Your internal audit year: four dates, what to cover, who can audit what

At a glance

• An internal audit is you checking your own system before someone else does. Its job is to find things, so a report with no findings is a warning sign, not a success.

• Spread audits through the year. BRCGS Food Safety Issue 9 expects at least four separate audit dates, with every part of the system covered at least once a year.

• Audit the riskier and the weaker areas more often. That is the whole method.

• Nobody audits their own work. On a small site that takes planning, not more staff.

• Monthly walk-round inspections of hygiene and building condition are a separate job from audits. You need both.

This guide is for the quality lead at a small food, drink or supplement site who has to plan the year’s internal audits and get them done alongside everything else.

1. List what has to be covered

Start with a plain list of everything your system does. For most small sites it looks like this:

• the HACCP plan, and whether the floor matches it

• supplier approval and goods-in

• cleaning, pest control, maintenance, glass and foreign-body controls

• allergens and labelling

• process checks, weights and calibration

• traceability, complaints, corrective actions, recall

• training, hygiene rules and protective clothing

• document control and records

• food defence and food fraud plans

• storage and dispatch

Every line needs an audit at least once in the year.

2. Decide how often, by risk

For each line ask two questions: how bad is it if this goes wrong, and how did it do last time? Anything that scores high on either gets audited more than once. Allergen control at a site handling several allergens might be looked at every quarter. Document control at a steady site might be once a year.

Write the reasoning down in a sentence per line. An auditor will ask why the plan looks the way it does, and “we looked at risk and last year’s results” with the notes to show it is the answer they want.

3. Put it on a calendar

Split the list across at least four dates through the year. Avoid one audit week in the month before your certification audit: it shows, and it leaves no time to fix anything.

A simple pattern for a small site is one or two topics a month, each taking an hour or two, with the higher-risk topics repeated. Give each audit a clear scope, such as “allergen changeover on line 2” or “supplier approval for packaging”, so it is a real look at one thing.

4. Who audits what

Two rules:

• The auditor is trained. A short course or in-house training, with a record, plus knowing the process they are looking at.

• The auditor isn’t checking their own work.

On a site with one quality person, that second rule needs a plan. Options that work:

• Train two or three people from production, engineering or the office, and have them audit each other’s areas.

• Have the quality lead audit everything except the quality system itself, and have a trained manager, a sister site or an outside consultant audit that.

• Swap with another small producer you trust.

What matters is that the person signing the audit didn’t do the work being audited.

5. Doing the audit

• Look at what happens, not only at paperwork. Watch the job, ask the person doing it to talk you through it, then compare with the procedure and the records.

• Follow one real example through. Pick one delivery, one batch, one complaint, and trace it end to end.

• Write down what was right as well as what was wrong, with the evidence: which record, which date, which line.

• Tell the person responsible for the area what you found before you leave it.

6. After the audit

Each finding needs an action, an owner and a date. Then someone checks the action was done and that it worked. That last step is the one most often skipped, and the one auditors look for.

Findings follow the same route as any other problem on site: fix it now, find the cause, stop it coming back. Take a summary of the year’s audits to your management review.

7. The monthly walk-round is separate

Alongside audits, keep a programme of inspections of the factory itself:

• Hygiene: is cleaning working, is housekeeping kept up?

• Building and equipment: doors, walls, floors, drains, lights, damaged equipment, anything that could end up in the product.

Set the frequency by risk, and no less than monthly where product is open. Record what was found, who will fix it and by when, and check it was done.

Checklist for the year

• A list of everything in the system

• A frequency for each, with one line of reasoning

• A calendar with at least four audit dates spread across the year

• Trained auditors, each with areas they can audit independently

• A report for each audit: scope, evidence, what was right, what wasn’t

• Actions with owners and dates, checked when done

• Monthly hygiene and building inspections, recorded

• A summary taken to management review

Common mistakes

• All the audits in one fortnight. It isn’t a programme.

• Checklists ticked “yes” all the way down. No evidence, no findings.

• The quality manager auditing the quality system.

• Actions raised and never closed, or closed without checking they worked.

• Auditing documents and never the floor.

• Inspections counted as audits, or the other way round.

Where this sits in the standards

BRCGS Food Safety Issue 9 covers internal audits and inspections in 3.4, which it treats as a fundamental requirement, and corrective actions in 3.7. Other standards ask for the same job in their own words and may set different minimums.

Sources (checked 10 November 2026)

• BRCGS Global Standard Food Safety, Issue 9 (our own reading; no text reproduced). The standard itself is available from BRCGS: brcgs.com

The planning method, staffing options and lists are general guidance based on common practice.

QAaval helps quality teams keep these records on the shop floor.