A dated programme covering every finding, the causes underneath them, and a readiness verdict before the auditor returns.
Failed audit recovery is a structured programme run after a certification audit ends in a fail, a downgrade, a suspension or a withdrawal. It covers root cause analysis across every finding, remediation of the parts of the system that produced them, and a readiness assessment before the reaudit. The aim is a certificate regained at a grade you can hold, and a system that does not produce the same findings again.
A long findings list rarely means a long list of unrelated problems. Grouping findings by what caused them usually reduces twenty items to three or four system causes, which makes the programme shorter and the improvement hold. Closing findings one at a time is what produces the same findings again at the reaudit.
We take on the whole recovery. Grouping and root cause across every finding, remediation of the system underneath, evidence generated over a period, and a mock audit verdict before the reaudit. Quoted on scope.
Schemes use different terminology and different thresholds. Your audit report records which outcome applies to you.
| Outcome | What it means | Commercial effect | Route back |
|---|---|---|---|
| Uncertified at first audit | The audit was for initial certification and the findings prevented a certificate being issued. | No certificate. Customers requiring one cannot be supplied. | Close findings, then a further audit before certification. |
| Downgrade | Certification continues at a lower grade because of the number or severity of findings. | Certificate held, though customers who specify a minimum grade may object. | Close findings and improve before the next scheduled audit. |
| Suspension | Certification is temporarily withdrawn while a serious issue is resolved. | The certificate cannot be used. Customers are usually informed by the scheme. | Close the findings, then verification by the certification body. |
| Withdrawal | Certification is removed, normally after a critical finding or a failure to close in time. | Loss of certified status and, in many cases, loss of supply agreements. | Full recertification audit once the system is rebuilt. |
Six things become true immediately, and each of them shapes how the recovery has to be run.
The audit report states what has been raised, at what grade, what the closure window is, and whether the outcome is a downgrade, a suspension or a withdrawal. That document governs everything, so it is read first.
Most schemes publish certificate status in a public directory, and many customer contracts oblige you to notify a change. Getting ahead of that conversation is normally better than being asked.
Auditors return knowing what was found. Areas that passed the first time get more attention on the second visit, and any previously accepted practice with a weak evidence trail is at risk.
A finding raised again after a recovery programme suggests the programme itself did not work, which affects how everything else in the audit is read.
Windows are set by the scheme and by the reaudit date, and the work has to fit inside them. Sequencing decides whether a recovery is achievable.
A long findings list rarely represents a long list of unrelated problems. Grouping them by cause makes the programme shorter and the improvement more durable.
Six phases, sequenced so evidence exists by the time the auditor returns.
| Phase | What happens |
|---|---|
| 1. Assessment | The audit report is read in full, findings are grouped by underlying cause, and the true scale of the work is established. |
| 2. Stabilise | Interim controls are put in place across anything currently uncontrolled, so risk is held while the permanent work runs. |
| 3. Root cause | Analysis across the grouped findings, which normally reduces a long list to a small number of system causes. |
| 4. Remediate | System rework covering documentation, procedures, training and the operational changes your team carries out. |
| 5. Evidence | Records generated over a period so controls have history behind them by the time the auditor returns. |
| 6. Readiness | A mock audit against the standard, with a verdict on whether the reaudit is winnable and what remains. |
Evidence is the binding constraint on almost every recovery. A control implemented three days before the reaudit has three days of records behind it, and auditors ask for evidence over a period. Sequencing decides whether a recovery is achievable inside the date you have.
These eight are where a recovery programme comes apart, and each is designed out of the programme from the start.
Twenty findings get twenty separate responses, each addressing its own symptom. The shared causes underneath survive, and they produce new findings at the reaudit.
Procedures get rewritten to satisfy the report. On the floor nothing changes, so the auditor sees the same gap between document and practice a second time.
Controls implemented days before an audit have no records behind them. Auditors ask for evidence over a period, and a control with three days of history rarely satisfies that.
Recovery spans quality, production, engineering and management. Without one owner with authority, actions stall between departments and the deadline arrives with the work incomplete.
The fastest available answer is operator error, and it is almost never the answer. Auditors returning after a failure test root cause reasoning harder than usual.
The report lists what was found on the day. A recovery that only addresses the listed items leaves everything the auditor did not have time to look at untouched.
Standards increasingly require evidence of resourcing and management engagement. A policy statement with no budget, meeting record or resource decision behind it is read as words.
Temporary measures holding the risk get dropped once the permanent fix is documented, before there is evidence the permanent fix works.
Food businesses whose certification audit ended in a fail, a downgrade, a suspension or a withdrawal. It suits operations where the findings list is longer than the team can absorb, and where a second poor outcome would cost supply agreements.
An initial certification audit ended without a certificate being issued.
Your grade has been downgraded and a customer specifies a minimum grade.
Your certificate has been suspended and supply is affected.
Certification has been withdrawn and you need to rebuild before recertifying.
A reaudit is scheduled and you are unsure the work will be ready.
There are more findings than your team has capacity to close.
The same findings have appeared at two consecutive audits.
A customer has been notified of the outcome and is asking for a plan.
You share the audit report in full, the outcome recorded, the reaudit date and any closure windows already running.
Findings are grouped by underlying cause and the true scale of the work is established, which is usually smaller than the list suggests.
Interim controls are put in place across anything currently uncontrolled.
Analysis across the grouped findings, then a dated milestone plan with owners, built backwards from the reaudit date.
Documentation, procedures and training are reworked, and your team is supported through the operational changes.
A mock audit against the standard, with a verdict on whether the reaudit is winnable and what remains to be done.
Operational changes on your site stay with your team. Changes implemented by an external party are rarely sustained, and the auditor will ask who owns them.
Appeals against a finding are made by you with your certification body, using their published process. Recovery work runs in parallel with an appeal.
Capital work, equipment replacement and construction sit outside the programme, though the plan states where they are required and by when.
Every programme is quoted against your own scope. Six findings with three months to the reaudit and forty findings with six weeks are very different pieces of work. These factors set the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
It depends on the outcome your certification body records. A downgrade means certification continues at a lower grade. A suspension means the certificate cannot be used until the issue is resolved. A withdrawal removes certification altogether. At an initial audit, findings can simply prevent a certificate being issued. Your audit report states which applies, along with the closure window and whether a further audit is required.
Both schemes work through grading and nonconformity counts. Enough findings, or a critical finding, results in no certificate at an initial audit, or in suspension or withdrawal for an existing one. The terminology differs between schemes, so the outcome recorded in your report is the one to work from.
It depends on the scale of the findings, the reaudit date and how much of the system needs rebuilding. The binding constraint is usually evidence. Controls need a history of records behind them before an auditor returns, and that history cannot be generated quickly.
Usually. Most schemes publish certificate status in a public directory, and many supply agreements oblige you to notify a change in certification status. Telling customers before they discover it generally goes better than the alternative.
In practice, yes. The auditor returns knowing what was found and looks harder at areas that passed the first time. Any practice previously accepted on a thin evidence trail is at risk on the second visit.
Certification bodies have an appeals process and it is stated in your contract with them. Appeals are worth pursuing where a finding is factually wrong or has been misgraded. They take time, so recovery work normally runs in parallel with an appeal, never instead of it.
Usually, once the findings are closed and the certification body has verified it. Verification is often on site for a suspension. The route back is stated by the certification body, and it is worth confirming in writing at the start of the recovery.
The programme covers investigation, planning, documentation, procedure work and readiness assessment. Operational changes on your site stay with your team, because changes implemented externally are rarely sustained and the auditor will ask who owns them.
A gap assessment measures a system against a standard before an audit. Recovery starts from an audit that has already gone badly, and it covers closure of the specific findings, remediation of the causes underneath them, and readiness for the reaudit. Recovery includes assessment work, and it does not stop there.
That indicates the recovery addressed symptoms and left the causes in place, and auditors treat it as evidence about the whole system. It is the outcome the grouping and root cause stages are designed to prevent, which is why the programme resists closing findings one at a time.
Rarely a good idea immediately after a failure. Scheme rules on transfer following an unresolved finding are strict, and a transfer at that point looks like an attempt to avoid the finding. Resolve the position first, then review the relationship.
A recovery plan with dated milestones, root cause analysis across the grouped findings, corrective and preventive actions, the remediated documentation, and a readiness verdict from a mock audit before the reaudit date.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
Hands on support closing a major nonconformity inside the window your certification body has given you.
Read about Major Nonconformity Support →A full rehearsal of your certification audit, run to the same protocol and duration as the real one, before the certification body arrives.
Read about Mock Certification Audit →A structured comparison of your current food safety system against the standard you need to meet, returning every gap with a priority and an owner.
Read about Food Safety Gap Assessment →Certificated course covering building a food safety management system to a GFSI standard.
View Certified FSMS Implementation Manager →Expert BRCGS Food Safety consulting worldwide. Gap assessments, Issue 9 certification prep, mock audits, Grade AA support and ongoing compliance for food...
See BRCGS Food Safety Consulting →Expert SQF consulting worldwide. SQF Code Edition 9 gap assessments, certification prep, SQF Practitioner support, Quality Code add-on and mock audits for food...
See SQF Consulting →Expert FSSC 22000 consulting worldwide. Gap assessments, certification prep, Version 7 transition support, internal audits and ongoing compliance for food...
See FSSC 22000 Consulting →Send your audit report and reaudit date, and receive a written quote covering the scope, the timeline and the price.