Internal audits carried out to the depth the standard intends, by an auditor with no reporting line into the work being audited.
An internal food safety audit checks whether the food safety system a business has documented is being followed in practice. Every major certification standard requires them, carried out on a planned schedule by trained auditors who are independent of the activity being audited. Using an external auditor satisfies the independence requirement, which is difficult for small technical teams to meet on their own.
The clause is easy to satisfy on paper and hard to satisfy properly. Auditing your own procedures fails the independence requirement however well the audit is conducted, and a programme that has never raised a nonconformity tells a certification body the audits are not searching.
An independent auditor covering the clauses you need, with graded findings and objective evidence, delivered in a report your certification body will recognise. Remote or on site, in any language, quoted on scope.
The independence requirement is what sends most businesses looking for an external auditor. This is how it works and what it means for your programme.
Standards require internal auditors to be trained, competent, and independent of the activity being audited.
In a one or two person technical function, the person competent to audit a procedure is usually the person who wrote it, and auditing your own work fails the clause however well it is done.
Certification bodies assess the internal audit programme, the competence of the auditors and the depth of the audits. Employment status is not part of that assessment.
An external auditor has no reporting line into the department being audited and no interest in the outcome, which makes the independence argument straightforward to evidence.
The audit programme, the schedule and the corrective actions remain yours. The audit is carried out on your behalf and reports into your system.
Auditor training and experience are recorded and supplied, so the competence evidence sits in your file before it is asked for.
Audited against objective evidence gathered on the day, across documents, records, practice and the people doing the work.
| Area | What is examined |
|---|---|
| Clause coverage | The clauses agreed in the audit scope, audited against objective evidence gathered on the day. |
| Documentation and records | Version control, completion, retention and retrievability as they exist, sampled on the day and never assumed. |
| Practice against procedure | What people do compared against what the documented system says they do. |
| Interviews at the right level | The people carrying out the work, alongside the people who wrote the procedures. |
| Previous findings | Whether earlier corrective actions were implemented and whether they have held. |
| Traceability | Trace exercises and mass balance where included in the agreed scope. |
| Prerequisite programmes | Programme documentation and the verification records proving each one operates. |
| The audit programme itself | Whether your schedule achieves the coverage the standard requires within the cycle, where you want it reviewed. |
Certification bodies assess the programme as well as the audits. These eight are what they find when a programme is weak.
An audit conducted entirely at a desk, checking that records exist. It never establishes whether the activity behind the record happened as described, which is what an internal audit is for.
Standards expect the full scope of the standard to be covered within the certification cycle. Programmes frequently repeat the comfortable areas and never reach the rest.
Internal audits that raise only observations. A programme that has never raised a nonconformity signals to a certification body that it lacks depth.
Findings written as opinions with no record of the document, record or observation behind them. They cannot be defended and they cannot be closed properly.
Multi shift operations audited exclusively during normal hours. Practice on nights and weekends routinely differs, and auditors know it.
Findings raised, recorded and left open. An open internal finding at a certification audit is worse than never having found it.
One person auditing the whole system indefinitely develops blind spots. Rotation, or an external auditor, resets what gets looked at.
Internal audit results that never reach management review, which most standards explicitly require as an input.
Written in the format certification bodies expect, and ready to go into your system without rework.
| Element | What it holds |
|---|---|
| Audit plan | Scope, clauses, timing and areas, issued in advance so the right people are available. |
| Findings register | Each finding with its clause reference, the objective evidence, and a grade. |
| Grading | Applied consistently to the scheme's own system, so findings mean the same thing your certification body means. |
| Evidence record | The document, record, observation or interview each finding rests on. |
| Positive observations | Where practice exceeds the requirement, recorded, because management review benefits from both. |
| Closing summary | Presented before the audit ends, so nothing in the report is a surprise. |
| Nonconformity register | Delivered in a format ready for your corrective action process. |
| Programme feedback | Comment on whether your audit schedule achieves the coverage the standard requires. |
Any certified operation, or one working towards certification, needing internal audits carried out to the depth the standard intends. It is particularly useful for small and medium sites where the technical function is one or two people and genuine independence cannot be achieved internally.
Your standard requires internal audits and nobody is sufficiently independent.
Your internal audits have been raised as findings for lack of depth.
Your trained internal auditor has left and the schedule has stalled.
You want a genuine assessment before your certification audit.
You need full clause coverage within the certification cycle.
Your team is too close to the operation to see what an auditor will see.
The same auditor has covered everything for years and blind spots have set in.
A vertical audit is required and nobody has run one before.
