A food manufacturer in Maharashtra supplying a major UK retailer received a BRC audit non-conformance citing three maintenance failures: no documented evidence of pest proofing inspections on food contact equipment enclosures, cleaning validation records missing for two filling lines, and a refrigeration unit with an overdue preventive maintenance work order that had been running on corrective bypass for six weeks. None of these failures involved actual product contamination. All three cost the plant its Grade A certification — and with it, the retail contract. Food safety maintenance compliance is not about whether maintenance is performed. It is about whether it is documented, traceable, and retrievable on demand by an auditor who has seen every attempt to paper over the gap. Start your free trial to build audit-ready maintenance compliance. Book a demo to see OxMaint's Compliance & Audit Trail Management module configured for FDA, FSMA, SQF, BRC, and ISO 22000.
Compliance & Audit Trail Management
Every Standard. Every Audit. Every Record — Retrieved in Under 2 Minutes.
OxMaint tracks maintenance compliance across FDA, FSMA, SQF, BRC, and ISO 22000 in a single platform — scheduled work orders, timestamped completion records, cleaning validation logs, calibration certificates, and tamper-evident audit trails that satisfy every regulatory framework your plant operates under.
The Five Regulatory Frameworks — What Each Requires from Maintenance
Food manufacturers operating in global markets routinely face simultaneous compliance obligations across multiple regulatory frameworks — each with its own maintenance documentation requirements, audit process, and non-conformance consequences. Understanding exactly what each standard requires from maintenance enables a plant to build a single integrated compliance programme rather than five separate systems, and to demonstrate compliance across all frameworks from a unified set of records maintained in one CMMS.
Five Regulatory Frameworks — Maintenance Requirements Compared
FDA / FSMA
21 CFR Part 117 — Preventive Controls for Human Food
Core Requirement
Written preventive maintenance programme for food contact equipment, with documented completion records retained for minimum 2 years
What Inspectors Check
PM schedule existence, completion records, calibration certificates for CCP monitoring instruments, corrective action documentation
Non-Conformance Consequence
FDA Warning Letter, import alert, facility registration suspension, consent decree
CMMS Requirement
Records must be attributable, contemporaneous, and retrievable — Part 11 applies to electronic records
SQF
SQF Code Edition 9 — System Element 11
Core Requirement
Documented maintenance schedule for all equipment, with records of maintenance performed, corrective actions, and equipment status at time of any food safety incident
What Auditors Check
Maintenance register completeness, work order completion records, lubrication records confirming food-grade lubricants, pest proofing documentation
Non-Conformance Consequence
Minor: corrective action required. Major: suspension of certification. Critical: immediate withdrawal
CMMS Requirement
Equipment register with maintenance history traceable per asset; FSMA alignment for US market facilities
BRC
BRC Global Standard Issue 9 — Clause 4.7
Core Requirement
Planned maintenance programme for all equipment used in food production, with documented completion. Maintenance personnel must be trained in food hygiene before working in production areas.
What Auditors Check
PM schedule and compliance rate, hygiene training records for maintenance staff, temporary repair records, foreign body risk assessment for maintenance activities
Non-Conformance Consequence
Grade reduction (A to B or B to C), certification suspension, loss of customer-mandated certification status
CMMS Requirement
Temporary repair register, foreign body risk log for maintenance events, hygiene clearance record after maintenance in production area
ISO 22000
ISO 22000:2018 — Clause 8.2 Prerequisite Programmes
Core Requirement
Maintenance and repair as a Prerequisite Programme (PRP) — documented procedures, defined frequencies, records of completion, and effectiveness monitoring
What Auditors Check
PRP documentation completeness, maintenance programme scope, evidence of monitoring and measurement, management review of PRP effectiveness
Non-Conformance Consequence
Minor NC: correction required within defined timeframe. Major NC: certificate suspension pending corrective action verification
CMMS Requirement
PRP monitoring records with objective evidence of completion; trend analysis of maintenance findings for management review
The Maintenance Documentation Requirements Every Standard Shares
Despite their differences in scope and certification process, FDA/FSMA, SQF, BRC, and ISO 22000 converge on the same core maintenance documentation requirements. A CMMS that satisfies these shared requirements simultaneously satisfies the maintenance documentation obligations of all four frameworks — eliminating the need for separate record systems per standard and the reconciliation burden that multiple parallel systems create during an audit.
