BRCGS Unannounced Audit: A Clear Guide to the 4-Month Window

A BRCGS unannounced audit is a full on-site audit where the auditor turns up without a date having been given to you. The hard part is knowing which clock runs from which event. This guide sorts those out, using Part III of the Standard and Position Statement 1 as published in F926 version 5 (6 October 2026).

The toolkit mentioned at the end is independent of BRCGS. For the wider picture, start with our BRCGS certification guide.

Two kinds of BRCGS unannounced audit

There are two routes to a BRCGS unannounced audit, and Position Statement 1 applies to both.

• Mandatory. You are on the announced or blended announced option, and at least once in every three years your audit is unannounced. The certification body tells you the year, never the date.
• Voluntary. You choose the unannounced programme and every audit is unannounced and fully on site. Grades carry a plus sign: AA+, A+, B+, C+ or D+.

A mandatory unannounced audit replaces your normal scheduled audit. It does not come on top of it. It is graded on the same table as an announced audit, with the plus sign added. If you want the grade table itself, see our post on BRCGS audit grades.

The BRCGS unannounced audit window: what each clock runs from

This is where sites get caught. Several different starting points are in play, and the protocol mixes them.

Read the table twice. The three-month and six-month clocks run from the last audit. The four-month window runs back from the audit due date. Mixing those up is how a site finds out in month ten that it has already missed an arrangement.

One more trap. The Standard is not consistent about the three-month clock: one passage counts it from the previous due date, while the protocol sections on scheduling, the flowchart and Position Statement 1 count it from the last audit. We use the last audit, which is the safer reading and the one the position statement uses.

What Position Statement 1 puts on the site

Position Statement 1 rewrote clause 1.1.10 and Part III 4.7.1. Its stated effective date is 1 August 2024, although its opening text says the clause changed from 1 May 2024. Position statements are binding and count as an extension of the Standard, so an auditor will test them.

In plain terms, the site is responsible for everything an unannounced audit needs to run to protocol. That covers three things.

1. Contract terms. Agree them with the certification body before the 4-month window opens, not after.
2. Keeping the certification body informed. Tell it about anything that affects planning, with maintenance shutdowns as the named example.
3. Being ready. The audit starts on arrival, with deputies in place for absent managers.

If arrangements are late, the consequences stack up. The audit due date moves to fit the late start, the audit can then happen at any point in the following four months, your current certificate may expire in the meantime, and a major non-conformity is raised against clause 1.1.10. The certification body reports this to BRCGS through the concession process.

The six-month figure in the position statement is easy to misapply. It is the certification body’s duty, under the amended 4.7.1 for the voluntary programme, to start the audit process within six months of the last audit. It is not a deadline for the site to finish its own paperwork. The site’s deadline is the opening of the four-month window.

A footnote on citations: the printed Standard and the position statement point to different clause numbers for the late-audit major. Some passages cite 1.1.12; the protocol sections and Position Statement 1 point to 1.1.10. We use 1.1.10.

Unavailable days for a BRCGS unannounced audit

You may nominate up to 10 days on which you are not available, for example because a customer is visiting. On a six-month schedule (after a C or D grade) the limit is 5. Days when the site is not operating, such as public holidays and shutdowns, do not count towards those numbers.

The notice rules differ between the two routes, and the Standard says so in separate places.

• Mandatory: tell the certification body about non-operating days, with dates and reasons, at least 4 weeks ahead. It may challenge a reason it finds weak.
• Voluntary: give the dates and reasons within 3 months of opting in. Later dates are accepted at the certification body’s discretion if given 4 weeks before the next unavailable date.

Treat the nominated days as a scarce resource, not a diary. Spending them early leaves nothing for a real emergency. Certification bodies are expected to use discretion in genuine emergencies, but that is their call, not your right.

On the day: what happens when the auditor arrives

Under the voluntary programme, the protocol says the site production facility inspection is expected to start within 30 minutes of the auditor’s arrival, after a short opening meeting. That figure sits in the voluntary section. For the mandatory audit the clear rule is that the auditor must be given access on arrival, and the sensible assumption is that you should plan to the same pace.

