SQF Certification: Codes, Audits, and Proof of Compliance

Food safety programs can look complete on paper and still fall short during an SQF audit. A facility may have documented procedures, employee training records, and a hazard analysis in place, yet struggle to demonstrate that its controls work consistently during production, cleaning, and equipment maintenance.

That gap between documented procedures and verifiable performance is where audit findings often emerge. SQF certification requires food businesses to establish a food safety management system and demonstrate that it works in practice, not simply that the paperwork exists.

For food safety and quality managers preparing for an audit, understanding the current SQF Codes is essential. The former Level 1, Level 2, and Level 3 terminology still appears in supplier questionnaires, but SQFI replaced that structure years ago. Meanwhile, Edition 10 introduces further changes that facilities should prepare for ahead of the anticipated January 2027 transition.

This guide explains what SQF certification covers, how today’s programs differ from the legacy levels, what auditors evaluate, and how facilities can build reliable evidence of compliance.

Key Takeaways:

• SQF certification demonstrates that a facility’s food safety or quality management system meets the requirements of the applicable SQF Code through an independent certification process.
• The former numbered levels have been replaced by industry-specific Food Safety Codes, the Quality Code, and Fundamentals programs.
• Audit readiness depends on records showing that preventive controls work consistently, not just documented procedures.
• Compressed air and process gases may require documented monitoring and testing when their use creates a food safety or product quality risk.
• Edition 10 strengthens expectations around food safety culture, change management, and risk-weighted audit scoring. Facilities should begin gap assessments before their applicable audit date.

What Is SQF Certification?

SQF certification is an independent assessment of a site’s food safety or quality management system against an applicable Safe Quality Food Code. The program is recognized by the Global Food Safety Initiative (GFSI) for eligible Food Safety Codes, helping food businesses demonstrate that their systems meet internationally benchmarked food safety requirements.

Certification applies to a defined site and scope. A company operating multiple facilities shouldn’t assume that certification at one location automatically covers the others. The applicable Code depends on what a site produces, handles, stores, or distributes.

During certification, an auditor reviews the site’s documented system and its implementation. This can include:

• Examining procedures
• Interviewing employees
• Observing operations
• Verifying whether controls are effective

Certification isn’t a guarantee that food safety incidents can never occur. It demonstrates that a facility has met applicable requirements at the time of assessment and must continue maintaining its system to retain certification.

What Does SQF Stand for in the Food Industry?

SQF stands for Safe Quality Food. The program is administered by the Safe Quality Food Institute (SQFI), a division of the Food Industry Association (FMI).

SQFI develops the Codes and certification framework, while independent certification bodies conduct audits and issue certificates to qualifying sites.

GFSI recognition matters to suppliers serving major retailers, manufacturers, and food service businesses. It indicates that an eligible certification program has been benchmarked against GFSI’s food safety requirements. Buyers can use this recognition when evaluating suppliers, although GFSI doesn’t directly certify individual facilities.

What Is SQF Certified vs. SQF Compliance?

• An SQF-certified facility has completed the certification process and holds a current certificate for the relevant site, scope, and Code.
• An SQF-compliant facility may follow requirements aligned with an SQF Code without holding a current certificate. The terms aren’t interchangeable when a buyer specifically requires certification.

A food safety plan, internal audit, or set of procedures may demonstrate a commitment to compliance, but these alone don’t satisfy a formal certification requirement. Facilities should confirm the buyer’s required Code, site coverage, and certificate validity.

Why Buyers Require SQF-Certified Suppliers

Retailers and food manufacturers need evidence that suppliers can manage food safety risks consistently. SQF certification provides a standardized way to evaluate a supplier’s food safety management system.

Certification can improve access to commercial opportunities and reduce the need for some customers to repeat basic assessments. However, buyers may still conduct their own audits or require additional controls.

For suppliers pursuing new contracts, the essential question is whether the buyer requires a current certificate and, if so, which Code and scope must be covered.

SQF Certification Levels and Codes Explained

SQFI replaced the old numbered certification structure beginning with Edition 8. Today’s program uses industry-specific Food Safety Codes, the SQF Quality Code, and Fundamentals programs.

The former levels remain common in procurement documents and online searches. Understanding their approximate equivalents helps facilities choose the correct certification pathway.

SQF Level 2 and Level 3 Certification Today

The former SQF Level 2 broadly corresponds to today’s SQF Food Safety Codes. These Codes address food safety management and operational practices across industry sectors, including:

1. Manufacturing
2. Primary production
3. Food packaging
4. Storage and distribution

The former Level 3 referred to food safety certification combined with the SQF Quality Code. The Quality Code focuses on product quality, including specifications, process controls, and measures that help ensure products consistently meet defined requirements.

