BRCGS Food Safety, Issue 9, Part III

A visitor control non-conformity, and 28 days to close it

Name: Noon Elite kiosk fire roll call demonstration
Uploaded: 2026-08-24T00:00:00+01:00
Duration: 1 min 40 s
Description: A visitor signs in on the iPad. The alarm goes. The marshal opens the live list on their phone at the muster point and reads off who is still on site.

The auditor has raised a non-conformity against clause 4.1.4 or 7.3.2, and Part III of the Standard has started a clock: 28 calendar days from the audit to give the certification body evidence of the correction, the root cause and a preventive action plan. This page quotes what BRCGS asks for, sets out questions for finding the root cause at your front door, and says plainly where a kiosk can sit in a plan and where it cannot.

Try it yourself, no sign-up

Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.

Book a 15 minute call What Part III asks for

We are not a certification body, an auditor or a consultant. The certification body decides whether your corrective action is accepted.

The finding

The two clauses a visitor control finding is raised against

Read the auditor’s wording first. Each clause has several sentences, and the finding is against one of them, not the clause as a whole.

Clause 4.1.4

Access to the site, and a visitor recording system

Policies and systems shall be in place to ensure that access to the site by staff, contractors and visitors is controlled. A visitor recording system shall be in place. Contractors and visitors, including drivers, shall be made aware of the procedures for access to the site.

The clause goes on to say that only authorised personnel shall have access to production and storage areas, and that staff shall be trained in site security procedures. A finding against it can be about any of those sentences, so read the auditor’s wording for which one.

Clause 7.3.2

Visitors and contractors, and a health questionnaire

Where there may be a risk to product safety, visitors and contractors shall be made aware of the types of symptoms, infection, disease or condition which would prevent a person visiting areas with open food. Where permitted by law, visitors shall be required to complete a health questionnaire or otherwise confirm that they are not suffering from any symptoms which may put product safety at risk, prior to entering the raw material, preparation, processing, packing and storage areas.

Two shalls: visitors and contractors made aware, and visitors completing a questionnaire or otherwise confirming, before they enter those areas.

Quoted from BRCGS Global Standard Food Safety, Issue 9, August 2022, pages 42 and 81, and checked against BRCGS’s free F904a checklist, read on 27 September 2026. The F926 position statements, version 4, effective 10 August 2026, do not change either clause.

The visitor clauses of Issue 9 in full A free visitor health questionnaire, for 7.3.2

What Part III asks for

The correction, the root cause and the plan, in BRCGS’s words

The 28 days are the site’s, set by the Standard. Part III says what goes to the certification body inside them, and who decides whether it is enough.

Part III, 2.3.2

Three things, for every non-conformity

Following identification of any non-conformities during the audit, the site shall undertake corrective action to remedy the immediate issue, analyse the underlying cause of the non-conformity (root cause), and develop a preventive action plan to address the root cause and prevent recurrence.

Part III, 2.3.2

28 calendar days, or no certificate

If satisfactory evidence of corrective action, the root cause analysis and a preventive action plan are not provided within the 28-calendar-day period allowed for submission following the audit, certification will not be granted. The site will then require a further full audit in order to be considered for certification.

Part III, 2.3.2

The root cause, with a timescale

The root cause shall be identified and a preventive action plan to correct it, including timescale, shall be provided to the certification body.

Part III, 2.3.2

How evidence is given

Close-out of non-conformities can be achieved in any of the following ways: objective evidence being submitted to the certification body, such as updated procedures, records, photographs or invoices for work undertaken; remote audit techniques being used to assess corrective actions; the certification body undertaking a further on-site visit.

Part III, 2.6

Who decides

After a review of the audit report and documentary evidence provided in relation to the non-conformities identified, a certification decision shall be made by the designated independent certification manager.

Table 2: when the audit ends in	Corrective action, in the table’s words
Grades AA, A and B, and grade C with no more than one major	“Objective evidence within 28 calendar days”
Grade C with two majors, and every grade D	“Revisit required within 28 calendar days”
A critical, three or more majors, or more minors than the table allows	“Certificate not granted. Re-audit required”

Quoted from Part III, sections 2.3.2 (pages 106 and 107) and 2.6 (page 110), and Table 2 (page 108), where each grade has an unannounced equivalent marked with a plus. The close out list is set out as one line here; the Standard prints it as bullets. Appendix 8 adds: “Preventive actions often take longer than 28 calendar days, and sites are therefore not expected to fully complete the preventive action prior to publication of the audit report.” Issue 9 gives no different window for an initial audit.

