BRCGS Food Safety Standard Guide | GIFSQ

How to Prepare for BRCGS Food Safety Certification

The BRCGS auditor starts with senior management commitment — the policy, the objectives, the review. Then the food safety plan, examined in real depth. Then the site standards walk: fabrication, hygiene, maintenance. Then product control — allergens, packaging, testing. Then process control, then personnel. Findings get graded critical, major, or minor, and the grade — AA through D — becomes the commercial credential your retail buyers read. The prepared site earns the AA. This guide builds that preparation.

BRCGS (Brand Reputation through Compliance Global Standards) Food Safety is the GFSI-benchmarked standard with retail DNA — it reflects what major retailers demand of their suppliers, and for sites supplying UK retail it’s effectively the license to trade. The current edition is Issue 9. Its character is prescriptive and detailed: the standard says what it expects, and the auditor checks the specifics. Prepare to that depth.

Step 1: Secure senior management commitment (Section 1)

Section 1 covers the food safety and quality policy (documented, communicated, reviewed), the organizational structure (clear responsibilities, named deputies), management review (planned, with the standard’s specified inputs, producing outputs that drive improvement), and resourcing. The BRCGS expectation is visible senior engagement — objectives set, performance monitored, culture driven from the top.

One distinctive requirement: the confidential reporting system. Employees must be able to report food safety concerns confidentially — the whistleblowing mechanism communicated, reports handled properly. It’s a small clause that auditors check directly: ask a few operators whether they know how to raise a concern confidentially, and the answer reveals whether the system is real.

Step 2: Build the food safety plan — HACCP (Section 2)

Section 2 is the HACCP-based food safety plan: Codex logic, prerequisite programs, the team, product descriptions, intended use, verified flow diagrams, hazard analysis, CCPs, critical limits, monitoring, corrective actions, verification, documentation. BRCGS auditors examine HACCP in genuine depth — the superficial plan fails here first. The plan has to withstand detailed questioning, not just tick the boxes.

BRCGS also requires TACCP and VACCP — threat assessment (food defense) and vulnerability assessment (food fraud) — within the plan’s scope. Review the plan on change and at least annually; it must be living, not laminated.

Step 3: Build the food safety and quality management system (Section 3)

Section 3 is the management system backbone: document control, record completion and retention, internal audits, corrective and preventive actions, supplier approval and monitoring, traceability, complaint handling, incident management, and the procedures that hold the system together. This is where auditors test whether the system manages itself — internal audits finding real issues, corrective actions closing with root causes, suppliers approved against risk.

Many sites underinvest here because it feels administrative. It isn’t. Section 3 is where the auditor forms the judgment about whether the system is under control — and it feeds every other section. When the internal audit program is finding genuine issues and the corrective actions show real root causes, the auditor’s confidence in the whole system rises. When Section 3 is thin, everything else gets probed harder.

Step 4: Meet the site standards (Section 4)

Section 4 is the prescriptive core: the site’s exterior and surroundings, building fabric (walls, floors, ceilings, windows, doors — cleanable and maintained), utilities (water, ice, steam, compressed air — controlled and tested), equipment designed for food safety and maintained, hygienic maintenance execution, staff facilities (changing rooms, toilets, canteens designed against contamination), and chemical control.

The BRCGS specifics matter here more than in most standards: temporary repairs must be controlled (documented, time-bound, food-safe), glass and brittle materials need a register with controls, and the fabrication is assessed against the standard’s text. Walk your site with the standard in hand — the physical reality has to match what the standard describes.

Step 5: Control product and process (Sections 5 & 6)

Section 5 (product control) covers product design and development integrated with HACCP, allergen management (BRCGS has detailed allergen expectations — mapping, segregation, cleaning validation, labeling), provenance and claims (substantiated, traceable), product packaging (food-safe, specified, approved), and risk-based product inspection and testing.

Section 6 (process control) covers the documented operations: process monitoring, line checks, start-up and changeover controls, quantity control, and calibration — scheduled, traceable, and current. The depth BRCGS expects on process control shows up in the details: the line checks evidenced, the changeovers controlled, the calibration stickers current.

