ISO Compliance Insights & Best Practices

SQF Audit Scoring: The Definitive 2027 Guide to Ratings

SQF audit scoring under Edition 10 starts every site at 100 and takes points off for each non-conformance, with heavier deductions for findings against the 11 Core Clauses. The final number decides your rating, and the rating decides what happens next: a 12-month cycle, a surveillance audit at six months, a failed initial audit, or an immediate suspension.

This guide explains the grades, the deductions and the ratings, works through examples at 80, 79 and 69, and sets out the clocks that start once the auditor leaves. It follows Part A of the SQF Food Safety Code: Food Manufacturing, Edition 10, which SQFI expects to be used for audits from January 2, 2027 at the earliest, subject to GFSI benchmarking.

Free gap assessment

Would your HACCP plan survive an inspection?

Score the whole of the Codex text, free - the good hygiene practices as well as the seven principles, with the US and EU overlays on top.

Run the free HACCP gap assessment → or View premium report sample

How SQF audit scoring works

The auditor grades each non-conformance as minor, major or critical (A2:18). SQFI’s Edition 10 glossary sets out what each grade means. In our words:

Minor: an occasional lapse. It does not mean the system has broken down, but it could lead to that if left uncorrected.
Major: a failure of a system element or a systemic breakdown, such as a pattern of minors, a serious departure from requirements, or no evidence of compliance. It points to a food safety risk, though not likely a significant public health risk.
Critical: a breakdown of control at a critical control point, a prerequisite program or another process step that is likely to pose a significant public health risk or contaminate product. Systematic falsification of food safety records is also critical.

Each grade carries a deduction (A2:19). Edition 10 adds a higher rate for findings against a Core Clause:

Non-conformance	Points deducted
Minor	1
Minor against a Core Clause	2
Major	5
Major against a Core Clause	7
Critical	50

The Core Clauses are 2.1.1, 2.1.2, 2.1.3, 2.3.4, 2.4.3, 2.4.8, 2.5.3, 2.6.1, 2.8.1, 11.2.5 and 11.7.3. Our SQF core clauses guide covers what auditors check in each.

SQF audit scoring bands and what each rating means

Score	Rating	What follows
80–100	Certified	Certificate issued; recertification audit in 12 months
70–79	Certified with Surveillance	Certificate issued; surveillance audit around the six-month mark
0–69 at an initial audit	F – Fails to Comply	No certificate; the site has to reapply
0–69 at a surveillance or recertification audit	Certified with Unannounced Surveillance	Certificate suspended immediately; reinstated only after the certification body verifies corrective actions on site; after a recertification audit, a six-month unannounced surveillance audit follows

The bottom row of the SQF audit scoring bands catches people out. The label contains the word “certified”, but the certificate is suspended. Do not let anyone tell a customer you are certified on the strength of that rating.

Worked SQF audit scoring examples

Four example audits show how SQF audit scoring plays out with a realistic mix of findings at a single manufacturing site:

Audit	Findings	Deductions	Score	Rating
A	3 minors, 2 majors, 1 Core Clause major	3 + 10 + 7 = 20	80	Certified
B	As A, plus 1 more minor	21	79	Certified with Surveillance
C	3 minors, 3 Core Clause minors, 3 majors, 1 Core Clause major	3 + 6 + 15 + 7 = 31	69	F at initial audit; Certified with Unannounced Surveillance (suspended) at recertification
D	1 critical, 2 minors	50 + 2 = 52	48	Fails at an initial audit regardless of score; suspended at any other audit

Audit A to B shows how thin the margin is: one extra minor, perhaps an unsigned record, moves you from a 12-month cycle to an extra surveillance audit at six months.

Audit C has no critical findings at all. It fails on volume and weight. Move just two of its Core Clause minors to ordinary clauses and it scores 71, a pass with surveillance. That is the practical case for spending your internal audit time on the Core Clauses.

Audit D shows why the critical deduction is set at 50. One critical alone leaves a maximum of 50, well below 70.

Critical non-conformances

A critical at an initial certification audit fails the audit outright (A2:18). At a surveillance or recertification audit, the 50-point deduction takes the score below 70, which gives the Certified with Unannounced Surveillance rating and an immediate suspension.

By definition, a critical involves a CCP, prerequisite program or process step out of control, or falsified records. The second is worth stating plainly to every shift: falsified records are graded critical, and intentional, systemic falsification is also a ground for withdrawing certification (A2:29).