The root cause

Questions to ask about your own front door

Appendix 8 defines preventive action as action to eliminate the root cause and prevent recurrence. These are questions, not answers, and none of them is ranked: the root cause is the one your site finds.

Does anybody sign out?

A book with arrivals and no departures cannot say who was on site at any moment after the first entry. Look at whether the sign out column is filled in, and on which days it is not.

Can the entries be read?

Could a stranger read last Tuesday’s names and companies without asking reception? An entry nobody can read does not show who was on site.

Is the health questionnaire kept, and can you find it?

If 7.3.2 applies to your visitors, where do the completed questionnaires go, can each one be matched to a visit, and who decides when a visitor answers yes?

Do drivers bypass reception?

Clause 4.1.4 names drivers. Is a driver who waits in the cab, walks into goods in or uses a side gate made aware of the access procedures, and does anything show that they were?

Were visitors and contractors told the procedures before they went in?

Are the procedures shown to every visitor, or to the ones reception remembers to hand the card to, and does anything show which version they saw?

What happens at the door when reception is empty?

Early starts, lunch cover and the weekend shift are where a procedure written for a staffed desk can stop working. What happens at the door at 6am?

In a preventive action

What a kiosk records

Who came inName and company, required on every sign in, with a vehicle registration if the visitor gives one.
For whomThe person they came to see, picked from your staff list where you have one.
When they leftThe time they signed out at the kiosk or were signed out by staff. Any visitor still signed in at 23:59 UTC is signed out automatically at that time, so a forgotten sign out shows 23:59, not when they left.
The wording each person acceptedYour access procedures and health declaration on screen, with Go Back and I Accept. Nobody signs in without accepting, and the record keeps the exact wording each person accepted, by its fingerprint, after you change it.
Who is on site nowA live roll call of the visitors and contractors signed in at the site, from every kiosk there, on a phone at the assembly point.

How the accepted wording is kept The fire roll call

And what it cannot do

What stays with you

Pick your root cause. The questions above are yours to answer, and the answer may be training, supervision or a gate rather than a kiosk.
Write your preventive action plan or your corrective action evidence.
Decide whether the certification body accepts either. It decides.
Ask a health question or store an answer. It shows one declaration and records that it was accepted. Whether a declaration accepted on screen is what your site means by 7.3.2’s “otherwise confirm” is for you and your certification body.
Record a driver who never comes to the kiosk. A courier who only uses the delivery drop-off is logged but is not signed in and is not on the roll call.

Timing, said plainly

The 28 days are yours, not ours

The Standard sets the 28 days, and they started at the end of your audit. We publish no installation time. Before a kiosk goes into a corrective action plan, ask us for a date, in writing, and plan around it.

Keep a paper correction in place until the kiosk is live: the book with a sign out column, the declaration on a card, whatever your corrective action says. A plan that depends on a delivery date nobody has given you is a plan the certification body can reasonably question.

The other two BRCGS standards

Packaging, and storage and distribution

Packaging Materials Issue 7: 28 calendar days, extended to 90 calendar days for non-conformities at an initial audit (Part I, and Part III 2.3.2).

Storage and Distribution Issue 4: 28 calendar days for a certificated site and 90 calendar days for an initial audit (Part III 2.5), read in the Standard on 27 September 2026.

See it work

A sign in and a fire roll call, in 100 seconds

A visitor signs in on the iPad. The alarm goes. The marshal opens the live list on their phone at the muster point and reads off who is still on site.

The player loads from YouTube only when you press play. Nothing is sent to Google before that. What happens when you do.

Before you ask

The questions technical managers ask after the audit

How long do we have to answer a BRCGS non-conformity?