The Quality Code is an add-on to an SQF Food Safety Code, not a standalone replacement for food safety certification.

If a supplier questionnaire asks whether a company holds “SQF Level 3 certification,” the facility should clarify whether the buyer means certification against the relevant Food Safety Code plus the Quality Code. It should then provide its current certificate details.

The term “SQF quality certification” remains useful when discussing the quality-focused component, but facilities should identify the actual Code listed on their certificate rather than relying on legacy terminology.

Fundamentals Programs for Small or Low-Risk Sites

SQF Fundamentals programs help eligible businesses establish or strengthen their food safety systems before pursuing a more comprehensive certification program.

Basic and Intermediate options support different stages of system development. Basic emphasizes foundational practices, while Intermediate places greater emphasis on documentation and structured controls.

These programs can help smaller operations demonstrate progress to customers. However, Fundamentals programs aren’t equivalent to GFSI-benchmarked SQF Food Safety Codes. A Fundamentals certificate may not satisfy a buyer that explicitly requires GFSI-recognized certification.

Choosing a Code, Including SQF Food-Grade Warehousing

The correct Code depends on the site’s activities, products, and industry sector. SQFI’s Code Selector helps businesses identify an appropriate starting point.

A food manufacturer needs a Code that covers its manufacturing activities, while a warehouse handling packaged food may need the SQF Food Safety Code: Storage and Distribution.

Food-grade warehousing doesn’t automatically mean SQF-certified warehousing. Buyers should verify the provider’s current certificate, site address, Code, and scope. They should also confirm that the certified activities cover the services being purchased.

Relevant controls may include temperature management, pest control, sanitation, traceability, allergen segregation, and product protection.

The legacy-level mappings are approximate comparisons, not formal equivalencies. GFSI recognition applies to eligible SQF Food Safety Codes, not automatically to every SQF program.

These are broad comparisons, not formal equivalencies. Buyers should evaluate the actual certificate and scope rather than relying on a legacy label.

SQF Certification Requirements

SQF certification requirements center on management commitment, a qualified SQF practitioner, a HACCP-based food safety plan, prerequisite programs, and records demonstrating that the system works in daily operations.

The precise requirements depend on the applicable Code, product category, and site activities. Facilities should use the relevant Code and supporting guidance as their authoritative reference.

SQF HACCP Plan and Management Requirements

Management must provide the resources, authority, and oversight needed to maintain food safety controls. Responsibilities should be clear, employees should receive appropriate training, and the site should address identified problems promptly.

The site must designate a qualified SQF practitioner to coordinate the food safety management system, maintain relevant plans and records, verify implementation, and help ensure nonconformities are addressed. The practitioner needs the knowledge and authority to do so effectively.

A HACCP-based food safety plan is another central requirement. Hazard Analysis and Critical Control Point (HACCP) principles help facilities identify biological, chemical, and physical hazards, assess their significance, and establish appropriate controls.

The plan should reflect actual operations, from receiving ingredients through production, storage, and dispatch. It should identify relevant hazards, define control measures, establish monitoring and corrective action procedures, and explain how the system is verified.

For a detailed explanation of the methodology, see TRI Air Testing’s guide to the seven principles of HACCP.

Auditors look beyond the existence of a plan. They may:

• Interview employees
• Review monitoring records
• Examine deviations
• Compare written procedures with actual practices

Missing records or repeated deviations without effective corrective action can undermine confidence in the system.

Prerequisite Programs, Including Air and Gases

Prerequisite programs establish the operating conditions needed to produce and handle safe food. Depending on the site and applicable Code, these may cover sanitation, pest prevention, equipment maintenance, employee hygiene, water quality, waste management, and environmental monitoring.

Compressed air and process gases deserve attention when they contact food, food-contact surfaces, or packaging surfaces that could affect product safety.

Compressed air can contain moisture, oil, particles, and microorganisms introduced through the compressor, distribution system, or point of use. The risk depends on the equipment, treatment systems, and intended application.

Air used directly in a food process may present a different risk from air used to power equipment with no contact with exposed product. Facilities should evaluate each application rather than assume every compressed air line needs identical controls.

A risk-based assessment should consider:

• Whether air or gas contacts exposed food, food-contact surfaces, or packaging.
• Which contaminants could affect product safety or quality.
• The effectiveness of filtration, drying, and other treatment equipment.
• Potential contamination from condensate, oil carryover, corrosion, or microbial growth.
• How the facility will verify that controls remain effective.

Testing should follow the applicable Code, customer specifications, risk assessment, and relevant technical standards. There is no universal SQF testing frequency for every compressed air system. Facilities should document why their sampling frequency is appropriate and how they respond to changes, equipment failures, or unfavorable results.

