BRCGS Unannounced or Blended Audit: The Rules in Force in Late 2026

Which BRCGS audit programmes apply at the end of 2026?

Four audit programmes coexist for BRCGS Food Safety Issue 9, and the GFSI page recognises all four: announced, blended announced, voluntary unannounced, and mandatory unannounced once every three years. The content of the audit is the same in every case; what changes is the notice given and the organisation it requires.

For a Moroccan exporter, the practical consequence is simple. From the second year of certification, the plant must be ready on any working day of the window, not only on a planned audit day. BRCGS says so in its protocol: the aim is to encourage an audit-ready food safety culture, not to catch sites out.

On the GFSI page, these four programmes are recognised under version 2020 of the benchmarking requirements. The 2026 BRCGS position statements, for their part, align Issue 9 with the 2024 version.

What changed in 2026?

Only one new rule reaches the shop floor: clause 7.4.2 on protective footwear, applicable since 10 August 2026. Everything else is alignment and formatting.

Clause 7.4.2. Among the protective clothing to be provided where required to prevent product contamination, the clause now lists suitable protective footwear alongside snoods for beards and moustaches. The BRCGS interpretation states that this footwear must be issued and worn to prevent product contamination and to maintain hygiene. On a Moroccan site, the rule also concerns seasonal workers, agency staff and visitors to production areas, not only permanent employees.

Statements already in force still apply. Since 2024, the site has been responsible for everything that allows the unannounced audit to take place (statement 1). It cannot change certification body in the four months before its re-audit due date (statement 2). And an initial audit is the first BRCGS audit at a site address, or an audit at a site whose certificate lapsed more than 24 months earlier (statement 3).

What must a site arrange for the unannounced audit?

A contract signed in time, up-to-date information and an organisation that keeps working whichever manager is absent. The BRCGS079 protocol sets out the obligations, and missing them costs a major non-conformity.

• The calendar. Within three months of an audit, the certification body tells the site the year of the unannounced audit. It starts the scheduling process no later than six months after the last audit.
• The contract. The site must have agreed contractual terms before the four-month window opens. Otherwise the audit due date is moved, the certificate may expire and a major non-conformity is raised.
• Non-audit days. The site may nominate up to ten days without audit (five if it is audited every six months), for a justified reason, at least four weeks in advance. A colleague on holiday is not an acceptable reason.
• The auditor’s arrival. The audit starts with a short opening meeting, then the inspection of the production areas begins within 30 minutes of the auditor’s arrival.
• Refusal of access. It leads to suspension of the certificate, a major non-conformity and a new unannounced audit within the following four months.

Checklist to agree with management before the window opens:

• The contract with the certification body covers the unannounced audit and is signed.
  
• Maintenance shutdowns and periods without production are notified to the certification body in writing.
  
• Any non-audit days are justified and notified at least four weeks in advance.
  
• A welcome is ready at any opening hour: contact person and deputy, workwear and footwear for the auditor.
  
• Every manager has a deputy, named in writing, present and trained.
  
• The day’s records are up to date at any hour, not only at the end of the shift.
  

When is a blended audit possible, and is it worth it?

A blended audit is possible only at an announced recertification, and only if the certification body and the site both agree. It can lighten the organisation of a well-digitised site; it brings nothing to a site whose records are scattered on paper.

The rules of the BRCGS080 procedure are precise. The certification body first carries out a risk assessment: the site’s history, complaints and recalls, the availability of documents in electronic form, the teams’ ability to work with video. The remote part covers mainly documents and records. The on-site part covers at least good manufacturing practices, HACCP in action and the traceability test. The total duration remains that of an on-site audit.

Three points to watch:

• non-conformities raised remotely count in the grade, even if they are corrected before the on-site part;
• a critical non-conformity at the remote stage, or a remote result that would prevent certification, leads to the immediate withdrawal of the existing certificate and a new, fully on-site audit;
• if the technology fails because of the site, the lost audit day may be charged to the site, as provided in the contract.

Where does Issue 10 stand?

In preparation, with no date. BRCGS has published neither the final content of Issue 10 nor a publication or effective date, so no new requirement can be audited today.

BRCGS consulted the industry on Issue 9 and brought together a technical working group to prepare the new version.

Until then, a site prepares and gets certified against Issue 9 and its position statements. The status of all five BRCGS standards is summarised on our BRCGS certification hub. For the full certification framework, read our guide to BRCGS certification in Morocco, and for the audit day itself, preparing the BRCGS certification audit.