BRCGS079, version 6
When the BRCGS auditor arrives unannounced
At least one audit in three is unannounced. The auditor walks in, and the production audit is expected to start within 30 minutes. BRCGS’s own protocol says what the site agrees in advance: who is told on arrival, their deputy, protective clothing and the entry rules. This page quotes it, and says what a sign in at reception records and what stays with your people.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £599 setup and £150 a month plus VAT, iPad and stand included. We are not a certification body or an auditor.
What the protocol says
Five passages about the morning the auditor arrives
BRCGS079 is a position statement and protocol, not a standard. It applies to the Food Safety, Packaging Materials and Storage and Distribution standards, and it sets out how an unannounced audit is arranged and run.
Page 4, the benchmark
At least one in three years
the GFSI Benchmark Version 2020 introduced a new requirement for certificated sites (with food safety, packaging materials or storage & distribution scopes) to have at least 1 unannounced audit every 3 years
All three BRCGS standards this site has pages for are in scope. For a site on annual audits, the protocol says, that means at least every third audit is unannounced.
2.5, Arrival on site
Agreed when you register, not on the day
It is particularly important that the usual practical issues surrounding the audit are agreed at the time of registering for an audit, periodically reviewed, and where necessary updated. This includes: Directions to the site; Site contact on arrival and their deputy; Agreed earliest time of arrival; Factory protective clothing requirements (e.g. coat and shoe size); Pre-providing factory entry rules such as videos/questionnaires to ensure efficiency
Five practical things, settled with the certification body in advance. Two of them are about the front door: who is told the auditor has arrived, and what the auditor is shown before going in.
2.6, Auditor identification
Proof they are who they say
As the site will not be expecting the auditor’s arrival, it is important that the auditor has sufficient identification to confirm that they are a genuine representative of the certification body. This may include the option for the site to contact the certification body to confirm the identification.
The auditor brings the identification. Looking at it, and ringing the certification body if you want to, is the site’s act.
3.1, Structure of the audit
Production within 30 minutes
unannounced audits will commence with a short opening meeting followed by an immediate inspection of the production facilities. It is expected that the production facility audit will commence as soon as possible and within a maximum of 30 minutes of the auditor arriving on site.
The clock starts at arrival. The same section says the audit is meant to encourage “an audit ready food safety culture and not to try to catch sites out”.
5.1, Refusal
Denied access means suspended
if the auditor arrives for the audit and is denied access, the site’s certification will be suspended. The site will remain suspended until a new unannounced audit can be completed. … In addition, a major non conformity shall be awarded.
The one outcome a front door must never produce. The same section says sites “are obliged to accommodate the auditor and allow the audit to commence on the auditor’s arrival at the site”, and can nominate in advance the days an audit cannot take place.
Quoted from BRCGS079, Position Statement and Protocol on Unannounced Audits: Meeting the GFSI Benchmark, Version 6, 24/07/2024, pages 4, 8, 9 and 10, read on 27 September 2026, and version 6.1 of 6 October 2026, the same text rebranded, pages 4, 6, 7 and 8. The 2.5 list is set out as one line here; the protocol prints it as bullets. BRCGS’s own spelling is kept inside the quotations.
At reception
What the protocol says, what the record shows, what stays with you
The auditor signs in on the iPad like any other visitor. Each line below says what that sign in records, and what it leaves to your people.
| What the protocol says | What the record shows | What stays with you |
|---|---|---|
| 2.5: the site contact on arrival and their deputy | The auditor signs in like any visitor, naming the site contact as the person they are visiting. A message goes at once to your site’s Teams or Slack channel with their name, company, who they are visiting and the time. If the contact and the deputy are both in that channel, they both see it. | Who is in the channel, and who watches it. The message goes to one channel, not to a named phone: if nobody is watching the channel, nobody is told. |
| 2.5: pre-providing factory entry rules, such as videos or questionnaires | Your entry rules on screen as text, accepted before the auditor is signed in, with the exact wording kept against the visit. | Anything sent in advance through the certification body. The kiosk does not play a video or ask questions; it shows your wording and records that it was accepted. |
| 2.5: agreed earliest time of arrival | The time the auditor signed in, stamped by the server. | The agreement itself, made at registration. |
| 2.5: factory protective clothing requirements | Nothing. The kiosk does not know the auditor’s coat or shoe size. | The clothing, ready by the door. |
| 2.6: identification that they represent the certification body | The name and company the auditor gave, and the time. | Checking the identification, and ringing the certification body to confirm it if you choose. The kiosk checks no ID. |
| 3.1: production audit within a maximum of 30 minutes of arriving | The arrival time, so how long it took to reach production can be worked out afterwards. | Getting there inside 30 minutes. The kiosk does not time the walk to the production floor. |
| 5.1: denied access means suspension and a major non conformity | Nothing that stops anyone. Signing in never refuses a visitor who accepts your wording. | Making sure whoever is on the desk knows the auditor goes in. |
If the iPad is offline when the auditor signs in, the sign in is kept on the iPad and sent when the connection comes back, with the real arrival time, and the channel message says it was recorded late.
