FSMS audits that find it before the auditor does

Every management system standard requires the site to audit itself against the whole of the standard on a planned programme, by auditors competent and independent of the activity audited. In a small technical team that collides with reality, because the person who understands the standard wrote the procedures and signs the verification records.

ASC runs the audit as the independent party, with the duration for each standard set out in the questions below. Findings go to management at a closing meeting on the last day, and the full written report follows within two weeks. A programme that has raised nothing but observations since the last certification audit tells the next auditor more about the programme than the site. This is covered in depth on the internal food safety audits page.

A readiness audit is a rehearsal conducted under audit conditions. Records are sampled at random from dates ASC selects, a batch is followed from receiving to despatch, operators are asked to explain the controls they own, and evidence retrieval is timed against the patience an auditor has.

The output is a readiness picture rather than a pass mark, with findings ranked so that anything likely to become a major nonconformance is dealt with first. Where the system will not hold under audit conditions we say so, and the site can decide whether to move the booked date rather than pay to be told the same thing by the certification body.

A response that reads retrained the operator closes almost nothing, because it locates the cause in a person, not in the system that allowed the failure. If the same finding could happen next month with a different operator, the root cause has not been found: the real question is why the form permitted a week of signatures in one sitting, and why verification never compared it against the production plan.

ASC works each finding through four recorded steps: the correction that deals with the product or record, the root cause established by investigation, the corrective action that stops the cause recurring, and the verification weeks later that checks whether it worked. Only the last closes anything, and closure follows evidence: a promise to update a document closes nothing until it is on file, issued under document control and verified in use.

Severity is a mechanism rather than a table. A minor is a single lapse in a control that otherwise exists and is generally followed. A major is a failure of the control itself, where the procedure does not exist, or nobody follows it, or the site cannot demonstrate that a hazard was controlled, or a legal requirement or critical control point is touched, and a cluster of minors against one clause is often graded upwards. The internal audit programme, the corrective action process and management review are what certification bodies most often find lapsed, and ASC rebuilds those three first.

ASC audits against the systems South African food businesses are actually asked to hold, and each has its own page here explaining how ASC implements it: FSSC 22000, ISO 22000:2018, BRCGS, GLOBALG.A.P., HACCP and GMP and SIZA. ASC can also audit against IFS Food and SQF where a customer specifies them.

The differences change how an audit is run, not how rigorous it is. ISO 22000:2018 asks whether the organisation planned, operated, verified and improved, so the audit spends real time on objectives, verification and management review. FSSC 22000 adds the prerequisite programme specifications and its own additional requirements. BRCGS is prescriptive and weighted towards the factory environment, product control and record discipline, which an auditor who has not worked a factory floor misses. GLOBALG.A.P. IFA is audited against control points and compliance criteria on the farm and in the packhouse, with producer groups carrying internal inspections on top of the producer self assessment. SIZA rests on contracts, wage records, working hours, housing and worker interviews.

Scope is set first and set honestly: which standard and sections, which sites, shifts and product streams, and which processes are seasonal. Auditing one shift proves nothing about the other two, and practice drifts at night because supervision is thinner and the person doing the pre operational hygiene check wants to go home.

The audit trail is what separates a real audit from a document review. Take a finished batch chosen from the despatch records, not one offered by the site, and work backwards through the release decision, the foreign body control records, the process records at each control point, the raw material lot numbers and the supplier approval file. Then work forwards into complaints, traceability and mass balance.

Remote sessions have a place, and ASC applies the approach IAF MD 4 sets for accredited certification bodies on the use of information and communication technology in audits, treating them as a planned technique rather than a substitute for being there. A screen verifies document control, training files, calibration, management review minutes and a live traceability exercise. It cannot verify dust on an overhead beam, condensation above open product, a perished door seal or pest evidence in a void, so ASC keeps the plant and the observation of practice on site.