SQF Certification Requirements and Audit Process (Ed. 9)

What is SQF certification, and what does Edition 9 change?

SQF certification is a food safety and quality certification scheme owned by the Safe Quality Food Institute (SQFI) and benchmarked by the Global Food Safety Initiative (GFSI). A site that passes an audit against the SQF Code by a licensed certification body earns a certificate it can show to retailers and food service buyers who require a GFSI-recognized scheme.

Edition 9 is the version of the Code that replaced Edition 8.1, with audits against it starting in 2021. Two parts of it matter most to the people I work with. The first is a more explicit expectation around food safety culture. The second is a tighter set of rules around how and when audits happen, including unannounced audits. The Code is organized by food sector category, so a manufacturer, a packaging supplier, and a storage and distribution site each work from a different Code document, though all of them share the system elements in Module 2.

This guide describes the Edition 9 structure as of the date below. SQFI publishes edition and effective dates on its website, and your certification body schedules you against the edition in force on your audit date.

If you are choosing between schemes, our comparison of BRC, SQF, and HACCP lays out how they differ.

How is the SQF Code organized?

Every SQF Code has the same skeleton. Module 2 (System Elements) is the management system, and it is the same for every sector. The second half is a sector-specific GMP module. For food manufacturing, that is Module 11, Good Manufacturing Practices for Food Manufacturing.

One thing I tell every client early: the auditor reads Module 2 and the sector module together. A beautifully written HACCP plan will not rescue a site where the floor does not match what the plan says.

What are the core SQF certification requirements?

The Code tells you what to do. It does not hand you a template. Here are the requirements I see sites trip over most, grouped the way an auditor will move through them.

Management commitment and food safety culture (clause 2.1)

Clause 2.1 asks senior management to set a food safety policy, define responsibilities, provide resources, and review the system. Edition 9 expects a documented approach to food safety culture, which means objectives, activities, and some way of measuring whether the culture is moving. A poster on the wall does not meet that. A plan with owners, dates, and an indicator you actually track does.

The Code also requires a designated SQF practitioner for the site, with a defined deputy, and that person must hold the qualifications the Code lists, including HACCP training and an understanding of the Code itself. A site without a practitioner on shift or a trained backup has an obvious audit finding waiting.

Document control and records (clause 2.2)

Clause 2.2 requires controlled documents and retained records. In my experience the finding here is rarely about missing records. It is about records that cannot be retrieved quickly, or procedures that three people on the floor describe three different ways. During an audit, the auditor will ask for a sample of records from the past year and expect them within minutes.

Specifications, suppliers, and approved materials (clause 2.3)

Clause 2.3 covers specifications for raw materials, packaging, finished product, and services that affect food safety, along with supplier approval and ongoing monitoring. Sites commonly write specifications once and never revisit them. The Code expects you to keep them current and to have an approval and monitoring process for suppliers that matches the risk of what they supply.

The food safety plan and food safety fundamentals (clause 2.4)

This is the HACCP core. The Code requires a food safety plan built on Codex HACCP principles, with a hazard analysis, critical control points, critical limits, monitoring, corrective actions, and verification. If you are also covered by the FDA's Preventive Controls for Human Food rule, your plan will need to satisfy 21 CFR 117.126 (the food safety plan) as well. SQF and the regulation overlap heavily, but they are not identical, and I would not assume a plan written for one fully satisfies the other without reading both.

Clause 2.4 also includes food safety fundamentals such as environmental monitoring where it is warranted and the regulatory compliance obligations for your products and markets. Allergen management is its own clause (2.8). For help building the plan itself, see our HACCP certification resources.

Verification and validation (clause 2.5)

This clause is where audits are won and lost. Clause 2.5 separates validation (proof that a control works at the limit you set) from verification (ongoing checks that you are following the plan). It also covers sampling and testing, internal audits and inspections, and corrective and preventive action. The Code expects the food safety plan to be validated and the effectiveness of the system to be reviewed at least annually, and also whenever a change could affect food safety.

