Planning and Preparing for an Internal Audit
Most weak audits are lost before anyone sets foot on the floor. Scope is vague, criteria are gathered on the move, the wrong records are requested, and half the allotted time disappears waiting for people who did not know the audit was happening. Planning and preparing properly is not paperwork for its own sake; it decides what evidence you can reach and how much confidence your conclusions deserve.
Planning works at two levels. An audit programme covers the whole cycle, usually a year: which areas, processes, and requirements will be audited, how often, by whom, and why. A plan for an individual audit then details one assignment within that programme. Both levels should be risk-based, following the approach encouraged by ISO 19011: put more effort where hazards, past failures, complaints, or change make failure more likely or more serious.
Building a risk-based audit programme
Start from coverage and risk together. Every element of the HACCP system and its prerequisite programs should be audited over the cycle, but frequency need not be equal. A CCP with repeated deviations, a new product line, or a sanitation program with rising failures deserves more attention than a stable area with clean results. Previous audit findings, external audit outcomes, customer complaints, recalls or withdrawals elsewhere in your sector, and operational changes all feed programme decisions.
Write into the programme: objectives, scope for each audit, assigned auditors with independence considered, timing that captures different shifts and seasonal work where relevant, and how results reach management review. Avoid scheduling every audit in one quiet month. Production under normal pressure, with normal staffing, is the system you actually need to test.
Planning one audit: scope, criteria, and team
For a single audit, define scope precisely. Scope states boundaries: sites, departments, processes, products, time period for records, and any exclusions. “Audit cooking and chilling for ready meals, production records for the past three months” can be planned and reported. “Audit food safety” cannot.
List criteria before you start: the HACCP plan sections, procedures, regulatory or scheme clauses, and standards you will judge against. Confirm auditor competence and independence for this assignment, name a lead auditor, and agree roles if more than one auditor is involved. Where language, shift patterns, or technical processes need specialist support, arrange it now, not during the closing meeting.
Documents to review before you arrive
Advance document review saves floor time and sharpens your trails. Request, in good time:
- Relevant HACCP plan, flow diagrams, and hazard analysis
- Procedures for the area and its prerequisite programs
- Previous audit reports, findings, and corrective action status
- Recent deviation, complaint, and nonconformity trends for the area
- Organisation charts, shift patterns, and any recent change notices
Reading previous findings tells you where to verify effectiveness rather than simply re-raise old issues. Reading change notices tells you what should look different since last time. Mark questions as you read, but keep an open mind: documents describe the intended system, and the audit tests the real one.
Checklists, sampling, and logistics
Prepare a checklist or audit trail guide from your criteria. Good checklists prompt evidence rather than yes-or-no answers: instead of “Is monitoring done?”, write “Select batches; compare CCP records with production quantities, probe calibration, and monitor interview”. Use the checklist as a servant, not a script. If evidence leads somewhere unexpected and relevant, follow it and record why.
Plan your sample deliberately. Cover different days, shifts, products, and operators for records; include the busiest periods, not only tidy ones. Decide in advance how you will select samples on site, for example by batch number or date range chosen by the auditor, which guards against a pre-selected perfect file.
Logistics that protect the audit
Agree date, start time, opening meeting attendees, guides, access to areas and systems, protective clothing, safety rules, and report timing. Notify auditees early enough for them to arrange cover for key staff, but remember an audit observes normal work: asking an area to deep-clean and rehearse for a week turns the visit into theatre. Communicate the timetable, then keep to it, and build in time for reviewing notes and agreeing findings before the closing meeting.
Preparation ends with a simple test. Could another auditor pick up your plan and understand what will be examined, against what, by whom, when, and with what sample? If yes, you are ready to audit. If not, the floor work will drift, and your report will show it.
Planning for difficult realities
Real audits meet absent key staff, lines stopped for breakdowns, and record systems that go down mid-visit. Planning cannot prevent any of that, but it can decide your response in advance. Name a deputy contact for each area, agree how evidence will be gathered if a process is not running, using records and interviews from recent production, and state in your report any limitation that reduced the evidence available. A transparent limitation protects your conclusions far better than quiet improvisation.
Build contingency time into the timetable, especially for tracing a batch or revisiting an area after an unexpected answer. Auditors who schedule every minute have no room to follow the very evidence that makes an audit worthwhile. A plan with breathing space is not a loose plan. It is a plan that expects reality and still delivers its scope.
Key points
- Plan at two levels: a risk-based programme for the cycle, and a detailed plan for each audit.
- Give more audit effort to high-risk, poorly performing, or recently changed areas.
- Define scope with clear boundaries and list criteria before evidence gathering starts.
- Review plans, procedures, previous findings, trends, and changes in advance.
- Build checklists that prompt evidence trails, and plan samples across shifts, days, and products.
- Sort logistics, independence, and timing early so floor time goes on evidence, not waiting.
