BRCGS Certification for the First Time: A US Guide

What does first-time BRCGS certification actually involve?

A mid-sized US food manufacturer gets BRCGS certified by choosing the right scheme, closing the gaps against the BRCGS Global Standard for Food Safety issue your certification body will audit you against (Issue 9 at the time of writing; see the note below on confirming this), running the system long enough to produce records, and passing an audit by a certification body accredited to ISO/IEC 17065 and approved by BRCGS. The standard itself is not the hard part. The hard part is that most plants already have a decent food safety program and discover during a gap assessment that it lives in people's heads, not in records an auditor can follow.

In our work with mid-sized plants, the pattern is consistent. The ones who struggle treat the audit as an event. The ones who do well treat it as a few months of building habits that happen to end in an audit. This article walks through the whole path in the order we would do it with you.

Is BRCGS the right scheme for your plant?

Before spending a dollar on gap work, confirm that BRCGS is the scheme your customers want. In the US, the three schemes I see most often are BRCGS, SQF, and FSSC 22000, and all three are benchmarked by the Global Food Safety Initiative (GFSI). That means a retailer that accepts GFSI-benchmarked certification can usually accept any of them, but in practice buyers have preferences.

If a customer has named BRCGS in a supplier agreement or a vendor questionnaire, the decision is made. If nobody has asked, spend a week talking to your top five accounts before committing. I wrote a longer comparison in our BRCGS vs SQF vs HACCP guide, and I would read that before you pick.

One point trips people up: HACCP is not a certification scheme in the way the other three are. It is a method that every GFSI scheme builds on, and in the US it overlaps with the hazard analysis and risk-based preventive controls required by 21 CFR Part 117.

What does BRCGS Issue 9 require?

BRCGS Food Safety Issue 9 took effect on 1 February 2022. BRCGS has been developing the next issue, so before you start gap work, confirm with BRCGS and your certification body which issue your first audit will be against and whether any transition dates apply. If a newer issue applies, run the gap assessment against that one. The structure below is Issue 9's and is organized into numbered sections. For a manufacturer, the ones that carry most of the work are these:

1. Section 1, Senior management commitment. This includes clause 1.1.2, which requires a documented food safety and quality culture plan with defined activities and a timeline. Many US plants have never written one.
2. Section 2, The food safety plan (HACCP). Built on Codex principles, with a trained HACCP team and a verified flow diagram.
3. Section 3, Food safety and quality management system. Document control, internal audits, supplier approval, corrective action, traceability, complaints, and incident management.
4. Section 4, Site standards. Layout, building fabric, utilities, pest control, foreign-body controls, and housekeeping.
5. Section 5, Product control. Allergen management, product labeling, and product authenticity.
6. Section 6, Process control. Quality management, calibration, and metal detection or other foreign-body equipment.
7. Section 7, Personnel. Training, hygiene, medical screening, and protective clothing.

Section 8 applies only if your site has high-risk, high-care, or ambient high-care production risk zones. Section 9 applies only if you handle traded products, meaning finished products bought in and sold on without being manufactured at your site. If you have neither, both sections are out of scope. Confirm the scope with your certification body early, not at the audit.

BRCGS also lists fundamental requirements, clauses where a failure puts the whole certificate at risk because the system cannot work without them. Senior management commitment and the HACCP plan are among them. When I run a gap assessment, I look at those clauses first, because a weakness there changes the entire timeline.

How does this line up with US regulation?

If your plant is already compliant with 21 CFR Part 117, you have a head start. The food safety plan required by 21 CFR 117.126 and the hazard analysis in 21 CFR 117.130 map well onto Section 2. The cGMP requirements in Subpart B of Part 117 map onto much of Section 4 and Section 7. What BRCGS adds is a heavier demand for documented verification, a formal culture plan, and detailed expectations for site condition in Section 4 (building fabric, pest control, foreign-body controls, housekeeping) that you should check clause by clause rather than assume your FDA inspection history covers.

BRCGS certification does not replace FDA compliance, and FDA compliance does not earn BRCGS. Plants sometimes assume one covers the other, and the gap that follows is expensive.

How do you run the gap assessment?

Start with an honest read of where you are. I recommend a structured gap assessment against every clause of Issue 9, done by someone who has not been living inside your plant's habits. Internal quality staff are often too close to the work to see what an auditor will see in the first ten minutes.

A useful gap assessment produces three things:

• A clause-by-clause status (conforming, partially conforming, not conforming) with evidence noted
• A short list of fundamental-clause risks that gate everything else
• A realistic action plan with owners and dates

What I find most often in first-time plants is not a missing program but a missing record. Pest control is happening, but the trend analysis is not. Suppliers are approved, but the approval criteria are not written down. Internal audits are being done, but they cover the whole site in one afternoon instead of following a schedule based on risk. Each of those is fixable, and each takes longer than people expect because the fix is a running record, not a document.

If you want outside help, a BRCGS consultant is most valuable at this stage and again in the weeks before the audit. In the middle, your own team does the work.

What should the implementation phase look like?

This is where mid-sized plants win or lose. Here is the sequence I use.

Get senior management actually committed

Clause 1.1.1 asks for a documented food safety policy and objectives, and the audit will test whether senior leaders actually know them. I have seen audits stall because the plant manager could not describe the culture plan he had signed. Give leadership a real role: monthly management review, visible participation in the culture activities, and ownership of the objectives.

Rebuild the food safety plan on a clean foundation

If your current HACCP or preventive controls plan was written years ago and edited in patches, start from the flow diagram and rebuild it. Walk the line, confirm the diagram matches what is on the floor, redo the hazard analysis, and validate the critical limits. A plan that has been verified by walking the process is much easier to defend than one that has been inherited.

