan aloud to a line operator and see if they recognize any of it.
Pull the last management review and confirm the inputs and actions are recorded.
Check every HACCP flow diagram against the line, standing at the line.
Run a mock trace on a product with rework, and time it.
Test your recall procedure with a real contact list, not a form.
Sample ten records at random and look for blank fields and unauthorized corrections.
Pick one raw material and follow its approval file from request to current performance review.
Check that your metal detector or X-ray test covers every material type in your risk assessment.
Walk the environmental monitoring map with the latest trend data.
Ask three new starters when they were trained, who signed them off and how competence was checked.
Verify the last allergen cleaning validation date.
Check calibration certificates for every device on the CCP list.

Where Sites Usually Need Help

The findings above cluster in the same places: culture measurement, supplier risk assessment, traceability tests, allergen validation and corrective action quality. Those five areas are worth a second look, because they require someone to ask the follow-up questions that internal staff can overlook. If you want a second pair of eyes before the certification body arrives, our BRCGS consultant page explains how we approach a gap assessment and audit preparation.

Last updated: 2026-11-09. Check the BRCGS website for any amendments or interpretation updates issued since Issue 9 was released.

Frequently Asked Questions

When did BRCGS Food Safety Issue 9 take effect?

Issue 9 was published in August 2022, and certification audits against it began on 1 February 2023.

How many sections are in BRCGS Food Safety Issue 9?

The requirements are in nine sections: senior management commitment, the food safety plan (HACCP), the food safety and quality management system, site standards, product control, process control, personnel, production risk zones, and traded products.

What are the most common BRCGS nonconformances?

They cluster in internal audits and corrective actions (clauses 3.4 and 3.7), supplier approval (3.5), traceability and recall testing (3.9 and 3.11), allergen validation (5.3), housekeeping and environmental monitoring (4.11), and training competence (7.1).

What is a fundamental clause in BRCGS?

Fundamental clauses are requirements the standard treats as the backbone of the food safety system, such as senior management commitment, HACCP, internal audits, corrective actions and traceability. Nonconformities against them carry heavier grading consequences, so check Part III of the standard for the current rules.

How long do I have to respond to BRCGS audit nonconformities?

Sites are generally expected to submit corrective action evidence within 28 days of the audit. Confirm the current deadline in the standard and with your certification body.