BRCGS Audit Preparation for a Small Food Factory: AI Checklists

Start with a clause-by-clause gap list, a document register and a mock audit, all drafted with an AI assistant from your own facts, then verify every line against the real standard and your real records. AI saves hours on the paperwork; it cannot grade your site, because the auditor from your certification body decides.

The trap is believing the draft. An assistant will happily write "daily glass checks are recorded in form QA-14" when no such form exists. Treat everything it produces as a list of questions to answer on the factory floor, not as evidence. Evidence is a signed record with a date, which you can put in an auditor's hand.

Follow me on Instagram@sagnikteaches

The standard in question is the BRCGS Global Standard for Food Safety. Issue 9 is the edition audited against as this is written. BRCGS began work on Issue 10 in 2026, with a public consultation and a technical working group, and has not announced a release date, so check the BRCGS site for the edition your audit falls under. Issue 9 has nine sections. Seven apply to every site: senior management commitment, the HACCP-based food safety plan, the food safety and quality management system, site standards, product control, process control and personnel. Section 8 covers production risk zones (high-risk, high-care and ambient high-care areas) and applies only where a site has them; section 9 covers traded products, meaning food the site buys in and sells on without making or packing it. Your preparation should mirror that order, because the auditor's report will.

Connect on LinkedInSagnik Bhattacharya

What to hand the AI and what to keep back

An assistant works from what you give it. Give it your own summary of each clause, your site facts and your file list, and it can organise them quickly. Do not paste the standard itself unless your licence permits it. Write short paraphrases such as "3.5 supplier approval: we need a documented approval process, risk assessment by material, and a monitoring routine". A page of those, one line per clause, is enough context for most of the jobs below.

Subscribe on YouTube@sagnikteaches

Use a business-grade or paid plan if you will paste anything commercially sensitive: recipes, customer specifications, supplier prices, complaint details. Business plans from the main vendors do not train on your content by default, while consumer plans usually carry an opt-out setting you have to find and switch. If you only work with file names, dates and clause summaries, a standard paid plan at about $20 a month is plenty. The point is not the tool but the habit of keeping recipes and customer names out of it.

Keep back three things entirely. Do not let AI write monitoring records after the event; backfilled records are the quickest way to turn a minor finding into something much worse. Do not let it invent procedures you do not follow, since the auditor will ask a line operator to describe the procedure. And do not let it decide a risk rating, because the hazard analysis must reflect your site and your team signs it.

Step one: a gap list by section, built from a one-page site profile

Begin with a profile the assistant can reuse. Half a page is enough: what you make, how many people work on a shift, the main hazards (allergens, foreign bodies, microbiological risks), whether you have high-care or high-risk areas, how many raw material suppliers you use, and which of the last audit's findings are still open. Paste it at the top of every prompt, or load it into a Claude Project or ChatGPT Project so you do not repeat it.

Then ask for a gap list in a fixed format so you can sort it later. This prompt works with ChatGPT, Claude or Gemini:

You are helping a quality manager prepare for a BRCGS Food Safety audit.
Site profile: [paste profile].
Below are my own one-line summaries of the requirements in Section 3
(food safety and quality management system). For each one, list:
1. The records an auditor would normally expect to see (evidence)
2. A question I should answer yes or no with a document in my hand
3. The usual weak spots in a small site
Output a table: requirement | evidence | yes/no question | weak spot.
Do not say whether we comply. Do not invent document names.
[paste your summaries]

The last two instructions matter. "Do not say whether we comply" stops the assistant from reassuring you, and "do not invent document names" stops it from filling the evidence column with plausible forms. Run it once per section so each answer stays short enough to read.

Here is the kind of row it returns for supplier approval, which sits in Section 3 (illustrative output; check the clause number in your own copy):

You would then walk the goods-in list, tick off each supplier against the file, and mark the row green, amber or red. The AI did the translation from requirement to question. You did the checking.

