SQF Internal Audit: A Practical 2027 Program and Checklist

An SQF internal audit program is how a site proves to itself, before the certification body does, that every part of its SQF System works as written. Under the SQF Food Safety Code: Food Manufacturing, Edition 10, element 2.5.4 sets the rules, and it is a Mandatory element: it can never be reported as not applicable at a certification audit (Part A, A2:8).

This guide is for the plant manager or SQF Practitioner rebuilding that program for Edition 10: what 2.5.4 asks for, how to schedule a year of SQF internal audit coverage, why the 11 Core Clauses deserve more audit time, who can audit, how findings close under 2.5.3, and what a usable checklist contains.

For the wider picture of what changed between editions, start with our SQF Edition 10 guide.

What 2.5.4 requires of an SQF internal audit program

Element 2.5.4 (Internal Audits) has a single requirement, 2.5.4.1. SQFI’s change document marks it as changed in Edition 10, so an Edition 9 procedure needs a fresh read rather than a new cover page. In our own words, the requirement expects the site to:

• Document and follow a method for scheduling and running internal audits, with named responsibilities.
• Verify the whole SQF System at least once a year. Every applicable requirement is in scope, not a sample of favorites.
• Use auditors who are independent of the function audited where that is practical.
• Audit against the current checklist or an equivalent, so the tool keeps pace with the Code edition.
• Record objective evidence of what was seen, read and heard.
• Send deficiencies and trends into the corrective action process (2.5.3).
• Communicate results to relevant management and to the staff who must act on them.

Two other requirements lean on this. Internal audit records are on the new annual records list in 2.2.3.3. And the monthly management update under 2.1.2.2 must include internal and external audit results, so your SQF internal audit program feeds senior management every month. Our SQF management review guide covers that update.

Planning an SQF internal audit schedule that covers the whole system

“The whole system” in Edition 10 Food Manufacturing means Module 2 (31 elements, 94 requirements) and Module 11 (33 elements, 164 requirements): 258 auditable requirements. The practical answer is to split them into audit blocks spread across the year.

A workable split follows the Code’s own sections. The frequencies below are an example a site can adopt or adjust; the Code sets the annual minimum, not the block design.

Three planning rules make the schedule hold up:

1. See every shift. A program audited only on first shift has not verified the system. Put second shift and the sanitation shift into the plan by name.
2. Audit the audit program too. Block 2.5 includes 2.5.4 itself, so the person who runs the SQF internal audit program should not audit it.
3. Leave room for triggered audits after a recall, regulatory action, serious complaint or significant change.

At year end, check completeness: every applicable requirement audited, every line and shift visited, any gap closed before the plan year ends. A non-mandatory clause may be treated as not applicable only with a written justification or risk assessment, so the checklist should point to it.

Give the 11 Core Clauses extra attention

Edition 10’s Core Clauses change the arithmetic. Under A2:19 the score is 100 minus deductions. A minor non-conformance normally costs 1 point and a major 5; against a Core Clause a minor costs 2 and a major 7. A critical costs 50 wherever it falls.

Here is why that matters. Three majors against ordinary clauses cost 15 points: a score of 85, Certified. The same three majors against Core Clauses cost 21: a score of 79, which is Certified with Surveillance and a six-month surveillance audit. Our SQF audit scoring guide works through more examples, and the SQF Core Clauses guide covers the evidence each one needs.

The Code does not tell you to audit Core Clauses more often; it is a sensible response to the scoring. Audit each Core Clause element twice a year, schedule those audits early in each half so findings close before the certification audit, and flag every Core Clause finding so it is tracked with priority.

Auditor competence and independence

Edition 10 is specific about training. Requirement 2.9.1.2, new in this edition, says training with a documented assessment must be given to the people who carry out audits and inspections, internal audits included. Requirement 2.9.1.4 then asks for training records that show who was trained, the skills needed, the training given, when, who delivered it, and that competence was confirmed. Your auditor files need all six.

A defensible competence standard for an internal auditor covers:

• completion of an internal auditor course, with a documented assessment of the result;
• working knowledge of the Edition 10 requirements for the elements they audit;
• at least one audit shadowing an experienced auditor before leading one;
• HACCP knowledge for anyone auditing the food safety plan (2.4.3).

