Getting SQF certified is the easy part. I know that sounds backwards.
All the attention goes to audit day: the prep, the stress, the "did we forget anything" panic. Then you pass, you get your certificate, and everyone finally exhales. The part you may not know is that your SQF Certification is only valid for 12 months. During every one of those months, you have to be running the system, not just holding a piece of paper that proves you once did.
There are over 14,000 SQF certified sites across 55 countries1. That tells us two things: the standard is becoming necessary in food manufacturing, and a lot of facilities are figuring out how to maintain it long after the auditor has driven away.
Most facilities are still on SQF Edition 9, which has been the standard since May 2021. Edition 10 has been in the works for a while, but SQFI has held off releasing it while the benchmarking application gets reviewed alongside GFSI. So, for now, auditors are working from Edition 9, and that means they're evaluating your ongoing maintenance, not just what's in place on audit day.
That's usually where facilities quietly fall apart. Not because the systems are hard, but because nobody owns them, and the momentum from audit prep evaporates by month three. Here are the ten systems that actually keep your certification valid in between audits.
Your food safety plan, SOPs, and HACCP plan are living documents. Every time a process, supplier, or piece of equipment changes, they need to change too. If what's written down doesn't match what's actually happening on the floor, an auditor will find that gap in about five minutes.
Sloppy record keeping is one of the most common non-conformances auditors flag: forms filled out incorrectly, missing information, and entries corrected with white-out.2 This isn't a rare slip-up. It's a pattern.
Set a real review schedule. Annual review is the floor, not the target. Any time something operational changes, review the document then, not whenever the calendar says it's due.
SQF doesn't just want proof that someone sat through a training session. They want evidence your employees actually know how to do their job because of it. That means records of initial training, records of refreshers, and something that shows the training changed behavior, not just a signature on a sheet.
Turnover makes this harder. New hires need food safety onboarding before they touch product, and that training has to be documented. Skip this step and non-conformances pile up fast.
Don't wait for the external auditor to find your problems. Internal audits are how you catch issues while they're still small and fixable. SQF expects these throughout the year, not crammed in two weeks before your renewal.
Think of internal audits as an early warning system. If you only run them right before the real audit, you're not managing risk, you're just hoping nothing turns up.
This is where a lot of facilities get sloppy. Under Edition 9, fixing the immediate problem isn't enough. You need a root cause analysis and evidence that your fix actually worked, real verification, not just a note that says "resolved."
If a piece of equipment drifts out of calibration, you need a documented assessment of whether product safety was affected during that window. That's a specific, explicit requirement now, not something you can infer your way around.
Any equipment tied to food safety (thermometers, checkweighers, metal detectors) needs regular calibration, with documentation to prove it. The same goes for preventive maintenance on anything that touches food.
The mistake is treating maintenance as a facilities issue that has nothing to do with food safety. It isn't. Auditors will ask your maintenance team direct food safety questions, so they need to understand the why, not just know how to fix the machine.
A contractor showing up once a month and leaving a report in a binder isn't a program. You need device inspection logs, trend data on activity, and records of any structural fixes made to keep pests out in the first place.
Pest control is actually the single most common category of non-conformance in Edition 9, showing up in both critical and major findings across audits worldwide.3 If your pest control records are just a stack of service invoices with no analysis behind them, you're far from alone, but it's still a gap.
Flaking paint, wall cracks, condensation. Small stuff, until it becomes a route for contamination. Routine facility inspections, withresults logged and follow-up actions tracked, show you're actively managing the building rather than just reacting when something breaks.
This one's newer, and it catches people off guard. SQF now wants proof that food safety understanding runs through the whole team, not just the QA department. That includes training records and competency checks for people who don't think of themselves as "food safety staff" but absolutely are, like your maintenance techs.
If your maintenance tech can't explain why a food-contact surface repair requires specific materials, that's a food safety culture gap, and it's one auditors are trained to spot.