A 24-person sauce producer works through its seven sections

Suppose a sauce and dressing producer with 24 staff, one site and about 60 raw material suppliers has a certification audit in twelve weeks. The quality lead, who also looks after the lab bench and the allergen matrix, has two evenings a week for preparation. In this illustration the site has no production risk zones and sells no traded products, so sections 8 and 9 drop out. She builds the profile, runs the gap prompt for each of the seven remaining sections, and then spends one afternoon walking the floor with the output on a clipboard. Illustrative figures for what came out:

The 19 reds are the work plan. She sorts them by how long they take to close, not by section. Four need building work (a damaged wall-to-floor junction in the packing room, a door seal, a drain cover, an unsealed light fitting above open product), so those go to the maintenance contractor first because lead times are weeks. Six are missing records she can start creating now (the allergen changeover verification, the annual review of supplier performance, two internal audit actions without closure dates). Nine are wording or training items she can finish herself in a fortnight.

The amber items are the dangerous middle. "Amber" in her log means a record exists but she is not sure it would satisfy a stranger: a cleaning schedule with no verification signature, a calibration certificate that does not state the tolerance. She gives the amber rows to the assistant again with a different prompt: "Here is what we have. Suggest the one extra detail that would make this convincing to an auditor, and tell me what question the auditor is likely to ask next." The reply is a starting point for a conversation with the team, not an answer.

A document register that shows what is missing, not just what exists

Most small sites have a folder of procedures, but nobody can say in thirty seconds which are current. A document register fixes that and doubles as the first thing you hand an auditor who asks "show me your procedure for X". Build it from a plain file listing, not from memory.

Export the folder contents to a spreadsheet (file name, last modified date), add three columns by hand (document owner, review due, replaces version), and paste the table into the assistant with this request:

Here is my document list for a food factory (name, date, owner).
Compare it with this list of document types an auditor usually asks for:
[paste your list: HACCP plan, allergen procedure, supplier approval,
traceability and recall, complaints, internal audit, corrective action,
pest control, cleaning, calibration, training, maintenance, ...].
Return three lists: (a) types with no matching file, (b) files not
reviewed in the last 12 months, (c) files whose names suggest two
versions of the same document. Do not guess content.

It reads file names and dates only, so you can run this without sharing any procedure text. A typical output for the sauce producer: no file matching "management of incidents and product withdrawal", two files named "Allergen procedure v3" and "Allergen procedure FINAL", and nine documents last touched more than a year ago. Each of those is a real finding in waiting, and each took ninety seconds to surface.

Then keep the register alive. Give each document an owner and a review month, and ask the assistant once a quarter to turn the register into a reminder email for each owner, listing only what is due in the next 60 days. If you already use a shared drive with a spreadsheet, that is enough; a document control system only pays off beyond about a hundred controlled documents.

This is the same discipline described in the ISO 9001 documentation tutorial, and the register transfers to any other standard you add later.

The checklist, grouped the way an auditor walks the site

The list below is a working checklist, not the standard. Each item says what to check and how to prove it. Clause numbers in this tutorial are the ones confirmed in Campden BRI's published commentary on early Issue 9 audit findings; for the rest, use the section names and check the numbering in your own copy.

Section 1 and 2: management and the food safety plan

• Policy and objectives signed this year. Prove it with a dated, signed policy and the objectives with measures. Ask AI to draft measurable objectives from last year's complaint and rejection data, then edit.
• Management review minutes. The meeting must have happened, with an agenda that covers audit results, complaints and resources. Minutes written after the event with the date of writing shown are acceptable; backdated ones are not.
• Audit due-date management. Clause 1.1.10 concerns audit due dates, and Campden BRI's early Issue 9 data listed late paperwork as one of the most common major findings. Put your window and the certification body's booking deadlines in a shared calendar.
• HACCP team and training records. Names, roles, evidence of training. Check that the person named as team leader still works there.
• Flow diagrams verified on site. Walk the line with the diagram and mark differences in pen. AI cannot do this step.
• Hazard analysis and CCP monitoring. Each critical control point needs a limit, monitoring, a corrective action and verification. Ask the assistant to list questions per CCP; fill in the answers from records.