What happens after the audit

Part A sets a series of clocks once the audit ends:

Step	Timing	Part A
Non-conformances given to the site in writing	Before the closing meeting	A2:20
Reviewed audit report reaches the site	Within 10 calendar days	A2:20
Corrective actions and root cause analysis approved by the auditor and closed in the SQFI database	Within 40 calendar days of the audit end	A2:21
Certification decision	No later than 50 calendar days after the audit end	A2:22
Certificate issued	Within 5 calendar days of the decision	A2:23
Appeal to the certification body	Within 15 days of the reviewed evidence; to SQFI within 55 days of the audit if unresolved	A2:25

Every minor and major needs a corrective action plus root cause analysis, not just a correction (A2:21). The certification body can extend the deadline in two situations: a minor that poses no immediate risk to product safety while interim controls hold it, or a major where the fix is structural, seasonal or needs long lead-time equipment, provided interim controls manage the risk. Our HACCP corrective action post covers how to write a root cause that an auditor will accept.

Surveillance audits

A Certified with Surveillance or Certified with Unannounced Surveillance rating brings a surveillance audit within 30 days either side of the six-month anniversary of the last day of the audit that earned it (A2:19, A2:26). When the surveillance audit follows a Certified with Unannounced Surveillance rating, it is unannounced within that window. It is a full system audit with a new score, and it does not move your recertification date. Seasonal sites have their own timing rules (A2:27).

Using SQF audit scoring before the auditor arrives

You can run the same arithmetic on yourself. After your internal audits, grade each open finding the way a certification body auditor would, apply the Edition 10 deductions, and see where you land. Three habits make that self-score honest:

Grade patterns, not just single findings. Several minors against the same element can amount to a major, because a pattern of minors is one of the ways the glossary describes a major.
Tag every finding with its element. Without the element you cannot tell whether the Core Clause rate applies, and SQF audit scoring depends on that tag.
Aim for margin, not 80. At 81, one minor the auditor finds and you missed keeps you certified; a second drops you to surveillance. Close the Core Clause gaps first, since each one is worth more.

A self-score is only as good as the internal audit behind it, so cover every element, and audit the Core Clauses with someone who does not own the program.

Suspension and withdrawal

A2:28 lists seven reasons a certificate is suspended:

The audit is not permitted within the 60-day audit window.
Corrective actions are not taken in time.
An unannounced audit is refused, or the auditor is refused entry.
The site turns away an auditor or SQFI at a visit outside the normal audit cycle, for example when SQFI comes to validate an audit or the auditor returns to check corrective actions.
A Certified with Unannounced Surveillance rating at a surveillance or recertification audit.
Failure to maintain the Code’s requirements, such as regulatory enforcement action, uncorrected regulatory inspection findings, or a confirmed outbreak linked to the site.
Failure to meet the agreement with the certification body.

In every case the site sends a corrective action plan within 48 hours of the suspension notice. After a low score (A2:28-4), the plan includes the root cause, the certification body verifies the corrective actions on site within 60 days, and only then is the certificate reinstated. Where the suspension came from a recertification audit, an unannounced surveillance audit follows within six months. The refused-audit triggers have their own follow-up steps; our SQF unannounced audit guide covers those.

Withdrawal is the next step down (A2:29). Its four causes are not following the suspension protocol, not taking approved corrective action in time, intentional and systemic falsification of records, and failing to maintain the integrity of the certificate. The certificate is returned within 30 days and the site cannot reapply for 12 months.

For the full picture of the edition change, read our SQF Edition 10 guide.

The SQF Edition 10 Toolkit includes an Audit Readiness Self-Scoring Workbook that applies the Edition 10 deductions and bands, an Audit Non-conformance Response and Certification Procedure built around the 40-day clock, a Certification Status and Notification Procedure for suspension and withdrawal, and the Core Clause Readiness Checklist.

SQF audit scoring FAQ

What is a passing SQF audit score?

80 to 100 is Certified, and 70 to 79 is Certified with Surveillance, which still issues a certificate but adds a surveillance audit. Below 70 fails an initial audit and suspends a certified site.

Does one critical non-conformance fail the audit?

At an initial audit, yes, outright (A2:18). At any other audit, its 50-point deduction takes the score below 70, so the certificate is suspended.

How long do we have to close audit findings?

Corrective actions, with root cause analysis, must be approved by the auditor and closed in the SQFI database within 40 calendar days of the audit end (A2:21), unless the certification body grants an extension.

Does a surveillance audit change our recertification date?

No. The surveillance audit is a full audit with its own score, held within 30 days either side of the six-month anniversary, but the recertification date stays where it was (A2:26).

What happens after an F – Fails to Comply rating?

At an initial audit, no certificate is issued and the site has to reapply (A2:24). Use the audit report as your gap list, close the findings properly, and make sure your records cover the period SQFI recommends before booking again.

Governance Docs

Governance Docs LLC