Food safety internal audits are not just a compliance exercise. When done well, they are one of the most powerful tools a food business has for catching problems before they reach a customer, a regulator, or a recall notice. This guide walks through how to plan, conduct, and follow up a food safety internal audit in a way that actually adds value, whether you are auditing against ISO 22000, FSSC 22000, or a HACCP-based system operating within a broader quality framework.
On this page
If you have conducted quality or safety audits before, many of the core techniques carry across. But food safety has some specific characteristics that change how you approach the audit, what evidence you look for, and where the real risks tend to hide.
Why Food Safety Internal Audits Are Different
Most ISO management system audits focus on process conformity and system effectiveness. Food safety audits do that too, but they carry an additional dimension: the potential for direct harm to people if controls fail. A nonconformity in a quality system might result in a defective product being reworked. A nonconformity in a food safety system might result in someone being hospitalised.
This changes the stakes. It also changes what you pay attention to. In a food safety audit, you are not just checking whether procedures exist and are followed. You are tracing whether the critical control points are actually controlling the hazards they are supposed to control, whether prerequisite programmes are genuinely maintained, and whether the people doing the work understand why the controls matter, not just what the procedure says.
The other major difference is the technical depth required. Food safety auditors need a working understanding of biological, chemical, and physical hazards, how they are introduced into food, and what control measures are effective against them. You do not need to be a food technologist, but you do need enough knowledge to ask meaningful questions and recognise when an answer does not make sense.
Exemplar Global Recognised Training ProviderRTP No. 310970
Before You Audit: Preparation That Actually Matters
Review the HACCP Plan and PRP Documentation
Your starting point before any food safety audit is the HACCP plan. Read it properly. Understand what hazards have been identified, what the critical control points are, what the critical limits are, and how monitoring is conducted. If you walk into the audit without this foundation, you will miss the most important things to check.
Alongside the HACCP plan, review the prerequisite programme documentation. PRPs are the foundation that makes CCPs workable. Cleaning and sanitation schedules, pest control records, supplier approval records, allergen management procedures, and personal hygiene requirements all need to be in place and functioning before the HACCP system can do its job. A good internal audit checks both layers.
Look at Previous Audit Results and Corrective Actions
Pull out the results from previous internal audits, any external or certification audit findings, and the corrective action register. What nonconformities were raised? Were they closed properly? Are there patterns, the same issue appearing in different audits, or the same area repeatedly struggling?
This review shapes where you focus your audit time. If allergen control has been flagged twice in the last twelve months, it deserves more attention this cycle than an area with a clean history.
Build a Checklist That Reflects the Real Process
Your checklist should be built around the actual process flow in the facility, not just a list of standard clauses. Map the product journey from receiving through storage, processing, packaging, and despatch. Then overlay your audit questions against that journey. This process-based approach is far more effective than working through a clause-by-clause list, because it shows you how the controls interact in practice, not just whether each one exists on paper.
For more on this technique, see process based vs clause based auditing.
Conducting the Audit: What to Look For
Start With the Critical Control Points
Do not leave CCPs until the end of your audit. Start there. If you run short on time, you want to have covered the highest-risk elements first. For each CCP, you are checking four things: that the critical limit is defined, that monitoring is happening at the required frequency, that monitoring records are complete and accurate, and that corrective actions are taken and documented when a deviation occurs.
The most common finding in this area is not that CCPs are undefined. It is that monitoring records are incomplete, or that deviations were identified but not formally documented as such. Ask to see the last month of monitoring records. Look for gaps, corrections, and any entries that look unusual. If a temperature log shows exactly the same reading every hour for eight hours, that warrants a conversation.
Test the Prerequisite Programmes on the Floor
PRPs are where most food safety failures actually start. A HACCP plan can be technically sound and still fail if the PRPs supporting it are not functioning. When you audit PRPs, get out of the office and onto the floor.
Walk the cleaning schedule against what you actually see. Are the hard-to-reach areas being cleaned? Are cleaning chemicals stored correctly and at the right concentration? Check pest control records against what the pest controller is actually doing. Look at the allergen management procedure and then walk through how allergens are physically separated in storage and on the production line. Ask a production worker what they do if they find a foreign object in the product. The answer tells you more than the procedure document ever will.
Audit Allergen Controls With Extra Care
Allergen management deserves its own section because it is consistently one of the highest-risk areas in food manufacturing and one of the most common sources of recall. When auditing allergen controls, you need to check the full chain: from incoming raw materials through storage, production scheduling, changeover cleaning, labelling, and finished product release.
Ask to see how allergen-containing ingredients are stored relative to non-allergen ingredients. Review the changeover cleaning procedure and ask who validates that it is effective. Check whether the label on the finished product matches the allergen declaration in the recipe. Look at how the business handles last-minute ingredient substitutions and whether there is a process to update labelling before product leaves the site.
Interview the People Doing the Work
The most valuable evidence in a food safety audit often comes from conversations with operators, not from documents. Ask the person monitoring the metal detector what they do if it rejects a pack. Ask the person responsible for CCP monitoring what happens if the temperature is out of spec. Ask the receiving operator how they decide whether to accept or reject an incoming delivery.
You are listening for two things: whether the person knows what to do, and whether what they describe matches the documented procedure. Gaps between the two are significant findings. They usually indicate either that training has not been effective, or that the procedure does not reflect how the process actually works.
Good interview technique is essential here. Open questions get you much more useful information than yes or no questions. For practical guidance on this, see audit interviewing techniques every auditor should master.
