Internal Audits: How to Audit Your Own Food Safety System

If you work in food safety, you already know the feeling. The external auditor walks through the door, and everyone in the plant suddenly stands a little straighter. But here is the uncomfortable truth most QA managers learn the hard way: an external audit should never be the first time your system gets properly tested. That job belongs to your internal audit program — and most of them are broken.

An internal audit is not a rehearsal for the real thing. It is the real thing, done by your own people, on your own schedule, with time left to fix what breaks. ISO 22000, BRCGS, SQF, and FSSC 22000 all require it. More importantly, regulators expect it. When FDA shows up for a routine inspection under the Food Safety Modernization Act, one of the first things an investigator looks for is evidence that you audit yourself. A thin internal audit record tells them everything.

What an Internal Audit Actually Is (and Isn’t)

Strip away the jargon and an internal audit is a simple thing: someone who did not do the work checks whether the work was done the way the system says it should be. That independence matters more than the checklist. ISO 19011 — the international guideline for auditing management systems — is blunt about it. Auditors must be impartial and objective. If your QA technician audits the receiving procedures she writes every week, that is not an audit. That is a self-review with a fancier name.

It also is not a surprise inspection of people’s behavior. Too many plants treat internal audits like police raids, and the result is predictable: operators hide problems, supervisors get defensive, and the audit report becomes a fiction everyone signs off on. The best internal auditors I have worked with think of themselves as mechanics, not cops. A mechanic finds the worn belt before it snaps. Nobody takes that personally.

Building a Program That Holds Up

A defensible internal audit program has four parts: a schedule, trained auditors, consistent execution, and real follow-up. Miss any one of them and the whole thing wobbles.

The Annual Audit Schedule

Every program starts with a calendar. Map every clause of your standard — every prerequisite program, every CCP, every procedure — against a 12-month schedule so the full scope of your food safety management system gets covered at least once a year. High-risk areas get audited more often. If your metal detector logs, your allergen changeovers, and your sanitation verifications only get audited annually, you are auditing like the hazards do not exist on the other 364 days.

Risk-based scheduling is not optional anymore. BRCGS Issue 9 and FSSC 22000 version 6 both push hard toward risk-based thinking. Put your highest-frequency audits where your highest-severity hazards live: allergen management, thermal process control, foreign material detection, and supplier approval.

Choosing and Training Auditors

Your auditors need two things: independence from the area being audited, and enough training to know what good looks like. A one-hour orientation is not training. At minimum, internal auditors should understand the standard you are audited against, basic audit technique (questioning, sampling, evidence gathering), and how to write a finding that means something. Pair new auditors with experienced ones for their first two or three audits.

One practical trick that works in mid-size plants: build a small cross-functional audit team. A maintenance lead auditing sanitation, a sanitation lead auditing receiving. People spot things outside their own silo that specialists walk right past, and the cross-pollination lifts the whole plant’s food safety awareness.

Sampling: How Much Is Enough?

Auditors cannot check everything, so they sample. The mistake is sampling three records and calling the area clean. A reasonable rule of thumb for a monthly activity: pull at least 10 records, or 10% of the month’s records, whichever is larger. If you find one nonconformance in ten, pull ten more. Patterns live in the second sample.

Running the Audit: Preparation Through Reporting

Good audits are boring in the planning and interesting in the findings. Each audit needs a plan: scope, criteria, the people and records involved, and a realistic time block. Two hours for a CCP audit is not generous; it is the minimum once you include interviews and record review.

On the floor, ask open questions and follow the evidence. “Walk me through what happens when the metal detector rejects” beats “You follow the metal detector procedure, right?” every time. Check what people say against what the records show and against what you observe. When all three agree, you have conformity. When they do not, you have a finding — write it down with the specific evidence, the specific clause it violates, and the specific record or observation.

The audit report should land within a week while memories are fresh. Grade findings clearly: critical (immediate food safety risk), major (systematic breakdown), minor (isolated slip). Vague findings produce vague corrections. “Sanitation records incomplete” is lazy. “Four of twelve pre-op inspection forms from the week of October 12 missing supervisor verification signatures, violating procedure SAN-04 section 5.2” gets fixed.

Closing the Loop: Findings That Actually Get Fixed

This is where most internal audit programs die. The report goes out, corrective actions get assigned, and six months later the same finding appears again. A finding is not closed when someone promises to fix it. It is closed when the corrective action is implemented, verified effective, and the evidence is on file.

Track every finding to closure with dates and owners. Review open findings monthly in your management review or food safety team meeting. And run the most powerful test in auditing: the look-back. Next time you audit that area, specifically check whether the old finding stayed fixed. Recurring findings are a system problem, and auditors should say so plainly.

Your internal audit program is the one part of your food safety system where you get to find your own problems on your own terms. A program that reports uncomfortable truths on time is worth more than any certificate on the wall. Build it, staff it, run it honestly — and when the external auditor arrives, you will already know exactly what they are going to find.