EMP AUDIT FINDINGS

Environmental Monitoring Audit Nonconformities Under FSSC 22000, BRCGS, SQF and IFS, and How to Close Them

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 24 min read

Environmental monitoring nonconformities under FSSC 22000 (clause 2.5.7), BRCGS Food Safety Issue 9 (4.11.8), SQF Edition 9 (2.4.8) and IFS Food Version 8 (5.6.2) come from the same few gaps: no risk basis, zone 1 not sampled, swabbing only after cleaning, no trend analysis and weak root cause work. You close them with evidence, not promises. ASC’s Automated EMP tool (R1 450, about USD 89 · EUR 77 · GBP 66 · AED 326, per site per year) produces that evidence, and our EMP consultants help you close open findings on time.

Why environmental monitoring findings keep coming up

Auditors grade environmental monitoring often because the clause asks for a working system backed by data, and data gaps are easy to see. FSSC’s own 2024 figures for Version 6 put environmental monitoring seventh among the fifteen most common nonconformities, and it also appears among the most common major ones.

Those rankings come from the Foundation FSSC Insights webinar of 25 March 2025, which also ranked nonconformity and corrective action third among major findings. In our audit work, the same dozen findings appear under every scheme.

South Africa’s 2017 to 2018 listeriosis outbreak reached 1 060 cases with 216 deaths where the outcome was reported, linked to a ready to eat processed meat product contaminated with Listeria monocytogenes sequence type 6 (WHO). Environmental monitoring finds that organism in drains and equipment before it reaches product.

For a clause walk through with auditor tips, read our FSSC 22000 environmental monitoring (2.5.7) guide; for design basics, see microbiological risk assessment and environmental monitoring.

What each scheme requires, side by side

All four schemes ask for the same core: a risk based programme for the relevant organisms, defined sites, frequencies and methods, limits with corrective action, trend analysis and periodic review. The emphasis differs. FSSC 22000 lists review triggers, BRCGS sets a minimum scope, SQF details the schedule and IFS links it to testing plans.

Check your audit version before quoting clause numbers. FSSC 22000 Version 7 was published on 7 May 2026, but Version 6 audits continue until 30 April 2027; clause 2.5.7 keeps its number and four elements in Version 6 and Version 7. SQF Edition 10 was released in March 2026, but Edition 10 audits start on 2 January 2027. IFS Food Version 8 has been mandatory since 1 January 2024, and BRCGS Issue 9 remains the audited issue while Issue 10 is still in development. See which scheme version applies in 2026.

How findings are graded and how long you have

Each scheme grades findings by severity and gives a fixed window for evidence. FSSC 22000 and BRCGS allow 28 calendar days, SQF Edition 9 allows 30, and IFS Food Version 8 gives four weeks from receipt of the auditor’s action plan. Critical findings and failed knock out requirements stop certification.

Twenty eight days is short when a pathogen result can take a week, so start the day the auditor leaves and send further verification as a dated plan. The timelines below are ASC’s estimates, not scheme rules; agree any overrun with your certification body before the deadline.

Findings in programme design

Design findings matter most because every result rests on the design. The four we see most often are no risk basis, zone 1 never sampled, sampling only after cleaning, and no neutraliser matched to the sanitiser. Any one can make years of negative results meaningless.

Finding 1: no risk basis or organism justification

What the auditor sees. A swab list copied from a template, such as aerobic plate count and coliforms on a ready to eat line with no Listeria spp. testing, or only Listeria in a dry products plant whose hazard analysis names Salmonella.

The requirement it breaks. FSSC 22000 2.5.7 (a), BRCGS 4.11.8.1, SQF 2.4.8.1 and IFS 5.6.2 all require a risk basis for the organisms and sites chosen.

The evidence that closes it. A documented risk assessment that names each organism and why, scores inherent and residual risk for every site and zone, derives frequency from the score and links to the HACCP hazard analysis, as our RA19 template does. For dry products, see our guide to environmental monitoring for Salmonella and Cronobacter spp.

Realistic closure timeline. One to two weeks, plus the first sampling round.

Finding 2: zones not defined or zone 1 not sampled

What the auditor sees. No zone map. Every swab is on a floor, drain or wall; food contact surfaces are skipped because a positive “would mean holding product”.

The requirement it breaks. FSSC 2.5.7 (b) covers all controls against environmental contamination, and FSSC’s environmental monitoring guidance defines zone 1 as product contact surfaces. BRCGS 4.11.8.1 and SQF 2.4.8.2 require defined sample locations, BRCGS across at least all open and ready to eat product areas.

The evidence that closes it. A zone map on the layout drawing, a site register with an ID and zone for every site, and zone 1 sites scheduled at a justified frequency, with the product decision rule written before the first sample. See our hygienic zoning risk assessment.

Realistic closure timeline. About a week, then one to two weeks for the first zone 1 results.

Finding 3: sampling only after cleaning

What the auditor sees. Every sample taken before start up, straight after sanitation, and years without a Listeria spp. positive in a wet ready to eat area.

