SQF Edition 10: Four Core Clauses. Four Documentation Gaps. One Audit You Won't Pass on Paper Alone.
The auditor arrives unannounced. Within 30 minutes, they're on the production floor. Within the hour, they want your allergen cleaning validation records, environmental monitoring trend data linked to CAPA closures, supplier risk assessments, and the root cause methodology from your last three corrective actions.
How long does it take you to pull all of that together?
If your answer involves opening file cabinets, calling the night shift supervisor, or cross-referencing three spreadsheets, you’ve already spent an hour of unnecessary scramble — and you’re barely through the first morning of a two-and-a-half-day audit.
According to SQFI, Edition 10 audits begin early 2027. The code was published March 2, 2026, which means the window to build the right documentation structure is shorter than QA teams may realize. Core Clauses carry weighted scoring under Edition 10, major non-conformances on these clauses are reported to carry higher point deductions than standard clauses, verify current weights with your certification body. Check SQFI's current scoring framework for specifics. Three major Core Clause findings significantly elevates certification risk and may trigger additional audit oversight, confirm current outcome thresholds with your certification body.
This post breaks down the four highest-risk Core Clauses, names the specific documentation structure auditors expect, and shows exactly where paper logs and spreadsheets leave you exposed. If you oversee multiple facilities — not all on the same GFSI scheme — or manage SQF alongside USDA or FDA regulatory oversight, the documentation gaps described here don’t stay confined to one audit; they surface across all of them.
Why these four clauses, and why the evidence standard changed
SQF Edition 10 designates a weighted subset of clauses as Core Clauses. Four of them, allergen management, CAPA, approved supplier program, and environmental monitoring, represent the areas where auditors consistently find that documentation doesn't match operational reality.
These aren't new requirements. What changed in Edition 10 is what counts as proof. Auditors are asking whether you can prove the program ran continuously, responded to real conditions, and that each element informed the others.
What auditors want to see is a traceable chain: allergen risk to supplier change to CAPA scope to environmental verification, with timestamps, methodology, and linked records. Paper and spreadsheets break that chain.
Clause 2.8.1: allergen management
What auditors expect to see:
Under SQF Clause 2.8.1, auditors want a risk-based allergen assessment conducted per SKU and per production line. Ingredient allergen verification should tie to incoming supplier declarations. Label verification logs need to show which staff member verified which label, on which run, with a timestamp. Cleaning validation must be specific to allergen cross-contact scenarios, and training records should demonstrate comprehension.
Where spreadsheets fail:
Allergen management on a spreadsheet is typically either a static risk register or a shift checklist. Neither captures the linkage auditors now require. When a supplier changes a formulation, does your allergen risk assessment automatically surface for review? When a line clearance fails, does it automatically generate a corrective action or for repeated failures a CAPA? When a label verification finds a discrepancy, is that event timestamped and connected to product disposition?
What audit-ready allergen documentation looks like:
- Per-SKU allergen risk assessment, versioned and dated
- Supplier allergen declarations linked to receiving records
- Line clearance records with operator-level sign-off and timestamps
- Label verification logs with lot-level specificity
- Corrective actions that trace back to any label or cross-contact event
- Training records that demonstrate comprehension, not just attendance
Your allergen records should be retrievable in minutes. When QA teams move from paper-based allergen tracking to digital forms captured at the point of work, with supervisor sign-off built into the workflow and CAPA triggers tied to out-of-spec results, auditors can follow the chain without asking anyone to reconstruct it.
Clause 2.5.3: corrective and preventive action
What auditors expect to see:
SQF Clause 2.5.3 now requires that your root cause analysis methodology, Five Whys, fishbone , fault tree, or otherwise, is documented at the time the CAPA is created in the record itself.
Auditors also want verification of effectiveness: evidence the corrective action worked, not just that it was closed. And they want CAPAs connected to their source, the audit finding, the customer complaint, the environmental positive, the non-conforming product event.
Where spreadsheets fail:
Most CAPA spreadsheets track status: open, assigned, closed. Some track the action taken. Very few enforce documentation of the RCA methodology at creation. Fewer still link CAPAs back to triggering events in a way auditors can trace without a phone call to whoever built the file.
The result is a program that works operationally but can't demonstrate itself during an audit, and auditors close this gap quickly.
What audit-ready CAPA documentation looks like:
- Source field capturing what triggered the CAPA
- Documented RCA methodology with supporting evidence
- Action assignments with due dates and named owners
- Verification of effectiveness as a separate, documented step after closure
- Trend visibility across CAPAs to catch recurring root causes
When your CAPA records are built around configurable templates, with required RCA fields, linked source events, named owners, and an approval step that enforces effectiveness verification before closure, auditors can follow every case from trigger to resolution. Auditors can also be granted controlled access to review specific records without seeing unrelated system data, which removes one of the friction points facilities dread most.
Clause 2.3.4: approved supplier program
What auditors expect to see:
SQF Clause 2.3.4 requires a risk-based approach to supplier selection, meaning your audit frequency, documentation requirements, and monitoring intensity should reflect what each supplier actually provides. A supplier of ready-to-eat ingredients carries different requirements than a packaging supplier. Allergen-containing ingredients require higher scrutiny. Foreign suppliers face additional verification requirements.
Auditors want to see that risk stratification documented and driving your scheduling. They want supplier audit records, not just certificates. They want evidence of ongoing performance monitoring, and that supplier non-conformances triggered corrective actions that were tracked and closed.