Documentation Requirements Shared Across All Four Food Safety Standards
Scheduled PM with documented completion records
All 4
Universal
Calibration records for food safety monitoring instruments
All 4
Universal
Corrective maintenance records with root cause and action taken
All 4
Universal
Cleaning and sanitation records for food contact equipment
All 4
Universal
Pest proofing inspection and maintenance records
3 of 4
Most
Temporary repair register with resolution timelines
3 of 4
Most
Maintenance personnel hygiene training records
3 of 4
Most
Foreign body risk log for maintenance activities
2 of 4
Selective
FSMA Preventive Controls: What the Maintenance Programme Must Contain
FSMA 21 CFR Part 117 is the most prescriptive of the four frameworks on maintenance programme content. It requires that the Food Safety Plan identifies equipment-related hazards, that the maintenance programme addresses those hazards, and that completion records demonstrate the programme is being executed as written. FDA investigators reviewing FSMA compliance do not just check whether a PM schedule exists — they verify that it was followed, that deviations were documented and corrected, and that the records are attributable to identified individuals with timestamps that confirm contemporaneous entry.
01
Mandatory
Food Contact Equipment PM Programme
Requirement: Written PM schedule for every piece of equipment that contacts food or food packaging materials. Schedule must be risk-based — frequency determined by equipment type, product risk, and failure history, not arbitrary calendar intervals.
CMMS Record: Work order per PM event with equipment ID, task performed, technician ID, completion timestamp, and pass/fail status. Overdue PMs flagged automatically. Completion rate tracked as KPI and reviewed by FSMA-responsible individual.
02
Mandatory
CCP Instrument Calibration Records
Requirement: All instruments used to monitor Critical Control Points (temperature controllers, pH meters, metal detectors, checkweighers, pressure gauges) must be calibrated at defined frequencies with records retained. An uncalibrated CCP instrument invalidates every monitoring record from its last known-good calibration date.
CMMS Record: Calibration work order per instrument with calibration date, instrument ID, standard used, as-found and as-left readings, pass/fail, and technician ID. Due-date alerts prevent expiry. Calibration certificate attached as document to the instrument asset record.
03
Mandatory
Corrective Action and Deviation Records
Requirement: When a PM is not completed on schedule, when equipment fails, or when a food safety-relevant deviation occurs during maintenance, FSMA requires a documented corrective action that identifies the cause, the action taken, and verification that the action was effective. "Fixed it" is not a corrective action.
CMMS Record: Corrective work order with failure description, root cause identified, action taken, parts replaced, technician and supervisor sign-off, and effectiveness verification date. Linked to the parent PM record for full traceability. CAPA workflow for repeat failures on food safety-critical equipment.
04
Mandatory
Allergen Control During Maintenance
Requirement: Maintenance activities that disturb allergen-containing equipment, open product contact surfaces in allergen-dedicated lines, or involve tools and parts that have contacted allergen products require documented allergen controls — typically cleaning validation before line restart and a production hold until cleaning is verified effective.
CMMS Record: Work order for any maintenance on allergen-critical equipment includes mandatory allergen control checklist — cleaning completion, swab test result (if required), and sign-off by QA before production restart. CMMS prevents work order closure without allergen control confirmation on flagged equipment.
05
Required
Sanitation Maintenance Records
Requirement: FSMA Sanitation Controls require that equipment is cleaned and sanitised at defined frequencies and that cleaning effectiveness is verified. Maintenance events that break into product contact surfaces require documented cleaning and sanitation before production resumes — not just a visual check.
