Home / Courses / Internal and supplier auditing
Internal audit Β· Supplier audit Β· ISO 19011:2026Online Internal & Supplier Auditing Practices Based on Your FSMS
Audit your own site, and the suppliers whose mistakes end up in your product, the way FSSC 22000, BRCGS and ISO 22000 expect. Plan against risk, collect evidence that holds up, write findings people act on, and close them out.
- Requirement
- Product on hold is identified and kept apart from released stock (site procedure for non-conforming product).
- Evidence
- Two pallets in the hold cage had no hold tag. The hold register had no entry for lot 2409-17.
- Statement
- Held product is not always identified, so it could be released by mistake.
- Grade
- MinorOwner: stores supervisor Β· Due: 14 days
Four different jobs that sites call “auditing”
Most weak audit programmes come from mixing these up. A daily walk-round is not an internal audit, and an internal audit is not a long inspection. Each job has a different owner, a different yardstick and a different record.
Monitoring
- Who
- The operator or QC on the line
- How often
- Every batch, shift or set interval
- Checks against
- A critical or operating limit
- Leaves behind
- A monitoring record, such as a CCP log
Inspection
- Who
- QC or the area supervisor
- How often
- Scheduled: pre-op, receiving, GMP walks
- Checks against
- A checklist of conditions that should be in place
- Leaves behind
- A checklist, with anything wrong corrected on the spot
Verification
- Who
- QA or the HACCP team
- How often
- Periodic, set in the verification plan
- Checks against
- Whether a control does what it was designed to do
- Leaves behind
- Record reviews, calibration checks, test results
Audit
- Who
- A trained auditor who is not auditing their own work
- How often
- Planned in a risk-based audit programme
- Checks against
- The standard, the law and your own procedures
- Leaves behind
- An audit report with findings, owners and dates
The Food Safety Inspections and Audit Readiness course starts exactly here, then builds up to one internal audit done properly.
Eight steps from programme to closed finding
ISO 19011:2026 is the guidance every GFSI scheme leans on for how audits are managed and carried out. This is the order the courses teach it in.
Build the programme
Decide what gets audited and how often, based on risk, past findings, complaints and changes on site.
Plan the audit
Set the objective, scope and criteria, pick an auditor who is independent of the area, and agree the date.
Prepare the checklist
Turn the criteria into questions two auditors would answer the same way, with the evidence you expect to see.
Open the audit
A short opening meeting: scope, timing, who you need to speak to, and how findings will be graded.
Collect evidence
Observe the work, interview the people doing it, and sample records. Follow one product or batch through the system.
Write the findings
Requirement, evidence and statement for each one, graded consistently, so the auditee can act on it without asking what you meant.
Close and report
Agree the findings at the closing meeting, then issue the report to the managers who own the actions.
Follow up
Root cause, correction and corrective action, then check the fix worked before the finding is closed.
What you find feeds the next programme: areas with repeat findings get audited sooner.
Internal audits look inward. Supplier audits look up the chain.
Both are required by FSSC 22000, BRCGS and ISO 22000, and both use the same method. What changes is where you stand and what you are allowed to ask for.
Internal audit
| Looks at | Your own FSMS: prerequisite programmes, the HACCP plan, records, training and management review |
|---|---|
| Criteria | The scheme you are certified to, the law, and your own procedures |
| Evidence | What you see on the floor, what people tell you, and what the records show |
| Output | Findings with owners and dates, and a report that feeds management review |
Supplier audit
| Looks at | A raw material, ingredient, packaging or service provider whose failure could reach your product |
|---|---|
| Criteria | Your specification, the contract, their certification and the law |
| Evidence | Their site, their records, their certificates and their test results |
| Output | An approval decision: approved, approved with conditions, or not approved |
Audit the supplier
On-site or remote audit, repeated on a set frequency. Typical for high-risk raw materials, allergens and direct food-contact packaging.
Questionnaire and evidence
A self-assessment questionnaire checked against certificates, specifications and test results, with an audit if the answers raise doubt.
Certificate and specification
A valid GFSI certificate and an agreed specification, reviewed at approval and whenever either changes.
An example of how many sites tier suppliers. Your own supplier approval procedure sets the criteria and frequencies.