Issue 9 Part III, 2.3.2: if satisfactory evidence of corrective action, the root cause analysis and a preventive action plan are not provided within the 28-calendar-day period allowed for submission following the audit, certification will not be granted, and the site needs a further full audit. For grade C with two majors and every grade D, Table 2 asks for a revisit within 28 calendar days instead of documentary evidence.

Is the window different for an initial BRCGS Food Safety audit?

Not in Issue 9: we found no separate corrective action window for an initial audit in the Standard or in the F926 position statements, version 4. What Issue 9 does say is that failing the statement of intent of a fundamental requirement, which is a major non-conformity, leads to non-certification at an initial audit and to withdrawal of certification at later ones. BRCGS Packaging Materials Issue 7 and Storage and Distribution Issue 4 are different, and allow 90 calendar days at an initial audit.

Do we have to finish the preventive action within 28 days?

No. Appendix 8 of Issue 9 says: “Preventive actions often take longer than 28 calendar days, and sites are therefore not expected to fully complete the preventive action prior to publication of the audit report.” The plan, with a timescale, goes to the certification body within the 28 days, and Part III says the non-conformities from this audit are checked again at the next one.

What evidence can we send for a visitor control finding?

Part III lists objective evidence such as updated procedures, records, photographs or invoices for work undertaken, a remote audit of the corrective action, or a further visit by the certification body. Which your certification body accepts for your finding is its decision, not ours.

Can a visitor kiosk close our non-conformity?

No. It can be part of what you do about one: a record of who came in, for whom, when they left and the wording each person accepted. It does not choose your root cause, write your plan or decide whether the certification body accepts it.

How quickly can a kiosk be installed?

We publish no installation time, and we will not put one on this page. The 28 days are yours, set by the Standard. Ask us for a date before a kiosk goes into a corrective action plan, and keep a paper correction in place until the kiosk is live.

Being straight with you

What this does not do

We are not BRCGS, a certification body, an auditor or a food safety consultancy. This is general information about a published standard, not certification advice.
A kiosk does not close a non-conformity. The certification body reviews the evidence you submit and decides.
We publish no installation time. Ask us for a date before a kiosk goes into a corrective action plan, and keep a paper correction in place until it is live.
The kiosk asks no questions and stores no health answers. It shows your declaration and records who accepted which wording, and when.
It checks no ID and records no badge being handed back. Its arrival message goes to one Teams or Slack channel per site, not to a person, and nothing is sent when somebody signs out.

Everything else the kiosk does not do

Sources

Check any of this yourself

BRCGS Global Standard Food Safety, Issue 9August 2022, free after registration on the BRCGS Store. Clauses 4.1.4 and 7.3.2, Part III sections 2.3.2, 2.4 (Table 2), 2.4.2 and 2.6, and Appendix 8 are quoted. Read 27 September 2026.
BRCGS, F904a Auditor Checklist and Site Self-Assessment Tool, Issue 9Version 1, 1 August 2022, free. BRCGS’s own reproduction of every Issue 9 requirement; 4.1.4 and 7.3.2 were checked against it word for word. Read 27 September 2026.
BRCGS, F926 Position Statements for Issue 9, version 4.1Version 4 is dated 27/04/2026 and effective from 10 August 2026; version 4.1, dated 6 October 2026, is the same document rebranded, with the same four statements. None of them changes 4.1.4, 7.3.2 or the 28 days. Read 27 September 2026, and read again at 4.1 on 13 October 2026.
BRCGS, Behind the scenes of Food Safety Issue 10Read 27 September 2026 under the title “Behind the scenes of Food Safety Issue 10”, dated 11 August 2026: Issue 10 in development, with no publication date. BRCGS rebuilt its website in October 2026 and the item is not on the new site, so this link is to its news index.

General information about a published standard, not certification advice. Your certification body works to the issue and position statements in force for your audit; check them against your own copy of the Standard. BRCGS has no connection with Noon Elite.

The morning of an unannounced audit BRCGS Food Safety, the visitor clauses

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.

Advise sites on this standard? Referral terms are on one page.

Next step

Bring the auditor’s wording and your audit date

Fifteen minutes on the phone. Read us the non-conformity and tell us when the audit ended, and we will give you a date we can install by, or tell you straight that a kiosk does not belong in this plan.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case