Internal Audits
Aligned with FSSC 22000 – Internal Audit Requirements
Requirement Overview
FSSC 22000 requires organizations to establish and maintain an internal audit program to verify that the food safety management system (FSMS) is effectively implemented, maintained, and continually improved. The audit process must be systematic, risk-based, and objective, ensuring compliance with organizational policies, regulatory obligations, and customer expectations.
Internal audits are critical for identifying nonconformities, driving corrective actions, and maintaining certification readiness.
Key Compliance Objectives
-
✓ Verify implementation and effectiveness of the FSMS
✓ Identify nonconformities and areas for improvement
✓ Document corrective actions and ensure follow-up
✓ Maintain ongoing certification and regulatory compliance
Step-by-Step Compliance Implementation
1. Develop a Risk-Based Internal Audit Program
-
Program Elements:
-
• An annual audit schedule covering the entire FSMS and prerequisite programs (PRPs)
• Frequency based on risk, past performance, and regulatory requirements
• Assignment of competent, independent auditors
Evidence to Maintain:
-
• Annual internal audit plan/calendar
• Risk assessment to justify audit frequency
• Auditor competence records (training, qualifications)
- • An annual audit schedule covering the entire FSMS and prerequisite programs (PRPs) • Frequency based on risk, past performance, and regulatory requirements • Assignment of competent, independent auditors
- • Annual internal audit plan/calendar • Risk assessment to justify audit frequency • Auditor competence records (training, qualifications)
2. Conduct Internal Audits Objectively and Thoroughly
-
Execution Requirements:
-
• Use approved, process-specific checklists and audit tools
• Review documents, interview staff, and observe activities
• Focus on verifying actual implementation, not just documented intent
• Maintain impartiality by separating auditing from operational responsibilities
Evidence to Maintain:
-
• Completed audit checklists and field notes
• Photos or other supporting evidence
• Signed auditor attendance and training records
- • Use approved, process-specific checklists and audit tools • Review documents, interview staff, and observe activities • Focus on verifying actual implementation, not just documented intent • Maintain impartiality by separating auditing from operational responsibilities
- • Completed audit checklists and field notes • Photos or other supporting evidence • Signed auditor attendance and training records
3. Report Audit Findings and Classify Nonconformities
-
Classification Guidance:
-
• Minor – Isolated issue with minimal risk to food safety
• Major – Significant deviation from FSMS requirements (e.g., control charts)
• Critical – High risk to food safety or legal compliance
Evidence to Maintain:
-
• Audit reports with clear evidence and classification
• Findings logged in an audit tracking register
• Formal notification to responsible process owners
- • Minor – Isolated issue with minimal risk to food safety • Major – Significant deviation from FSMS requirements (e.g., control charts) • Critical – High risk to food safety or legal compliance
- • Audit reports with clear evidence and classification • Findings logged in an audit tracking register • Formal notification to responsible process owners
4. Implement Corrective and Preventive Actions (CAPA)
-
CAPA Process Steps:
-
• Perform root cause analysis (RCA) for each nonconformity
• Develop and assign corrective action plans with deadlines
• Verify implementation and effectiveness of actions taken
Evidence to Maintain:
-
• CAPA forms with documented RCA
• Action completion verification records
• Updated SOPs, training logs, or control records
- • Perform root cause analysis (RCA) for each nonconformity • Develop and assign corrective action plans with deadlines • Verify implementation and effectiveness of actions taken
- • CAPA forms with documented RCA • Action completion verification records • Updated SOPs, training logs, or control records
5. Review Audit Results and Monitor Trends
-
Trend Review Activities:
-
• Analyze frequency and types of nonconformities
• Identify recurring or systemic issues
• Adjust audit scope and frequency based on results
Evidence to Maintain:
-
• Quarterly or annual trend summaries
• Management review records reflecting audit data
• Updated FSMS documents incorporating improvements
- • Analyze frequency and types of nonconformities • Identify recurring or systemic issues • Adjust audit scope and frequency based on results
- • Quarterly or annual trend summaries • Management review records reflecting audit data • Updated FSMS documents incorporating improvements
Common Audit Findings & Recommended Fixes
| Audit Finding | Recommended Action |
|---|---|
| Missing or incomplete audit program | Develop and document an annual audit plan with defined scope & risk |
| Repeat nonconformities in the same area | Strengthen RCA process and verify CAPA effectiveness |
| Lack of audit evidence | Retain all checklists, notes, and supporting records |
| No follow-up on corrective actions | Track CAPA status and verify closure before marking complete |