Section 3: the management system, traceability and complaints

• Supplier approval. One record per supplier, risk-rated, as in the table above.
• Traceability test. Pick one finished batch and trace it back to every ingredient and forward to every customer, with a mass balance. Time the exercise and write down how long it took. Run it twice before the audit with different products.
• Complaints. A log, trend analysis and a closed loop. Ask AI to group last year's complaint descriptions into themes and propose a trend table; verify the grouping against the originals.
• Incident and recall procedure. A named team, a call tree that works, and a mock recall record. Test the phone numbers.
• Internal audit schedule. A schedule that covers the whole standard across the year, auditors independent of the area audited, and corrective actions with owners and dates.

Section 4: the building, equipment and hygiene

• Cleanliness and hygiene. Clause 4.11.1 was one of the most frequent findings in early Issue 9 data, minor and major. Show cleaning schedules, verification (visual checks, swabs) and that the people doing the job know the method.
• Pest management. Clause 4.14.1. Current or poorly managed past infestation is likely to be graded major, according to Campden BRI. Show the contractor's visit reports, trend analysis, proofing actions and bait station maps.
• Chemical control. Clause 4.9.1.1. Check every decanted bottle is labelled, concentrations match supplier instructions, and printer inks and cleaners are controlled.
• Equipment design. Section 4.6 is new in Issue 9, and existing equipment is judged against the same criteria as new. Walk each food-contact machine with a torch looking for flaking paint, exposed threads and hollow tubes.
• Foreign body controls. Glass and brittle plastic register, metal detector or X-ray test records, sieves and filters inspected.

Section 5 and 6: product and process control

• Allergen control. Matrix by product, line changeover cleans verified, labelling checked against the recipe. See the tutorial on AI label makers versus manual checks for why a person must sign off each label.
• Labelling and pack control. Right label on the right pack, with line clearance and a record of who checked.
• Weight and measure controls. Checkweigher or scale checks logged, and the calibration status of every device used for monitoring.
• Product release and testing. A defined release rule, test results filed, a method for out-of-specification results.

Section 7: people

• Induction and training matrix. Who is trained on what, when, by whom. Temps and agency staff count.
• Personal hygiene and protective clothing. Watch a changeover at shift start. Rules on jewellery, nails, hair and visitors written and followed.
• Medical screening. A questionnaire at starting work and a way to report illness. Check how it is handled when someone is unwell.

Sections 8 and 9: only if they apply to your site

• Production risk zones. If you have high-risk, high-care or ambient high-care areas, section 8 adds requirements for those zones on layout and segregation, building fabric, equipment, staff facilities, housekeeping, waste and protective clothing. Ask the assistant for a separate gap list per zone, and settle the zone classification itself from BRCGS's own guidance on production risk zones, not from the assistant's view of your products.
• Traded products. If you buy in finished products and sell them on without processing or packing them, section 9 applies to those lines, and you tell your certification body before the audit that you want it included. Keep a list of traded lines with their approved suppliers and specifications; a traded line missing from the audit scope is an easy gap to overlook.

Mock audit questions that sound like an auditor, not a quiz

An auditor does not read your procedures aloud. They pick a record, a person or a place and ask a question. Mock audits fail when the questions are too polite. Ask the assistant to produce vertical-audit questions, meaning a trail through one product or one process from start to finish, and ask it to phrase them as an auditor would speak to an operator.

Write 15 questions an auditor might ask a packing line operator at a
small food factory making sauces in glass jars. Include: three about
glass and foreign bodies, three about allergens at changeover, three
about what they would do if a metal detector failed, three about
labelling checks, and three about hygiene. Keep each to one sentence
and make them open ("show me", "what would you do if").

Illustrative output includes "Show me how you know the right label is on this jar", "What would you do if the metal detector rejected five packs in a row?" and "Where would you report a broken jar on the line?". Use them in two ways. First, ask the operators themselves, with the quality lead observing, and note hesitation. Second, ask the quality lead's manager the management questions, such as "When did you last review complaint trends and what did you change?"

