BRCGS unannounced audits: rules, windows and how to plan them

What is a BRCGS unannounced audit?

A BRCGS unannounced audit is a full audit against the Standard where the certification body chooses the date and does not tell the site in advance. It replaces the announced re-audit for that year, covers the whole Standard, and results in a new certificate. It exists because the Global Food Safety Initiative (GFSI) benchmark expects certificated sites to be audited unannounced at regular intervals.

The rules sit in two BRCGS documents: the protocol BRCGS079 (version 6, July 2024) and the F926 position statements for Food Safety Issue 9 (version 4 applies from 10 August 2026). Issue 10 is in development, so check the current documents before you change your procedure.

How often must a BRCGS unannounced audit happen?

BRCGS079 requires at least one unannounced audit every 3 years at each certificated site for three Standards: Food Safety, Packaging Materials and Storage and Distribution. For a site on annual audits that means at least every third audit is unannounced. Agents and Brokers and the Consumer Products Standards are outside the rule.

Sites graded C or D are audited every 6 months, and they still need an unannounced audit every 3 years. A failed unannounced audit still meets the GFSI requirement, so the 3-year clock restarts from it.

1. Initial auditAnnouncedA new site has its first audit announced unless it asks for unannounced.
2. Within 2 yearsFirst unannouncedThe first unannounced audit falls in either of the following 2 years.
3. Every 3 yearsRepeatAt least one unannounced audit in each 3-year period after that.
4. After a lapseClock continuesF926 says the 3-year unannounced cycle continues even if certification lapses.

When can the auditor arrive? The 4-month window

The unannounced audit can happen at any time in the 4 months before the audit due date. That period includes the 28 days immediately before the due date, which is the normal window for an announced re-audit. The audit cannot take place after the due date, except by concession for exceptional circumstances or seasonal sites.

Worked example: a site's audit due date is 15 June 2027. The unannounced window opens on 15 February 2027. The announced 28-day window would start on 18 May. The auditor can arrive on any operational day from 15 February to 15 June, excluding the site's nominated non-audit days.

For seasonal sites, BRCGS079 allows the window to extend up to 6 weeks after the due date when the due date falls near the start of the season, with no penalty for the late audit. More on this in scheduling audits around seasonal production.

What are BRCGS non-audit days and how many can a site nominate?

A site may nominate up to 10 days when it is not available for an audit. A site on a 6-month audit frequency may nominate up to 5. The dates must reach the certification body at least 4 weeks in advance and need a justifiable reason, such as a customer visit for a scheduled first production. A specific colleague being absent, or blocking one day every week, is not acceptable.

Seasonal sites get a pro rata allowance. If the season is 2 months long, half the 4-month window, the site gets up to 5 non-audit days.

• ✓Typical shift patterns and production schedules
• ✓Dates with no planned production
• ✓Nominated non-audit days with reasons, at least 4 weeks ahead
• ✓Management organisation chart
• ✓Simple site plan
• ✓Process flow diagram
• ✓Contact details for arrival and site access

Announced vs unannounced: what changes for the planner

The audit content is the same. What changes is who controls the date, how wide the window is and what happens when things go wrong. Treat the two as different booking types in your planning system.

The unannounced certificate supersedes the existing one and is issued within 42 days of the audit. Its expiry is the previous certificate's expiry plus 6 or 12 months, depending on grade, so the audit due date pattern is kept.

How should a certification body plan a BRCGS unannounced audit?

BRCGS079 makes the certification body responsible for starting the unannounced process within 6 months of the last audit. F926 adds that audit options must be discussed with the site within 3 months of the last audit, and that contractual terms must be agreed before the 4-month window opens. The practical sequence looks like this.

1. Set the yearWithin 3 months of the last audit, tell the site which year the unannounced audit falls in. Never give the date.
2. Agree terms before the windowConfirm fees, access arrangements and contacts before the 4-month window opens.
3. Collect site dataShift patterns, production plans and non-audit days, with at least 4 weeks' notice.
4. Reserve auditor capacityAllocate a qualified auditor for the product categories and hold days early in the window.
5. Pick the date internallyChoose an operational day inside the window, avoiding non-audit days, and restrict who can see it.
6. Hold a fallbackKeep a second date before the due date in case of illness, travel disruption or a production stop.

Keeping the date confidential is a systems question as much as a people one. Calendar invites, client portals and automatic confirmation emails can all leak it. Check what your client date confirmation process sends before an unannounced booking goes live.

In ScheduleAI, the unannounced flag, window and non-audit days sit on the audit record, so the engine places the audit early in the window and a planner approves the date before anyone outside the planning team can see it.

What happens if the site refuses entry?

The consequences are set out in the protocol, and planners should know them because they create urgent follow-up work.

If a site fails to make adequate arrangements before the window opens, F926 moves the audit due date to accommodate the delay, raises a major non-conformity and the certificate may expire.

Common BRCGS unannounced audit scheduling mistakes

Most problems come from treating the unannounced audit as a normal booking that happens to be secret. These are the errors that cause late audits and lost certificates.

• Leaving the booking to the final 28 days, so one sick day pushes the audit past the due date.
• Allocating an auditor without checking approval for the site's product categories. See food safety auditor qualification.
• Forgetting that sites with Food Safety and Packaging certificates audited separately need both audits unannounced.
• Accepting non-audit days without a reason, or more than the 10-day or 5-day limit.
• Sending automated confirmations that reveal the date to the site.

For sites holding several schemes, BRCGS recommends auditing the Standards together under one programme, either both announced or both unannounced. See planning audits across several GFSI schemes.

ScheduleAI is audit scheduling software built for testing, inspection and certification (TIC) organisations, with a planner approving every plan.