BRCGS Food Safety, Issue 9, Part III
A visitor control non-conformity, and 28 days to close it
The auditor has raised a non-conformity against clause 4.1.4 or 7.3.2, and Part III of the Standard has started a clock: 28 calendar days from the audit to give the certification body evidence of the correction, the root cause and a preventive action plan. This page sets out what BRCGS asks for, quoting the Standard where its exact words carry the consequence, gives you questions for finding the root cause at your front door, and says plainly where a kiosk can sit in a plan and where it cannot.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
We are not a certification body, an auditor or a consultant. The certification body decides whether your corrective action is accepted.
The finding
The two clauses a visitor control finding is raised against
Read the auditor’s wording first. Each clause has several sentences, and the finding is against one of them, not the clause as a whole.
Clause 4.1.4
Access to the site, and a visitor recording system
Policies and systems shall be in place to ensure that access to the site by staff, contractors and visitors is controlled. A visitor recording system shall be in place.
The clause goes on, in our words: contractors and visitors, drivers included, are made aware of the procedures for access to the site; only authorised personnel reach production and storage areas; staff are trained in site security procedures. A finding against it can be about any of those sentences, so read the auditor’s wording for which one.
Clause 7.3.2
Visitors and contractors, and a health questionnaire
Where permitted by law, visitors shall be required to complete a health questionnaire or otherwise confirm that they are not suffering from any symptoms which may put product safety at risk, prior to entering the raw material, preparation, processing, packing and storage areas.
That is the second of the clause’s two shalls. The first, in our words, asks that where there may be a risk to product safety, visitors and contractors are made aware of the symptoms, infections, diseases and conditions that would keep a person out of areas with open food. A finding can be against either.
Quoted in part from BRCGS Global Standard Food Safety, Issue 9, August 2022, pages 42 and 81, and checked against BRCGS’s free F904a checklist, read on 27 September 2026; the sentences in quotation marks are the Standard’s, the description under each is ours. The F926 position statements, version 4, effective 10 August 2026, do not change either clause.
The visitor clauses of Issue 9 in fullA free visitor health questionnaire, for 7.3.2
What Part III asks for
The correction, the root cause and the plan: what Part III asks for
The 28 days are the site’s, set by the Standard. Part III says what goes to the certification body inside them, and who decides whether it is enough. Where the exact words carry the consequence they are quoted; the rest is in ours.
Part III, 2.3.2
Three things, for every non-conformity
For each non-conformity the audit raised, the site corrects the immediate issue, finds the underlying cause, and writes a preventive action plan to address that cause and stop it recurring. Three deliverables, however small the finding.
Part III, 2.3.2
28 calendar days, or no certificate
If satisfactory evidence of corrective action, the root cause analysis and a preventive action plan are not provided within the 28-calendar-day period allowed for submission following the audit, certification will not be granted.
The site then needs a further full audit before it can be considered for certification. Calendar days, counted from the audit.
Part III, 2.3.2
The root cause, with a timescale
a preventive action plan to correct it, including timescale
The root cause is identified and the plan to correct it goes to the certification body with dates on it. A plan without a timescale is not what the clause asks for.
Part III, 2.3.2
How evidence is given
Three routes to close-out: objective evidence sent to the certification body (the Standard names updated procedures, records, photographs and invoices for work done), remote audit techniques used to assess the corrective action, or a further visit to the site by the certification body. Which applies to your finding is its call.
Part III, 2.6
Who decides
The certification decision is made by the certification body’s designated independent certification manager, after a review of the audit report and the documentary evidence for each non-conformity. Not the auditor, and not the site.
| Table 2: when the audit ends in | Corrective action, in the table’s words |
|---|---|
| Grades AA, A and B, and grade C with no more than one major | “Objective evidence within 28 calendar days” |
| Grade C with two majors, and every grade D | “Revisit required within 28 calendar days” |
| A critical, three or more majors, or more minors than the table allows | “Certificate not granted. Re-audit required” |
Read from Part III, sections 2.3.2 (pages 106 and 107) and 2.6 (page 110), and Table 2 (page 108), where each grade has an unannounced equivalent marked with a plus; the two passages in quotation marks above and the three phrases in the table are the Standard’s words, the rest is ours. Appendix 8 says preventive actions often take longer than 28 calendar days and a site is not expected to have finished one before the audit report is published; the question on it below quotes the sentence. Issue 9 gives no different window for an initial audit.
