Internal Audit in Food Businesses: Check Yourself Before Others Do
An internal audit in food businesses is neither an end in itself nor a form of harassment. It is the moment when you take a look yourself, before the authority, a certifier or a customer does. The advantage is obvious: you find gaps while you can still close them calmly. That is why it pays to take your own audit seriously instead of ticking it off as an annoying duty.
Why an internal audit matters
In everyday life, your business runs on routine. And that is exactly where deviations creep in that nobody notices any more. An internal audit is a deliberate step back. It checks whether your team actually lives what the documents say.
This is the core of every HACCP-based self-check. A plan in the drawer protects nobody. Only regular review shows whether your system holds up in real day-to-day operations.
What the law requires
The central basis is Article 5 of Regulation (EC) No 852/2004 on the hygiene of foodstuffs. It requires food business operators to put in place, implement and maintain one or more permanent procedures based on HACCP principles. Part of this is checking regularly that your measures work. The law calls this check verification, and it is essentially the legal core of your own audit.
To put this into context, the law does not literally require a formal, documented internal audit. Instead, it requires self-checks and evidence of them. Certification standards such as IFS Food, FSSC 22000, BRCGS or ISO 22000, by contrast, clearly require a structured audit procedure.
So if you are certified or want to be, there is no way around the internal audit. You can find out more about the requirements in our articles on ISO 22000 and on IFS Food requirements.
What to watch out for in your own audit
To make your audit more than ticked boxes, a few points matter. They sound bureaucratic, but they make the difference between an alibi and real benefit.
Clear scope. Decide in advance which area or process you are checking. An audit without focus fizzles out.
Independence. Whoever checks an area should not be responsible for it. Ideally, internal auditors look at areas they do not work in every day.
Competence. Your internal auditors need sufficient expertise. The ISO 19011 guidelines for auditing management systems provide good orientation on principles, audit programmes and auditor competence.
Evidence. Document both conformities and deviations. If nobody wrote it down, auditors treat it as if it never happened.
Scope and frequency should follow the risk. The more critical a process, the more closely and more often you look at it. Fixed intervals depend on the business, the sector and the standard, so set them internally.
How to run your internal audit
A good audit follows a clear sequence. As a result, you leave nothing to chance and end up with a usable result instead of loose notes.
Step 1: Plan. Define the audit plan and scope: what you check, who checks it and when.
Step 2: Prepare. Get the right basis ready, for example a checklist or your HACCP plan.
Step 3: Check on site. Observe, ask questions and review evidence. Do not just leaf through folders.
Step 4: Record. Note your findings, clearly separated into fulfilled and deviating.
Step 5: Agree actions. Define corrective actions with owners and deadlines.
Step 6: Follow up. Track implementation and check it again in the next audit.
An internal audit stands or falls with the last step. After all, a deviation that nobody follows up is just a nicely documented construction site. Only consistent follow-up turns your audit into a real improvement tool. With the QMSpot audit management module, findings, actions and deadlines stay in one place.
A short checklist for your own audit
If you are just starting out, this minimum framework helps. It does not replace a site-specific audit plan, but it gives you a solid structure.
Area and date. You name the audited area and the date clearly.
Audit basis. You define the checklist, plan or standard you checked against.
Findings. You record observations factually and traceably.
Deviations. Each one has an action, an owner and a deadline.
Filing. You document the result and keep it ready for the next round.
You can build this framework once as a template in the QMSpot checklists and inspection plans module and reuse it for every audit.
The most common weak spots
Many audits fail not because of the business but because of avoidable mistakes in the approach. These points come up particularly often.
Theory only. The audit checks documents and ignores what actually happens in the kitchen, warehouse or production.
No real actions. Teams note deviations, but they never become a corrective action with a deadline. The QMSpot defect management module closes exactly this gap.
Too close to the area. The auditor checks their own area and therefore finds nothing.
Gaps in the records. The documentation has holes, so evidence is hard to provide later.
A one-off. The audit happens once, and nobody repeats it or follows it up.
The good news is that a little structure defuses each of these weak spots early. That is exactly what your audit is for.
Frequently asked questions
Is an internal audit required by law?
What the law requires is self-checks based on HACCP principles, including evidence and verification. A formal internal audit, on the other hand, is mainly something certification standards such as IFS Food or ISO 22000 require.
Who may carry out the audit?
A competent person who is ideally not responsible for the audited area. That can be someone from your own team or external support.
How often should I audit?
That depends on the risk, the size of your business and the relevant standard. You check critical processes more often. You set fixed intervals internally.
What belongs in an audit report?
In short: the audited area, the date, the audit basis, the findings and the agreed corrective actions with deadlines. That way, your result remains traceable months later.
How to get started
This week, pick one process, for example goods-in or cleaning, and ask a colleague from another area to audit it with you. Use the short checklist above and plan one hour for it.
Afterwards, agree on no more than three actions with clear owners and deadlines. To see how audits, actions and evidence come together in one system, take a look at QMSpot quality management software.
Not sure whether your own audit would hold up when it counts?
Then let's talk briefly about your processes and see how you can plan internal audits, track actions and keep evidence with QMSpot in a clear and traceable way.