SQF Audit Training Checklist: What the Auditor Will Ask For

An SQFaudit doesn’t test whether training happened — it tests whether you can evidenceit, from three directions at once. Per SQFI’s published audit process, the auditor gathers objective evidence by reviewing documentation and records, interviewing staff — its site-audit guidance says from senior management to shift workers — and observing operations. Training gets tested by all three: the program on paper, the records behind it, and whether the person on the line can actually answer for the task they’re doing. Here’s the checklist for having all three ready.

The training checklist

1. 1
   The documented training program

   The mandatory program (clause 2.9.2) exists in writing, covers the code's listed task areas — HACCP, CCP monitoring, hygiene, GMPs, sampling and testing, environmental monitoring, allergen/food defense/food fraud, plus any other tasks identified as critical to your SQF system — and defines competencies and training methods per duty, plus your refresher provisions.
2. 2
   A named, documented owner

   Who establishes and implements training needs is defined and documented (2.9.1.1), and senior site management can show it resources training (2.1.1.6). SQFI's own audit guidance checks whether senior management itself appears in the training records.
3. 3
   Records with all six elements

   Pick any employee: their records show name, skills description, training description, completion date, trainer, and competency verification (2.9.2.3). Auditors also check records are current and signed or authorized.
4. 4
   Competency verification you can show

   For each critical task, evidence the person can do it — a quiz result or a documented observation. SQFI guidance calls this the most critical field in the record.
5. 5
   Refresher history at your own cadence

   Your program defines refresher needs; your records must show refreshers actually ran at the intervals you committed to. A lapsed refresher against your own stated cadence is a self-inflicted finding.
6. 6
   SQF practitioner credentials

   Primary and substitute practitioners are designated (2.1.1.4), and the practitioner has completed a HACCP training course and can evidence HACCP competency (2.1.1.5).
7. 7
   Contractors and visitors covered

   Maintenance and engineering contractors are trained in your food safety and hygiene procedures or escorted at all times (11.2.2.2); visitors entering processing areas are under the same trained-or-escorted rule (11.3.4.1).
8. 8
   The language check

   Training materials and delivery for critical tasks exist in the language(s) your staff actually understand (2.9.2.2) — auditors can test this simply by interviewing the workforce.
9. 9
   Interview-readiness on the floor

   Staff at every level can describe the food-safety tasks they're trained on. Remote-audit guidance expects 80% of on-site time spent on observation and interviews — the floor is where training evidence gets stress-tested.

How findings are graded — and what they cost

SQF grades non-conformances as minor, major, or critical. Two definitions matter most for training: the major definition explicitly includes the absence of evidence demonstrating compliance — the exact failure mode of a real program with weak records — and systemic falsification of records is itself critical. Under Edition 9 scoring, each clause finding deducts 1, 5, or 50 points from 100: 96–100 rates E (Excellent), 86–95 G (Good) — both on 12-month re-certification — 70–85 C (Complies), which triggers a 6-month surveillance audit, and below 70 fails with no certificate. A critical at an initial certification audit is an automatic failure requiring re-application.

After the audit, corrective actions must be verified and closed out within 30 calendar days of the site audit, and every minor and major requires a documented root cause analysis. The clock is short — which is why the cheapest corrective action is the finding you prevented by checking your own records first.

Before your first audit: the 90-day rule

SQFI’s implementation guidance is blunt about sequencing: document the system (“say what you do”), then run it — with a recommended minimum of 90 days of records— before the site audit (“do what you say”). For training, that means at least three months of dated completions, competency sign-offs, and refresher activity in the system before the auditor arrives. Certification then runs on an annual cycle: re-certification audits fall within ±30 days of the anniversary, a C-rating adds a 6-month surveillance audit, and an unannounced audit is required once every three years.