GFSI Audits Explained: Recognised Schemes, What to Expect, and How to Prepare

If a customer has told you they need a GFSI audit, they have asked for something that does not technically exist. The Global Food Safety Initiative does not audit facilities, does not issue certificates, and does not accredit certification bodies. It benchmarks other people's food safety standards and recognises the ones that meet its requirements.

What your customer means is that you need certification against a GFSI-recognised scheme, such as SQF, BRCGS or FSSC 22000. You pick one of those schemes, you are audited by a certification body accredited for it, and the certificate you receive carries that scheme's name. GFSI is nowhere in the transaction except as the body that decided the scheme was credible.

That distinction matters more than it sounds. It determines which standard you buy, who you hire, what the audit covers, how you are graded and what the certificate says. This guide covers the schemes currently recognised, what actually happens in the audit, how grading differs, the non-conformities that come up most often, and what it realistically costs.

What GFSI Actually Does

GFSI is a business-driven initiative, run under the Consumer Goods Forum, that exists to solve a specific problem: before it existed, a manufacturer selling to five retailers could be audited five times a year against five different standards, at their own cost, with no two audits agreeing on what good looked like.

GFSI's answer was to publish a set of Benchmarking Requirements and invite scheme owners to demonstrate that their standards meet them. A scheme that passes becomes GFSI-recognised, and retailers can then accept certification against any recognised scheme instead of running their own audit programme. The principle the industry uses for this is "once certified, accepted everywhere."

The organisations that own those schemes are called Certification Programme Owners. GFSI's own certification guidance is explicit that GFSI does not provide certification and that companies must go to a recognised CPO.

It Is a Customer Requirement, Not a Regulation

Worth being clear about, because it changes how you should think about the spend: GFSI-recognised certification is not required by US law. FSMA does not mandate it. The FDA does not check for it. No federal or state regulation makes it a condition of operating.

It is a commercial requirement imposed by customers, most often retailers, foodservice groups and brand owners who will not buy from an uncertified site. That makes it a sales prerequisite rather than a compliance obligation, and it means the business case belongs with the commercial team as much as with quality.

The GFSI-Recognised Certification Programme Owners

There are twelve recognised CPOs as of September 2026. Most published lists are incomplete or out of date, so here is the full set with the benchmark version each is currently recognised against.

Two things here catch people out. The first is that the list is longer than most articles suggest. If you make fresh produce, seafood or red meat, there are sector-specific schemes that may fit your operation better than a general manufacturing standard.

The second is the name change. The Global Aquaculture Alliance became the Global Seafood Alliance, and a surprising number of published scheme lists still use the old name. If you are working from a list that says Global Aquaculture Alliance, it has not been updated in some years and may be wrong about other things too. The authoritative source is GFSI's own register of recognised CPOs.

What Changed in Benchmarking Requirements v2024

Look again at the benchmark version column. Only two CPOs, CanadaGAP and the Japan Food Safety Management Association, are currently recognised against Benchmarking Requirements v2024. Every other scheme, including SQF, BRCGS, FSSC 22000 and IFS, remains recognised against v2020.

GFSI published BMR v2024 in December 2024. Scheme owners could begin applying for recognition against it from January 2025, and those already recognised under v2020.1 were given a window running to September 2025 to apply. A year past that window, the migration is still in progress across most of the industry. GFSI publishes a summary of the key changes from v2020.1 to v2024 alongside the implementation handbook.

What does this mean for your site? In the short term, very little. You are certified against a scheme, not against the benchmark, and your scheme's requirements are what your auditor assesses. The benchmark version governs the relationship between GFSI and the scheme owner.

What it does tell you is that scheme requirement changes are coming. When your CPO moves to v2024, it will publish a new edition or issue of its standard, and that is when the changes reach your facility. Watching your scheme owner's publication schedule is the useful signal, not watching GFSI.

Choosing a Scheme

The choice is usually narrower than it first appears, because most sites are constrained by factors outside quality's control.

Start with the customer. If a major customer specifies a scheme, that is the scheme. Retailers frequently name SQF or BRCGS explicitly in supplier agreements, and no amount of technical preference will override a contractual requirement.