CMMS Record: Sanitation work order linked to maintenance work order — cleaning performed after maintenance, method used, chemical concentrations, contact times, rinse verification, and sign-off. Sanitation record retrievable by batch number, equipment ID, or date range for trace-back investigations.
FSMA & FDA Compliance
FDA Inspectors Ask for Records. OxMaint Retrieves Them in Under 2 Minutes.
OxMaint maintains FSMA-compliant maintenance records with contemporaneous timestamps, individual technician attribution, and tamper-evident audit trails — satisfying 21 CFR Part 11 requirements for electronic records while enabling any record to be retrieved by equipment, date, batch, or technician within minutes of an FDA inspector's request.
BRC Issue 9: The Maintenance Requirements Most Plants Fail
BRC Global Standard Issue 9 introduced significantly strengthened maintenance requirements compared to its predecessors. Three new or strengthened requirements catch plants that have maintained a BRC certification for years without updating their maintenance programme to match the current standard. Understanding exactly which clauses BRC auditors scrutinise most closely — and which documentation gaps trigger grade reductions — is the difference between a Grade A result and a non-conformance that costs a retail contract.
BRC Clause
Requirement
Most Common Failure
Severity
CMMS Solution
4.7.1
Planned maintenance programme for all food contact and food safety equipment with documented records
PM schedule exists but completion records are incomplete — tasks logged as "done" with no detail of what was checked or found
Major
Work order templates with mandatory fields — cannot close without task-specific data entered per checklist item
4.7.2
Temporary repairs must not put product safety at risk and must be documented with a defined resolution timeframe
Temporary repairs (tape, cable ties, makeshift guards) in production areas with no written record and no defined deadline for permanent fix
Major
Temporary repair work order type with mandatory escalation date — system alerts supervisor when temporary repair exceeds defined timeline without resolution
4.7.3
Foreign body risk control during maintenance — tools, nuts, bolts, and parts must be controlled and accounted for
No tool control procedure, no record of tools taken into and removed from production area, no check that all parts removed during repair were reinstalled or accounted for
Major
Maintenance work order checklist: tools taken in, tools removed, parts accounted for, sign-off by technician and production supervisor before restart
4.7.4
Maintenance personnel trained in food hygiene before working in production areas
Maintenance contractors and temporary technicians working in production areas without documented food hygiene induction — training records not linked to CMMS work order access
Minor
CMMS links technician access to training record status — work orders in food areas cannot be assigned to users without current food hygiene training certificate on file
4.7.5
Lubricants, cleaning chemicals, and maintenance materials used in food contact areas must be food-grade and documented
Lubricant records absent or show industrial-grade lubricant used on food contact bearings — no record of which lubricant was used at which maintenance event
Major
Work order materials field records lubricant type and grade per task — food-grade lubricants flagged in parts inventory, non-food-grade flagged as restricted for food contact use
SQF Code Edition 9: The Maintenance Audit Checklist Auditors Use
SQF audits follow a structured verification process against the SQF Code that is more prescriptive than BRC in some areas of maintenance documentation. SQF Edition 9 System Element 11 (Maintenance Programme) requires that the maintenance register covers all production and processing equipment, that records demonstrate the programme is being followed, and that the programme is reviewed and updated when equipment changes. The following checklist mirrors the verification sequence SQF auditors use — preparation against this list is the most direct path to a clean SQF maintenance audit.
SQF Edition 9 Maintenance Audit Preparation Checklist — Element 11
Is there a written, dated maintenance programme covering all production equipment?
The SQF maintenance programme document must be dated, version-controlled, and cover every piece of equipment used in food production. Equipment added since the last audit must be included. The document must specify maintenance frequency per equipment type — not a generic "as required" statement. SQF auditors request the programme document first and use it as the verification template for the rest of the maintenance audit.
Are maintenance records complete for the full audit period — typically 12 months?