The root cause
Questions to ask about your own front door
Appendix 8 defines preventive action as action to eliminate the root cause and prevent recurrence. These are questions, not answers, and none of them is ranked: the root cause is the one your site finds.
Does anybody sign out?
A book with arrivals and no departures cannot say who was on site at any moment after the first entry. Look at whether the sign out column is filled in, and on which days it is not.
Can the entries be read?
Could a stranger read last Tuesday’s names and companies without asking reception? An entry nobody can read does not show who was on site.
Is the health questionnaire kept, and can you find it?
If 7.3.2 applies to your visitors, where do the completed questionnaires go, can each one be matched to a visit, and who decides when a visitor answers yes?
Do drivers bypass reception?
Clause 4.1.4 names drivers. Is a driver who waits in the cab, walks into goods in or uses a side gate made aware of the access procedures, and does anything show that they were?
Were visitors and contractors told the procedures before they went in?
Are the procedures shown to every visitor, or to the ones reception remembers to hand the card to, and does anything show which version they saw?
What happens at the door when reception is empty?
Early starts, lunch cover and the weekend shift are where a procedure written for a staffed desk can stop working. What happens at the door at 6am?
In a preventive action
What a kiosk records
- Who came inName and company, required on every sign in, with a vehicle registration if the visitor gives one.
- For whomThe person they came to see, picked from your staff list where you have one.
- When they leftThe time they signed out at the kiosk or were signed out by staff. Any visitor still signed in at 23:59 UTC is signed out automatically at that time, so a forgotten sign out shows 23:59, not when they left.
- The wording each person acceptedYour access procedures and health declaration on screen, with Go Back and I Accept. Nobody signs in without accepting, and the record keeps the exact wording each person accepted, by its fingerprint, after you change it.
- Who is on site nowA live roll call of the visitors and contractors signed in at the site, from every kiosk there, on a phone at the assembly point.
And what it cannot do
What stays with you
- Pick your root cause. The questions above are yours to answer, and the answer may be training, supervision or a gate rather than a kiosk.
- Write your preventive action plan or your corrective action evidence.
- Decide whether the certification body accepts either. It decides.
- Ask a health question or store an answer. It shows one declaration and records that it was accepted. Whether a declaration accepted on screen is what your site means by 7.3.2’s “otherwise confirm” is for you and your certification body.
- Record a driver who never comes to the kiosk. A courier who only uses the delivery drop-off is logged but is not signed in and is not on the roll call.
Timing, said plainly
The 28 days are yours, not ours
The Standard sets the 28 days, and they started at the end of your audit. We publish no installation time. Before a kiosk goes into a corrective action plan, ask us for a date, in writing, and plan around it.
Keep a paper correction in place until the kiosk is live: the book with a sign out column, the declaration on a card, whatever your corrective action says. A plan that depends on a delivery date nobody has given you is a plan the certification body can reasonably question.
The other two BRCGS standards
Packaging, and storage and distribution
Packaging Materials Issue 7: 28 calendar days, extended to 90 calendar days for non-conformities at an initial audit (Part I, and Part III 2.3.2).
Storage and Distribution Issue 4: 28 calendar days for a certificated site and 90 calendar days for an initial audit (Part III 2.5), read in the Standard on 27 September 2026.
See it work
A sign in and a fire roll call, in 100 seconds
A visitor signs in on the iPad. The alarm goes. The marshal opens the live list on their phone at the muster point and reads off who is still on site.
The player loads from YouTube only when you press play. Nothing is sent to Google before that. What happens when you do.
Before you ask
The questions technical managers ask after the audit
How long do we have to answer a BRCGS non-conformity?
Twenty-eight calendar days from the audit. Part III 2.3.2 of Issue 9 says that if the evidence of corrective action, the root cause analysis and the preventive action plan have not reached the certification body inside that period, certification is not granted and the site needs a further full audit. For grade C with two majors and every grade D, Table 2 asks for a revisit within the 28 days instead of documentary evidence.
Is the window different for an initial BRCGS Food Safety audit?