Then your product category. A produce packer has PrimusGFS, GLOBALG.A.P. and CanadaGAP available. A seafood processor has the Global Seafood Alliance standard. Sector schemes often fit the operation more closely than a general manufacturing standard does.

Then your export market. IFS carries weight with European retailers, particularly in Germany and France. BRCGS is strongly established with UK and European retail. JFS-C matters in Japan. SQF is heavily used in North America and Australia.

Then cost and internal fit. If you already run an ISO-based management system, FSSC 22000 will feel familiar because it is built on ISO 22000. Our comparison of GFSI, SQF and BRCGS goes through the differences, and FSSC 22000 vs ISO 22000 covers that relationship.

Then Choose the Certification Body

The scheme and the certification body are two separate decisions, and the second one gets rushed. GFSI does not accredit certification bodies. Accreditation comes from a national accreditation body, and the scheme owner maintains the list of certification bodies licensed to audit against its standard.

Certification bodies differ in audit availability, sector experience, geographic coverage and cost. An auditor who has audited dozens of sites in your category will ask sharper questions and give more useful findings than one learning your process during the opening meeting. Our guide to the FSSC 22000 certification bodies covers what to compare.

You will also need a named individual responsible for the system internally. SQF formalises this as a defined role, covered in our guide to the SQF practitioner, and other schemes expect an equivalent owner for the food safety management system even where they do not name the position.

Whichever scheme you choose, the foundation is the same. Every recognised scheme requires a functioning HACCP system built on Codex principles, so a solid HACCP plan is the prerequisite for all of them.

What Actually Happens in the Audit

The audit itself follows a broadly consistent shape across schemes, with meaningful differences in the detail.

Before the audit, you register with the scheme owner, select an accredited certification body and agree a date. Most schemes require a documented management system to have been operating long enough to generate records, commonly around three months, so an audit booked too early will fail on evidence alone.

Opening meeting. The auditor confirms scope, sites, products and processes to be covered, and explains how the audit will run. Scope errors caught here are cheap. Scope errors caught later are expensive.

Facility tour. Typically the longest and most revealing part. The auditor walks the process flow, observes practice against procedure, and talks to operators directly. Much of the eventual finding list originates here rather than in the document review.

Document and record review. The auditor traces what they saw on the floor back through your records. Expect them to pick a date, a product and a lot, and follow it end to end through monitoring records, corrective actions, verification sign-offs and traceability.

Traceability and mass balance exercise. Most schemes require a full trace within a set time limit, commonly four hours, both upstream to ingredients and downstream to customers, with quantities reconciling.

Closing meeting. The auditor presents findings graded by severity, and confirms the response timeline.

Announced and Unannounced Audits

Every GFSI-recognised scheme now includes an unannounced element. The common arrangement is that a site must receive at least one unannounced audit within each three-year certification cycle, though the mechanics vary: some schemes let you opt into a fully unannounced programme for a higher grade or a recognition mark, and some specify a window rather than a fully open calendar.

The practical implication is that readiness cannot be a two-week project before a known date. Our guide to the food safety internal audit covers building a rolling programme, and ISO 19011 sets out the auditing principles most schemes expect internal auditors to work to.

Scoring and Grading Differs by Scheme

This is where schemes diverge most, and where comparing two certificates at face value misleads.

BRCGS grades AA down to D based on the number and severity of non-conformities, with the grade determining whether your next audit is at six or twelve months. A critical non-conformity or too many majors results in no certificate. Our guide to the BRC audit covers the grading bands, and BRCGS certification covers the wider process.

SQF scores numerically out of 100, translating to ratings from Excellent down to Failing, with a single critical non-conformity causing automatic failure regardless of the score elsewhere. SQF certification levels and SQF Edition 10 cover the structure, and the SQF audit guide walks through the day itself.

FSSC 22000 does not grade. You either conform or you do not, with findings classified as minor, major or critical, and certification following closure. FSSC 22000 Version 6 covers the current requirements.

A site with an SQF score of 96 and a site with a BRCGS grade A are not directly comparable, and treating them as equivalent in a supplier approval programme is a mistake worth avoiding.