Where spreadsheets fail:
Supplier compliance in most facilities lives across shared drives, email threads, and spreadsheets tracking certification expiration dates. When an auditor asks to see the full evidence chain, supplier risk rating, audit frequency, last audit result, any non-conformances, the corrective actions those non-conformances generated, the manual assembly is extensive.
The operational problem is real too. When a supplier is delinquent on a required document, does your team know immediately, or do they find out when the truck arrives?
What audit-ready supplier documentation looks like:
- Risk-based supplier classifications, documented and revisable
- Requirements defined per supplier and material category
- Automated notifications when documents are due or expired
- Supplier-submitted documentation stored and retrievable
- Non-conformances linked to specific suppliers
That last point deserves more than a bullet. When a supplier non-conformance generates a SCAR that feeds directly into your CAPA system, auditors can see the full chain in one place: the non-conformance, the corrective action request issued to the supplier, the internal CAPA triggered, and the verification that it closed. That's the evidence trail Clause 2.3.4 is looking for.
Clause 2.4.8: environmental monitoring program
What auditors expect to see:
SQF Clause 2.4.8 requires that your environmental monitoring program is risk-based and facility-specific. Your sampling plan, the locations, frequencies, and target organisms, must be justified by an assessment specific to your facility's operations and layout. A generic EMP template doesn't satisfy this requirement.
Auditors also want to see what happened when results were unsatisfactory. Did positives trigger CAPAs? Were root causes documented? Is the program reviewed annually, or when conditions change? And critically, is the EMP connected to your change management process (Clause 2.3.5), so new equipment, new suppliers, or new production areas trigger reassessment? Under 21 CFR § 117.165, FDA also expects verification procedures to confirm that environmental monitoring is actually working. Edition 10 auditors are trained to look for the same gaps.
Where spreadsheets fail:
An environmental monitoring spreadsheet can record swab results. It typically can't show you whether a positive trend in Zone 2 should prompt expansion of Zone 1 sampling. It can't link a new equipment installation to a review of sampling locations. It can't connect an unsatisfactory result to the CAPA that was triggered and subsequently verified.
The underlying problem is that environmental monitoring doesn't exist in isolation. It's the verification mechanism for your allergen controls, sanitation effectiveness, and supplier management. If your EMP data can't be cross-referenced with those other programs, auditors can't evaluate whether your food safety system is actually working.
One QA leader put it plainly: "Not having to wait till the end of the day when you're doing paperwork review to realize that you had a failure on the line is huge." (Egglife) That's the gap between an EMP that documents results and one that actually drives response.
When an unsatisfactory result is flagged in real time, the system can automatically generate a corrective action, and for repeated positives in the same zone, trigger a formal CAPA with root cause documentation required before closure.
What audit-ready EMP documentation looks like:
- Written, facility-specific risk-based assessment with documented justification
- Sampling plan with location rationale, organism selection, and frequency basis
- Results in a format that supports trend analysis across sites and time periods
- Unsatisfactory results linked to CAPAs with root cause documentation
- Annual review records, or review records triggered by operational changes
- Program connected to change management records
Instead of manually assembling swab result spreadsheets before every audit, your EMP trend data should be queryable in real time, filterable by zone, organism, time period, and linked CAPA status. When results are captured digitally at the point of collection rather than transcribed from paper at the end of a shift, manual entry errors stop creating documentation gaps your EMP can’t afford.
The common thread across all four gaps
Work through each clause and the documentation failure isn't about intent: most QA teams have allergen plans, most run CAPAs, most maintain supplier files, and most take environmental swabs.
The gap is structural: as one QA team described their situation before digitizing: "We had a lot of binders, filing cabinets. We tried Excel. It's just time consuming and not user-friendly. Handwritten documents that are hard to read, things are scratched out, scribbled on." (Blue Bell Creameries)
Paper and spreadsheets capture data in isolation: they don't enforce connections between programs, they don't generate audit trails at the point of work, they don't notify you when something is overdue before an auditor finds it. They require manual reconstruction to answer the questions auditors now routinely ask.
Edition 10's weighted scoring makes this concrete: core Clause major non-conformances carry higher point deductions than standard clauses, and three major findings creates substantial certification risk. The four clauses in this post are exactly where auditors find documentation that doesn't hold up to scrutiny.
Many QA leads are managing this across SQF, BRC, customer audits, and FDA inspections simultaneously. The documentation gaps described here don't stay confined to one audit, they surface across all of them.
Where to start
If you're a FSQA professional reading this, the honest first step is a gap assessment against these four clauses, to assess whether your documentation can answer the specific auditor questions outlined above.
What that assessment should tell you:
- Which clauses rely on paper or spreadsheet records that can't produce traceable evidence
- Where CAPA closures lack root cause methodology documentation
- Whether your EMP is linked to your CAPA program in a retrievable way
- What your supplier file looks like from an auditor's perspective
GFF, Inc. put it well after their most recent major audit: "We still brought all of our binders as references, but we didn't need them because everything was already in [SafetyChain]." That's what audit-ready documentation actually looks like: records that exist where auditors can see them, organized the way auditors ask for them.
Download our SQF Edition 10 Audit Prep Checklist: it covers the specific evidence auditors expect for each Core Clause, with a gap-by-gap worksheet you can work through before your next audit window opens.