SQF auditors select specific equipment and request the complete maintenance history for the audit period. Every scheduled PM must have a corresponding completion record. Gaps — where a PM was scheduled but no completion record exists — are non-conformances unless there is a documented explanation (e.g., equipment out of service, alternative PM performed). A CMMS that generates the full maintenance history per asset by date range satisfies this request within 60 seconds.
Is there documented evidence that lubricants used on food contact equipment are food-grade?
SQF specifically requires that lubricants used on equipment where incidental food contact is possible are food-grade (NSF H1 or equivalent) and that records demonstrate which lubricant was applied at each maintenance event. Auditors request the lubricant specification sheets and cross-reference them against the maintenance work orders for food contact equipment. A single work order showing non-food-grade lubricant used on food contact bearings is a major non-conformance.
Are pest proofing inspection records current and complete for all food contact equipment enclosures?
SQF requires regular inspection and maintenance of pest proofing on all food contact equipment enclosures, utility entry points, and building fabric. Inspection records must show who inspected, what was found, and what corrective action was taken for any finding. Auditors specifically check that gaps, holes, and wear points identified in previous inspections have been repaired and re-inspected. Pest proofing maintenance records must be in the CMMS, not in a separate manual pest control binder that is not linked to the equipment maintenance record.
Are calibration records current for all food safety-relevant measuring instruments?
SQF auditors request calibration records for temperature monitoring equipment, pH meters, weighing scales, and any other instrument whose reading is used to make a food safety decision. Records must show calibration date, next due date, calibration standard used, as-found and as-left readings, and the result. Any instrument with an expired calibration — even by one day — invalidates every food safety decision made using that instrument since its last valid calibration. CMMS due-date alerts prevent this, but only if the calibration schedule is correctly configured and monitored.
ISO 22000 Maintenance as a Prerequisite Programme (PRP)
ISO 22000:2018 treats maintenance as a Prerequisite Programme — one of the foundational control measures that manages the general food safety environment, distinct from the HACCP-based hazard controls applied to specific CCPs. The PRP classification means maintenance must be systematically planned, monitored for effectiveness, reviewed at defined intervals, and updated when changes occur. A plant seeking ISO 22000 certification for the first time will find that the maintenance PRP documentation requirement is one of the most documentation-intensive elements of the certification gap assessment.
ISO 22000 Maintenance PRP — Required Documentation
PRP Procedure Document
Clause 8.2.1 — Documented procedure for equipment maintenance
Written procedure defining the scope of the maintenance programme, frequency determination method, responsibility assignment, and the record format used. Must be version-controlled and reviewed at each management review cycle. Available to auditors on demand.
Maintenance Records as Monitoring Evidence
Clause 8.2.4 — PRP monitoring records
ISO 22000 requires objective evidence that PRP monitoring is occurring — for maintenance, this means completion records demonstrating the programme is being executed as specified. PM compliance rate, overdue PM tracking, and corrective action records all constitute monitoring evidence. These records must be retained and presented during certification audits.
Management Review of PRP Effectiveness
Clause 9.3 — Management review input
ISO 22000 requires that PRP effectiveness — including maintenance — is reviewed at management review meetings. This requires a structured KPI report covering PM compliance rate, overdue PMs, corrective maintenance trends, and calibration compliance. The management review minutes must document that maintenance PRP performance was reviewed and any actions required were assigned.
PRP Update When Changes Occur
Clause 8.2.3 — PRP update control
When new equipment is installed, existing equipment is modified, or a non-conformance reveals a gap in the maintenance programme, the PRP must be formally updated and re-approved. Change management for the maintenance programme must be documented — auditors check whether equipment changes in the audit period were reflected in updated maintenance schedules within a reasonable timeframe.
The Cross-Standard Compliance Calendar: What to Do and When
Building a cross-standard compliance calendar consolidates the maintenance activities required across FDA/FSMA, SQF, BRC, and ISO 22000 into a single operational schedule — preventing the situation where different compliance activities are managed in separate systems by different people, and where the gap between systems becomes the audit finding. The following schedule covers the minimum frequency requirements of all four frameworks simultaneously.
