Why Food Manufacturing Audits Demand a Different Mindset
Auditing a food manufacturing facility is not like auditing a professional services firm or a construction company. The stakes are immediate and tangible. A nonconformity in a law firm might result in a missed deadline. A nonconformity in a food plant could result in contaminated product reaching consumers, a public health incident, or a nationwide recall that costs millions and destroys a brand built over decades.
On this page
That reality shapes how you approach every aspect of the audit. You are not just checking that procedures exist and records are filled in. You are tracing whether the system actually prevents unsafe or substandard product from leaving the facility, and whether the organisation can respond quickly and accurately when something goes wrong.
This guide is written for auditors conducting ISO 9001 quality management audits in food manufacturing environments. It covers the three areas that matter most in this sector: statistical and judgement sampling of product and process records, traceability systems and how to test them, and recall and withdrawal procedures and what effective testing looks like. If you are preparing for an internal audit, a supplier audit, or a certification audit at a food manufacturer, this is where to focus your attention.
Understanding the Regulatory and Standard Context
Before you walk onto the floor, you need to understand what framework the organisation is operating under. ISO 9001 is the most common quality management standard in food manufacturing, but it rarely operates alone. Many Australian food manufacturers also hold certification to HACCP, FSSC 22000, or ISO 22000. Some are subject to Safe Food Australia requirements, state food authority regulations, or customer specific quality requirements from major retailers.
As an ISO 9001 auditor, your scope is quality management, not food safety in the HACCP sense. But the two are deeply intertwined in this sector. Product specifications, process controls, inspection records, supplier controls, and nonconforming product management all sit at the intersection of quality and safety. You cannot audit one without understanding the other.
If the organisation holds a food safety certification alongside ISO 9001, find out whether those audits are conducted separately or as a combined audit. Understanding the full picture helps you avoid duplication and ensures you focus your ISO 9001 audit on what it is actually designed to assess: whether the quality management system is effective in consistently delivering product that meets requirements.
For a broader overview of how ISO 9001 applies specifically to food manufacturers, the post on ISO 9001 for Food Manufacturers: Where Quality Management Meets Food Safety is a useful starting point.
Exemplar Global Certified Training ProviderRTP No. 310970
Sampling in Food Manufacturing: What Auditors Actually Look For
The Purpose of Sampling in This Context
In food manufacturing, sampling refers to two things that auditors need to keep distinct. First, there is product sampling, meaning the physical testing of product at various stages of production to verify it meets specification. Second, there is audit sampling, meaning the selection of records, batches, and processes you examine during the audit to draw conclusions about the system as a whole.
Both matter. A well designed product sampling programme is a key quality control mechanism. And how you conduct your audit sampling determines whether your conclusions are meaningful or superficial.
Auditing the Product Sampling Programme
When you audit the product sampling programme, you are looking for evidence that it is statistically sound, consistently applied, and linked to real quality outcomes. The questions you should be asking include:
- How are sample sizes determined? Is there a documented rationale, or is it based on habit?
- Are sampling frequencies tied to risk? Higher risk products or new suppliers should attract more frequent sampling.
- Are the testing methods validated? A test that has not been validated against a known standard is not providing reliable data.
- Are results reviewed and acted upon? Sampling data sitting in a folder that nobody reads is not a functioning control.
- What happens when results are out of specification? Is there a clear, documented process for holding product, investigating, and making a disposition decision?
Request a sample of recent in process and finished product inspection records. Look for trends, not just individual results. If every result is comfortably within specification and there is no evidence of any out of specification result ever occurring, that is worth probing. Either the sampling programme is very effective, or the records are not reflecting reality.
Audit Sampling Across Batches and Shifts
When selecting records to review, do not accept whatever is placed in front of you. Ask for records from different production lines, different shifts, different operators, and different time periods. Nonconformities in food manufacturing often cluster around specific shifts, specific operators, or specific time periods such as end of shift or changeover periods.
A practical approach is to select three or four recent product batches and trace them forward and backward through the system. What were the incoming material specifications? Were they verified on receipt? What were the in process control results? What was the final release decision based on? This trace gives you a far richer picture than reviewing a stack of individual records in isolation.
For more on how to approach audit sampling strategically, the article on Audit Sampling Strategies: Choosing What to Look At provides a practical framework you can apply directly to this type of audit.
Traceability: The Backbone of Food Quality Management
What Traceability Actually Means in Practice
Traceability in food manufacturing means the ability to identify and follow the movement of a food product, ingredient, or substance through specified stages of production, processing, and distribution. ISO 9001 Clause 8.5.2 requires the organisation to use suitable means to identify outputs and to maintain documented information to enable traceability where it is a requirement.