Depending on the application, testing may assess particles, moisture, oil, or microbiological contamination. Relevant ISO 8573 methods can help evaluate compressed air purity, but the appropriate methods and acceptance limits depend on the intended use.

Environmental monitoring is related but distinct. It may involve sampling food-contact and non-food-contact surfaces, equipment, or the surrounding processing environment for relevant microorganisms. Facilities should ensure their monitoring programs reflect the hazards associated with their operations.

Compressed air testing doesn’t replace environmental monitoring, and environmental swabs don’t establish that compressed air is suitable for every process.

Audit-ready evidence may include:

• A documented assessment of compressed air and gas applications.
• A sampling plan specifying locations, test parameters, frequency, and acceptance criteria.
• Laboratory reports identifying samples, methods, results, and relevant limits.
• Maintenance records for compressors, filters, dryers, and distribution lines.
• Corrective action records and follow-up verification after unfavorable results.

Independent laboratory testing can provide objective data about compressed air quality. Results become more useful when linked to the site’s risk assessment, reviewed by responsible personnel, and incorporated into a documented verification process.

SQF Requirement Areas and the Evidence Auditors Expect

Auditors assess both the documented system and its implementation. Common evidence categories include the following, although specific requirements vary by Code and site activities.

A passing laboratory result alone may not establish compliance. Auditors may ask why the sample was taken, how the result compares with acceptance criteria, who reviewed it, and what happened if it failed.

For example, if a compressed air sample exceeds the facility’s microbiological limit, the site should document its response. Depending on the risk, this may involve assessing affected product, investigating the source, correcting filtration or equipment problems, and conducting follow-up testing.

A corrective action should demonstrate that the underlying cause was addressed and the fix was effective, not merely that a task was completed.

HACCP SQF and ISO 9001 SQF Certification: How They Compare

HACCP, SQF, and ISO 9001 serve different purposes. Understanding the distinctions helps facilities choose suitable systems and explain their credentials accurately.

HACCP is a method for identifying and controlling food safety hazards. It forms part of many food safety management systems, including SQF, but HACCP alone isn’t equivalent to SQF certification.

SQF provides a broader certification framework that includes applicable HACCP-based controls and other requirements, such as management responsibility, prerequisite programs, verification, traceability, and corrective action.

ISO 9001 is a general quality management system standard focused on consistently meeting customer and applicable requirements and improving organizational processes. It’s not specifically designed for food safety and isn’t a GFSI-recognized food safety certification scheme.

Sources: FAO/WHO Codex Alimentarius, General Principles of Food Hygiene (CXC 1-1969); SQFI, Certification Programs; and ISO, ISO 9001 Explained.

A facility can use ISO 9001 principles alongside SQF, but ISO 9001 certification doesn’t substitute for SQF when a buyer requires the latter.

How SQF Audits Work

SQF certification involves an audit conducted by a licensed certification body. Facilities must select the appropriate Code, establish their management system, and demonstrate that it meets applicable requirements.

Desk Audit, Facility Audit, and Scoring

The process begins with registration through SQFI and selection of an appropriate certification body. The site identifies its industry sector, Code, and certification scope before proceeding.

Initial certification involves reviewing the documented system and assessing implementation at the facility. Auditors examine procedures, training records, supplier approvals, laboratory reports, maintenance logs, and corrective action documentation. They may also interview employees and observe relevant operations.

Facilities should conduct an internal audit against the applicable Code before the certification audit. This helps identify missing records, overdue actions, inconsistent results, and procedures that no longer reflect actual practices.

Edition 9 uses an overall audit score to determine the rating and required surveillance. Edition 10 introduces weighted scoring that gives greater importance to designated Core Clauses. Findings against these requirements can therefore have a more significant effect on the audit outcome.

Edition 10 also raises the point cost of Core Clause findings. A minor finding against a Core Clause costs 2 points instead of 1, and a major finding costs 7 instead of 5. The rating system changes as well. Edition 10 drops the Excellent, Good, and Complies labels and uses a simpler certification status. The table below shows how the two editions compare.

The Edition 10 score bands are tighter than Edition 9’s. A site that scored in the Complies range under Edition 9 could land in Certified with Surveillance under Edition 10, especially if its findings fall under Core Clauses. Confirm which edition applies to your next audit with your certification body.

Keeping Your SQF Certificate: Recertification and Unannounced Audits

SQF certification isn’t permanent. Facilities must maintain their systems, address nonconformities, and complete the required audit cycle to retain certification.