Common Major and Critical Non-Conformities

Auditors see the same findings repeatedly across sites and schemes. The list is remarkably stable.

• Verification records signed but never reviewed. Monitoring records complete, verification column signed, no evidence anyone read them or acted on an out-of-spec entry.
• Document control failures. Operators working from a superseded revision, uncontrolled copies on the floor, or a procedure whose approval signature is missing.
• Calibration overdue. An instrument used to monitor a critical limit with an expired calibration record, which retroactively undermines every reading taken with it.
• Allergen changeover evidence. A cleaning procedure that exists on paper without records demonstrating it was performed and verified between specific runs.
• Traceability exercise failure. Not completing the trace within the time limit, or a mass balance that does not reconcile.
• Training records incomplete. No evidence that the person performing a critical task was trained and assessed as competent for it.
• Corrective action closed without root cause. A deviation record showing the immediate fix but no analysis of why it happened or evidence the fix worked.
• Internal audit programme incomplete. Scheduled internal audits not performed, or performed without covering the full scope across the cycle.

Read that list again and notice the pattern. Almost none of these are failures of food safety knowledge. They are failures of scheduling, record-keeping and follow-through, which is why sites with genuinely good technical practice still collect findings.

The Corrective Action Window

Finding a non-conformity is normal. Every audit produces some. What determines your outcome is the response.

Schemes set a fixed window for submitting evidence, commonly 28 days for majors and minors, and considerably shorter for anything critical. What auditors want is evidence of correction, root cause and preventive measures, not a promise. A photograph of a cleaned area closes very little on its own; a photograph plus the revised procedure, the retraining record and the verification check that confirms it held is what closes a finding.

Miss the window and the consequences escalate quickly, from a downgraded grade to a withheld certificate to a full re-audit at your cost. Our guide to the corrective action plan covers building responses that survive review.

Cost and Timeline, Honestly

Costs vary widely by scheme, site size, product complexity, number of shifts and geography, so treat any single figure with suspicion. The components are consistent:

• Scheme registration or licence fee, paid to the CPO, typically a few hundred to low thousands of dollars annually.
• Certification body audit fee, usually charged per auditor-day, with most manufacturing audits running two to four days on site.
• Travel and expenses for the auditor.
• Preparation cost, which is almost always the largest line and the one that gets left out of the budget. Consultancy, staff time, training, equipment, document creation and remediation typically dwarf the audit fee.
• Annual recertification, because this is a recurring cost, not a one-off.

For timeline, a site starting from a reasonable GMP baseline with a functioning HACCP plan should plan on six to twelve months to first certification. A site starting from very little should plan on longer. The gap analysis is what tells you which you are, and doing it honestly at the start saves far more than it costs.

How to Prepare

Preparation follows a sequence that works regardless of scheme.

Run a gap analysis against the specific standard and edition you will be audited to. Not a generic checklist, the actual standard, clause by clause. Our GMP audit checklist is a reasonable starting point for the baseline conditions underneath any scheme.

Close the documentation gaps before you worry about the audit date. Most sites find their procedures exist but are unapproved, undated, or describe a process that changed two years ago.

Build the record history. You cannot audit records that do not exist yet. If your scheme expects three months of operating records, the clock starts when the system is genuinely running, not when you write the procedure.

Run a mock audit with someone who did not build the system. An internal auditor who wrote the procedures will not see what an external auditor sees. Where budget allows, a food safety consultant running a pre-assessment is usually money well spent.

Fix what the mock audit finds, and verify the fixes held. A finding you close two days before the real audit with no verification evidence is a finding waiting to reappear.

Rehearse the traceability exercise against the clock. It is the single most commonly failed live test and the one most easily practised in advance.

Running that programme is mostly an exercise in keeping documents current and keeping scheduled checks from slipping. If your procedures, records and internal audit schedule currently live across shared drives, spreadsheets and paper, see how Allera's food quality management software holds controlled documents with approval workflows and scheduled review dates, tracks recurring checks against owners and due dates, and produces an exportable audit trail showing who did what and when.