In food manufacturing, traceability is almost always a requirement. It is required by customers, by regulators, and by the practical need to execute a targeted recall if something goes wrong. A traceability system that cannot quickly and accurately identify which customers received which batches of which product is not fit for purpose.
How to Test a Traceability System
The most revealing audit technique for traceability is the traceability exercise. You pick a batch, a lot number, or a date code and ask the organisation to demonstrate that they can trace it both forward and backward through the supply chain. This is sometimes called a mock recall or a traceability test.
Forward traceability means: starting from a raw material or ingredient, can you identify which finished product batches it ended up in, and which customers or distribution channels received those batches?
Backward traceability means: starting from a finished product batch, can you identify every raw material and ingredient that went into it, which suppliers they came from, and what the verification records show?
When you run this exercise, time it. A traceability system that takes four hours to produce results is not going to support an effective recall. Industry expectation in many food sectors is that traceability results should be available within two to four hours. Ask the organisation what their target is, and then test whether they can actually meet it.
Common Traceability Failures
In practice, the traceability weaknesses auditors most commonly find in food manufacturing include:
- Rework that is not captured in the traceability record. If product is reworked and blended back into a batch, the traceability record needs to reflect that. Often it does not.
- Bulk ingredient top ups that break the batch link. When a mixing vessel is partially filled from one lot and then topped up from another lot, the traceability record needs to capture both. This is frequently missed.
- Packaging material traceability gaps. Labels, packaging, and printed materials are part of the traceability picture, particularly if a labelling error triggers a recall.
- Contract manufacturer or co packer blind spots. If part of the production is outsourced, does the traceability system extend to the co packer's records?
- Manual records that are illegible, incomplete, or altered. Handwritten batch records that have been crossed out without explanation are a red flag.
When you find a traceability gap, document it specifically. Do not write that traceability records were incomplete. Write that Batch 2024 0317 could not be traced forward to customer dispatch records because the rework log for 17 March did not capture the receiving batch number.
Recall and Withdrawal Procedures: Testing Whether They Actually Work
The Difference Between Recall and Withdrawal
A recall involves removing product from the market, including from customers and consumers. A withdrawal involves removing product from the distribution chain before it has reached the end consumer. The distinction matters because the communication requirements, the regulatory notifications, and the logistics involved are different.
ISO 9001 Clause 8.7 deals with control of nonconforming outputs, and Clause 8.5.2 requires documented information to enable traceability. Together, these clauses underpin the recall and withdrawal requirement. But in food manufacturing, you are also likely to be looking at customer specific requirements, regulatory requirements under the Australia New Zealand Food Standards Code, and potentially FSANZ notification obligations.
What to Look for in the Recall Procedure
Start by reviewing the documented recall and withdrawal procedure. It should address:
- Trigger criteria: what events or findings would initiate a recall or withdrawal?
- Roles and responsibilities: who makes the decision to recall, who communicates with customers, who notifies regulators?
- Contact lists: are they current? A contact list with outdated customer contacts is useless in a crisis.
- Communication templates: are there pre approved templates for customer notification, regulator notification, and media statements?
- Product recovery and disposition: what happens to product that is returned or recovered?
- Root cause investigation: is there a requirement to investigate the root cause of the issue that triggered the recall?
- Effectiveness review: is there a requirement to review the effectiveness of the recall after it is completed?
A procedure that ticks all these boxes on paper is a starting point. The audit question is whether it actually works in practice.
Mock Recall Exercises: What Good Looks Like
The most effective way to test a recall procedure is to review records of mock recall exercises. Best practice in the food industry is to conduct at least one mock recall per year. Ask to see the records of the most recent exercise.
What you are looking for is evidence that the exercise was genuine, not cosmetic. A genuine mock recall exercise will include:
- Selection of a specific batch or lot number as the subject of the exercise
- A timed attempt to trace the product forward to all customers who received it
- Calculation of the percentage of product accounted for (the target is typically 100%)
- Documentation of any gaps identified
- Corrective actions raised for any gaps
- Sign off by management
If the mock recall exercise record shows that 100% of product was accounted for in 45 minutes with no gaps and no corrective actions raised, ask some probing questions. Either the system is exceptionally well designed, or the exercise was conducted in a way that avoided finding problems. Ask who ran the exercise, what batch was selected and why, and what the process was for the trace.
