BRC Issue 9 requires a documented internal audit programme. But there is a significant gap between a programme that technically exists and one that satisfies a certification auditor. This guide covers what the standard actually requires and how to build something that holds up under scrutiny.
What Clause 3.4 Actually Says
Your programme must cover every activity that forms part of your food safety and quality management system, audited at least once per year. Frequency must be risk-based. Sections with a history of non-conformances should appear more often than sections with a clean record.
The standard also requires unannounced audits as part of the programme. At least one audit per cycle must be conducted with short notice or none at all. This is one of the most common gap findings at BRC certification visits. If your programme does not explicitly schedule an unannounced element, it is incomplete.
Risk-Based Scheduling
Risk-based scheduling is not optional, and it is not sufficient to audit every section at the same frequency. Your programme must demonstrate that frequency reflects previous audit performance.
If Clause 4.11 (Cleaning and Disinfection) produced three NCs last year, it needs more airtime in this year's programme than Clause 5.1 (Management of Allergens) which had a clean run. Document the rationale for each section frequency. A BRC auditor will ask to see it.
What Must Be Covered
Every clause that applies to your site must be covered within the cycle. That includes all fundamental requirements, any optional modules your site has adopted, supplier approval and monitoring activities, and traded goods handling if it falls within your scope.
A common mistake is building a programme around sections rather than clauses. Track coverage at clause level. It is the only way to be certain nothing gets missed across twelve months.
Auditor Competence
Internal auditors must be competent for the clauses they audit. BRC Issue 9 expanded this requirement. Auditors now need to demonstrate competence in both the technical subject matter and auditing soft skills. Training records must be current and available on the day.
Where possible, auditors should be independent of the area they are reviewing. A production supervisor auditing their own shift against cleaning requirements does not satisfy the independence principle.
What a BRC Auditor Looks For
When a certification auditor reviews your internal audit programme, four things matter: evidence that the programme covers all required clauses, evidence that scheduling is risk-based with a documented rationale, evidence that NCs raised during internal audits were closed with root cause analysis, and evidence that programme results were reviewed by senior management.
That last point is where many programmes fall short. Clause 1.1.2 requires senior management to review the food safety system at defined intervals. Internal audit results must feed into that review. If they do not, you have a gap regardless of how well the auditing itself was conducted.
Building It in Practice
Start with a clause coverage matrix. List every applicable clause and assign a target audit frequency based on risk. Map these across a 12-month calendar, distributing workload evenly across quarters. Assign named auditors and confirm their competence covers the clauses they are assigned.
Schedule the unannounced element explicitly. Note in the programme which audit will be conducted with short or no notice. Review the programme quarterly against actual completion. A programme that exists on paper but runs three months behind is a finding in itself.
The Case for Software
Spreadsheet-based audit programmes create two problems: version control and evidence retrieval. When a BRC auditor asks to see the audit conducted on Clause 4.11 six months ago, a well-structured digital system retrieves it in seconds. A shared spreadsheet folder rarely does.
AuditCore's Programme Builder maps directly to BRC Issue 9 clause structure, supports risk-based frequency assignment, and tracks completion against plan. The programme compliance rate is visible at a glance, which is exactly what you need for management review and for the certification visit.