Internal Audits
Aligned with FSSC 22000 – ISO 22000:2018 Clause 9.2: Internal Audit
Also Relevant: ISO/TS 22002-1:2009 – Clause 18: Verification of PRPs
Requirement Overview
FSSC 22000 requires organizations to plan, implement, and maintain an internal audit program to verify that the food safety management system (FSMS) conforms to planned arrangements, the requirements of the standard, and any additional regulatory or customer requirements.
Key Standard Reference:
•ISO 22000:2018 Clause 9.2.2 – The audit program must consider the status and importance of processes, previous audit results, and risk-based thinking.
•ISO 22000:2018 Clause 9.2.3 – Internal audits must be conducted by personnel independent of the process being audited.
•ISO/TS 22002-1 Clause 18 – PRPs must be verified to ensure ongoing effectiveness.
Internal audits are critical for identifying nonconformities, driving continual improvement, and ensuring readiness for certification audits.
Key Compliance Objectives
Step-by-Step Compliance Implementation
1. Develop a Risk-Based Internal Audit Program
-
Program Elements:
-
• An annual audit schedule covering the entire FSMS and prerequisite programs (PRPs)
• Frequency based on risk, past performance, and regulatory requirements
• Assignment of competent, independent auditors
Evidence to Maintain:
-
• Annual internal audit plan/calendar
• Risk assessment to justify audit frequency
• Auditor competence records (training, qualifications)
- • An annual audit schedule covering the entire FSMS and prerequisite programs (PRPs) • Frequency based on risk, past performance, and regulatory requirements • Assignment of competent, independent auditors
- • Annual internal audit plan/calendar • Risk assessment to justify audit frequency • Auditor competence records (training, qualifications)
2. Conduct Internal Audits Objectively and Thoroughly
-
Execution Requirements:
-
• Use approved, process-specific checklists and audit tools
• Review documents, interview staff, and observe activities
• Focus on verifying actual implementation, not just documented intent
• Maintain impartiality by separating auditing from operational responsibilities
Evidence to Maintain:
-
• Completed audit checklists and field notes
• Photos or other supporting evidence
• Signed auditor attendance and training records
- • Use approved, process-specific checklists and audit tools • Review documents, interview staff, and observe activities • Focus on verifying actual implementation, not just documented intent • Maintain impartiality by separating auditing from operational responsibilities
- • Completed audit checklists and field notes • Photos or other supporting evidence • Signed auditor attendance and training records
3. Report Audit Findings and Classify Nonconformities
-
Classification Guidance:
-
• Minor – Isolated issue with minimal risk to food safety
• Major – Significant deviation from FSMS requirements (e.g., control charts)
• Critical – High risk to food safety or legal compliance
Evidence to Maintain:
-
• Audit reports with clear evidence and classification
• Findings logged in an audit tracking register
• Formal notification to responsible process owners
- • Minor – Isolated issue with minimal risk to food safety • Major – Significant deviation from FSMS requirements (e.g., control charts) • Critical – High risk to food safety or legal compliance
- • Audit reports with clear evidence and classification • Findings logged in an audit tracking register • Formal notification to responsible process owners
4. Implement Corrective and Preventive Actions (CAPA)
-
CAPA Process Steps:
-
• Perform root cause analysis (RCA) for each nonconformity
• Develop and assign corrective action plans with deadlines
• Verify implementation and effectiveness of actions taken
Evidence to Maintain:
-
• CAPA forms with documented RCA
• Action completion verification records
• Updated SOPs, training logs, or control records
- • Perform root cause analysis (RCA) for each nonconformity • Develop and assign corrective action plans with deadlines • Verify implementation and effectiveness of actions taken
- • CAPA forms with documented RCA • Action completion verification records • Updated SOPs, training logs, or control records
5. Review Audit Results and Monitor Trends
-
Trend Review Activities:
-
• Analyze frequency and types of nonconformities
• Identify recurring or systemic issues
• Adjust audit scope and frequency based on results
Evidence to Maintain:
-
• Quarterly or annual trend summaries
• Management review records reflecting audit data
• Updated FSMS documents incorporating improvements
- • Analyze frequency and types of nonconformities • Identify recurring or systemic issues • Adjust audit scope and frequency based on results
- • Quarterly or annual trend summaries • Management review records reflecting audit data • Updated FSMS documents incorporating improvements
Common Audit Findings & Recommended Fixes
| Audit Finding | Recommended Action |
|---|---|
| Missing or incomplete audit program | Develop and document an annual audit plan with defined scope & risk |
| Repeat nonconformities in the same area | Strengthen RCA process and verify CAPA effectiveness |
| Lack of audit evidence | Retain all checklists, notes, and supporting records |
| No follow-up on corrective actions | Track CAPA status and verify closure before marking complete |