Keep the mock audit honest by following three rules. Pick samples you did not prepare. Write the finding in the language an auditor would use ("no evidence of verification of cleaning in the packing room on three of ten days sampled"). And grade it harshly: when in doubt, mark the finding as a non-conformity, because the real one will be graded by someone who has no reason to be kind.

A good rhythm is a half-day mock audit at week eight, a second at week eleven covering only the findings from the first, and a final walk-round the day before. For the first, borrow someone from outside the area; a manager from another department, a trusted customer technologist, or a consultant if you have the budget. AI plays no part in the observation itself, but it helps afterwards: paste your notes into the assistant and ask it to draft the corrective action requests with a clear problem statement, a space for root cause and a space for the action. Edit the root cause with the team; AI tends to write "lack of training" for everything.

A realistic slip: the checklist that said everything was fine

One failure pattern is worth naming because it is so tempting. A quality lead asks an assistant: "Here are our procedures. Are we ready for the audit?" The assistant answers with a confident summary: records in place, no obvious gaps, a few suggestions on wording. It sounds like a pass. The real problem: the assistant only saw procedure titles, not records, so it could not know that the glass register had no entries for two months or that two of the cleaning verification forms had been signed in advance for the week.

The fix is a rule: never ask AI whether you are ready. Ask it to produce questions and evidence lists, then answer them yourself from records. Its job ends where the physical check begins.

A second slip is quieter. AI drafts a procedure that is tidier than your practice, you file it, and the next audit finds that staff do not follow it. A procedure that does not match reality is a non-conformity of its own. Whenever you use an AI-written procedure, have the person who does the job read it aloud on the floor and correct every sentence that is not how they work.

Twelve weeks to audit: who does what

If your site has several open findings from last year, start with them. Auditors re-check earlier non-conformities and a repeat finding reads as a management failure rather than a one-off.

Briefing the team so answers match the records

A plain, one-page briefing helps every operator who may be spoken to. Ask the assistant to draft it from your procedures, then trim it so it fits on a single sheet at a readable size. Illustrative content for the packing area: what to do if you find a broken jar, where the allergen changeover checklist lives and who signs it, how to read the metal detector test card, who to call about an unexpected stoppage, and what to say when you do not know ("I'd check the procedure and ask my supervisor", never a guess).

Teach one rule above all: show the document, do not describe it from memory. A confident wrong answer is worse than "I'll find the record". Practise it with the mock questions above, each operator answering at least three, and have supervisors do the same for their areas. AI can also produce a short quiz for each area; keep it to ten questions so people will actually do it.

For management, the briefing is different. They need to be able to explain how the HACCP team reviews changes, what the site does with complaint trends and where resources are discussed. Ask the assistant for a one-paragraph talking point on each, then check each against the real minutes. If the minutes do not support the talking point, the talking point is wrong.

After the audit: drafting responses without papering over problems

When the report arrives, each non-conformity needs a response: the correction, the root cause analysis and the corrective action, within the deadline in your certification body's report. This is a place AI helps and can hurt. It helps by structuring the response. It hurts when it produces a response that sounds complete but does not fix the root cause.

A short prompt does well: "Here is a non-conformity as written by the auditor and what we found when we investigated. Draft the response in three parts: immediate correction, root cause, corrective action with an owner and a date. Ask me questions if my information is not enough to identify a root cause." The last sentence matters, because assistants will otherwise write a plausible cause. If the root cause for a missing cleaning record was a supervisor on leave with no cover, the action is a cover rule and a check, not "retrain all staff".

Then check that every action has an owner, a date and a way to confirm it worked. A good practice is to verify closure two or three weeks later with a new sample, and log the check. The same register that tracked your preparation now tracks the findings.