The most common finding I see is a CCP with a critical limit copied from a supplier or a textbook and no documented evidence that it works for the actual product and process.

Traceability, withdrawal, and recall (clause 2.6)

Clause 2.6 requires product identification and a traceability system that works one step back and one step forward, plus a tested recall and withdrawal procedure. The Code expects the recall system to be tested at least annually. If you are in the US, the FDA's recall plan requirement at 21 CFR 117.139 sits alongside this. Run the mock recall with a real timer. The Code requires the test but sets no time target; my own practice is to expect full reconciliation of a lot within a few hours, and an auditor who sees a gap will write it up.

Site security, food defense, and food fraud (clause 2.7)

The Code requires site security and a food defense plan, and it requires a food fraud vulnerability assessment with a mitigation plan. Many sites already have a FSMA food defense plan and simply need to align the paperwork.

Training (clause 2.9)

Training covers the people who handle product and the people who make food safety decisions. The auditor will look for a training program with a competency check, and for the HACCP training the practitioner holds. Sign-in sheets alone are weak evidence that anybody learned anything.

What does Module 11 require on the production floor?

Module 11 is the module most operations teams feel directly. It translates the system elements into physical conditions. The main areas are:

• Site and premises: location, layout, construction, and product flow that prevent cross-contamination.
• Equipment and maintenance: hygienic design, preventive maintenance, calibration, and controls on maintenance work in production areas.
• Personnel hygiene and welfare: handwashing, clothing, jewelry and personal items, medical screening, and break area rules.
• Sanitation and cleaning: documented procedures, chemical control, verification of cleaning effectiveness.
• Pest prevention: a program appropriate to the site, with trend analysis.
• Water, ice, air, and utilities: potability testing and compressed air controls.
• Receiving, storage, and transport: temperature control, segregation, and condition of delivery vehicles.
• Allergen handling and segregation: physical and procedural controls that keep allergens out of products that do not declare them.

I think the best preparation for Module 11 is a floor walk with fresh eyes. Walk it as if you were the auditor, with a notebook, at a shift change. You will find things you stopped seeing months ago.

What is the SQF audit process, step by step?

The path from decision to certificate is the same for most sites. The details below follow the Code's structure, but your certification body will set specific dates and fees.

1. Register the site with SQFI. You register through the SQF assessment database, choose your sector category, and select a licensed certification body.
2. Appoint your SQF practitioner. This should happen before anything else, because that person will drive the implementation.
3. Do a gap assessment. Compare your current system against Module 2 and the sector module. A pre-assessment audit by the certification body is optional, and some sites use it as a dress rehearsal.
4. Implement and run the system. The system needs to have operated long enough to produce records. The auditor will want to see evidence of implementation, not only documentation, including completed internal audits and a management review.
5. Complete the certification audit. Auditors review documents and records, walk the site, interview staff, and test traceability. The Code splits this into a documentation review and an on-site implementation review, and the scoring covers the whole.
6. Respond to nonconformances. The site submits root cause and corrective action for each nonconformance within the time limit set by the Code and your certification body (14 calendar days from the last day of the audit under the SQF Code's Edition 9 audit rules).
7. Receive the certification decision. The certification body reviews the audit and issues, or declines to issue, the certificate.
8. Maintain it. You recertify with an annual recertification audit. Your certification body may also schedule a surveillance audit depending on risk and audit performance. At least one recertification audit in every three-year cycle must be unannounced. You must also notify your certification body of significant changes.

How do SQF audit ratings and nonconformances work?

SQF audits are scored, and the result is a rating. Each audit produces a rating, and the score bands and point deductions for each finding type are set out in the Code and SQFI's audit guidance, so I don't reproduce them here. A critical nonconformance is a failure of a food safety control that creates a real risk, and it can produce an immediate fail.