A finding someone can act on has three parts
Most audit reports fail at the finding. If the person who owns the problem cannot tell what was wrong, where you saw it and which requirement it breaks, nothing gets fixed.
Cleaning records not up to date. Improve.
- RequirementThe cleaning schedule for Line 2 requires the filler to be cleaned and signed off after every allergen run.
- EvidenceProduction records show three sesame runs in week 36. The cleaning record has sign-off for one of them.
- StatementThere is no evidence that the filler was cleaned after two allergen runs.
- Grade and ownerMajor. Hygiene supervisor, correction within 24 hours, root cause and corrective action within 14 days.
Write yours in the free Findings Writer.
Three online auditing courses
Start with inspections and one audit done properly, then take on the audit programme and your suppliers. The ISO 9001 course is for sites that also run a quality management system. Prices are in rand, with an indicative US dollar, euro and pound figure under each.
Food Safety Inspections and Audit Readiness for QCs and HACCP Teams
For QCs, HACCP team members and supervisors who have never been shown how to inspect or audit.
- Monitoring, inspection, verification and audit told apart
- A checklist that finds problems, and evidence that lasts
- Pre-op, receiving, in-process and line-clearance inspections
- Findings, root cause and making the fix stick
- One internal audit to ISO 19011:2026, and how to be audited
R1 699Workshop audit on your own site
View the course
Internal and Supplier Auditing Practices Based on FSMS
For QA managers, internal auditors on the programme and supplier approval staff.
- The standards and what they require of an FSMS audit
- Audit requirements for food safety management systems
- The audit process, from plan to closing meeting
- Reporting and following up corrective action
- Auditing raw material, packaging and service suppliers
R3 650Self-paced
View the course
ISO 9001:2026 Internal Auditor
For quality staff auditing a quality management system, including food businesses certified to ISO 9001.
- The internal auditor, the requirement and the principles
- Auditing ISO 9001:2026 clause by clause
- The audit programme under clause 9.2.2
- Planning, conducting and reporting the audit
- A workbench case study: Mzansi Fresh Meals
R4 670 R3 850Limited period special, self-paced
Auditing bundle: Audit Readiness plus Internal and Supplier Auditing for R4 159 instead of R5 349, a saving of R1 190.
View the bundle| Your job | Start with | Why |
|---|---|---|
| QC or HACCP team member, new to auditing | Audit Readiness | Learn to inspect and to run one audit properly before you are put on the programme. |
| Internal auditor on the site programme | Internal and Supplier Auditing | Programme, planning, evidence and follow-up at the depth a certification audit will test. |
| Supplier approval or procurement | Internal and Supplier Auditing | How to judge a supplier’s site, records and certificates, and make an approval decision you can defend. |
| QA or technical manager | The bundle | You train the auditors and own the programme, so you need both levels. |
| Quality staff at an ISO 9001 site | ISO 9001:2026 Internal Auditor | Clause by clause for a quality management system, with its own case study. |
Two audit tools you can use today
Built for our ISO 9001 internal auditor course. The method is the same for a food safety audit.
Audit Plan and Checklist Builder
Set the objective, scope and criteria, pick an independent auditor, and build the checklist to go with it.
Open the builderFindings Writer and Audit Report
Write each finding as requirement, evidence and statement, grade it, and give it an owner and a date.
Open the writerAuditing guides
ISO 19011:2026 and your food safety internal audits
What changed in the fourth edition, and what to update in your audit procedure.
How to prepare for a food safety audit in South Africa
Getting ready for a certification audit without the two-week panic.
Human error is not a root cause
How to investigate people failures so the corrective action works.
Internal and supplier auditing for an FSMS
A longer look at the audit cycle and supplier approval.
Auditing training FAQ
Internal and Supplier Auditing Practices
What is the difference between an internal audit and a supplier audit?
An internal audit assesses your own food safety management system (your procedures, prerequisite programmes, HACCP plan and records) to confirm they are implemented and effective. A supplier audit assesses an external provider of raw materials, ingredients, packaging or services against your food safety and approval criteria. Both use the same core auditing skills of planning, evidence gathering and reporting, and this course covers both.
Do I need to be an experienced auditor to take this course?
