How often should you audit each area? Building a risk based internal food safety audit schedule

Most internal audit programmes we review are a calendar with every clause listed once a year, written in January and never touched again. Certification body auditors now ask a harder question: why this frequency for this area? This guide shows you how to build an internal food safety audit schedule that a certification auditor will accept, with every frequency backed by a risk score rather than a guess.

What the schemes require of an internal audit programme

ISO 22000:2018 deals with internal audit in clause 9.2. In plain language, the organisation must audit at planned intervals to check that the food safety management system meets its own requirements and the standard, and that it is effectively implemented and maintained. The programme must take into account the importance of the processes concerned, changes in the system and the results of monitoring, measurement and previous audits. Auditors must be objective and impartial, results must be reported to the food safety team and relevant management, and corrections and corrective actions must be taken within an agreed time frame.

FSSC 22000 Version 7 is built on ISO 22000:2018, so the same clause applies. The difference is scope: your internal audits also need to cover the prerequisite programme requirements for your sector and the FSSC additional requirements. If your clause list only covers the ISO 22000 headings, you have a gap.

BRCGS sites will recognise the same thinking, with firmer rules. The Food Safety Standard asks for a scheduled programme with at least four different audit dates spread through the year, frequencies set from the risk of each activity and previous audit performance, and every activity covered at least once a year. It also asks for separate documented inspections of the factory environment and processing equipment. Whatever your scheme, the message is the same: frequency must follow risk and performance, and you must be able to explain it.

Listing what you audit: areas, processes and clauses

Before you can score anything, you need a complete list of what can be audited. We call it the audit universe. Build it from three views and cross check them against each other:

• Physical areas: receiving, raw material stores, chillers and freezers, preparation, processing, packing, finished goods, dispatch, the laboratory, workshops, change rooms, the canteen and outside areas.
• Processes: HACCP plan verification and CCP monitoring, allergen management, traceability and recall, supplier approval, cleaning and sanitation, pest control, maintenance and calibration, foreign body control, training, food defence, food fraud, complaint handling, management review and document control.
• Clauses: every clause of your standard and every scheme requirement, mapped to the process or area where you will test it.

The clause map matters. When the certification auditor asks where you audited a specific requirement, you should be able to point to the audit and the date. A simple matrix with clauses down the side and audits across the top shows any blank rows at a glance.

Scoring risk and past performance to set frequency

Give each process or area a score on four factors. Keep the scale simple, 1 for low and 3 for high:

Factor	1 (low)	3 (high)
Food safety impact	Failure is unlikely to affect product safety	Failure could directly cause an unsafe product, for example an allergen or CCP failure
Complexity and change	Stable, simple process	New lines, new products, new staff or frequent changes
Past audit performance	No findings in the last two audits	Major or repeated findings, internal or external
Complaints and incidents	None linked to this area	Complaints, deviations or near misses linked to it

Add the four scores for a total out of 12, then convert it to a frequency. One workable rule: 10 to 12 means quarterly, 7 to 9 means twice a year, 4 to 6 means once a year. That banding is our method, not a scheme rule. You can use your own, provided it is written down and applied consistently. Set a floor of once a year for every process: BRCGS requires it, and it is the simplest way to show any certification auditor that the whole system is covered.

The same thinking applies to your PRP inspections between audits. The PRP Verification Plan Risk Assessment Template (RA01) scores each prerequisite programme and sets an inspection frequency from the risk rating, which gives you a defensible base for the GMP side of the programme.

A worked twelve month schedule for a medium food plant

Here is a twelve month plan for a snack manufacturer in Gauteng with two production lines, several allergens on site and FSSC 22000 certification. The scores came from the method above.

Process or area	Score	Frequency	Months
Allergen management and labelling	12	Quarterly	Feb, May, Aug, Nov
HACCP plan, CCP monitoring and verification	11	Quarterly	Jan, Apr, Jul, Oct
Cleaning, sanitation and environmental monitoring	10	Quarterly	Mar, Jun, Sep, Dec
Traceability, withdrawal and recall	9	Twice a year	Mar, Sep
Supplier approval and incoming materials	8	Twice a year	Apr, Oct
Maintenance, calibration and foreign body control	8	Twice a year	Jun, Dec
Pest control	7	Twice a year	May, Nov
Food defence and food fraud	6	Once a year	Jul
Training, competence and food safety culture	6	Once a year	Aug
Warehousing, dispatch and transport	5	Once a year	Oct
Management review, objectives and document control	5	Once a year	Jan

That is 24 audits in the year, about two a month, which a site of this size can resource. Monthly GMP walk inspections run alongside the programme and feed their results into the scores. Notice that the high scoring areas are spread across the year so no quarter goes by without a look at allergens, CCPs and hygiene.

Who audits what: independence and competence

Auditors must not audit their own work. The production manager cannot audit production, and the person who wrote the HACCP plan should not be the one verifying it. On a medium site, cross auditing works well: the QA technologist audits stores and dispatch, the engineering planner audits training records, the stores supervisor audits cleaning. On a small site with only one QA person, bring in an outside auditor for the QA processes. Our internal food safety audits service can fill that gap.

Competence is the other half. Each internal auditor needs training in audit technique, knowledge of the standard and enough understanding of the process to know what good looks like. ISO 19011 gives the accepted guidance on auditing management systems. Keep training records and a short competence matrix showing which auditor is approved for which process. Our Internal and Supplier Auditing Practices course trains your team to plan, conduct and report audits against an FSMS, including supplier audits.

Changing the schedule when things go wrong

A risk based schedule is a living document. Rescore and add audits when any of these happen:

• A major nonconformity, or the same minor finding twice in a row.
• A complaint trend linked to an area, such as foreign matter from one line.
• A new product, new line, new allergen or a significant process change.
• A change of key people, such as a new shift supervisor or hygiene manager.
• Findings from a certification, customer or regulatory audit.
• An incident, withdrawal or recall.

In one example, a meat processor in the Western Cape had pest control scored at 6 and audited once a year. Two rodent sightings in the dry store in April pushed the complaints and past performance scores up, the total moved to 9, and an extra audit was added in May with a follow up in August. The change was recorded with the date, the reason and the new score. That record is what a certification auditor wants to see: evidence that the programme responds to what happens on site.

Keep version control on the schedule and record every change. Certification auditors often ask for last year’s plan alongside this year’s to see whether it actually moved. If you want an outside view before that happens, an independent FSMS audit will show you whether your programme holds up.

What to do this week

• List your audit universe: areas, processes and every clause of your scheme.
• Score each process on impact, complexity, past performance and complaints.
• Set frequencies from the scores and write down the rule you used.
• Spread high scoring audits across the year and check that every clause is covered.
• Assign auditors who are independent of the area and check their training records.
• Add a change log to the schedule and record the reason for every change.