What AI is not for in this process

Do not use AI as a substitute for the standard or your certification body's guidance. Where a requirement is unclear, ask the certification body, or read the interpretation guidelines BRCGS publishes for its standards. Do not use it to decide whether a finding is minor or major; the grading rules sit in the standard and the auditor applies them. Do not use it to produce records. And do not feed it audit reports from other companies or confidential customer specifications.

If your wider goal is to cut routine paperwork, the small manufacturer quality-control tutorial shows where else AI helps on a production site, and the tutorial on checking an AI-drafted HACCP plan covers the verification habits that apply here too. The principle is the same everywhere in food safety: AI organises, people verify, the auditor decides.

Questions food producers ask before using AI on audit preparation

Can AI tell me whether my site would pass a BRCGS audit?

No. AI can draft a gap list, a document register and practice questions, but it has not seen your factory, your records or the current wording of the standard unless you give it. Only the auditor from your certification body grades the site. Use AI to find gaps early, then check each one yourself.

Is it safe to paste the BRCGS standard into ChatGPT or Claude?

Check the licence on your copy first, because the standard is a paid, copyrighted document. A safer habit is to write a one-line summary of each clause in your own words and give the AI that. Never paste supplier contracts, customer specifications or recipes into a free consumer plan.

Which AI is best for a food safety document register?

Any current chat assistant with file upload does the job: ChatGPT, Claude or Gemini. The choice matters less than the input. Give it a plain list of your file names and revision dates, and ask it to flag gaps rather than write documents from nothing.

How early should a small factory start preparing?

Allow about twelve weeks if your records are in reasonable shape, longer if procedures live in people's heads. The slow parts are collecting evidence over time, such as three months of monitoring records, and fixing building or equipment findings, not writing documents.

Further reads

• Should an AI Chatbot Answer Allergen Questions for Your Restaurant? — Why allergen answers need a person, not a chatbot.
• Where Should a Small Manufacturer Start With AI? — Where else a small production site can start with AI.
• AI in Food Service: A Four-Week Menu Cycle With Costs and Allergens — Allergen records and costs in a food-service menu cycle.
• How to Track Contract Renewals and Deadlines With AI — Reminders for certificates and renewals that lapse quietly.
• AI Supplier Management: Track Prices, Lead Times, and Risk — Supplier approval records are a classic audit gap.
• A Simple AI Risk Register for Small Businesses (With Template) — A simple register format you can adapt for audit actions.
• 5S Audit Checklist: Build One for Your Shop Floor With AI — An area-by-area 5S scoring sheet drafted with AI from photos and notes, scored monthly by a supervisor, with AI turning the scores into a one-page trend.
• Cold Chain Temperature Logs: AI Flags Breaches in Logger Exports — How a small food distributor can use AI on logger exports to find breaches, spot gaps and faulty sensors, and draft the corrective-action note.
• Food Product Costing: AI-Built Batch, Yield Loss and Margin Sheet — Cost a food product from raw invoices to margin by channel, with trim loss, cook-off, packaging and labour minutes in one batch sheet.
• Food Production Schedule: AI Plans Around Allergen Changeovers — A weekly production schedule for five products on one line: allergen order, cleaning windows, shelf-life batch sizes and an AI prompt to draft it.
• Foreign Body Complaint: Investigate and Reply as a Food Producer — A step-by-step foreign body complaint routine for a food producer: sample, batch trace, line records, reply letters and escalation triggers, with AI as helper.
• Lot Numbering System for a Food Producer: Design Batch Codes — A lot code built from date, line and shift, tied to ingredient lots and tested with a mock recall before you need it.
• Retailer Supplier Questionnaire: Answer It From Evidence, Using AI — Build an answer bank from your own food-safety documents, let AI match questions to it and draft replies, then link evidence to every answer.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: BRCGS Global Standard Food Safety Issue 9 structure as described in BRCGS document listings, Campden BRI commentary on Issue 9 non-conformances and consultant guides to the Issue 9 sections; ChatGPT, Claude and Gemini vendor pages for plan details. Check clause wording and grading rules against your own licensed copy of the standard.