What happens if you fail a BRC audit

Failing a BRCGS audit is a grading outcome rather than a closure. The auditor raises non-conformities during the audit, goes through them with you at the closing meeting, and the certification body then applies the grading rules in the issue of the standard you were audited against. Minors and majors are closed out with documented evidence inside the protocol's close-out window, commonly 28 calendar days, and your grade reflects how many were raised and of what type. A critical non-conformity, or a major raised against a statement of intent, normally takes the site to an uncertificated outcome, which means a full re-audit rather than a paper close-out. Check the exact wording and timings against your current protocol and your certification body, because the detail moves between issues of the standard.

The cost of failure is commercial, not regulatory. BRCGS certification is a customer requirement, so an uncertificated result does not stop you making food, it stops you supplying the retailers and manufacturers whose supplier approval depends on a current certificate. In practice that means notifying customers, holding or re-routing volume, paying for a re-audit, and watching your own certificate turn red in somebody else's expiry tracker. The technical fix is usually small. The schedule and the trust repair are not.

The sequence, from finding to re-audit

1. The finding is raised on site. The auditor describes the objective evidence, the clause, and the category. This is the moment to ask for the category and the clause out loud, because the difference between a minor and a major changes the next four weeks.
2. The closing meeting sets expectations. You hear the provisional list and whether the auditor believes a re-audit is in scope. The certification body, not the auditor alone, makes the certification decision.
3. The report arrives. You now have the written wording you have to answer, and the close-out clock starts from the audit date rather than from the day the report lands. That gap is where sites lose a week.
4. You submit corrective action evidence. Root cause, corrective action, preventive action, and proof. For a document gap, proof means the document itself plus evidence that the system which should have caught it has changed.
5. The certification body reviews and decides. Accepted evidence closes the non-conformity. Evidence that only shows the document, with no change to the process, often comes back for more.
6. A re-audit happens where the outcome requires it. An uncertificated result means a further full audit, scheduled with the certification body, with its own fee. Fees are set per certification body and usually quoted as a day rate plus travel, so treat any number you read anywhere, including in articles like this one, as an estimate and ask your certification body for the real one.

Why a document gap becomes a major

Auditors rarely fail a site because one certificate is missing. They escalate because the missing certificate shows the system that was supposed to control it is not running. If your supplier approval procedure says current certification is held and reviewed for every approved raw material supplier, and three suppliers have nothing on file, the finding is not about three PDFs. It is about a procedure the site does not follow, which is the shape of a major.

That is also why the close-out evidence matters more than the document. Uploading the certificate answers the symptom. Showing the review cadence, the named owner, the alert thresholds, and the chase record answers the clause.

The document gaps that come up most

• An expired supplier audit certificate that nobody noticed because the renewal date lived in one person's calendar.
• An allergen declaration that predates a specification change, so the document on file no longer matches what you buy.
• A certificate of analysis missing for a delivered lot, found by the auditor through traceability rather than through the document file.
• A certificate covering a different site or scope than the one you actually source from, which reads as current until someone reads the address.
• An approval record with no evidence behind it, where the spreadsheet says approved and the folder says nothing.
• No record of chasing, which is the quiet one. You asked the supplier three times, by phone, and can prove none of it.

The first week after a failed audit

Work in this order. Confirm the category and clause of every finding in writing. Put the close-out deadline, counted from the audit date, in one place everyone can see. Assign a single owner per non-conformity, not per department. Tell affected customers before they find out from a certificate database, because the conversation you start is easier than the one you answer. Then book the re-audit early if one is required, since certification body diaries, not your corrective actions, usually set the real date.

For document findings specifically, collect the missing items and, at the same time, write down how the gap will be visible next time. An auditor who sees only the recovered documents has no reason to believe the next cycle will differ.

Closing the document layer before the next audit

Most of the gaps above are not knowledge problems, they are calendar problems spread across dozens of suppliers and three or four certificate types each. That is the part Certly is built for. When it launches, it holds a supplier list with the certificate types each supplier owes you, stores the uploaded certificates against supplier and type, tracks expiry dates with alert thresholds at 90, 60 and 30 days, and sends chase emails to the supplier contact with a one-click upload link that needs no login. Each send is logged, including sends that failed, and you can trigger a chase manually from a supplier row when you want the record to show you asked today.

The part that matters in a closing meeting is the status view: current, expiring soon, expired and missing, per supplier, on one screen, exportable as a PDF for the auditor with the same status labels you see on screen. It carries a standing line stating plainly that Certly tracks and reminds on certificate expiry, and does not verify certificate authenticity or guarantee regulatory compliance. That line is deliberate. The judgment about whether a document is genuine and sufficient stays with your QA team, which is where an auditor expects to find it. What a tracking system can do is make sure the conversation is about judgment rather than about a folder nobody updated since March.