GFSI Mock Audit (BRCGS, IFS, FSSC 22000): What It Covers and Delivers

What is a GFSI mock audit?

It is a complete audit of your site against the target standard, run with the certification body’s method a few weeks before the real audit. It carries no certification value: its purpose is to know where you stand while there is still time to act.

Food plants in Morocco and across Africa usually book one in three situations:

• an initial certification audit against BRCGS Food Safety Issue 9, IFS Food Version 8 or FSSC 22000;
• a re-audit or surveillance audit, especially after a disappointing grade or score;
• a change of version, such as the move from FSSC 22000 Version 6 to Version 7, whose upgrade audits take place between 1 May 2027 and 30 April 2028.

A mock audit is neither the internal audit programme that all three standards require throughout the year, nor the gap analysis at the start of a project. It comes at the end, once the system is running. Its value lies in one thing: the auditor arrives with fresh eyes and none of the explanations your team has been giving itself for months.

When should you schedule the mock audit?

Early enough to correct, late enough for the system to have produced evidence. In practice we place it two to four months before the certification audit, and always before an unannounced audit window opens.

The timing depends on the standard and the audit programme:

For BRCGS, official document F926 states that within three months of an audit the certification body tells the site the year of its mandatory unannounced audit. That is the moment to book the mock audit.

How does a mock audit run?

It follows the same sequence as a certification audit: preparation, opening, site tour, interviews, live tests, record review, closing. The BRCGS Guide to Certification describes the real audit as observation of procedures and processes, review of documentation and staff interviews; a mock audit does exactly the same.

1. Preparation. Scope, products, lines, HACCP studies, night shifts, outsourced activities. The auditor asks for the documents the certification body will ask for: HACCP plan, culture plan, internal audit programme, last reports.
2. Opening meeting. With senior management. If the mock audit is unannounced, only one senior manager knows the week.
3. Site tour. The auditor starts on the floor: intake, storage, production, high-risk areas if any, dispatch, external areas.
4. Interviews. Operators, shift leaders, maintenance, laboratory, purchasing, the managing director. Each must explain what they do and show it.
5. Live tests. A traceability exercise on a batch chosen by the auditor, a CCP check, a metal detector test, a review of the allergen matrix.
6. Targeted record review. Records linked to what was seen on the floor, not the other way round.
7. Closing meeting. Findings graded critical, major or minor, with the requirement and the evidence observed.

For multi-site groups in West or East Africa, the same method applies site by site; the preparation and part of the record review can be done remotely, but the floor tour and interviews cannot.

What does the mock audit report contain?

A good report looks like the certification body’s report, plus what to do about each finding. Senior management should be able to decide after one read.

At a minimum it includes:

• every non-conformity, graded as at the real audit, with the requirement, the finding and the evidence;
• for BRCGS, an estimate of the likely grade, presented as an indication, never a promise;
• for IFS Food, any KO requirements involved: under the IFS scoring system, a KO scored D removes 50% of the points and the certificate cannot be awarded;
• a dated close-out plan, with an owner for each action and the works to budget;
• the strengths to keep, so the team does not break what works.

The close-out plan must reflect real deadlines: after a BRCGS certification audit, the site has 28 days to close its non-conformities. Better to have dealt with them before.

Which non-conformities does a mock audit reveal most often?

The same ones from plant to plant, and rarely where the team expects them. These are the ten findings our auditors raise most often in mock audits in Morocco and West Africa; this is field experience, not a statistic.

1. HACCP flow diagram that differs from the real line: an added step, a rework loop, a forgotten bypass.
2. Critical limits without justification: a temperature or time inherited from an old document and never validated.
3. Food safety culture plan without follow-up: written by quality, never reviewed by senior management.
4. Incomplete internal audits: requirements never audited, actions never closed.
5. Corrective actions without root cause analysis: the symptom is fixed, the problem returns.
6. Weak supplier approval: packaging suppliers forgotten, no risk assessment, expired certificates.
7. Traceability test too slow or incomplete: raw materials found, but not the packaging or the customers delivered.
8. Poor allergen control: incomplete matrix, cleaning not validated, labels not checked at each changeover.
9. Degraded production environment: condensation above open product, damaged joints, cracked floors, crossed flows.
10. Calibration and equipment checks: thermometers, scales and foreign-body detectors with no verification records.

Several of these touch IFS Food KO requirements, covered in IFS Food Version 8: the KO requirements that fail audits. For BRCGS sections and grading, read our complete Issue 9 guide.

Mock audit or gap analysis: which one do you need?

Both, at different times. The gap analysis opens the project; the mock audit closes it.

For a site that is already certified, a gap analysis is still useful at each change of version; the move to FSSC 22000 Version 7 is the textbook case. If a buyer is about to audit you directly, see also how EU and UK buyers qualify suppliers in Morocco and Africa.

Before the mock audit, check that everything is ready:

• The certification audit date, or the unannounced audit window, is known.
  
• The mock audit scope is identical to the scope of the target certificate.
  
• Records cover a period of real operation.
  
• The internal audit programme has been completed and actions are tracked.
  
• People from every shift, including nights, are available for interviews.
  
• A recent batch is available for the traceability test.
  
• Senior management has blocked time for the closing meeting and action plan.
  
• A budget for possible works is set aside.