Keep your approved vendor list current and make sure every supplier still meets your requirements. Review vendor performance regularly, handle new approvals, remove vendors who fall short, and keep the team in the loop when something changes.
Your certification covers your facility, but your ingredients and packaging come from somewhere else. You need ongoing verification that suppliers still meet the standards you agreed to: updated certificates, periodic reviews, and a clear process for what happens when a supplier falls out of compliance.
This isn't a one-and-done list. Suppliers change ownership,get acquired, or let their own certifications lapse without telling you. You need a system that checks in regularly, especially given that a single recall costs food companies around $10 million on average before you even factor in reputational damage or lost sales.
Someone senior needs to actually look at all of it: the audits, the CAPAs, the training records, and draw conclusions. Management review isn't a box-checking meeting. It's where leadership confirms the food safety system is genuinely working and decides where resources need to go.
Skip this and every department ends up doing its own thing, with nobody connecting the dots.
Certification renews annually, and unannounced audits happen at least once every three years, sometimes more often if a facility opts in.There's no off season. The system is either running or it's falling behind, and it always falls behind at the worst possible time: during the audit you didn't see coming.
Here's the upside. A four-year study of 406 food facilities from the University of Arkansas, published in the Journal of Food Protection, found that sites running a GFSI-based program like SQF saw a 34% drop in recalls.4 That's what you get for doing the unglamorous, continuous work instead of just checking boxes once a year.
None of these ten systems is especially hard on its own. The challenge is keeping all ten running at the same time, all year, without one person clearly responsible for them. The facilities that struggle with SQF usually aren't the ones with bad food safety practices. They're the ones treating certification like a finish line instead of an ongoing job, trying to manage ten interlocking systems across spreadsheets and shared drives that half the team forgets to check. This is exactly where a dedicated system like MakerComply earns its keep, keeping training, documentation, CAPA, and audit records in one place instead of scattered across whoever remembered to updatewhat.
The certificate doesn't prove you did the work. It proves you're still doing it.
References:
Getting SQF certified is the easy part. I know that sounds backwards.
All the attention goes to audit day: the prep, the stress, the "did we forget anything" panic. Then you pass, you get your certificate, and everyone finally exhales. The part you may not know is that your SQF Certification is only valid for 12 months. During every one of those months, you have to be running the system, not just holding a piece of paper that proves you once did.
There are over 14,000 SQF certified sites across 55 countries1. That tells us two things: the standard is becoming necessary in food manufacturing, and a lot of facilities are figuring out how to maintain it long after the auditor has driven away.
Most facilities are still on SQF Edition 9, which has been the standard since May 2021. Edition 10 has been in the works for a while, but SQFI has held off releasing it while the benchmarking application gets reviewed alongside GFSI. So, for now, auditors are working from Edition 9, and that means they're evaluating your ongoing maintenance, not just what's in place on audit day.
That's usually where facilities quietly fall apart. Not because the systems are hard, but because nobody owns them, and the momentum from audit prep evaporates by month three. Here are the ten systems that actually keep your certification valid in between audits.
Your food safety plan, SOPs, and HACCP plan are living documents. Every time a process, supplier, or piece of equipment changes, they need to change too. If what's written down doesn't match what's actually happening on the floor, an auditor will find that gap in about five minutes.
Sloppy record keeping is one of the most common non-conformances auditors flag: forms filled out incorrectly, missing information, and entries corrected with white-out.2 This isn't a rare slip-up. It's a pattern.
Set a real review schedule. Annual review is the floor, not the target. Any time something operational changes, review the document then, not whenever the calendar says it's due.
SQF doesn't just want proof that someone sat through a training session. They want evidence your employees actually know how to do their job because of it. That means records of initial training, records of refreshers, and something that shows the training changed behavior, not just a signature on a sheet.
Turnover makes this harder. New hires need food safety onboarding before they touch product, and that training has to be documented. Skip this step and non-conformances pile up fast.