I would coach every team the same way here. Do not argue the finding in the closing meeting. Ask the auditor what evidence would close it, write it down, and use the corrective action window to do the root cause properly.

Are SQF audits announced?

Mostly, yes, but not always. Under the Code, a certified site must undergo an unannounced recertification audit at least once every three years. The certification body picks the window, and you will not know the date. It means your system has to be audit-ready all year, which is the point of a food safety management system in the first place. Treat it as a feature. A site that is genuinely running its system loses nothing when the auditor shows up early.

How long does SQF certification take, and what does it cost?

The honest answer is that it depends on where you start. A site with a mature HACCP program, good records, and an engaged team can close a gap assessment in a few months. A site starting from verbal procedures and handwritten logs should plan on longer, because the system has to run and generate records before an auditor can verify it. The biggest timeline driver is the starting state of your records and validation. Next is how quickly you can staff and train the practitioner role, then the number of corrective actions the gap assessment turns up. Audit fees depend mainly on site size and employee count, then product complexity and the certification body you choose, so get quotes from more than one.

Pre-audit checklist

Use this as a final pass before you book the audit:

• SQF practitioner and deputy named, trained, and documented.
• Food safety policy signed, with measurable objectives and a food safety culture plan.
• Specifications and supplier approvals current for all materials in scope.
• Hazard analysis reviewed within the last year, with CCP limits validated for your actual products.
• Internal audit program completed, with findings closed.
• Management review held and minutes on file.
• Mock recall completed within the last twelve months, with timings recorded.
• Food defense plan and food fraud vulnerability assessment current.
• Training records tie to competency, not just attendance.
• Floor walk done with no open sanitation, pest, or allergen issues.

Common reasons sites fail or struggle

In my view, the pattern behind most poor audits is a system written for the auditor instead of for the operation. The documents look right, but the people on the line cannot explain them. Fix that by involving line leads in writing the procedures, and by letting them find the gaps first. Other frequent causes are a practitioner who is the only person who understands the system, internal audits that are done on schedule but find nothing, and management reviews held without real data or decisions. Validation and corrective action weaknesses are covered in the clause 2.5 section above.

If you would rather have a second set of eyes before the certification body arrives, our SQF consultant page explains how we support gap assessments and audit preparation.

Where to go from here

The Code is not hard to read. What takes time is making the daily operation match the paperwork. Start with the gap assessment, name your practitioner, and be honest about where you are today. What would the auditor find if they walked in tomorrow morning?

Last updated: 2026-10-10

Frequently Asked Questions

What is SQF Code Edition 9?

Edition 9 is the version of the SQF Code, owned by the Safe Quality Food Institute and benchmarked by GFSI, that replaced Edition 8.1 for audits starting in 2021. It is organized into Module 2 (System Elements) and a sector-specific GMP module, such as Module 11 for food manufacturing. Confirm with your certification body which edition applies to your audit date.

Is an unannounced audit required for SQF?

Yes. Under the Code, a certified site must have an unannounced recertification audit at least once every three years. The certification body chooses the window, so the site must stay audit-ready throughout the year.

What is the difference between SQF Module 2 and Module 11?

Module 2 contains the system elements that apply to every certified site, including management commitment, the food safety plan, verification and validation, and traceability and recall. Module 11 contains the Good Manufacturing Practices for food manufacturing, covering premises, equipment, hygiene, sanitation, pest control, and allergen handling.

Do I need an SQF practitioner?

Yes. The Code requires each certified site to designate an SQF practitioner, with a trained deputy, who has the required HACCP training and knowledge of the Code. This person is responsible for developing, implementing, and maintaining the system.

How is an SQF audit scored?

Audits are scored and produce a rating of Excellent, Good, Complies, or Fail. Points are deducted for minor, major, and critical nonconformances, and a critical nonconformance can result in a failed audit. Check the current Code and SQFI guidance for the exact scoring values.