By Mthokozisi Nkosi, ASC Food Safety Training. Reviewed 21 September 2026.
Short answer: build a weekly routine so the site is always ready. Two of the four kinds of auditor who visit a South African food site can arrive without an appointment, so a site that needs a fortnight of overtime to get ready will fail the visits that matter most. Staying ready takes about an hour a week from the person who owns each area: one walk in the auditor’s order, and ten records put through five tests.
Who audits a South African food site, and which audits are unannounced?
| Who | Against what | Warning |
|---|---|---|
| Certification body auditor | Your scheme, for example FSSC 22000 or BRCGS Food Issue 9 | Announced, except that FSSC 22000 Version 6 and BRCGS Food Issue 9 both require at least one unannounced audit in every three years |
| Customer or retailer technologist | Their specification and code of practice | Usually announced, sometimes a day or two |
| Environmental health practitioner | Regulation R638 of 2018 under the Foodstuffs, Cosmetics and Disinfectants Act | None required |
| Your own internal auditor | Your procedures, under ISO 22000:2018 clause 9.2 or your scheme’s equivalent | Planned and sent in advance |
Every site knows the fortnight before the certification audit. Overtime on cleaning, fresh paint, a QC locked in an office with a pile of records. The certificate gets renewed, and everybody on the floor learns that the standard is something you do for visitors. Wet paint, contractors and dismantled equipment in the days before an audit create findings of their own.
What is the difference between a food safety inspection and an audit?
An inspection looks at condition: the state of the area, the equipment and the product today. An internal audit looks at the system: whether a procedure is implemented as documented and is effective. The routine in this article is an inspection routine. It keeps the site ready for both.
| Inspection | Internal audit | |
|---|---|---|
| Looks at | Condition of the area, equipment and product today | Whether the system is implemented as documented and is effective |
| How often | Risk based, at least monthly in open product areas | A programme spread over at least four dates in the year |
| BRCGS Food Issue 9 clause | 3.4.4 | 3.4.1 |
Audit readiness checklist for a food factory: the area walk
- Start outside. Perimeter, waste area, bait stations, doors that do not seal. Auditors form a view before they reach reception.
- Follow the product from receiving to dispatch. That is the route a trace takes and the route a good auditor walks.
- At every zone change, stop and look up. Overheads, condensate, flaking paint, light covers, cable trays.
- Then look under and behind. The underside of conveyors, inside guards, table legs, the back of the hand wash station.
- Open what is closed. Open cupboards, lockers, the supervisor’s desk drawer and the cabinet nobody owns.
- Finish where records are kept at the line and read today’s sheet while you are standing there.
The first ten minutes usually turn up physical things. Tape and cable ties holding equipment together. String. Cardboard under a table leg. A personal cup in production. Unlabelled spray bottles. A scoop with a cracked handle. Anybody who looks can find these.
Audit readiness checklist: five tests every record must pass
| Test | What it means | What failure looks like |
|---|---|---|
| Complete | Every field filled. If a check did not apply, the sheet says so and says why | Blanks. A blank is not a zero and it is not a pass |
| On time | Entered when the check was done, where it was done | One pen, evenly spaced times, identical readings, no smudges. That sheet was written from memory at the end of the shift |
| Legible and permanent | Ink. A mistake gets a single line through it, the right value, initials and the date | Pencil, correction fluid, overwritten numbers |
| Acted on | An out of limit result has a deviation and an action beside it | A number outside the limit with nothing written next to it. This is where a minor becomes a major |
| Verified | Signed by the named verifier, in time, by somebody who read it | A verifier’s signature on a sheet that has an out of limit result nobody reacted to |
Pull ten sheets, spread across shifts, weeks and products. Ten spread out tells you more than thirty consecutive ones from day shift, because night and weekend shifts get the least supervision.
A worked example. A QC pulls ten wash water sheets from a salad line, limit 50 to 150 ppm free chlorine, checked hourly. Seven are fine. One night shift sheet reads exactly 100 ppm every hour in the same pen. One afternoon sheet shows 30 ppm at 15h00 with nothing beside it, verified and signed the next day. One has a reading changed with correction fluid. Three failures on three different tests, and the most serious is the verifier’s signature, because verification is the control that was supposed to catch the other two.
What do you do with a gap you find?
Report it. Do not fill it in. Raise a deviation dated today: what is missing, what you did to confirm the product was safe, and what changes so it does not happen again. Use anything independent to establish product safety, such as a data logger, the readings on either side of the gap, the dispatch temperature check, complaints and returns against that batch.
An auditor who finds a gap with a dated deviation next to it sees a system that works. A suspiciously perfect sheet makes the auditor dig. A missing record is a minor or a major with a corrective action. A record created or altered to get through an audit is fraud.
Can you find it in four hours?
