SQF Unannounced Audit: Essential 2027 Readiness Guide

An SQF unannounced audit is a recertification audit where your certification body tells you who the auditor is, but not the date or time, and if your site turns that auditor away the certificate is suspended immediately. Every certified SQF site gets one at least once every three years. The rule lives in Part A of the Code, section A2:14, with the consequences of refusing it set out in A2:28.

The good news is that the rules are short and specific. This guide walks through when the audit can happen, how blackout periods work, what refusal costs you, and how to run a site that is ready on any shift. Requirement numbers refer to the SQF Food Safety Code: Food Manufacturing, Edition 10. SQFI’s Edition 10 FAQ says the unannounced audit requirement has not changed in Edition 10 and that the three-year timeframe is not disrupted by the new edition.

How the SQF unannounced audit rule works

Here are the SQF unannounced audit rules from A2:14 in one place, with the related Part A references.

When your SQF unannounced audit can happen

Start with the window, because it is the only part of an SQF unannounced audit you can calculate. Take the last day of your initial certification audit and find its anniversary. The window runs from 30 days before that date to 30 days after.

For example, if your initial certification audit ended on 15 May, your recertification window each year runs from 15 April to 14 June. In the year your certification body chooses for the unannounced audit, the auditor can arrive on any operating day in that window that is not covered by an agreed blackout.

What you cannot calculate is which year it will be. Treat every recertification window as one that might be unannounced, and you will never be caught out. Part A sets a minimum duration of two audit days for a Food Manufacturing certification or recertification audit (A2:12), and your certification body sets the actual length, so plan for the auditor to be on site for at least that long.

Blackout periods: how to agree them

Blackout periods keep an SQF unannounced audit away from dates with a real operational reason behind them: a seasonal plant that is shut, a planned shutdown for a line rebuild, a period with no production. A2:14 lets the site and certification body negotiate a 90-day blackout period for those situations. It is not a way to avoid a busy month or a week when the SQF Practitioner is on vacation.

Timing matters. Under 2.1.1.5, one of the SQF Practitioner’s duties is to make sure relevant blackout dates reach the certification body at least 90 days before the audit window opens. That lead time has grown: SQFI’s change document shows that Edition 9 asked for blackout dates one month before the 60-day window. If you are used to the Edition 9 timing, move your reminder.

Keep the blackout request in writing, with the dates and the business reason, and keep the certification body’s confirmation. If your operating calendar changes after that, talk to the certification body straight away. Permanent or temporary changes to your certification dates for legitimate reasons go through the certification body to SQFI, and need written approval from SQFI Compliance (A2:31).

What happens if you refuse an SQF unannounced audit

Suspension is immediate, and it is one of the seven suspension triggers in A2:28. Turning away an auditor or SQFI at a visit outside the audit cycle, such as SQFI validating an audit or the auditor coming back to check corrective actions, is a separate trigger with the same result.

A2:28 then sets out what follows a refused unannounced audit:

1. Within 48 hours of receiving the suspension notice, the site provides a plan explaining why it refused and agreeing to an unannounced audit within the next 30 days.
2. The certification body carries out an on-site recertification audit within 30 calendar days of receiving the site’s confirmation.
3. If the site achieves a certified rating at any level, the certification body lifts the suspension in the SQFI Assessment Database and confirms it in writing.
4. An additional unannounced surveillance audit follows no more than six months after that unannounced recertification audit.

While suspended, the site may not present itself as holding an SQF certificate, and the certification body changes the site’s status in the SQFI Assessment Database to suspended, with the reason and the date. One refused visit therefore costs a suspension, an extra recertification audit inside 30 days and an extra unannounced surveillance audit within six months.

The practical rule is simple: nobody at your site has the authority to send an auditor away. If someone doubts the auditor’s identity, the auditor waits in reception while you call the certification body to confirm the name it gave you.

Not the same thing: unannounced surveillance

Sites sometimes confuse the three-yearly SQF unannounced audit with an unannounced surveillance audit. They come from different rules.

• The three-yearly unannounced audit is a normal recertification audit without a date. Every certified site gets one (A2:14).
• An unannounced surveillance audit is extra. It follows a score below 70 at a recertification audit, which produces the “Certified with Unannounced Surveillance” rating and an immediate suspension (A2:19, A2:28). It also follows a refused unannounced audit, as described above.

For how the score and rating are worked out, see our guide to SQF audit scoring.

The Select Site option

Part A also lets a certified site go further. A site can give up the three-year cycle and choose to have every recertification audit unannounced, every year. Each of those audits follows the same A2:14 protocol, and the site is recognized as an “SQFI Select Site” on the SQF public directory and on its certificate. It is voluntary. It suits sites that are confident in their day-to-day state and want a visible signal of that for customers.

How to be ready for an SQF unannounced audit on any day

You cannot prepare for the day, so prepare the site. These are the controls that make the difference.

Arrival and call list

• A written arrival procedure for reception and the gatehouse: check identification, sign the auditor in, start the call list.
• A call list in order: primary SQF Practitioner, substitute, duty shift supervisor, QA, plant manager. Post it at reception, the gatehouse and each supervisor’s desk, and test the numbers monthly.
• A named substitute SQF Practitioner who can lead the audit. Edition 10 requires both a primary and a substitute (2.1.1.5).

Every shift, not just first shift

• Brief shift supervisors to act as the auditor’s guide until a practitioner arrives.
• Make sure the records an auditor asks for first (CCP monitoring, pre-operational inspections, allergen changeover records, the hold log, training records) can be reached on every shift, including second and sanitation shifts. A record locked in an office until 08:00 is a readiness gap.
• Tell sanitation crews not to shorten anything because an auditor is watching.

Keep the system current all year

• Run the internal audit program across all elements every year and close its findings on time, so there is no backlog waiting for an auditor to find. Our guide to SQF internal audits covers building that program.
• Keep corrective actions within their due dates and review overdue ones at the monthly management update.
• Run a mock unannounced audit a few times a year: a manager arrives without warning on a random shift, and you time how long it takes to reach the practitioner, start the opening meeting and pull five records. Log every gap as a corrective action.

SQF unannounced audit FAQ

Do we get any notice of an SQF unannounced audit?

You get the auditor’s name, because the certification body must give it for every audit (A2:10). You do not get the date or time. You also know the window, because it is fixed to the anniversary of your initial certification audit.

Does Edition 10 change the unannounced audit rule?

SQFI says the requirement has not changed and the three-year timeframe carries on through the edition change. The one detail worth noting is the blackout notice: Edition 10’s 2.1.1.5 asks for blackout dates at least 90 days before the audit window opens, against one month before the window in Edition 9.

Can part of an SQF unannounced audit be done remotely?

No. Part A allows a remote portion for other audits by agreement, but unannounced audits are on-site audits only.

What if our SQF Practitioner is away when the auditor arrives?

The audit goes ahead. That is why Edition 10 requires a substitute practitioner and why your call list and shift supervisors matter. Asking the auditor to come back another day could count as failing to permit the audit, which is a suspension trigger under A2:28.

Put the readiness in writing

Readiness that depends on one person’s memory fails on second shift. The SQF Edition 10 Toolkit includes an Unannounced Audit Readiness Procedure with an arrival sequence, call list, off-shift cover, records-by-shift table and a mock audit report, plus the Certification Status and Notification Procedure for the A2:28 suspension steps and the SQF Practitioner Appointment and Competency Record for the primary and substitute. For how Edition 10 changes the rest of Part A and Module 2, start with our SQF Edition 10 guide.