The requirement it breaks. Post clean samples verify cleaning but do not find organisms surviving in harbourage, which is the point of 2.5.7 (b). SQFI’s guidance says pathogen swabbing “should be performed during production, not immediately after cleaning and sanitizing”, after at least 3 to 4 hours of production.

The evidence that closes it. A revised protocol stating each sample type’s purpose, in production samples a few hours into the run, rotation across shifts and days, and sample times on the results log.

Realistic closure timeline. Days for the protocol, then two to four weeks of in production results.

Finding 4: no neutraliser matched to the sanitiser

What the auditor sees. Dry swabs or swabs moistened with sterile water, and a sanitiser change with no check that the swab still works.

The requirement it breaks. No clause names the neutraliser, so auditors raise this under methods: BRCGS 4.11.8.1 asks for defined test methods and FSSC 2.5.1 (a) for validated ones. Li and colleagues (2020) found that at a very high quaternary ammonium concentration, Letheen broth did not neutralise effectively while Dey/Engley and HiCap broths did (BMC Microbiology).

The evidence that closes it. A method record per area naming the sanitiser and concentration, the swab or sponge and the neutralising broth, backed by the supplier specification or laboratory confirmation. ISO 18593:2018 is a sound reference for surface sampling procedure, and our surface swabbing guide explains the choices.

Realistic closure timeline. One to two weeks, mostly waiting for the right swabs.

Findings on laboratories, limits and positives

A sound design still fails if results cannot be trusted or nobody knows what they mean. The two findings here are an unfit laboratory or method, and no action limits or product decision when a food contact surface tests positive for a pathogen.

Finding 5: laboratory not competent or method not fit

What the auditor sees. No accreditation or proficiency testing record for the tests used, or an unvalidated in house rapid pathogen test.

The requirement it breaks. FSSC 22000 2.5.1 (a) requires a competent laboratory. FSSC’s interpretation article says ISO/IEC 17025 accreditation is not mandatory, but the laboratory must operate to it, validate methods and should do proficiency testing annually, covering all methods over four years; environmental monitoring is in scope. IFS 5.6.3 prefers laboratories with ISO/IEC 17025 accredited methods.

The evidence that closes it. A SANAS accreditation certificate and schedule listing your methods, or proficiency testing results and method validation.

Realistic closure timeline. One to three weeks if the laboratory holds the evidence. If you change laboratory, submit the new contract and its accreditation schedule inside the window.

Finding 6: no action limits, or no product decision on a zone 1 positive

What the auditor sees. A log that says “positive” and “area re-cleaned” with nothing about product made on that line.

The requirement it breaks. BRCGS 4.11.8.2 requires documented control limits and corrective action, SQF 2.4.8.2 a plan for undesirable results, and IFS 5.6.5 immediate correction. Annex I of Codex CXG 61-2007 advises a response to every positive, scaled to the likelihood of product contamination, from no action through intensified cleaning and source tracing to holding and testing product. Codex is guidance, not South African law, and CXG 61 was revised in 2026.

The evidence that closes it. Alert, action and escalation levels per test and zone, a zone 1 pathogen hold and release rule agreed in advance by the food safety team, and one completed positive record, real or rehearsed, from detection to product disposition.

Realistic closure timeline. About a week. A documented mock exercise is often the fastest proof of use.

Findings on corrective action, trends and review

These findings show a programme that runs but does not learn. Positives are cleaned and swabbed again with no root cause, results are filed but never trended, and the programme is years old despite new lines and long runs of negative results.

Finding 7: corrective action says “cleaned and re-swabbed”

What the auditor sees. Every positive closed with “area re-cleaned, re-swab negative”, no vector sampling or investigation, and the same drain positive a few months later.

The requirement it breaks. SQF 2.5.3.1 requires root cause identification and 2.4.8.3 preventive action on unsatisfactory trends. BRCGS 4.11.8.2 requires corrective action, and for FSSC 22000, ISO 22000:2018 clause 10.1 applies.

The evidence that closes it. An investigation record: correction, intensified vector sampling around the site, causes checked, root cause, corrective action, verification sampling over a defined period and sign off.

Realistic closure timeline. Correction on the day and investigation within two weeks. Verification sampling often runs two to six weeks, so submit the first results with a dated plan.

Finding 8: no trend analysis

What the auditor sees. Laboratory reports filed as PDFs. “Trending” is a yearly count of positives.

The requirement it breaks. FSSC 2.5.7 (c) requires regular trend analysis, SQF 2.4.8.3 tracking and trending, and IFS 5.6.5 a defined frequency for trend review. SQFI’s guidance lists trend analysis evidence among auditor checks.

The evidence that closes it. Monthly positive rate by zone, a repeat site list, positives by area and count results against limits, with dated minutes of actions taken.

Realistic closure timeline. A few days if the data exists, two weeks if it must be rebuilt.

Finding 9: review not done annually or after triggers

What the auditor sees. A programme dated three years ago, despite a new line, a recall and eighteen months of zero positives.

The requirement it breaks. FSSC 2.5.7 (d) requires review at least annually and on five triggers, BRCGS 4.11.8.3 at least annually, and IFS 5.6.8 updates based on results, legislation and other changes.

The evidence that closes it. A review log with the date, trigger, scope, decisions and the new version of the risk register.

