As more food manufacturing facilities continue to implement and comply with the Global Food Safety Initiative (GFSI) Audit Schemes, they are also required to conduct Internal Audits of their Foods Safety Management Systems. Meeting these GFSI requirements involves developing a strong internal audit program that utilizes internal resources and trained auditors to perform internal audits. One of the most common GFSI non-conformances is poorly designed or implemented internal audit programs. Which is why, we’ve created a step-by-step internal audit checklist to help you get started.
An internal audit is a complete review of the food safety system against major GFSI Audit Schemes, like SQF or BRCGS Standards, as well as HACCP and internal standards and policies. The company’s own trained staff or consultants should conduct internal audits and involve more than just a GMP inspection of the facility and verification of the Critical Control Points.
Internal auditing involves a systematic, planned, independent, and documented process for obtaining evidence to review and evaluate against pre-arranged standard requirements. There are many reasons a facility should conduct internal audits such as preparing for third party audits, satisfying program requirements, creating records of due diligence, identifying improvement opportunities, and verifying compliance to standard.
There are A LOT of types of audits, which unfortunately for all of us food safety folks, means we most likely spend a fair bit of our time preparing for someone to visit. (We don’t get into this field because it’s easy, do we?) But what’s the difference between an internal and external audit? Third-party auditors come in to evaluate your company’s policies and procedures during external audits. If you are aiming to become HACCP, BRCGS, or SQF certified, you need to hire a certification body to come into your facility and grade you against the specified program.
Internal audits, however, are privately run by your company. Most of the time these audits are conducted by your in-house food safety staff, but they can also be directed by a third-party as a consultation. While it is common for food safety staff to lead internal audits, involving department leads from multiple departments is recommended to meet the requirement that auditors be independent of the program or activity they are auditing.
If you choose to use a consultant, they will perform a mock audit, and provide specific suggestions to help you address the nonconformances with appropriate corrective actions. For most food safety teams, this is a big benefit to working with an outside consultant. In addition, internal audit reports do not get submitted to a certification body or an audit scheme’s organization. Now let’s get into the internal audit checklist!
The internal audit team should be multi-disciplinary, so that they can independently and objectively audit different departments, functions, and processes within the organization. The internal audit team should understand the audit plan, schedule, procedure, documentation, and objective of the internal audit process, including the GFSI Checklist or whichever standard you are auditing yourself against.
Once you have selected your internal audit team, the next step is to decide which audit type you will be conducting for this specific audit. There are many companies which have multiple certifications based on client requirements. More specifically you may be HACCP certified but might also sell your product in well-known chain stores such as Costco, Target, and Whole Foods. Each of those retailers has their own set of criteria which must be met.
Scheduling, documentation of that schedule, and sticking to the schedule are a big part of internal auditing. HACCP, BRCGS, and SQF all have specific call outs to having an internal auditing schedule, and more importantly, sticking to it. If you do not, it’s very likely to negatively impact your certification. Think of it like a proactive versus reactive approach.
Key steps to conducting an Internal Audit consist of the Plan, Do, Check and Act (PDCA) Cycle, also known as the Deming Wheel. The PDCA cycle is a repetitive four stage cycle and is used for continuous improvement in many business processes.
Plan
Establish the objective or define the scope of the audit and create an annual schedule. Selecting and training of the internal auditors are also key components of the planning step.
Do
Implement the plan or execute the process, which involves the collection of information for evaluation. Look for deviations in the implementation against the plan and check for appropriateness and completeness. This step involves utilizing the Internal Audit Checklist Tool for assessment and includes conducting risk assessment of non-conformities according to standard classification of Critical, Major, and Minor Non-conformities.
Check
This step includes writing the non-conformity report and assigning responsibility and deadlines for conducting root cause analysis and corrective action.
Act
Follow-up with the corrective actions in the check step and verify that the corrective actions are effective and will prevent future re-occurrence. This is a great place to use root cause analysis! By doing so you can turn a corrective action into a preventive action.
The internal auditor’s main goal is to verify and provide supporting evidence that the program audited either complies with or does not comply with the established requirement or standard. The internal auditor should not just interview the personnel but also review policy, procedures, and records; observe, and evaluate all the collected information to confirm that it is meeting the planned and established standard.
Once the Internal Audit has been concluded, the auditing team should conduct a closing meeting with the appropriate department staff, confirm the scope or area covered during the audit, read out non-conformities (where appropriate), assign responsibility, agree to corrective actions with deadlines and thank everyone for their time and cooperation.
There are many challenges facilities face when conducting internal audits. With that, we have some recommendations that will help overcome many of these challenges.
Your internal audit non-conformity report must be written in a timely manner and provide routine updates to Senior Management.
No matter which type of certification you are trying to attain, HACCP is the backbone of any sound food safety program. And whichever certification body you choose to work with, their HACCP standard will likely include a section on internal auditing. In terms of HACCP, you will probably be required to conduct an internal audit of your HACCP plan and document it thoroughly.
It’s a good idea to conduct internal audits multiple times throughout the year and to have that schedule of audits documented. By doing so, you can better prepare your facility for your real certification audit.
BRCGS Food Standard 9 specifically calls out internal audits for the standard in Section 3.4. One note for this program is the idea of independence. This means that the person conducting the internal audit (4 per year are required at a minimum) cannot be the person who is responsible for the work being audited aka you can’t check your own work.
Fundamental – The company shall be able to demonstrate that it verifies the effective application of the food safety plan, and the implementation of the requirements of the Global Standard Food Safety and the site’s food safety and quality management system.
The current SQF code is Food Safety Code: Food Manufacturing Edition 9. Internal auditing is mentioned many times throughout edition 9 in voluntary and non-voluntary ways. Unlike BRCGS, SQF only requires one internal audit per year, but you can absolutely do more than that. They also mention independent auditing but only “where practical”.
Now that you understand the basics of internal auditing, it’s time to take what you’ve learned back to your facility. Implementing a robust internal auditing program is essential to food manufacturing facilities seeking to achieve and maintain certification. Your internal audit is a tool. A tool that can keep you in compliance, identify areas of improvement, and proactively prepare you for any upcoming audits. You’ve got this!
If you need any help, our team is always here to help. Our team of trainers, consultants, and auditors who specialize in HACCP, SQF, and BRCGS certification, are ready to partner with you and take some of the stress out of managing a food safety program on your own.