Not in Issue 9: we found no separate corrective action window for an initial audit in the Standard or in the F926 position statements, version 4. What Issue 9 does say is that failing the statement of intent of a fundamental requirement, which is a major non-conformity, leads to non-certification at an initial audit and to withdrawal of certification at later ones. BRCGS Packaging Materials Issue 7 and Storage and Distribution Issue 4 are different, and allow 90 calendar days at an initial audit.
Do we have to finish the preventive action within 28 days?
No. Appendix 8 of Issue 9 says: “Preventive actions often take longer than 28 calendar days, and sites are therefore not expected to fully complete the preventive action prior to publication of the audit report.” The plan, with a timescale, goes to the certification body within the 28 days, and Part III says the non-conformities from this audit are checked again at the next one.
What evidence can we send for a visitor control finding?
Part III lists objective evidence such as updated procedures, records, photographs or invoices for work undertaken, a remote audit of the corrective action, or a further visit by the certification body. Which your certification body accepts for your finding is its decision, not ours.
Can a visitor kiosk close our non-conformity?
No. It can be part of what you do about one: a record of who came in, for whom, when they left and the wording each person accepted. It does not choose your root cause, write your plan or decide whether the certification body accepts it.
How quickly can a kiosk be installed?
We publish no installation time, and we will not put one on this page. The 28 days are yours, set by the Standard. Ask us for a date before a kiosk goes into a corrective action plan, and keep a paper correction in place until the kiosk is live.
Being straight with you
What this does not do
- We are not BRCGS, a certification body, an auditor or a food safety consultancy. This is general information about a published standard, not certification advice.
- A kiosk does not close a non-conformity. The certification body reviews the evidence you submit and decides.
- We publish no installation time. Ask us for a date before a kiosk goes into a corrective action plan, and keep a paper correction in place until it is live.
- The kiosk asks no questions and stores no health answers. It shows your declaration and records who accepted which wording, and when.
- It checks no ID and records no badge being handed back. Its arrival message goes to one Teams or Slack channel per site, not to a person, and nothing is sent when somebody signs out.
Sources
Check any of this yourself
- BRCGS Global Standard Food Safety, Issue 9August 2022, free after registration on the BRCGS Store. Clauses 4.1.4 and 7.3.2, Part III 2.3.2, Table 2 and Appendix 8 are quoted in part, a sentence or a phrase each; 2.4.2 and 2.6 are described in our words. Read 27 September 2026.
- BRCGS, F904a Auditor Checklist and Site Self-Assessment Tool, Issue 9Version 1, 1 August 2022, free: it is listed under Food Safety on this BRCGS page. BRCGS’s own reproduction of every Issue 9 requirement; 4.1.4 and 7.3.2 were checked against it word for word. Read 27 September 2026.
- BRCGS, F926 Position Statements for Issue 9, version 4.1Version 4 is dated 27/04/2026 and effective from 10 August 2026; version 4.1, dated 6 October 2026, is the same document rebranded, with the same four statements, and is listed under Food Safety on this BRCGS page (the Standard’s own page offers a version 5, also dated 6 October 2026, whose change log says rebranding only). None of them changes 4.1.4, 7.3.2 or the 28 days. Read 27 September 2026, and read again at 4.1 and 5 on 13 and 14 October 2026.
- BRCGS, Behind the scenes of Food Safety Issue 10Read 27 September 2026 under the title “Behind the scenes of Food Safety Issue 10”, dated 11 August 2026: Issue 10 in development, with no publication date. BRCGS rebuilt its website in October 2026 and the item is not on the new site, so this link is to its news index.
General information about a published standard, not certification advice. Your certification body works to the issue and position statements in force for your audit; check them against your own copy of the Standard. BRCGS is a trade mark of BRC Trading Limited, which has not endorsed, reviewed or had any part in this page. Its documents are quoted a clause at a time, with the document, version and date read beside each, and none is copied here: the files are on brcgs.com, on the pages the links above go to.
The morning of an unannounced auditBRCGS Food Safety, the visitor clauses
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Bring the auditor’s wording and your audit date
Fifteen minutes on the phone. Read us the non-conformity and tell us when the audit ended, and we will give you a date we can install by, or tell you straight that a kiosk does not belong in this plan.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? ben@noonelite.com
Not the person who signs it off? Send them the one page business case