You confirm the standard, the clauses in scope and the audit duration. An audit plan is issued in advance so the right people are available.
The audit opens with scope, method and timing confirmed, in the same form a certification audit would use.
Evidence is gathered through document review, record sampling, observation and interview, with findings recorded as they arise.
Findings are presented before the audit ends, so nothing in the report is a surprise and factual errors are corrected on the spot.
A written report is issued with findings graded, evidence recorded and clause references given.
Findings are delivered in a nonconformity register ready for your corrective action process.
The audit reports findings. Root cause analysis and corrective action planning are separate work, because an auditor who writes the corrective actions is no longer independent of them at the next audit.
Where you want that support, it is provided through CAPA and root cause analysis support and documented as a distinct engagement.
An internal audit is not a certification audit and produces no certificate.
Every audit is quoted against your own scope. A half day document audit and a full clause coverage programme across three sites are very different pieces of work. These factors set the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
It is a systematic examination checking whether the food safety system a business has documented is being followed in practice. It covers documentation, records, practice on the floor and interviews with the people doing the work, all measured against the requirements of the standard. Findings are graded and recorded with the objective evidence behind them.
Yes. Standards require internal audits to be carried out by trained auditors who are independent of the activity being audited. They do not require the auditor to be your employee. Using an external auditor strengthens the independence position, provided the auditor is competent and the audit is properly documented, and competence evidence is supplied for your file.
Most standards require the full scope of the standard to be covered within the certification cycle, on a risk based schedule, which in practice means at least one full cycle each year. Higher risk areas are audited more often. The audit programme should state the rationale behind the frequency chosen, and that rationale is itself commonly audited.
Partly. Document review, record sampling and interviews work well remotely. Observation of practice, hygienic condition and actual behaviour on the floor does not. A blended approach is common, with document heavy clauses audited remotely and operational clauses audited on site.
Someone trained in auditing, competent in the subject matter, and independent of the activity being audited. Competence has to be documented. This is where small technical teams run into difficulty, because the person qualified to audit a procedure is frequently the person who wrote it.
It is raised as a finding with the evidence recorded, and discussed with you at the closing before the report is issued. Where a finding indicates an immediate food safety risk, it is raised immediately, without waiting for the end of the audit.
The report is written in the format certification bodies expect, with clause references, objective evidence and graded findings. Certification bodies assess your internal audit programme, its coverage and the competence of the auditors. What matters is that the audits are competent, documented and acted on.
An audit that follows a single batch or product through every stage of the process and every record associated with it, from raw material intake to dispatch. It tests whether the system holds together across departments, and several standards expect vertical audits within the programme.
Announced audits get the right people available and the right records to hand. Unannounced or short notice audits show practice as it normally is. Mature programmes use both, and where a certification body operates unannounced audits, internal practice runs at short notice too.
That usually indicates a depth problem. A programme that has never raised a nonconformity across a full cycle tells a certification body the audits are not searching, and auditors respond by looking harder at everything else.
Yes. Multi site programmes are scoped as one project with a schedule across the sites, which is normally more efficient because preparation is shared. A comparison across sites is often the most useful output, since practice diverges more than most businesses expect.
No, and deliberately. An auditor who writes the corrective actions is no longer independent of them at the next audit. Where you want that support, it is provided separately through CAPA and root cause analysis support and documented as a distinct engagement.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
Structured root cause analysis and corrective action planning for findings that need to close properly and stay closed.
Read about CAPA and Root Cause Analysis Support →A full rehearsal of your certification audit, run to the same protocol and duration as the real one, before the certification body arrives.
Read about Mock Certification Audit →A structured comparison of your current food safety system against the standard you need to meet, returning every gap with a priority and an owner.
Read about Food Safety Gap Assessment →Certificated course covering audit planning, evidence gathering and reporting.
View Certified Internal Audit Specialist →Certificated course covering auditing a HACCP system against Codex and scheme requirements.
View Certified HACCP Internal Auditor →Expert HACCP consulting worldwide. HACCP plan development, hazard analysis, CCP determination, validation, internal audits and training for food businesses of all sizes.
See HACCP Consulting →Expert ISO 22000 consulting worldwide. Gap assessments, FSMS design, internal audits, mock certification audits and ongoing compliance support for food businesses of...
See ISO 22000 Consulting →Expert BRCGS Food Safety consulting worldwide. Gap assessments, Issue 9 certification prep, mock audits, Grade AA support and ongoing compliance for food...
See BRCGS Food Safety Consulting →Tell us the standard, the clauses in scope and the sites, and receive a written quote covering the scope, the deliverable and the price.