If no mock recall exercises have been conducted, that is a nonconformity against the requirement to maintain a documented procedure and demonstrate its effectiveness. Raise it clearly and specifically.
Nonconforming Product Control: Where Quality Management Gets Tested
ISO 9001 Clause 8.7 requires the organisation to ensure that outputs that do not conform to their requirements are identified and controlled to prevent unintended use or delivery. In food manufacturing, this is one of the highest stakes clauses in the entire standard.
When you audit nonconforming product control, look for evidence across the full production cycle. How is nonconforming product identified at goods inwards? How is it segregated? What does the disposition process look like, and who has authority to make disposition decisions? Is there a clear distinction between product that can be reworked, product that can be downgraded, and product that must be destroyed?
Ask to see recent nonconforming product records. Look for patterns. If the same nonconformity is recurring month after month without evidence of root cause investigation and corrective action, that is a systemic failure of Clause 10.2 as much as Clause 8.7.
One scenario worth specifically probing is what happens to product that is on hold pending test results. Is it physically segregated and clearly labelled? Is there a risk of it being accidentally released while awaiting results? Walk the floor and look for hold tags, quarantine areas, and labelling practices. What you see on the floor will tell you more than any procedure document.
Supplier Controls in Food Manufacturing
Food manufacturers are heavily dependent on their suppliers. Raw material quality, ingredient specifications, and packaging integrity all flow directly into product quality. ISO 9001 Clause 8.4 requires the organisation to control externally provided processes, products, and services. In food manufacturing, this means robust supplier approval and monitoring programmes.
When auditing supplier controls, ask to see the approved supplier list and the criteria for approval. How are new suppliers assessed? What happens when a supplier fails to meet specification? Is there evidence of ongoing supplier performance monitoring, not just initial approval?
Look specifically at how the organisation handles suppliers of high risk ingredients. A supplier of a major allergen, for example, should be subject to more rigorous controls than a supplier of packaging tape. If the supplier control programme treats all suppliers the same regardless of risk, that is a gap worth noting.
Certificates of Analysis are a common verification tool in food manufacturing. Ask how incoming CoAs are reviewed. Is someone actually checking that the results meet specification, or are they being filed without review? A CoA that shows a result outside specification but was accepted without investigation is a significant finding.
Audit Approach on the Factory Floor
Much of what matters in a food manufacturing audit cannot be found in documents. It is found on the floor. Walk the production area with intention. You are looking at:
- Labelling and identification of materials, work in progress, and finished product
- Segregation of allergens and high risk materials
- Calibration status of weighing and measuring equipment
- Hygiene and housekeeping standards as indicators of operational discipline
- Whether operators can explain the quality requirements for their process step
- Whether hold and quarantine areas are physically secure and clearly marked
Talk to operators. Ask them what they do when they find something that does not look right. Their answers will tell you whether the nonconforming product procedure is understood and followed, or whether it exists only in a folder in the quality manager's office.
If you are new to auditing unfamiliar processes, the article on How to Audit a Process You Have Never Seen Before offers practical guidance on building understanding quickly without losing credibility.
Exemplar Global Certified Training ProviderRTP No. 310970Raising Findings in a Food Manufacturing Context
When you raise findings in a food manufacturing audit, be specific and link them to actual risk. A finding that says traceability records were incomplete is far less useful than one that says the rework log for the week of 10 March did not capture the original batch numbers of materials incorporated into Batch 2024 0310, meaning forward traceability from those materials to finished product cannot be established.
Classify your findings carefully. A traceability gap that means a targeted recall cannot be executed is a major nonconformity. A sampling frequency that has not been reviewed against current production volumes is a minor nonconformity or an observation depending on the risk context. The grading matters because it determines the urgency of the corrective action response.
For practical guidance on writing nonconformity reports that actually drive change, the post on How to Write a Nonconformity Report That Actually Gets Fixed is worth reading before your next food manufacturing audit.
Building Your Competence in Food Manufacturing Auditing
Auditing food manufacturing quality systems effectively requires a combination of ISO 9001 auditing skills and sector specific knowledge. If you are building your auditing career and want to work in this sector, investing in formal auditor training is the most direct path to the competence you need.
At Audit Workshop, our ISO 9001 Lead Auditor and Internal Auditor courses are built around real audit practice, not just clause by clause theory. The training is delivered by Dilawar Laghari, a certified lead auditor with over 14 years of compliance experience and more than 500 external certification audits across diverse industries including manufacturing. Whether you are starting out as an internal auditor or building toward lead auditor certification, the courses give you the practical skills to audit effectively in demanding environments like food manufacturing.