Three situations are written down:

• Access refused. On a mandatory audit your certification is suspended. It stays suspended until a new unannounced audit is done, which can fall at any point in the following four months. You may also be liable for the auditor’s time. On the voluntary programme you can be moved back to announced audits, charged costs, and have the certificate suspended or withdrawn at the certification body’s discretion.
• No production. If you told the certification body the site would be operating but the auditor finds no production, or only out-of-scope products, the audit cannot go ahead and another has to be arranged.
• Key managers absent. Absence is not a reason to stop the audit. A nominated deputy must be there, and the senior production or operations manager is expected at the opening and closing meetings.

The auditor also expects some pre-audit information, including your HACCP plan summary, site plan, shift patterns and production schedule, and for the unannounced route, practical logistics such as entrance requirements and a contact list for arrival. Keep these current in a single pack.

Becoming ready for a BRCGS unannounced audit any day

Readiness is mostly about the things that cannot be rebuilt on the morning. A short list that works:

1. A named deputy for every key role, who has actually run the area, not one who has only seen the procedure.
2. Records within reach. If an auditor asks for last month’s metal detector checks or the supplier file for a raw material, the answer should take minutes.
3. An up-to-date traceability test. The traceability challenge is part of the minimum on-site work in every option. Our post on the BRCGS traceability test covers it.
4. A walk-round routine. Clause 3.4.4 already requires monthly hygiene and fabrication inspections of open product areas. If those are honest, the factory floor holds few surprises.
5. A shutdown and changeover calendar shared with the certification body, as Position Statement 1 expects.
6. Open non-conformities closed. Do not carry old corrective actions into the window.

None of that is new. The point of the unannounced option is that it removes the preparation sprint. If your system only works after a sprint, the audit will show it. The same logic applies at other schemes. For comparison, see our posts on the SQF unannounced audit and the FSSC 22000 unannounced audit, which follow different rules.

Other rules worth knowing

• The three-year requirement does not pause. Failed audits and a change of certification body do not stop the clock. Position Statement 3 narrows the definition of an initial audit, and says the three-year cycle continues through a lapse of up to 24 months.
• Changing certification body. Position Statement 2 bars a change in the last four months before the due date, whether or not an unannounced audit is scheduled, unless BRCGS agrees in writing through the concession process.
• Leaving the voluntary programme. The next audit falls in the 28 calendar days up to the anniversary of the last audit. If your last grade was C+ or D+, the due date is six months after the last audit, with the same 28-day window.
• Seasonal sites. In the first year in the voluntary programme the window runs up to six weeks past the due date, with no penalty for lateness.

The BRCGS website lists the current position statements. Check it before you rely on any date in this post, because the Standard and position statements are the only authority.

To build the paperwork around all of this, the BRCGS Food Safety Toolkit includes a Blended and Unannounced Audit Readiness Procedure, an Audit Preparation and Audit Day Procedure and an Audit Grade and Recertification Calendar, as part of 123 templates (78 Word and 45 Excel) for $149.

Sample pages from the toolkit: Audit grade and recertification calendar; Issue 9 self assessment; Cleaning and disinfection procedure.

BRCGS unannounced audit FAQ

Will I be told the date of a BRCGS unannounced audit?

No. For the mandatory audit the certification body tells you the year, within three months of your last audit, and never the date. You do not receive the date under the voluntary programme either.

Can a BRCGS unannounced audit happen outside the four-month window?

Not normally. It falls in the last four months before the audit due date, including the final 28 calendar days. The main exception is lateness on your side: if arrangements are late, the due date moves and the audit can fall in the following four months. Refusal and seasonal production have their own rules.

Can we refuse a BRCGS unannounced audit?

Refusal on a mandatory audit leads to suspension until a new audit is completed, and possible liability for the auditor’s costs. Nominating unavailable days in advance is the permitted route.

How does a BRCGS unannounced audit differ from an announced one?

The protocol generally follows the announced one, and the grading bands and reporting are the same. The differences are that you do not know the date, the grade carries a plus sign, the report and certificate state the unannounced option, and the site carries more of the planning duty under clause 1.1.10.