Every food safety standard audited in South Africa accepts digital records, and none of them require paper. ISO 22000:2018 clause 7.5, which FSSC 22000 Version 7 is built on, uses the phrase documented information precisely so that the medium does not matter. BRCGS Issue 9 clause 3.3 asks for records that are legible, genuine, retained and protected from loss, with no mention of paper. GLOBALG.A.P. IFA v6 lets producers keep records in any form the inspector can read. Regulation R638 of 2018 expects the person in charge to show that cleaning, pest control, temperature control and training are done and recorded, and an environmental health practitioner will accept those records on a screen. The question auditors ask is not paper or digital. It is whether the record is controlled.
The five tests an auditor applies to any record
Whether the record is a ring binder or a database row, an experienced auditor is checking the same five things. Who made the entry and when. Whether it can be altered after the fact without a trace. Whether the person who verified it is different from the person who made it. Whether it can be found when asked for. Whether it is legible, complete and retained for the period the standard requires. Paper fails the second and fourth tests more often than any other. A pen entry can be backdated and nobody can prove it. A record from 14 months ago lives in a box in a storeroom.
Where paper records lose audits
In the audits ASC’s team has conducted and observed over the years, the non-conformances raised against records fall into a short list that repeats across sectors. Missing entries, typically a weekend or a night shift where the sheet was not filled in. Pre-filled entries, where a whole week of temperature readings appears in the same pen with the same handwriting at the same angle. Illegible entries, especially on sheets that live near a wash-down area. Records that exist but cannot be produced within the time the auditor is prepared to wait. And verification signatures applied in bulk, which an auditor spots when thirty daily sheets carry a supervisor signature dated the same day.
None of these are food safety failures in themselves. They are evidence failures. The cleaning may have been done perfectly. The audit still records a non-conformance because the system cannot show it.
What a digital record does differently
A properly built digital record carries its own evidence. The entry is timestamped by the system, not by the person. The user is identified by login. A correction creates a new version and keeps the old one, so the history is visible. Verification is a separate action by a separate user, and the time gap between entry and verification is recorded. When a task is not done, the absence is visible immediately as a missed task with an alert, rather than a blank line discovered weeks later. Retrieval is a search, not a search party.
Auditors notice the difference. A record set that produces any requested document in under a minute, with a clear audit trail, changes the tone of an audit. The auditor stops testing the record system and starts looking at the food safety system, which is where you want their attention.
What auditors still want to see on a digital system
Going digital does not remove scrutiny, it moves it. Expect an auditor to ask how users are authenticated and whether shared logins are in use, because a shared tablet login undermines the who-made-the-entry test. Expect questions about backups and where the data is hosted, which is a legitimate business continuity point under FSSC 22000 Version 7’s requirements on documented information and under BRCGS Issue 9 clauses 3.2 and 3.3. Expect them to ask what happens when the connection drops on the production floor. A good system records offline and syncs later, with the original capture time preserved. Expect them to ask to see the audit trail on one record, picked at random. If the system cannot show it, you are back to paper’s problem in a more expensive form.
Hybrid systems, and why they are the worst of both
Many sites run a hybrid, with digital documents and paper records, or digital daily checks and paper CCP monitoring because the thermometer does not talk to the tablet. Hybrids inherit every weakness of paper and add a new one, which is the question of which system is the controlled copy. If you are going to run paper anywhere, the auditor will want to know how that paper is reconciled with the digital record and who is responsible for the gap. The cleaner answer is to put every record that an auditor can request into one system and keep paper only for things an auditor will never ask for.
Making the switch without losing a year of history
The practical worry is continuity. An auditor will want to see 12 months of records, and if you switched systems four months ago, that means two systems. Keep the paper records in their existing files for the retention period, note the switch-over date in your document control procedure, and make sure the new system has the same record identifiers so a trend can be followed across the change. ASC does this as part of ASCloud setup, which loads your existing document set and checklists so that the first digital record follows directly from the last paper one.
See how a record looks on ASCloud
Timestamped entries, separate verification, a full audit trail and a search instead of a storeroom. Full document FSMS from R3,800 per site per month.
Frequently asked questions
Do I still need to print records for the auditor?
No. Auditors review records on screen. Most prefer it, because they can filter and search. Have a tablet or laptop ready at the audit table.
Are electronic signatures legal in South Africa?
Yes. The Electronic Communications and Transactions Act 25 of 2002 recognises electronic signatures and data messages as evidence. Food safety standards do not require an advanced electronic signature for routine records.
What about records from the thermometer or the scale?
Instrument readings can be entered manually with the instrument identified, or captured automatically where the instrument supports it. Either way the entry is timestamped and attributed.
How long must records be kept?
It depends on the standard and the product. FSSC 22000 and BRCGS expect retention at least for the shelf life of the product plus a period defined by the site, commonly a minimum of 12 months and often longer for exports. Set the retention period in your document control procedure and let the system hold it.