No. The course is designed to build practical auditing competence from the ground up, making it suitable for newly appointed internal auditors and QA/QC staff, as well as those wanting to strengthen an existing approach. It walks you through the full audit cycle step by step so you can apply the method to your own site.
Is internal auditing actually required by FSSC 22000, BRCGS and ISO 22000?
Yes. All GFSI-benchmarked schemes require a planned internal audit programme carried out by competent, impartial auditors to verify that the FSMS conforms to requirements and is effectively implemented. They also require suppliers to be assessed and approved on a risk basis. Demonstrating auditor competence is part of meeting these requirements.
How is the course delivered and how long does it take?
The courses are fully online and self-paced, so you can work through them around your shifts. Internal and Supplier Auditing Practices is about 20 hours of content, Food Safety Inspections and Audit Readiness about 9 hours, and ISO 9001:2026 Internal Auditor about 13 hours. On completion you download a certificate of completion. ASC is a FoodBev SETA accredited and SAATCA registered online training provider.
Will this course make me a certified lead auditor for certification bodies?
This course develops the practical skills to plan, conduct and report internal and supplier audits within your own organisation and supply chain, and to drive corrective action. It is focused on building competent internal and supplier auditors; it is not a third-party certification-body lead auditor qualification. For most QA/QC and food-safety teams, internal and supplier auditing competence is exactly what the standards and their own programme require.
What is a non-conformance and why does writing them well matter?
A non-conformance is a documented finding that a specific requirement of the standard, procedure or legal rule has not been met, supported by objective evidence. Writing it clearly (stating the requirement, the evidence and where it was found) means the auditee can understand it, investigate the root cause and correct it effectively. Vague or opinion-based findings, by contrast, create disputes and rarely lead to real improvement, which is why the course places strong emphasis on this skill.
What is the difference between a food safety inspection and an audit?
An inspection looks at condition: is the area, the equipment and the product in the state it should be in today. An audit looks at the system: is the procedure implemented as documented, and is it effective. BRCGS Food Issue 9 asks for both, inspections in clause 3.4.4 and the internal audit programme in clause 3.4.1. FS50, ASCβs Food Safety Inspections and Audit Readiness course, teaches both and ends with a workshop where you do one.
Which edition of ISO 19011 does the course use?
ISO 19011:2026, the fourth edition, published in May 2026. It replaced ISO 19011:2018 on publication and has no transition period. If your internal audit procedure still cites the 2018 edition, update the reference.
Food Safety Inspections and Audit Readiness (FS50)
Do I need audit experience to do FS50?
No. FS50, ASCβs Food Safety Inspections and Audit Readiness course, is written for quality controllers, HACCP team members and supervisors who have been told to do inspections and internal audits and were never shown how. Basic food safety or HACCP knowledge is assumed.
I am not working on a site at the moment. Can I still complete the practical work?
Yes. Every activity and the final workshop can be done on a case study built into the course: a ready meal and salad factory, a citrus packhouse or a restaurant kitchen. The case gives you the procedures, the last audit, the complaints and what you see on the walk. The thinking is yours.
How is FS50 different from the Internal and Supplier Auditing course?
FS50, ASCβs Food Safety Inspections and Audit Readiness course, is the practical foundation: about 9 hours of lessons and assessments on inspections, conducting one internal audit properly and being audited. The 20 hour Internal and Supplier Auditing Practices course goes further into managing the audit programme and auditing suppliers. If you have never been shown how to audit, do FS50 first.
How is the course assessed, and what is the pass mark?
A knowledge check and a game in every module, a final assessment, and a workshop assignment where you upload your own audit workbook and a short note to the site manager. The pass mark is 70 percent on every assessment. You have two attempts at each knowledge check, game and the proctored final assessment, and three at the workshop assignment. The assignment is marked automatically against published criteria and returns written feedback. Your certificate is released once everything is passed and you have left a short course review.
Is FS50 SETA accredited?
No. FS50 is a short skills course. You receive an ASC certificate of completion. It is not registered against a unit standard and carries no credits.
What do I walk away with?
An audit plan, a risk-based checklist of at least fifteen points, a completed inspection record, written and graded findings and an audit report, all in one Excel workbook you built yourself and can reuse on your site, plus the ASC certificate.
Walk into the next audit knowing what the auditor will ask
Start with one audit done properly, then build the programme around it.