Cross-Standard Maintenance Compliance Calendar
Every Shift
CCP instrument function check and calibration verification (temperature probes, pH meters, metal detector sensitivity test)
Pre-production equipment condition inspection and sign-off before first batch
Fill volume / weight check on dosing and filling equipment
FDA, FSMA, SQF, BRC, ISO 22000
Weekly
Food contact equipment cleaning validation record review — verify all required sanitation records complete
Temporary repair register review — verify no temporary repairs exceed defined resolution timeline
Pest proofing walk-through on food contact equipment enclosures and entry points
FSMA, SQF, BRC, ISO 22000
Monthly
PM compliance rate report — percentage of scheduled PMs completed on time
Calibration due date review — instruments with calibration expiring in next 30 days flagged for scheduling
Food-grade lubricant verification — confirm correct lubricant used on all food contact equipment in period
Maintenance hygiene training record review — confirm all active maintenance staff current
All standards
Quarterly
Full pest proofing inspection with documented findings and corrective actions
Corrective maintenance trend review — repeat failures trigger CAPA
Calibration programme scope review — new or modified instruments added to schedule
Foreign body risk review for maintenance activities — update risk register if new tools or processes introduced
SQF, BRC, ISO 22000
Annually
Full maintenance programme review and update — equipment changes reflected, frequencies validated against failure history
Management review of maintenance PRP effectiveness — KPI trend, corrective action closure rate, calibration compliance
LOTO periodic inspection per OSHA / Factories Act requirement — one per authorised employee per machine
Mock audit against all applicable standard requirements — gap identification before certification audit
All standards
Audit Readiness: What Inspectors Request and How Fast You Need to Respond
The practical test of a food safety maintenance compliance programme is not whether the records exist in theory — it is whether they can be retrieved, presented, and explained under the time pressure of a live inspection. FDA inspectors, SQF auditors, and BRC auditors all follow a similar information-gathering sequence. Plants that can respond within minutes rather than hours demonstrate programme maturity that influences the auditor's overall assessment of the facility's food safety culture.
Request 1
PM Schedule and Compliance Records for Selected Equipment
Auditor selects 3–5 specific pieces of equipment and requests the PM schedule and all completion records for the audit period. Expected response time: under 5 minutes with a CMMS. Response: generate asset maintenance history report by equipment ID, showing all scheduled PMs, completion dates, technician names, and any overdue items with explanations.
Request 2
Calibration Records for CCP Monitoring Instruments
Auditor requests calibration records for temperature controllers, metal detectors, pH meters, and checkweighers. Expected response time: under 3 minutes. Response: retrieve calibration work order history per instrument showing as-found readings, as-left readings, calibration standard, technician ID, and certificate attachment. Confirm all instruments in calibrated status at time of audit.
Request 3
Corrective Maintenance Records and Root Cause Documentation
Auditor requests all corrective maintenance events on food contact equipment in the audit period. Expected response time: under 5 minutes. Response: generate corrective work order report by equipment category, showing failure description, root cause identified, action taken, parts used, and effectiveness verification. Any repeat failures on same equipment should have a CAPA record attached.
Request 4
Cleaning and Sanitation Records After Maintenance Events
Auditor selects a specific maintenance event and requests evidence of cleaning and sanitation before production resumed. Expected response time: under 3 minutes. Response: retrieve sanitation work order linked to the maintenance work order showing cleaning method, chemical used, contact time, rinse verification result, and QA sign-off timestamp. Demonstrates that no batch started before cleaning was confirmed complete.
Request 5
Maintenance Personnel Training Records
Auditor requests evidence that maintenance staff working in food production areas have current food hygiene training. Expected response time: under 2 minutes. Response: retrieve training record per technician from CMMS user profile — food hygiene training date, certificate reference, and expiry. Confirm CMMS is configured to prevent assignment of food area work orders to technicians with expired training.
