The QA directors who pass SQF cleanest aren't the ones who work hardest in the week before the audit. They're the ones who don't change anything for the audit. If your team is pulling 60-hour weeks to "get ready," you're not preparing for an audit — you're hiding from one. Here's the 30-day playbook that turns audit week into just another week.
SQF Edition 9 added more emphasis on culture, food fraud, and food defense than previous editions, which means the auditor isn't just looking at records anymore — they're looking at whether the records reflect what's actually happening on the floor. The fastest way to fail SQF 9 is to have a beautiful binder and a sanitation program nobody on the night shift can describe. Here's how to make sure your records match your operation, your team can talk about the program coherently, and audit day stops being your worst week of the quarter.
What auditors actually look for (and what you think they look for)
QA directors new to SQF tend to over-prepare paper and under-prepare people. Auditors care about both, but they spend their time on the floor talking to operators far more than they spend in the document room flipping through records.
Specifically, auditors are testing four things. First, that your documented system describes what's actually happening — when they ask an operator to explain their pre-op procedure, the operator's answer matches the SSOP. Second, that your verification activities have teeth — failures are documented, CAPAs are tracked, root cause is identified, and the corrective action actually closed the gap. Third, that your records are timely and contemporaneous — entries are made at the time of the activity, not back-filled at the end of the shift. Fourth, that your culture matches your manuals — when an operator finds a problem, do they report it, and does the system actually respond?
Notice what's not on the list: glossy binders, color-coded labels, a fresh coat of paint in the corridor. Those things don't hurt, but they don't save a program that can't answer the four questions above.
The 30-day countdown plan
A useful prep window starts 30 days before the audit. Less than that and you can't fix structural issues; more than that and the prep momentum dissolves. Here's how to use the time.
Days 30 to 21: Document accuracy review. Pull every SSOP and verify it matches the procedure your team actually runs. This is the work most QA directors skip because it's tedious — but it's the work that prevents the worst audit findings. Walk the line with the sanitation lead, open the SSOP on a tablet, and have the operator perform the procedure. Note every divergence. Either update the procedure to match reality, or retrain the operator to match the procedure. Don't both-sides this.
Days 20 to 14: Record sampling. Pull a random 90-day sample of pre-op records, EMP records, ATP logs, allergen change-over verifications, and CAPA closures. Verify every one is signed, timestamped, and complete. Note gaps. Investigate root cause on every gap — usually it's a workflow issue, not an individual failure.
Days 13 to 7: Mock audit. Run a full mock audit with someone outside the food safety team — a peer plant's QA director if you have the relationship, a consultant if you don't. The mock audit should follow the auditor's typical day: floor walk, document review, operator interviews. The findings from your mock should be more aggressive than what you expect from the actual auditor.
Days 6 to 2: Fix what the mock found. No new programs, no new SSOPs, no new training initiatives. Just close the specific gaps identified in the mock. Each gap gets a CAPA. Each CAPA closes with verification. This is the week where most plants make the mistake of adding new things — resist.
Day 1 (day before audit): Quiet shift. Normal sanitation, normal records, normal operations. The worst thing you can do the day before an audit is push for a "perfect" shift — that's where shortcuts get taken and operators get nervous. The best day before an audit is the most boring day of the month.
The week-before mock audit, in detail
A good mock audit takes a full day. It starts with a 30-minute opening meeting (same as the real one), goes into a 2-hour facility tour, runs 3 hours of document review, and ends with a 90-minute closing where findings are presented. The mock auditor should follow the standard SQF audit checklist — there are good ones available from the SQFI and from consulting firms — and grade your responses honestly.
The most useful part of the mock isn't the findings list. It's the operator interview portion. Have the mock auditor interview three operators per shift, picked at random, on questions like: "Walk me through your pre-op procedure." "What do you do if the sanitizer titration reads low?" "Where do you record allergen change-over verification?" If your operators can't answer these clearly, your documented program isn't reaching the floor.
Common findings — and how to avoid them
The findings list from SQF audits is remarkably consistent across plants. The same six issues show up year after year.
Records not contemporaneous. Pre-op signed at 0600 for a 0400 activity. Auditors check timestamps. Fix: complete records in real time on a mobile system; eliminate the paper-collection-then-data-entry workflow.
Verification activities incomplete. Sanitizer titration logged but no action taken on out-of-range readings. Fix: every verification has an action rule — out-of-range means a CAPA opens automatically.
CAPA closure without verification. The corrective action was completed; the verification that the corrective action worked was not. Fix: closure requires a verification step, mandatorily.
SSOPs don't match operations. Cleaning procedure says 145°F dwell 10 minutes; operator actually runs 138°F dwell 8 minutes because that's how the foam cleaner manufacturer's chart says it works at the current pH. Fix: update the SSOP, retrain, document the change.
EMP positive without vector sampling. Listeria spp. positive on Zone 2, no vector sampling response documented. Fix: positive results trigger an automatic CAPA workflow that includes vector sampling.
Allergen change-over verification missing. Verification swab planned, but no record of completion. Fix: change-overs can't be marked complete without the verification swab result.
Audit day itself
On audit day, do three things. Have the QA director present in the opening meeting and the closing meeting, but not in every interview — your team needs to be able to answer questions without you there. Provide records on request without delay, but don't volunteer records you weren't asked for. Stay calm; the auditor isn't your adversary, they're verifying that your system works.
If the auditor finds something, don't argue. Take the finding, write it down, and ask clarifying questions to make sure you understand exactly what they're flagging. Disagreement happens — there's a formal process for it after the audit, not during.
Make audit day just another shift
MySitesSupervisor keeps every record audit-ready in real time — sanitation, quality, EMP, CAPA — with timestamps, signatures, and one-click exports formatted for SQF, BRC, and FSMA auditors. No prep week required.
Schedule a 30-min demo