Introduction to FSMS Auditing Techniques

An auditor spends a full day on site, fills twenty pages with notes, and still cannot answer the only question that matters at the closing meeting: is food from this plant safe, and does the system keep it that way? Notes are not findings. Technique is what turns time on site into a defensible conclusion.

FSMS auditing is a systematic, independent, and documented process for obtaining objective evidence and evaluating it against audit criteria. For ISO 22000 audits, criteria are the requirements of the standard plus the organisation’s own FSMS arrangements and applicable legal and customer requirements referenced by the system. Guidance for managing audit programmes and conducting audits comes from ISO 19011.

Principles That Govern Every Audit

ISO 19011 sets seven principles. Treat them as working rules, not posters.

• Integrity: perform work honestly, diligently, and responsibly; observe legal requirements; remain impartial.
• Fair presentation: report truthfully and accurately, including significant obstacles and divergent opinions.
• Due professional care: apply diligence and judgement in accordance with the importance of the task and confidence placed in you.
• Confidentiality: protect information obtained during the audit; do not use it for personal gain or disclose it improperly.
• Independence: remain independent of the activity audited wherever practicable and free from bias and conflict of interest.
• Evidence-based approach: reach reliable conclusions from verifiable evidence based on appropriate sampling.
• Risk-based approach: plan and conduct audits focusing on matters of significance to the client and the achievement of audit programme objectives.

When two principles pull in different directions, judgement decides. A risk-based focus might limit sampling in a low-risk office process to spend more time on allergen controls. Fair presentation still requires you to record that limit and its basis.

Core Techniques for Gathering Evidence

Three methods supply almost all audit evidence: interviewing people, observing activities and conditions, and reviewing documented information. No single method is enough. A procedure says labels are verified at start-up. Observation shows verification happening. An interview reveals whether the operator knows what to do when a label is wrong, and records show whether verification has ever caught an error and what followed.

Triangulation and Trails

Triangulation means confirming a claim from at least two independent sources. Triangulate safety-critical claims always: CCP monitoring, cleaning effectiveness, traceability, and handling of deviations. If sources conflict, follow the conflict. Conflict is evidence, not inconvenience.

Audit trails structure triangulation. A vertical trail follows one product or lot through every stage: goods received, storage, preparation, processing, packing, and dispatch, checking controls and records at each step. A horizontal trail follows one requirement across the site: for example, competence for everyone performing sanitation on all shifts. A backward trail starts from a result, such as a complaint or a positive pathogen result, and works back to causes and system responses. Skilled auditors combine trails rather than auditing clause by clause in document order.

Sampling With Judgement

You cannot check everything. Sampling must be deliberate and explained. Base samples on risk: hazard severity, process variability, previous results, complaints, changes, and time since last verification. Include edge cases deliberately: first production after sanitation, changeovers between allergen profiles, new staff, new suppliers, end-of-shelf-life products, and rework.

Record sampling rationale in notes so conclusions are reproducible. If you checked three of ninety monitoring records, say why those three and what population they represent. When a sample reveals a problem, expand sampling in a focused way to judge whether the issue is isolated or systemic before grading a finding. Expanding without limit is unfair; refusing to expand after a serious hit is careless.

Evaluating Evidence and Forming Findings

Compare evidence against criteria line by line. A finding needs four parts: the requirement, the evidence, the gap, and the location or scope affected. Language must stay factual. Write what was seen, read, and heard, with document identities, dates, lot codes, and places.

Separate nonconformity from observation and opportunity for improvement, following the rules of the audit type you are performing. Internal audits, supplier audits, and certification audits grade findings differently, and the lead auditor must apply the scheme in force. Never invent a grading rule mid-audit.

Close the loop during the audit itself. Confirm factual accuracy with the auditee as you go, so closing meetings resolve conclusions rather than argue about facts. Surprises at closing usually signal poor technique earlier in the day.

Time management is a technique in its own right. Protect consolidation time during the day rather than spending every minute gathering new material, because unprocessed evidence cannot support conclusions. A practical rhythm is to audit in blocks, pause to review notes against criteria, list unproven claims, and then target the next block at closing those gaps. Lead auditors also manage team technique: rotate trails so no auditor works alone on a critical area all day, compare note quality early, and intervene when a colleague accepts verbal assurance for a safety-critical control. Consistent method across the team is what makes a multi-auditor conclusion credible.

Finally, report writing begins on site, not after departure. Draft finding wording while evidence is fresh and test it by asking whether the auditee could act on it without further explanation. If a draft needs your memory to make sense, it lacks identifiers, values, or the specific requirement. Rewrite it before the closing meeting.

Key points

• FSMS auditing compares objective evidence against ISO 22000, the organisation’s own arrangements, and referenced legal and customer requirements.
• ISO 19011 principles are integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.
• Use interviews, observation, and document review together; triangulate every safety-critical claim.
• Work through vertical, horizontal, and backward trails instead of marching through clauses in order.
• Sample on risk, record your rationale, and expand samples judiciously when problems appear.