Frequently Asked Questions
No — and maintaining separate systems is a compliance risk in itself, because records in two systems can diverge, creating inconsistencies that auditors from either body will flag. A single CMMS that captures all required record types — PM completion, calibration, corrective maintenance, cleaning validation, temporary repairs, tool control, lubricant records, and training linkages — satisfies both BRC Issue 9 and SQF Edition 9 maintenance documentation requirements from a unified data set. The key is ensuring the CMMS captures the specific fields required by each standard: BRC's foreign body risk log and temporary repair register are additions that SQF does not explicitly require, but including them in the CMMS workflow adds negligible overhead and eliminates any BRC-specific documentation gap.
FDA/FSMA requires minimum 2 years for records associated with preventive controls. SQF requires records retained for the shelf life of the product plus 12 months, with a practical minimum of 2 years for most ambient food products. BRC requires records retained for the shelf life plus one year, minimum 12 months for products with short shelf life. ISO 22000 defers to regulatory requirements in the applicable jurisdiction but requires records retained sufficiently to enable product traceability and investigation. For multi-standard plants, the practical approach is a 3-year minimum retention period across all maintenance record types — covering the most stringent requirement across all applicable frameworks and providing adequate history for trend analysis and audit response.
Contract and temporary maintenance workers must have individual CMMS user accounts — not shared credentials — for their records to be attributable as required by FSMA, BRC, and SQF. Each contractor account should be linked to their training record status (food hygiene certificate, site induction, LOTO authorisation) so that the CMMS can prevent assignment of restricted work orders to contractors without current required certifications. Contractor accounts must be deactivated immediately when the contractor leaves site — this is a specific requirement under FDA 21 CFR Part 11 for facilities with electronic record obligations. In practice, a short-term contractor account that is created, used for the duration of the contract, and deactivated on departure provides full record attributability without creating an ongoing account management burden.
The first 30 minutes of an unannounced FDA inspection determine whether the facility is in a responsive or defensive posture for the entire inspection. Assign a single escort for the inspector and a dedicated records coordinator whose sole role is retrieving records on request — do not have the same person who is answering technical questions also searching for records. With a CMMS, the records coordinator should be able to generate any requested maintenance record report within 2–3 minutes. Do not reconstruct, recreate, or fill in missing records during an inspection — FDA investigators are specifically trained to detect retrospective record completion, and the attempt to cover a gap is treated far more seriously than the original gap. If a record does not exist, acknowledge it, explain the gap, and present the corrective action already underway or planned.
CMMS migrations are a high-risk period for compliance continuity. The key requirements are: all historical records must be migrated completely and verifiably — auditors will request records from periods before and after the migration date; the old system must remain accessible (read-only) for the full retention period of its records, or records must be fully exported and verifiable in the new system; the migration must be validated — under FSMA 21 CFR Part 11, a system migration that results in records being inaccessible or unverifiable constitutes a data integrity failure even if the underlying maintenance was performed. Document the migration process, validate that record counts match before and after, and retain the migration validation documentation as part of the compliance record package.
Compliance & Audit Trail Management
One Platform. Five Standards. Zero Audit Surprises.
OxMaint's Compliance & Audit Trail Management module is built for food manufacturers operating under multiple regulatory frameworks simultaneously. Every maintenance work order is timestamped, attributed to an individual, and stored in a tamper-evident audit trail — satisfying FDA, FSMA, SQF, BRC, and ISO 22000 documentation requirements from a single system. Any record retrieved in under 2 minutes. Any audit passed with confidence.
5
standards covered in one system
<2 min
any record retrieved on demand
78%
audit NCs eliminated
Tamper-evident audit trail on every work order
CCP calibration due-date alerts and lockouts
Temporary repair register with escalation alerts
Food-grade lubricant tracking per work order
Training record links to work order access control
Any record retrieved in under 2 minutes at audit