Under the standard cycle, sites undergo annual recertification audits. Each certificate stays valid for one year plus 75 days, counted from the date of the site’s first certification audit. The extra 75 days give the site time to finish its recertification audit before the certificate lapses. For example, a site first certified on March 1 has until about May 15 of the next year to complete recertification. Certain audit outcomes can trigger additional surveillance requirements. Facilities should track their audit dates, corrective action deadlines, and any conditions attached to their certificates.

SQF also requires an unannounced recertification audit at least once within every three years under applicable program rules. This tests whether controls operate consistently outside a specially prepared audit window.

Maintaining records as work happens is therefore essential. Reconstructing documentation shortly before an audit can leave gaps that undermine confidence in the system.

What Edition 10 Changes for SQF-Certified Sites

SQFI published Edition 10 in March 2026. Audits against the new edition are anticipated to begin as early as January 2027, subject to completion of the GFSI benchmarking process. Facilities should monitor SQFI’s Edition 10 FAQ and confirm transition dates with their certification bodies.

Edition 10 changes four areas that sites should start preparing for now.

1. Food safety culture. Edition 10 introduces a documented food safety culture assessment plan requirement across the Food Safety Codes. Facilities should evaluate how leadership, employee understanding, reporting practices, and everyday decisions affect food safety.
2. Change management. Facilities should assess changes that could affect food safety, including new equipment, process modifications, product changes, and adjustments to operating conditions. Documenting the assessment, approval, implementation, and verification of relevant changes helps prevent new hazards from being introduced.
3. Competency-based training. Edition 10 asks sites to show that employees can do their food safety tasks correctly, beyond simply attending training. Expect auditors to look for competency assessments, on-the-job observations, and records of retraining when someone’s performance falls short.
4. Weighted Core Clauses. Edition 10 gives greater scoring weight to designated Core Clauses. Sites should identify the applicable clauses for their Code and prioritize gaps according to their significance.

Facilities should also review environmental monitoring and verification practices. Sampling plans must reflect relevant hazards, results should be evaluated systematically, and adverse trends should trigger appropriate action.

The practical next step is an Edition 10 gap assessment. Compare current procedures with the revised Code, identify missing requirements, assign responsibilities, and set deadlines for corrective work.

Where testing supports a control or verification program, review the methods, sampling locations, acceptance criteria, and frequencies. This is particularly important when compressed air, process gases, water, or the processing environment could affect product safety.

Starting early gives teams time to correct weaknesses and verify that revised procedures work before their applicable audit date.

SQF Certification FAQs

What is an SQF-certified facility required to test?

Testing depends on the applicable Code, hazard analysis, product characteristics, and customer requirements. Depending on the operation, this may include:

1. Product testing
2. Water analysis
3. Environmental monitoring
4. Compressed air and process gas testing

Facilities should document their testing rationale, acceptance criteria, and response to unfavorable results.

Is SQF food certification required by law?

SQF certification is generally a voluntary third-party certification rather than a universal legal requirement. However, retailers and manufacturers may make it a condition of doing business. Facilities must still comply with applicable food safety laws regardless of certification status.

How long does it take to get SQF certified?

The timeline depends on facility complexity, existing food safety programs, and gaps identified during preparation. Sites with established HACCP procedures and reliable records may be ready sooner than those building a system from scratch. Allow time for implementation, internal audits, corrective actions, and certification scheduling.

How does SQF compare to BRCGS and FSSC 22000?

SQF, BRCGS, and FSSC 22000 are separate food safety certification schemes recognized by GFSI under applicable scopes and recognition arrangements. They share the goal of strengthening food safety management, but their requirements and audit protocols differ. Facilities should choose the scheme that meets customer requirements and operational needs rather than assuming one certificate automatically substitutes for another.

Building an SQF Compliance Program That Holds Up to Audit

A successful SQF audit depends on more than complete documentation. Facilities must demonstrate that controls are implemented consistently, monitoring results are reviewed, and problems are corrected before they undermine food safety.

Maintain accurate records, verify prerequisite programs, review laboratory results, and investigate deviations to establish their root causes. Where compressed air or process gases present a contamination risk, documented testing can provide objective evidence that relevant controls are working as intended.

With Edition 10 approaching, review food safety culture, change management, training competency, environmental monitoring, and Core Clauses now. Early preparation gives teams time to identify weaknesses and verify improvements before the next audit.

TRI Air Testing helps facilities obtain reliable analytical data for compressed air, breathing air, and other testing needs. When laboratory testing forms part of a food safety verification program, clear results and supporting documentation can strengthen the evidence available to auditors.

Contact TRI Air Testing to discuss your testing requirements and how appropriate testing can support your facility’s food safety and audit-readiness efforts.