Step 6: Manage personnel (Section 7)

Section 7 covers training, personal hygiene, medical screening, and protective clothing. The training must be competency-based and role-specific — BRCGS effectively expects the matrix to show coverage of the right topics per role: HACCP awareness, allergen controls, CCP monitoring for the monitors, hygiene for everyone. Agency and temporary staff must be trained before they work, and supervised.

The audit tests training effectiveness through interviews, not just records. The operator who can explain what they do and why is the evidence the training worked; the training record alone isn’t.

Step 7: Run the production risk zones where applicable (Section 8)

Section 8 applies where products or processes require it: high-risk, high-care, ambient high-care, and low-risk zones, defined by risk assessment. The controls are segregation — physical, procedural, personnel and material flows — plus changing procedures and environmental controls matched to the zone.

Auditors test zone integrity directly: they watch the flows, check the changing discipline, and probe whether the segregation on paper survives the shift. The product’s risk determines the zone; the zone determines the controls; the audit determines whether the controls are real.

Step 8: Handle traded products (Section 9) if applicable

Section 9 covers sites that buy and sell food without manufacturing it — storage, distribution, brokers. The controls: supplier approval, product specifications, traceability, conformity verification, complaint handling, incident management — proportionate to the trading activity. If it applies to you, treat it as its own mini-system, not an afterthought.

Step 9: Navigate the audit protocol

BRCGS audits run announced or unannounced — the unannounced program puts roughly one audit in three on a surprise basis, testing the daily reality rather than the prepared performance. Audit duration is risk-based (size, complexity, headcount). Findings grade as critical (certification denied or suspended), major, or minor, with corrective actions due within 28 days — root cause, correction, preventive action, evidence. The grade (AA, A, B, C, D) follows from the number and severity of nonconformities.

The unannounced discipline is BRCGS’s signature challenge: the site that operates the standard every day passes the surprise audit; the site that prepares for the announced one fails it. Everyday readiness isn’t a slogan here — it’s the protocol.

What earns the grade

Management commitment you can see, not just read about — the policy lived, the review producing actions, the confidential channel working. A HACCP plan that survives the detailed examination because it’s genuine. A site whose fabric matches the standard’s prescriptive text. Zones whose segregation holds up under watching. And a management system in Section 3 that proves the whole thing is under control.

Common mistakes

Paper commitment. The policy exists, the review is a ritual, leadership is absent from the system. Auditors interview operators and check the confidential reporting channel — absence shows immediately. Make the engagement visible and real.

Superficial HACCP. The plan that ticks boxes but collapses under detailed examination — BRCGS’s first and most common failure point. Build genuine rigor: verified flow diagrams, real hazard analysis, validated limits.

Skipping Section 3. All effort goes to the floor and the HACCP plan while document control, internal audits, and corrective actions are thin. Section 3 is where the auditor judges whether the system manages itself. Invest there.

Fabric that doesn’t match the text. The prescriptive site standards unmet — temporary repairs uncontrolled, glass register missing, drainage wrong. Walk the site with the standard in hand and close the gaps literally.

Announced-only readiness. The facade for the scheduled audit, the failure on the unannounced one. With one audit in three arriving unannounced, everyday operation is the only preparation.

Weak 28-day responses. Corrective actions submitted with “retraining” as the root cause and thin evidence — rejected, certification at risk. Root-cause properly, evidence thoroughly, submit once and well.

Checklist

• [ ] Section 1: senior management commitment — policy, structure, comprehensive management review, resources, confidential reporting
• [ ] Section 2: HACCP food safety plan — Codex thorough, TACCP/VACCP included, living reviews
• [ ] Section 3: management system — document control, internal audits, CAPA, supplier approval, traceability
• [ ] Section 4: site standards — fabric, utilities, equipment, maintenance, staff facilities, chemicals per prescriptive specifics
• [ ] Sections 5 & 6: product control (allergens, packaging, testing) and process control (operations, calibration)
• [ ] Section 7: personnel — competency-based training per role, hygiene, medical screening, protective clothing
• [ ] Section 8: production risk zones defined and disciplined where applicable
• [ ] Section 9: traded products module applied where applicable
• [ ] Audit protocol navigated: announced/unannounced readiness, 28-day corrective actions, grade-targeted system