How the Teams or Slack message worksHow the accepted wording is kept
See it work
A sign in and a fire roll call, in 100 seconds
A visitor signs in on the iPad. The alarm goes. The marshal opens the live list on their phone at the muster point and reads off who is still on site. An auditor signs in the same way.
The player loads from YouTube only when you press play. Nothing is sent to Google before that. What happens when you do.
Before you ask
The questions technical managers ask about unannounced audits
How often is a BRCGS audit unannounced?
At least once every three years, for sites with food safety, packaging materials or storage and distribution scopes, according to BRCGS079 version 6. For a site on annual audits, the protocol says that means at least every third audit.
What happens in the first 30 minutes of an unannounced audit?
A short opening meeting, then an immediate inspection of the production facilities. Section 3.1 of BRCGS079 says the production facility audit is expected to start as soon as possible and within a maximum of 30 minutes of the auditor arriving on site.
What should we agree before an unannounced audit?
Section 2.5 lists what is agreed when you register for the audit: directions to the site, the site contact on arrival and their deputy, the agreed earliest time of arrival, protective clothing requirements, and any factory entry rules, such as videos or questionnaires, provided in advance. It says these are periodically reviewed and updated where necessary.
How do we know the auditor is genuine?
Section 2.6 says the auditor should have sufficient identification to confirm they represent the certification body, and that this may include the option for the site to contact the certification body to confirm it. The check is made by your people. The kiosk records the name and company the auditor gave and the time, and checks no ID.
What if we refuse the auditor entry?
Section 5.1 says the site’s certification will be suspended until a new unannounced audit is completed, within the next four months, and a major non conformity will be awarded. Sites can nominate in advance the days an audit cannot take place.
Does the kiosk tell our site contact the auditor has arrived?
It tells your site’s Teams or Slack channel, the moment the auditor signs in, with their name, company, the person they are visiting and the time. It does not message a person directly. If your site contact and their deputy are both in the channel and watching it, they both see it.
Being straight with you
What this does not do
- We are not BRCGS, a certification body or an auditor, and this is general information about a published protocol, not certification advice.
- The kiosk does not make a site audit ready. It keeps the time the auditor arrived and the wording they accepted, and tells your channel they are here.
- The message goes to one Teams or Slack channel per site, not to a person. Nothing is sent when somebody signs out.
- It checks no ID, plays no video and asks no questions.
- Anyone still signed in at 23:59 UTC is signed out automatically at that time, so a forgotten sign out shows that time, not when the auditor left.
Sources
Check any of this yourself
- BRCGS079, Position Statement and Protocol on Unannounced Audits, Version 6.1Version 6 is dated 24/07/2024; version 6.1, dated 6 October 2026, is the same text rebranded and repaginated, free from BRCGS. Pages 4, 6, 7 and 8 of 6.1 are quoted (pages 4, 8, 9 and 10 of version 6). Read 27 September 2026, and read again at 6.1 on 13 October 2026.
General information about a published protocol, not certification advice. BRCGS revises its protocols; check the version your certification body works to. BRCGS has no connection with Noon Elite.
BRCGS Food Safety, the visitor clausesBRCGS Packaging MaterialsBRCGS Storage and DistributionAfter the audit: a visitor control non-conformity and its 28 days
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Tell us what happens at your door when the auditor walks in
Fifteen minutes on the phone. Who is on the desk, who is your site contact and their deputy, and which channel they watch. We will tell you straight whether a kiosk helps.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case