Don't wait for the external auditor to find your problems. Internal audits are how you catch issues while they're still small and fixable. SQF expects these throughout the year, not crammed in two weeks before your renewal.
Think of internal audits as an early warning system. If you only run them right before the real audit, you're not managing risk, you're just hoping nothing turns up.
This is where a lot of facilities get sloppy. Under Edition 9, fixing the immediate problem isn't enough. You need a root cause analysis and evidence that your fix actually worked, real verification, not just a note that says "resolved."
If a piece of equipment drifts out of calibration, you need a documented assessment of whether product safety was affected during that window. That's a specific, explicit requirement now, not something you can infer your way around.
Any equipment tied to food safety (thermometers, checkweighers, metal detectors) needs regular calibration, with documentation to prove it. The same goes for preventive maintenance on anything that touches food.
The mistake is treating maintenance as a facilities issue that has nothing to do with food safety. It isn't. Auditors will ask your maintenance team direct food safety questions, so they need to understand the why, not just know how to fix the machine.
A contractor showing up once a month and leaving a report in a binder isn't a program. You need device inspection logs, trend data on activity, and records of any structural fixes made to keep pests out in the first place.
Pest control is actually the single most common category of non-conformance in Edition 9, showing up in both critical and major findings across audits worldwide.3 If your pest control records are just a stack of service invoices with no analysis behind them, you're far from alone, but it's still a gap.
Flaking paint, wall cracks, condensation. Small stuff, until it becomes a route for contamination. Routine facility inspections, withresults logged and follow-up actions tracked, show you're actively managing the building rather than just reacting when something breaks.
This one's newer, and it catches people off guard. SQF now wants proof that food safety understanding runs through the whole team, not just the QA department. That includes training records and competency checks for people who don't think of themselves as "food safety staff" but absolutely are, like your maintenance techs.
If your maintenance tech can't explain why a food-contact surface repair requires specific materials, that's a food safety culture gap, and it's one auditors are trained to spot.
Keep your approved vendor list current and make sure every supplier still meets your requirements. Review vendor performance regularly, handle new approvals, remove vendors who fall short, and keep the team in the loop when something changes.
Your certification covers your facility, but your ingredients and packaging come from somewhere else. You need ongoing verification that suppliers still meet the standards you agreed to: updated certificates, periodic reviews, and a clear process for what happens when a supplier falls out of compliance.
This isn't a one-and-done list. Suppliers change ownership,get acquired, or let their own certifications lapse without telling you. You need a system that checks in regularly, especially given that a single recall costs food companies around $10 million on average before you even factor in reputational damage or lost sales.
Someone senior needs to actually look at all of it: the audits, the CAPAs, the training records, and draw conclusions. Management review isn't a box-checking meeting. It's where leadership confirms the food safety system is genuinely working and decides where resources need to go.
Skip this and every department ends up doing its own thing, with nobody connecting the dots.
Certification renews annually, and unannounced audits happen at least once every three years, sometimes more often if a facility opts in.There's no off season. The system is either running or it's falling behind, and it always falls behind at the worst possible time: during the audit you didn't see coming.
Here's the upside. A four-year study of 406 food facilities from the University of Arkansas, published in the Journal of Food Protection, found that sites running a GFSI-based program like SQF saw a 34% drop in recalls.4 That's what you get for doing the unglamorous, continuous work instead of just checking boxes once a year.
None of these ten systems is especially hard on its own. The challenge is keeping all ten running at the same time, all year, without one person clearly responsible for them. The facilities that struggle with SQF usually aren't the ones with bad food safety practices. They're the ones treating certification like a finish line instead of an ongoing job, trying to manage ten interlocking systems across spreadsheets and shared drives that half the team forgets to check. This is exactly where a dedicated system like MakerComply earns its keep, keeping training, documentation, CAPA, and audit records in one place instead of scattered across whoever remembered to updatewhat.
The certificate doesn't prove you did the work. It proves you're still doing it.
References:
