Change Management: Building an Audit-Ready Approach for SQF Edition 10

Following our webinar with Kiwa ASI, this guide breaks down what SQF Edition 10 actually expects from change management, where sites typically lose points in audits, and how to build a workflow that holds up under scrutiny. Access the original recording here.

Kiwa ASI logo

 

1. Requirements: What Edition 10 Actually Expects

Change management isn't a new concept in SQF. What's new in Edition 10 is that it now has its own clause, its own weight in scoring, and its own expectation that sites can produce evidence, not just a policy binder. Most facilities believe they have a change management process, until you look at what actually happens the moment a change occurs. That's where the gaps show up.

Clause 2.3.5 is explicit: sites must document and implement a procedure to evaluate any change, including temporary, emergency, unplanned, or corrective-action-driven changes, that could affect food safety or the food safety system. At minimum, that procedure has to account for:

  • Formulations
    Any change to a recipe or manufacturing process for a product within your certification scope needs to go through the procedure, not just changes to entirely new products.
  • Inputs
    This covers materials, ingredients, labels, and equipment. If what goes into the product or what touches the product changes, it counts.
  • Specifications
    Updates to specs for raw materials, packaging, chemicals, processing aids, or contract services all trigger the same evaluation, even when the finished product looks identical on the outside.
  • Plans
    Anything that impacts your HACCP plan, including critical control limits, needs to be evaluated and, where necessary, revalidated before the change takes effect.

Every change also has to be confirmed or validated, documented, and communicated in a timeframe that keeps food safety intact. The key word is "before." Edition 10 expects risk to be evaluated ahead of implementation, not discovered afterward.

Two food workers in manufacturing facility

2. Risks: Why Small Changes Cause Big Problems

The most common misconception is that change management only applies to major capital projects. In practice, the changes that create the most exposure are the ones nobody thought to flag.

  • Equipment Modifications
    A modification made for productivity or maintenance reasons can quietly change product flow, create a new harborage point, or make a piece of equipment harder to clean. One facility ran a line faster without looping in food safety, and environmental swabs started coming back positive. The investigation eventually traced it to an equipment angle change that made proper sanitation impossible.
  • Supplier Substitutions
    "It's essentially the same ingredient" is the phrase to watch for. Specifications, allergen profiles, and processing characteristics can all shift even when the ingredient name on the label doesn't. Supplier swaps have gone unreported until customer complaints traced a taste or quality issue back to a raw material change QA never knew about.
  • Lines & Scheduling
    Running an allergen-containing product on a line shortly before a non-allergenic one is a change in production scheduling as much as it is a change in product. A shortened sanitation window between runs, even by five or ten minutes, can be the difference between a clean changeover and a cross-contact event.
  • Labeling & Packaging
    Mislabeling is consistently among the leading causes of food recalls. A packaging roll that doesn't get swapped, a line that isn't cleared before changeover, a formulation change that should have triggered a label review but didn't. These are rarely dramatic changes. They're small steps that got skipped.

3. Workflow: Building a Compliant Process 

A strong process turns the clause into a repeatable sequence of questions rather than a wall of text.

  • Identify
    What is changing, and why?
  • Evaluate
    What could this change affect? Biological, chemical, or physical hazards. A CCP or other preventive control. Allergen status. Cleaning and sanitation. Validation needs.
  • Approve
    Who needs to be involved? QA shouldn't be the only signature on this. Ask who else might be affected before the decision is final, not after.
  • Implement
    Update whatever the evaluation flagged: procedures, specifications, labels, training, HACCP documentation.
  • Verify
    Did the change actually work? Approval only authorizes implementation. Verification is what confirms it was effective.

That last step is the one sites skip most often. A change gets approved, then implemented, and the process gets closed. Whether it actually achieved what it was supposed to achieve, and whether anyone checked, is a separate question that Edition 10 expects an answer to.

Doc control comment and verification

4. Speed: Balancing Compliance and Urgency

Production doesn't stop for paperwork, and Edition 10 doesn't ask it to. The answer is a risk-based, tiered approach rather than treating every change identically.

  • Tiering
    Distinguish low-, medium-, and high-risk changes, and define the level of review each tier requires. Not every change needs the same scrutiny, but every change needs to go through the sorting exercise before you decide that.
  • Emergencies
    Equipment breaks. Suppliers fall through. Something has to change right now. The goal isn't to bypass change management when time is short, it's to have a defined process for exactly that scenario, so "emergency" doesn't become shorthand for "undocumented."

Managing an emergency in a controlled way is not the same as ignoring change management because you're in a hurry.

5. Ownership: Making Change Cross-Functional

QA cannot own this alone, and Edition 10 doesn't expect it to. Engineering, maintenance, operations, purchasing, R&D, regulatory, warehouse, IT, and finance can all touch a change that ends up affecting food safety.

Getting buy-in from teams that don't see themselves as part of the food safety process starts with explaining impact, not issuing instructions. Telling maintenance to fill out a form because "food safety wants it" rarely lands. Explaining what happens downstream if the form doesn't get filled, and what role that department actually plays in preventing it, tends to land better. Under Edition 10's updated grading structure, change management now falls under a core clause, which means point deductions for a miss are heavier than they used to be. That's useful for getting leadership to prioritize the conversation, but the more durable motivator is still operational: a missed change is a line-down, recall-risk, customer-complaint problem long before it's an audit finding.

6. Audits: Where Documentation Falls Short

The most common finding isn't that sites aren't managing change. It's that they can't produce the evidence.

  • Process
    No documented review process exists.
  • Sequencing
    Changes were implemented before approval.
  • Assessments
    Risk assessments are missing or generic, "no food safety impact identified" with nothing behind it.
  • Involvement
    No evidence other departments were included in cross-functional review.
  • Training
    Team members were never briefed on the change and its implications.
  • Verification
    No evidence the change was confirmed effective.
Foreign material analytics almonds

A strong risk assessment should show the thinking, not just the conclusion. An auditor should be able to read the record and understand why a site decided a change was acceptable, or what additional controls it triggered. That standard is useful internally too: if your own team can't reconstruct why a change was approved, the documentation isn't doing its job either way.

 

7. Implementation: Where Digital Solutions Help

Most of the failure points above trace back to the same root cause: the process lived on paper, in email threads, or in someone's memory, and none of those hold up under audit pressure. That's pushing more sites to move change management onto the same kind of digital footing they've already adopted elsewhere in their food safety programs.

It mirrors a broader shift already underway across the industry, where operations are digitizing legacy approaches to meet the Edition 10 demand for data-backed evidence of food safety culture. Change management is a natural extension of that shift, because a digital workflow does more than store records. It actively enforces the historical sequence auditors are looking for.

A digital approach to change management improves four things: coordination, comprehension, prevention, and insight.

  • Clear Coordination
    Change requests can automatically prompt the right next steps, with clear assignees and deadlines, plus notifications and tracking that ensure completion. Assignments can span verification, training, and much more. 
  • Reinforced Uptake
    Updated SOPs don't live in a dusty binder. Guidance can be embedded inside live records, meaning teams aren't guessing which policies apply or how to action new procedures.
  • Live Prevention
    Potential audit findings don't hinge on intensive reading and manual detection. Guardrails monitor live records and workflows, so issues get flagged and escalated automatically if a step in the process gets skipped.
  • Scalable Insight
    Legacy FSQA documentation is data-rich but insight-poor, because most analytics involve tedious manual cleanup and charting. In modern solutions, reporting is real-time and automated. Dashboards show whether a change is needed in the first place, and later, whether it actually worked.

This means a single change request can route from initial submission through risk tiering, cross-functional review, implementation, and post-implementation verification, with every attachment, sign-off, and comment attached to one record. When an auditor asks for evidence, the answer is pulled in one quick search, not a scavenger hunt through five departments' filing systems. 

 

Takeaways: Before Your Next Audit

Before your next audit, test your process against a few basics: is risk evaluated before implementation, not after? Is the approach tiered so speed and thoroughness aren't fighting each other? Is ownership cross-functional rather than resting on food safety alone? And does every step, from approval to verification, leave a paper trail an auditor can follow? Technology won't replace good judgment, but it will make sure none of this falls through the cracks.

Change management isn't really a new obligation. It's a new spotlight on a process many sites were already running informally. The sites that come out of Edition 10 in the best shape will be the ones that turned that informal process into something documented, cross-functional, and provable, well before an auditor asks to see it.