Realistic closure timeline. One to two weeks.

Findings on execution, people and records

The last group is about doing what the written programme says: following the schedule, training the samplers and keeping records that agree. Each is often graded minor alone, but together they tell an auditor the programme is not under control.

Finding 10: sampling schedule not followed

What the auditor sees. Weekly zone 1 sampling with gaps in peak season, and the same ten sites every time.

The requirement it breaks. FSSC 2.5.7 (b) and IFS 5.6.2 require the programme to be implemented, BRCGS 4.11.8.1 sets test frequency, and SQF 2.4.8.2 requires frequency, locations and rotation.

The evidence that closes it. A four week schedule matrix rotating by shift and day, a monthly planned versus completed check, and make up samples for anything missed.

Realistic closure timeline. A week for the corrected schedule and check; we usually submit two to three weeks of on schedule sampling.

Finding 11: samplers not trained

What the auditor sees. The sampler cannot explain the sample area, neutraliser, aseptic handling or labelling, and there is no training record.

The requirement it breaks. ISO 22000:2018 clause 7.2 (competence) for FSSC 22000, which appeared in FSSC’s 2024 top 15, and IFS 5.6.5 and 5.6.6 on competent personnel.

The evidence that closes it. A sampling work instruction, training records with an observed practical assessment, and a refresher interval. Our EMP and surface swabbing course certificates can be filed at once.

Realistic closure timeline. One to three weeks.

Finding 12: records inconsistent

What the auditor sees. Site IDs on laboratory reports that do not match the register, missing dates, typing errors and three versions of the schedule.

The requirement it breaks. ISO 22000:2018 clause 7.5 (documented information) for FSSC 22000, BRCGS 4.11.8.1 (recording and evaluation of results) and SQF 2.4.8.3.

The evidence that closes it. One results log keyed to site ID and laboratory reference, controlled versions of the register and schedule, and a reconciliation of past reports.

Realistic closure timeline. One to two weeks to reconcile, then ongoing control.

The closure evidence pack

A closure evidence pack is the set of records proving a finding is corrected, its cause removed and the fix working: usually the risk register, zone map, schedule, results log, trend charts, positive and corrective action records, review log, and laboratory and training evidence.

Writing a root cause and corrective action plan that gets accepted

An accepted plan separates correction from corrective action, names a root cause that explains why the gap existed, removes that cause and proves the fix works. Plans that restate the finding as the cause, or just say “retrain staff”, come back.

1. Contain and correctRecord what you did at once: product assessed or held, area sanitised, missing zone 1 sites added to this week’s schedule.
2. Define the problem“Zone 1 surfaces on Line 2 were not sampled from March to August” is usable. “EMP not adequate” is not.
3. Find the root causeUse five whys or a fishbone, testing each cause against evidence. Root causes are usually systemic: no risk method, no review owner, an unadapted template.
4. Check the reachCould the same cause affect other lines or sites?
5. Remove the causeChange the system: a scored risk assessment, review ownership in a job profile, the programme on the management review agenda.
6. Assign owners and datesEvery action gets a name and a due date inside the window, or a reason it needs longer.
7. Prove it worksAttach the verification you have, such as first in production results, a review log entry or an internal audit, and date what is still to come.

A weak root cause for Finding 3 reads: “Staff swabbed at the wrong time.” A strong one reads: “The procedure did not define the purpose or timing of each sample, and the schedule followed the sanitation shift, so every sample was taken after cleaning. No review tested whether the programme could detect harbourage.”

Preparing for an unannounced audit

All four schemes require at least one unannounced audit in each three year cycle, so environmental monitoring evidence must be ready on any working day. Keep one current pack, sample to schedule every week, and make sure more than one person can present the programme.

See the requirements in FSSC 22000, BRCGS and SQF; IFS Food makes at least every third audit unannounced.

• Risk assessment, zone map and site register match the floor, including new equipment.
• This week’s samples were taken on schedule.
• The results log is current, with site ID and laboratory reference on every result.
• Every positive in the last 12 months has a closed record with root cause and verification.
• Trend charts, review minutes and the review log of annual and trigger reviews are filed.
• Swabs, neutralising broth and sanitiser match the method record, and laboratory accreditation is current.
• Two trained samplers and a deputy presenter are available.
• Drains and harbourage areas flagged by the programme appear in pest control and maintenance records.

Check this list monthly; see our hygiene audit preparation tips.

How ASC helps you close the finding

ASC helps in three ways: EMP consultants who close open findings with you, the Automated EMP tool and RA19 template that produce the evidence, and online training that makes the programme stick. Start with one finding, a full rebuild or a pre audit review.

Our training platform has more than 3 600 course enrolments and a 4.9 average rating from 672 verified reviews, our clients rate us 4.9 from 350+ Google reviews across our Gqeberha, Johannesburg and Cape Town offices, and KFC and Spur franchise groups train their teams with ASC. See also our EMP consultant guide and EMP cost guide. For a quick answer, book a virtual consultation at R480 (about USD 29 · EUR 26 · GBP 22 · AED 108) per hour or WhatsApp +27 61 483 0381.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for site specific advice.