Record Retention Requirements
Aligned with SQF Code Edition 9 – System Element 2.2.2
Requirement Overview
Under SQF Code Edition 9, System Element 2.2.2 states:
“Records shall be maintained for a minimum of three years or as required by legislation, whichever is longer, and be made available to authorized personnel upon request.”
A compliant recordkeeping system ensures traceability, supports audit readiness, and meets legal and certification obligations.
Note: This resource is for educational and internal implementation use only. Food Safety Systems is not affiliated with or endorsed by the Safe Quality Food Institute (SQFI). For official SQF requirements, visit www.sqfi.com.
Key Compliance Objectives
-
✓ Maintain records for at least 3 years or as required by applicable laws
✓ Implement secure, organized storage systems (digital or physical)
✓ Establish controlled access and retrieval procedures
✓ Develop a clear disposal protocol for obsolete records
Step-by-Step Implementation Guide
1. Develop a Record Retention Schedule
-
What to Include:
-
• List of required documents (e.g., audits, training, CCP logs, verifications)
• Retention periods based on SQF and regulatory requirements
• Destruction method (e.g., shredding, digital wipe) for expired records
Evidence to Maintain:
-
• Approved record retention schedule
• Documentation showing regulatory alignment (e.g., FDA, FSMA, CFIA)
- • List of required documents (e.g., audits, training, CCP logs, verifications) • Retention periods based on SQF and regulatory requirements • Destruction method (e.g., shredding, digital wipe) for expired records
- • Approved record retention schedule • Documentation showing regulatory alignment (e.g., FDA, FSMA, CFIA)
2. Implement a Secure Storage System
-
Options:
-
• Physical Storage: Fireproof filing cabinets with environmental controls
• Digital Storage: Encrypted cloud-based platforms with automated backups
• Hybrid Systems: Paper archives + digital logs for cross-referencing
Evidence to Maintain:
-
• SOP section outlining storage systems
• Photos/screenshots and encryption/backup records
- • Physical Storage: Fireproof filing cabinets with environmental controls • Digital Storage: Encrypted cloud-based platforms with automated backups • Hybrid Systems: Paper archives + digital logs for cross-referencing
- • SOP section outlining storage systems • Photos/screenshots and encryption/backup records
3. Control Access and Retrieval
-
Requirements:
-
• Assign designated record custodians
• Maintain logs of access/viewing activity
• Use indexing tools for efficient searching (manual or digital)
Evidence to Maintain:
-
• Access logs or permission tracking
• Retrieval test results (response times, accuracy)
- • Assign designated record custodians • Maintain logs of access/viewing activity • Use indexing tools for efficient searching (manual or digital)
- • Access logs or permission tracking • Retrieval test results (response times, accuracy)
4. Train Staff and Verify Competency
-
Training Should Cover:
-
• Record types and how to recognize/label them
• Secure handling and retrieval
• Disposal timing and process
Evidence to Maintain:
-
• Training attendance and certification records
• Observations or verification logs showing proper handling
- • Record types and how to recognize/label them • Secure handling and retrieval • Disposal timing and process
- • Training attendance and certification records • Observations or verification logs showing proper handling
Common Audit Findings & Recommended Fixes
Audit Finding
Corrective Strategy
Missing or misplaced records
Create a formal document locator matrix
Retention period below 3 years
Adjust schedule to meet or exceed minimum requirements
No disposal records or procedure
Establish a documented and logged disposal protocol
Slow or failed retrieval of records
Digitize indexing and implement periodic retrieval drills
| Audit Finding | Corrective Strategy |
|---|---|
| Missing or misplaced records | Create a formal document locator matrix |
| Retention period below 3 years | Adjust schedule to meet or exceed minimum requirements |
| No disposal records or procedure | Establish a documented and logged disposal protocol |
| Slow or failed retrieval of records | Digitize indexing and implement periodic retrieval drills |