Trace a Product From Start to Finish
One of the most effective techniques in a food safety audit is the product trace. Take a finished product and trace it backwards through production: which batch of raw materials was used, what were the CCP monitoring results for that batch, what was the cleaning status of the line before production started, and what allergens were present on the line in the preceding run.
Then run the trace forward: if there were a problem with that batch, could the business identify all affected product and withdraw it? Test the traceability system against a real example rather than accepting the claim that it works. Traceability failures are a major nonconformity under most food safety standards and a serious regulatory risk.
Common Nonconformities in Food Safety Internal Audits
Based on real audit experience, the following are the areas where nonconformities most frequently appear in food safety audits:
- Incomplete or falsified CCP monitoring records. Records that appear to have been filled in retrospectively, or that show implausibly consistent readings, are a red flag. This is a systemic issue, not just a paperwork problem.
- Corrective actions not taken when deviations occur. A deviation from a critical limit must trigger a defined corrective action, including disposition of the affected product. Many businesses record the deviation but do not document what happened to the product.
- HACCP plan not reviewed after process changes. If the production line changes, a new ingredient is introduced, or a new piece of equipment is installed, the hazard analysis needs to be reviewed. Many businesses do not have a formal trigger for HACCP review.
- PRPs not verified. Cleaning schedules are documented but verification that cleaning was effective is absent. Pest control records exist but trend analysis is not conducted.
- Allergen controls not validated. The changeover cleaning procedure exists, but there is no evidence that it has been validated to demonstrate it actually removes allergen residues to an acceptable level.
- Supplier approval records out of date. Approved supplier lists that have not been reviewed, or suppliers who are actively used but not on the approved list.
- Training records incomplete. Operators working on CCPs without documented evidence of competency in the monitoring procedure.
Writing Findings That Drive Real Change
A food safety audit finding needs to be specific enough that the person responsible for corrective action knows exactly what the problem is, where it was observed, and what evidence supports the finding. Vague findings like CCP records not maintained adequately are not useful. A finding that states which CCP, which date range, how many records were missing, and what the required frequency is gives the corrective action owner something they can actually work with.
For each nonconformity, you should also be thinking about the food safety significance. Is this a technical paperwork issue, or does it represent a genuine gap in hazard control? The severity of the finding should be reflected in how urgently it is treated and how deeply the root cause analysis needs to go.
The corrective action process matters as much as the finding itself. A finding that gets a superficial fix, fill in the missing records, retrain the operator, is likely to recur. The root cause needs to be understood. Why were the records missing? Was it a workload issue, a supervision gap, a training failure, or a system design problem? The corrective action should address the root cause, not just the symptom.
Following Up After the Audit
Internal audits only add value if the findings are acted on. This sounds obvious, but in practice many organisations have a corrective action register full of overdue items. As the internal auditor, you have a responsibility to follow up that actions have been completed and, more importantly, that they have been effective.
For minor findings, a documented corrective action with a completion date and evidence of implementation is usually sufficient. For major findings, or findings related to CCP control, you should verify effectiveness before closing the action. That might mean reviewing records from the period after the corrective action was implemented, or conducting a targeted follow-up observation on the floor.
The results of your audit, including the status of corrective actions, should feed into the management review process. Food safety performance is a standing agenda item for management review under ISO 22000, and the internal audit programme is one of the primary inputs. Make sure your audit results are presented in a way that gives management the information they need to make decisions, not just a list of findings.
Exemplar Global Recognised Training ProviderRTP No. 310970Building a Food Safety Internal Audit Programme
A single audit is not an audit programme. An effective food safety internal audit programme covers all elements of the food safety management system over a defined period, with frequency determined by risk. High-risk areas, CCPs, allergen management, and microbiological controls, should be audited more frequently than lower-risk administrative processes.
The programme should also be responsive. If there is a food safety incident, a customer complaint related to a potential hazard, or a significant process change, an unscheduled audit of the relevant area is appropriate. Do not wait for the next scheduled audit cycle to check whether controls are working after a significant event.
Auditor competence is a critical factor. The person conducting a food safety internal audit needs to understand the food safety concepts they are auditing, not just general audit methodology. If your internal auditors have a quality or safety background but limited food safety knowledge, structured training is a worthwhile investment before they take on food safety audit responsibilities.
If you are looking to build or improve your food safety auditing skills, the article on how to become a food safety auditor in Australia is a practical starting point for understanding the credentials and competencies the sector expects.
Food Safety Auditing and ISO 22000
ISO 22000 is the international standard for food safety management systems. It integrates HACCP principles with the management system framework used across other ISO standards, making it familiar territory for auditors who have worked with ISO 9001 or ISO 45001. The internal audit requirements sit at Clause 9.2, and the expectations are broadly consistent with other ISO management systems.
What makes ISO 22000 distinctive is the emphasis on the interaction between PRPs, operational PRPs, and the HACCP plan. The standard requires that these three layers are coherent and that the hazard analysis drives the selection of control measures across all three. When auditing an ISO 22000 system, you need to be able to follow that logic and identify where it breaks down.
If you are working in or moving into food safety auditing, understanding the full structure of ISO 22000 is essential. The article what is ISO 22000 and who needs it provides a clear overview of the standard and the types of organisations it applies to.
At Audit Workshop, our training courses are built around the practical realities of auditing, not just the theory. Whether you are an internal auditor looking to extend your competence into food safety, or a quality manager wanting to run more effective internal audits, our ISO auditor training programmes give you the skills to audit with confidence. Explore our course options at auditworkshop.com.
