Introduction to HACCP Internal Audits

Walking a production floor with a clipboard and writing down what looks wrong is a useful inspection habit, but it is not an internal audit. An internal audit of a HACCP system follows a defined scope and criteria, gathers evidence in a planned way, and reaches conclusions another competent person could follow from the same evidence. Learning that discipline is the starting point for every other auditing skill.

Codex places verification, including internal audit, under Principle 6 of HACCP. ISO 19011 provides widely used guidance on auditing management systems, including food safety systems. Combining both gives you a practical definition: a systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine how far audit criteria are fulfilled.

Four words that define an audit

Each word in that definition carries weight. Systematic means planned: audits happen to a programme, with scope, criteria, and methods decided in advance, not when someone has a free afternoon. Independent means auditors approach the work objectively and, where possible, do not audit their own work. Documented means plans, evidence, findings, and reports are recorded and retained. Objective evaluation means conclusions rest on verifiable evidence, not opinion, personality, or a single unchecked claim.

Audit criteria are the reference points you audit against. In a HACCP internal audit they usually include:

• Your HACCP plan, hazard analysis, and flow diagrams
• Prerequisite program procedures and site standards
• Regulatory requirements applying to your products and market
• Customer and certification scheme requirements you have committed to meet
• Your own corrective actions and commitments from earlier audits

Types of internal audit you will use

System audits examine how a whole system, such as HACCP or allergen management, is designed and implemented. Process audits follow one process, for example cooking and chilling, from inputs to outputs. Product audits trace a specific product or batch through records and controls. Most internal programmes blend all three across a year.

Vertical auditing is a practical technique worth learning early. Pick one batch and trace it forward or backward through receiving records, storage, production, CCP monitoring, deviations, laboratory results if any, packaging, and dispatch. Horizontal auditing takes the opposite cut, checking one requirement, such as calibration or training, across many departments. Both reveal different weaknesses, and a balanced programme uses both.

How an audit unfolds

Although details vary, a sound audit moves through recognisable stages. A programme sets frequency, coverage, and responsibilities for the year, based on risk, previous results, and change. Each individual audit is then planned: scope, criteria, team, timetable, and areas to visit. An opening meeting confirms arrangements with the auditee. Auditors gather evidence through interviews, observation, and document and record review. Findings are evaluated against criteria and classified under your system’s rules. A closing meeting presents findings, a written report follows, and corrective actions are agreed, completed, and checked for effectiveness.

Evidence, findings, and nonconformity

Audit evidence is information relevant to the criteria that can be verified. A finding states how evidence compares with criteria. Where criteria are not met, the result is a nonconformity, and good practice describes it in three parts: the requirement, the evidence, and the gap between them. “Housekeeping poor in corridor, 14:20” is an opinion. “Procedure X requires pallets stored clear of walls for inspection; at 14:20, pallets blocked the wall along Bay 3, preventing pest inspection” is a finding someone can act on and verify later.

What internal audits are not

Internal audits are not a hunt for someone to blame, a consultancy visit that redesigns the process on the spot, or a rehearsal where auditees are coached to hide problems before external auditors arrive. Auditors may explain requirements and discuss possible approaches in general terms, but designing the fix for your own finding compromises independence when you later verify that fix.

Nor is an audit the whole of verification. Record review, calibration, sampling, and complaint review continue between audits. Audits sample; they do not examine every record, every shift, or every product. Honest reporting states the sample and its limits, so management understands the level of assurance an audit can and cannot give.

Handled well, an internal audit feels firm and fair to the people being audited: clear about criteria, curious about how work really happens, precise about evidence, and focused on whether consumers are protected. Build that reputation early and staff will bring problems to auditors instead of hiding them.

Your mindset on a first internal audit

New auditors often worry about missing something cleverly hidden. Experience teaches a calmer lesson: most significant findings sit in ordinary places, in incomplete records, unclear responsibilities, overdue calibrations, procedures nobody follows because they no longer match the line, and corrective actions closed without anyone checking whether they worked. A methodical trail through ordinary evidence finds them reliably.

Curiosity serves you better than suspicion. Assume people are trying to do a good job inside a system that may be helping or hindering them, and let evidence adjust that view where it must. Ask how a task is meant to work, how it works on a busy shift, and how anyone knows it worked. Those three questions, patiently followed, will carry a beginner through a credible audit and build the judgement later audits depend on.

Key points

• An internal audit is systematic, independent, documented, and based on objective evidence against defined criteria.
• Criteria include your HACCP plan, PRPs, regulatory, customer, and scheme requirements.
• Programmes blend system, process, and product audits, using vertical and horizontal trails.
• Findings state the requirement, the evidence, and the gap; nonconformity follows when criteria are not met.
• Auditing is one part of Principle 6 verification, alongside record review, calibration, and other checks.
• Audits sample, so reports should be honest about scope and limits.