Build the management system in layers

Do not try to write forty procedures at once. Start with the ones that generate records an auditor will ask for in the first hour: internal audit, corrective action, supplier approval, traceability, and complaint handling. Then add the supporting procedures.

Run the system long enough to show records

This is the part nobody likes hearing. A procedure with no records behind it proves very little. Auditors want to see that you have run an internal audit cycle, held a management review, tested traceability, and closed corrective actions. Plan for the system to operate for at least a few months before the certification audit so those records exist. If a customer is pushing a deadline, tell them this plainly.

Test traceability and recall

Run a mock recall and a traceability exercise on a real finished-product lot. Time it. Check mass balance. The results usually surface labeling or lot-coding gaps that are far cheaper to fix now.

How long does first-time certification take?

The honest answer depends on how much of your system already exists. Here is a planning range I use as a starting point, not a promise.

Plants with a mature FDA-compliant program and a strong quality team can move faster. Plants that need physical changes, like rebuilt hand-wash stations, new pest-proofing, or foreign-body controls, take longer because capital and contractors set the pace.

Adding the table's ranges, with the records period running inside implementation, the path to the certification audit is roughly 4.5 to 9 months, plus up to 28 days to close out nonconformities.

Cost is the other planning question. Budget for these categories and get written quotes for each: certification body audit fees (which vary with site size, scope, and audit duration), any outside gap assessment or mock audit, staff time for documentation, training, and internal audits, and capital fixes to the building or equipment. The capital fixes are the least predictable line, so a gap assessment that surfaces them early is the best way to size the total.

How does the certification audit work?

You choose a certification body that is accredited to ISO/IEC 17065 and approved by BRCGS, and your site is enrolled on the BRCGS Directory. The auditor reviews documentation, walks the plant, interviews staff, and performs a vertical audit and traceability test on selected products. Nonconformities are graded as critical, major, or minor.

• A critical nonconformity means no certificate is issued.
• A major nonconformity must be addressed with evidence that the certification body accepts before a certificate is granted. The certification body reviews that evidence and may require a revisit, depending on the finding. Majors also count against your grade.
• Minor nonconformities need a corrective action plan with root cause, correction, and preventive action.

Corrective action evidence is due within 28 days of the audit. Late or weak responses are one of the most common reasons first-time certificates get delayed, so decide before the audit day who owns each response.

BRCGS gives you the choice between an announced audit and an unannounced audit. Many first-time sites choose announced, which gives you a window to prepare. Unannounced is a reasonable goal for later cycles, and some customers prefer it, so ask them.

What mistakes sink first-time BRCGS audits?

A handful of problems show up again and again.

• The culture plan exists on paper only. Clause 1.1.2 expects activities that actually happened, measured in some way. A slide deck is not a plan.
• Internal audits are too shallow. An auditor who finds a weakness your internal audit missed will question the entire audit program.
• Supplier approval is informal. If you cannot show how a raw material supplier was approved and how it is monitored, expect a nonconformity.
• Floor conditions do not match the documents. Cracked floors, unsealed gaps, and damaged equipment are the quickest way to a pile of minors that add up.
• Operators cannot explain their own controls. Auditors ask the person at the line what a critical limit is and what they do when it fails. Train for that conversation.

In my view, the best preparation for the audit is a mock audit run by someone who will tell you the truth. Pay for one. It is cheaper than a failed certification event, and the lessons stick better when the findings are about your own plant.

What happens after you are certified?

Certification is the start of a cycle. You will be audited again, usually at 6 or 12 month intervals depending on your grade (grades run from AA to D and reflect the number and severity of nonconformities; stronger grades earn the 12-month cycle and weaker ones the 6-month cycle, and the standard's audit protocol sets the exact cut-offs), and your internal audit program, management review, and culture plan need to keep producing evidence in between. Plants that let the system go quiet after the certificate arrives tend to have a rough recertification.

Also keep an eye on the standard. BRCGS revises its standards periodically, so check the BRCGS website for the issue your certification body is auditing against before you plan your next cycle.

Where should you start this week?

If you are a quality manager reading this with a customer deadline in the background, here is what I would do in the next five working days. Confirm in writing which scheme your top accounts require. Request quotes from two or three approved certification bodies. Pull your current food safety plan and flow diagram and ask whether they match the floor. Then book a gap assessment, because everything else on the schedule depends on what it finds.

If you want a second set of eyes on any of this, you can reach us through the Certify Consulting contact page. What is the one clause in Issue 9 that makes your team nervous? Start there.

Last updated: 2026-10-19

Frequently Asked Questions

How long does it take a mid-sized US food manufacturer to get BRCGS certified for the first time?

A realistic range is about four to eight months from scheme decision to certification audit, depending on how much of your system already exists. Plants with a mature FDA-compliant program move faster. Plants that need physical repairs or a rebuilt HACCP plan take longer.

Is BRCGS certification required by the FDA?

No. FDA requirements, such as the preventive controls rules in 21 CFR Part 117, are separate from BRCGS. BRCGS is a private, GFSI-benchmarked scheme that customers may require. Holding it does not replace FDA compliance.

What is the difference between a major and critical nonconformity in a BRCGS audit?

A critical nonconformity means no certificate is issued. A major nonconformity must be closed, with evidence accepted by the certification body, before the certificate is granted. Minor nonconformities need a corrective action plan, and evidence is due within 28 days of the audit.

Do I need to choose between BRCGS, SQF, and FSSC 22000?

Usually yes, and the choice should follow your customers. All three are GFSI-benchmarked, but buyers often name a preferred scheme. Ask your top accounts in writing before you invest in gap work.

Does BRCGS Issue 9 require a food safety culture plan?

Yes. Clause 1.1.2 of Issue 9 requires a documented food safety and quality culture plan with defined activities and a timeline, and sites need to show evidence that the activities happened.