Internal Auditing Procedure

Plan complete, risk-based audit coverage

Technical or quality management maintains a documented internal audit programme covering all elements of the FSQMS. Audit timings are distributed across at least four days during the year, and all relevant activities, processes and system elements are audited at least once every twelve months.

The programme remains risk-based by taking account of previous audit outcomes, operational changes, incident trends, customer or regulatory requirements and the perceived risk associated with loss of control of the activity. A documented schedule then sets planned dates and defined scopes, identifies the areas, processes or system elements to be audited and assigns auditors with independence maintained. The programme and schedule are kept under review as site operations and audit coverage change.

Protect auditor competence and independence

Responsibility is allocated across the functions that make the audit programme work. Senior management provides sufficient resources, supports transparent and accurate participation and reviews audit outcomes to ensure effective actions are implemented.

Technical or quality management develops and oversees the programme and schedule, assigns competent auditors, maintains auditor independence, reviews reports, monitors corrective actions and verifies closure. Internal auditors prepare and conduct assigned audits, gather objective evidence, document findings and communicate them to relevant personnel. Department managers or functional leads provide access to facilities, equipment, documents and records and implement corrective actions arising from findings.

Personnel involved in internal auditing receive role-appropriate training in audit techniques and principles, the FSQMS, HACCP and prerequisite programme expectations, objective-evidence gathering and evaluation, and corrective-action processes. Training is documented and reviewed for ongoing effectiveness.

Gather objective evidence against defined criteria

Audit preparation includes review of relevant FSQMS documents, previous findings and corrective actions, together with the checklists or other supporting materials needed for the planned audit. Interviews, record reviews and observational activities are planned before the audit is carried out.

The procedure requires auditors to examine practices, behaviours, facilities and equipment, interview personnel, review monitoring, verification and operational records, and evaluate compliance with FSQMS procedures, prerequisite programmes and HACCP-based controls. Audit activity is required to be objective, evidence-based and aligned with the audit plan.

Report findings and verify corrective action

Audit findings record the date and auditor, the area, activity or process audited, the applicable criteria, conformances or good practices, non-conformances supported by objective evidence and required corrective actions. Objective evidence of all findings is retained to substantiate the audit conclusions, and findings are communicated to relevant personnel and reviewed by technical or quality management.

Non-conformances identified through internal audit are recorded, managed and investigated through the Corrective & Preventive Action Procedure. Department managers or functional leads implement corrective actions within agreed timescales, identify root causes where applicable and provide evidence of completion. Technical or quality management reviews the adequacy of those actions, verifies effective closure and escalates unresolved or recurring issues to senior management.

Extend verification through scheduled inspections

The procedure also establishes a documented programme of scheduled inspections for the factory environment and processing equipment. Hygiene inspections assess cleaning performance, housekeeping standards and hygiene-related practices, while fabrication inspections examine buildings, structures, surfaces, drains, ceilings and processing equipment for conditions that could present contamination risk.

Inspection frequency is determined by risk and by changes that may influence product safety, legality, authenticity or quality, with open product areas inspected no less than once per month. Competent personnel carry out the inspections so that existing issues, emerging risks and conditions affecting the manufacturing environment or equipment integrity can be identified.

Inspection outcomes are recorded and communicated to the responsible personnel, including the issues observed, their potential impact and any immediate or longer-term actions required. Urgent risks are escalated to technical or quality management. Corrective actions are agreed with the responsible area, given timescales appropriate to risk and reviewed by technical or quality management to confirm that they have been carried out and are effective.

Bring audit and inspection evidence into management review

Results from internal audits and scheduled inspections are summarised and analysed for trends, risks and systemic issues. Through management review, that information is used to assess the ongoing suitability and effectiveness of the FSQMS and to inform improvements to processes, procedures, training and resource allocation.

Scheduled-inspection results also support maintenance planning, environmental-control review and hygiene-related improvement. Together with internal-audit findings and corrective-action follow-up, they provide senior management with structured evidence of where controls are working and where further action is required.

Connect auditing with controlled information and corrective action

The procedure interfaces directly with document control, record completion and maintenance, and corrective and preventive action. Audit templates, checklists, reports and schedules remain subject to the Document Control Procedure, while the completion, maintenance, retention and protection of audit records are governed through the Record Completion & Maintenance Procedure.

Within the wider FSQMS, these interfaces keep audit criteria, objective evidence, corrective action and management review connected without transferring the detailed controls of those supporting procedures into the Internal Auditing Procedure itself.