Internal Audits: How to Check Your Own Food Safety System

Audit yourself before someone else does

There's a simple habit that separates the food businesses that sail through external audits from the ones that scramble: they audit themselves first. An internal audit is you, or someone in your business, checking your own food safety system against what it should be, finding the gaps, and fixing them, before an auditor or EHO does it for you.

It's also something certification standards expect to see evidence of. Here's how to run a useful internal audit without it becoming a bureaucratic chore.

What an internal audit is (and isn't)

An internal audit is a planned, honest check of your own food safety management system. It's not a quick glance around the kitchen; it's a structured look at whether your documented system is actually being followed and is actually working.

The key word is honest. An internal audit only has value if you genuinely look for problems rather than confirming everything's fine. The whole point is to find the gaps while they're cheap and easy to fix, not to produce a clean report that misses them. An internal audit that never finds anything isn't reassuring; it usually means it wasn't done properly.

What to check

A thorough internal audit works through the same areas an external auditor would. You're checking both that your documents are right and that what happens in practice matches them:

1. Your HACCP plan. Does it still match what you actually do? Have products or processes changed without the plan being updated?
2. Records. Are your temperature, cleaning, and monitoring records being completed consistently, with real values and no gaps?
3. Prerequisite programmes. Are cleaning, pest control, hygiene, and maintenance procedures documented and being followed?
4. Supplier management. Is your approved supplier list current? Are any certificates expired?
5. Allergen management. Is your allergen information accurate and your matrix up to date? Do labels match recipes?
6. Traceability. Could you trace a batch quickly if you had to?
7. Training. Is everyone's training current?

A useful technique is to compare what your system says against what you actually observe and what your records show. Where those three don't line up, you've found something worth fixing.

How often to do it

Frequency should reflect your size and risk, but a sensible rhythm for a small producer is a focused internal audit at least once a year, with lighter checks more often, perhaps a quick monthly look at records and certificates to catch drift early. The annual audit is your thorough review; the lighter monthly checks stop small things accumulating between them.

Tie your internal audit into your annual HACCP review, since they cover much of the same ground, and time it to give you room before any external audit, so anything you find can be fixed in good time rather than discovered too late.

Act on what you find, and record it

Finding issues is only half the value; acting on them is the rest. For each finding, do the same three things you would for an external non-conformance: fix the immediate problem, work out why it happened, and put something in place so it doesn't recur. Record the finding and what you did about it.

Keeping a record of your internal audits, and the actions you took, matters for two reasons. First, it's evidence: external auditors and standards like to see that you audit yourself and act on it, because it demonstrates a system that improves rather than just exists. Second, it lets you track whether the same issues keep reappearing, which tells you where your system is genuinely weak.

Make it easier with everything in one place

The practical difficulty with internal audits is that checking your whole system means gathering evidence from everywhere: records, certificates, the HACCP plan, training, supplier documents. When these are scattered across folders and devices, an internal audit is a big job, which is exactly why it gets skipped.

When everything lives in one system, the internal audit becomes far lighter, because the evidence is all in one place and the gaps are more visible. Being able to see at a glance which certificates are expiring, where records have gaps, and whether training is current turns the audit from an excavation into a review. FoodSafe brings your HACCP plan, records, supplier certificates, allergen information, and training into one place, which makes checking your own system, and seeing where it's slipping, genuinely manageable.

The habit that keeps you ready

Internal auditing is the discipline that keeps a food safety system honest. Check your own system regularly and genuinely, act on what you find, record it, and watch for repeat issues, and you turn external audits from stressful tests into confirmations of what you already know. The producers who never fear an audit aren't lucky; they've simply already found and fixed the things an auditor would, because they looked first.

For measuring your overall readiness between audits, see our guide to your food safety compliance score.

Food safety compliance, handled.