Best Practices in Internal Auditing

Two auditors can examine the same site and produce very different value. One returns a list of missing signatures. Another returns three findings that stop a recurring allergen incident, a traceability weakness nobody had tested, and clear evidence that a corrective action from last year never worked. Difference lies in practice, not personality: preparation, impartiality, risk focus, and the discipline to write findings that a busy manager can act on the same week.

Best practice in internal auditing is not extra paperwork. It is a set of habits drawn from ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach, and the risk-based approach. Applied to ISO 22000 audits, those habits decide whether your programme drives improvement or becomes a calendar ritual everyone endures.

Protect independence and objectivity

Never audit your own work. Beyond that simple rule, watch for softer threats: auditing a close friend’s department, auditing a system you designed, or depending on the auditee for your next favour. Declare conflicts early and swap areas. Objectivity also means resisting prior conclusions. Last year’s problem area may have genuinely improved; go in ready to find that, and let this year’s evidence speak. Fair presentation cuts both ways: report conformity accurately where you find it, and do not soften a serious finding because the closing meeting will be uncomfortable.

Confidentiality matters inside one company too. Audit notes may contain commercially sensitive information, personnel issues, or customer details. Store them under the programme’s control, share findings through agreed channels, and never use audit access for purposes outside the audit. Trust in that discipline is what keeps people candid with auditors.

Focus time where risk lives

Risk-based auditing means your sampling, depth, and frequency follow food safety significance and performance history. Spend the longest time on significant hazard controls, processes with deviations, areas after change, and controls whose failure would reach the consumer undetected. Give stable, low-risk support processes proportionate attention, enough to confirm they still work, not equal time for the sake of symmetry.

Plan audits across the full operating reality of the site. Processes that run at night, at weekends, or seasonally must appear in the programme over time. Auditing only day shift, office hours practice gives a partial verdict on the system, and experienced auditees know it. Where attending unsocial hours is impractical, use records, data, and interviews that genuinely cover those shifts and record the limitation honestly.

Write findings that drive action

A strong finding has three parts: the requirement, the evidence, and the gap between them, stated in plain language. Name the clause or procedure, describe exactly what was seen or sampled, and let the reader reach your conclusion without effort. Avoid opinions, exaggeration, and blame aimed at individuals; systems produce most failures, and findings aimed at people produce defensiveness instead of correction.

Grade findings consistently if your programme uses grading, and reserve the highest grade for issues with real food safety or conformity impact, such as a breached critical limit without product control, a falsified record, or a significant hazard with no control. When everything is major, nothing is. Agree facts at the closing meeting while evidence is fresh, distinguish correction from corrective action, and set timescales proportionate to risk, not to a standard number of days applied to everything.

Verify effectiveness, not just closure

Programmes decay when findings are closed on the strength of a revised document or a training signature. Best practice checks effectiveness after time has passed: did the deviation recur, do records show the new behaviour, does the trend improve? Build effectiveness checks into follow-up and into the next audit of the area. A corrective action that did not work is not a closed action; it is information that the root cause analysis was wrong, and the programme should treat it that way.

Keep competence and the programme itself improving

Auditor competence needs maintenance. Internal auditors should understand ISO 22000 requirements, audit techniques consistent with ISO 19011, and enough of the processes they audit to recognise abnormal evidence, or be paired with a technical expert. Review auditor performance through observed audits, quality of reports, and auditee feedback, and use it to coach, not to punish. Rotate assignments where possible so knowledge spreads and familiarity does not dull scepticism.

Finally, audit the audit programme. Clause 9.2 results feed management review, so report programme health honestly: coverage achieved against plan, overdue findings, repeat findings, and areas never reached. A programme that reports only completed audits hides its own nonconformities. The sites with the strongest food safety systems treat internal auditing as a control in its own right, planned, measured, and improved like any other.

Best practice also includes knowing when to stop and escalate. If you find evidence of imminent risk to consumers, a deliberate falsification, or obstruction that prevents the audit reaching evidence, pause the routine work and inform the audit programme manager and responsible management at once. Continuing a tidy timetable past a serious discovery is not professionalism. Handling it promptly, factually, and through the right channel is exactly what the site relies on its best auditors to do, even when the moment is uncomfortable for everyone involved.

Key points

• Follow ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based and risk-based approaches.
• Declare conflicts, never audit your own work, and let current evidence override past impressions.
• Direct time and sampling toward significant hazards, change, and poor performance history, across all shifts over time.
• Write findings as requirement, evidence, and gap, graded consistently and free of personal blame.
• Close findings on verified effectiveness over time, not on revised documents alone.
• Report programme health, including repeats and gaps, into management review.