Independence: 2.5.4.1 asks for independence from the function audited where practical. The simplest rule to defend is that no one audits a program they own. The SQF Practitioner usually owns much of Module 2, so those blocks go to a trained auditor from another department. Smaller sites can cross-audit between lines, borrow a trained auditor from a sister site, or bring in an external auditor for the blocks where no independent person exists. Whatever you choose, write it into your SQF internal audit procedure so the certification auditor can see the reasoning. Our SQF Practitioner guide covers that role’s duties in more detail.

Recording objective evidence

A checklist full of ticks proves only that someone held a pen. Every line should record what was examined, for conforming and non-conforming results alike.

Mix records, observation of work as it happens, and interviews with the people doing the job. Follow at least one trail, for example from a finished lot back to raw material receipt, or from a complaint to its closed corrective action. Trails test the joins between programs.

Grade findings on the same minor, major and critical scale the certification audit uses. That way the internal result doubles as a forecast of your score.

Closing findings through corrective action (2.5.3)

2.5.4.1 sends deficiencies and trends into the corrective action process, and that process, 2.5.3, is itself a Core Clause. Weak follow-up on internal audit findings can therefore become a Core Clause finding of its own.

2.5.3.1 lists audit and inspection findings among the issues the site must investigate and resolve. The procedure has to cover corrections, a root cause analysis method, corrective and preventive actions, a check that those actions worked, and communication of the outcome to relevant management and staff. For an internal audit finding that means:

1. log the finding in the corrective action register with its grade and a Core Clause flag;
2. make the immediate correction;
3. find the root cause, not just the symptom;
4. set corrective and preventive actions with an owner and a due date;
5. verify effectiveness, ideally at the next audit of that element;
6. report the status at the monthly management update.

Treat repeats as trends. A finding against the same requirement in two consecutive audits, or several minors pointing at one weakness, deserves its own root cause analysis. If root cause work is new to your team, our HACCP corrective action guide covers the method.

One point of confusion: the 40-calendar-day clock in Part A, A2:21 applies to certification audit findings, which the auditor approves and closes in the SQFI database. SQF internal audit findings run on deadlines your own procedure sets. Set them tight enough that nothing is still open when the certification body arrives.

What a usable SQF internal audit checklist contains

SQFI publishes the Edition 10 Food Manufacturing checklist and change document as Excel files on its Food Manufacturing code library page. You can build your own equivalent with room for evidence, grading and follow-up. If you do, cite requirement numbers and write your own audit prompts rather than copying SQFI’s text. A practical checklist row holds:

Add a coverage grid of requirements against months, so the year-end check takes minutes.

If you would rather start from a built program than a blank spreadsheet, the SQF Edition 10 Toolkit includes an Internal Audit Procedure and an Internal Audit Program and Element Checklist that lists every applicable requirement by id with our own audit prompts, plus the Core Clause Readiness Checklist and the Audit Readiness Self-Scoring Workbook for testing your score before the certification body does.

SQF internal audit FAQ

How often does an SQF internal audit have to happen?

The whole SQF System must be audited at least once a year under 2.5.4.1. Splitting it into blocks spread across the year makes that manageable. Auditing Core Clause elements more often is a choice driven by the higher deductions, not a stated requirement.

Can the SQF Practitioner run the internal audits?

The SQF Practitioner can own and manage the program. Auditing the programs they run themselves undermines the independence 2.5.4.1 asks for where practical, so those elements are better audited by a trained auditor from another function or an external auditor.

Can we hire a consultant to do our SQF internal audit?

Yes. An external auditor is one way to get independence on a small site. The program, the follow-up and the corrective actions remain the site’s responsibility, and the auditor’s competence should still be on file.

Do internal audit findings have to close within 40 days?

No. The 40-day rule in A2:21 covers certification audit findings. Your internal audit procedure sets its own closure deadlines, and findings still go through the 2.5.3 corrective action process.

Does the SQF internal audit include Module 11?

Yes. The whole SQF System means every applicable requirement in Module 2 and Module 11, across every area, line and shift in scope.