If you cannot find a record during the audit, the auditor treats it as missing. Test retrieval like anything else. Pick a finished product from last month and pull everything behind it: receiving, batch sheet, monitoring, cleaning, release, dispatch. BRCGS Food Issue 9 clause 3.9.3 expects a full traceability test to be achievable within four hours, and it is a good discipline whether or not you are certified to that standard. Pay attention to why it was slow. Records in a locked office with one key holder pass the test on paper and fail it on the day that person is on leave.
How do you brief staff before an audit?
People on the floor are nervous of auditors because nobody has told them what to expect. Ten minutes at a shift start fixes most of it:
- The auditor may speak to anybody.
- Describe what you do, and show it.
- Answer what was asked, then stop.
- I do not know, ask my supervisor is an acceptable answer. A confident wrong answer becomes a training finding.
If you are escorting, keep your own notes of what the auditor sampled: which records, by date, and who was interviewed. When the report arrives two weeks later saying three of ten records were missing, your notes tell you which ten, and whether the three were missing or were in the other file.
How to challenge a finding
The edition changed in May 2026. See what changed in ISO 19011:2026. ISO 19011:2026 clause 6.4.8 expects the auditor to review each nonconformity with you so the evidence is agreed to be accurate. That review is your moment, and there are three honest grounds:
- The evidence is wrong. The record exists, and here it is. Bring it before the closing meeting.
- The criterion is wrong. The clause does not require what the finding says. Ask to read it together.
- The grade is wrong. The grading rules, read out loud, give a minor and not a major.
The last auditor never raised it is not a ground. Nor is it has always been done this way.
Learn to do this on your own site, in about 9 hours
Food Safety Inspections and Audit Readiness for QCs and HACCP Teams is our online course for the people who do the inspections and sit in the audits. 27 lessons, two tools that export to Excel, a workshop on your own site or our case study, and an assignment marked automatically against published criteria. R1,699 per delegate.
Frequently asked questions
How do I prepare for a food safety audit?
Build a weekly routine of one area walk and ten records tested. Walk the area in the order an auditor does: outside first, then follow the product from receiving to dispatch, looking up at every zone change and under and behind equipment. Then sample ten records spread across shifts and weeks and test each for five things: complete, on time, legible and permanent, acted on, and verified. Fix what you find through your normal deviation and corrective action process. Do this weekly and there is nothing special to do before the audit.
Can a food safety audit be unannounced in South Africa?
Yes. FSSC 22000 Version 6 and BRCGS Food Issue 9 both require at least one unannounced audit in every three years. An environmental health practitioner enforcing Regulation R638 of 2018 does not need an appointment at all. Retailer and customer visits are usually announced, sometimes with only a day or two of notice.
What do auditors look for first?
Physical condition first, then documents. Tape, string and cable ties holding equipment together, cardboard under a table leg, unlabelled spray bottles, a personal cup in production, damaged utensils, and a cleaning sheet signed for a task that visibly did not happen. They form a view outside the building, before they reach reception.
What should I do if I find a missing record before an audit?
Raise a deviation dated today. Say what is missing, confirm from independent data whether the product was safe, for example a data logger, the readings either side of the gap and the dispatch check, and record what changes so it does not recur. Never fill the record in afterwards. A missing record is a finding with a corrective action. A falsified record is fraud and puts the certificate at risk.
How should staff answer an auditor’s questions?
Answer the question that was asked and then stop. Do not guess. It is acceptable to say you do not know and to name the supervisor who does. Put the record in front of the auditor. Do the job the way it is done every day. Do not hand out model answers, because three operators giving the same rehearsed sentence tells the auditor they were coached.
Can I challenge an audit finding?
Yes, on three grounds: the evidence is wrong and you can produce the record, the criterion does not require what the finding says, or the grade does not match the written grading rules. Raise it before the closing meeting. If the disagreement survives, it is recorded in the report, and certification bodies have a formal appeals process.
What goes on an audit readiness checklist for a food factory?
Six area checks and five record checks. Area: outside and perimeter, the product route from receiving to dispatch, overheads at every zone change, under and behind equipment, closed cupboards and lockers, and the records kept at the line. Records: complete, on time, legible and permanent, acted on, and verified. Add a timed retrieval test of every record behind one finished product.
What is the difference between an inspection and an internal audit?
An inspection looks at condition: the state of the area, equipment and product today. An internal audit looks at the system: whether a procedure is implemented as documented and is effective. BRCGS Food Issue 9 requires both, documented inspections under clause 3.4.4, at least monthly in open product areas, and an internal audit programme under clause 3.4.1.
Sources
- ISO 19011:2026 Guidelines for auditing management systems, clauses 6.4.7 and 6.4.8.
- BRCGS Global Standard Food Safety Issue 9, clauses 3.4.1, 3.4.4 and 3.9.3.
- FSSC 22000 Version 6 scheme requirements for unannounced audits. FSSC, Version 7 key changes and transition dates.
- Regulation R638 of 22 June 2018 under the Foodstuffs, Cosmetics and Disinfectants Act, 1972 (Act 54 of 1972). ISO 22000:2018 clause 9.2.
- The worked example is a training scenario from the FS50 course, built from real audit patterns. It is not a real company.