BRCGS audit: internal audit before your certification audit
An internal audit is a check that you carry out yourself before the external certification audit. You test whether your procedures, records and shop floor meet the BRCGS requirements within your own scope. The aim is to find findings before the auditor does. That costs less, causes less stress and shows that your system works. The BRCGS scheme is recognised by the GFSI (Global Food Safety Initiative). According to a whitepaper by Mérieux NutriSciences on Issue 9, all activities relating to food safety, authenticity, legality and quality must be assessed at least once a year. The audit programme therefore runs all year, not only shortly before the certification audit.
Use the requirements guide as the common thread, and the scope page to decide what you must check. For what to do with findings, read the audit result.
An internal audit is not a copy of the requirements list that you hand to a colleague. If you only tick boxes, you will not see the gaps. Always check the evidence on the shop floor.
Planning in five steps
| Step | When | What you do |
|---|---|---|
| 1. Record the plan | At the start of the year | Set the scope, the dates and the order of the areas; every activity is covered at least once a year |
| 2. Choose the auditor | Before the start | Appoint someone who does not manage the process themselves |
| 3. Carry out the audit | Spread across the year, with the last part well before the external audit | Work through the scope, ask for evidence, look at the shop floor |
| 4. Report | Directly after the audit | Record each finding with evidence and location |
| 5. Follow up | Before the external audit | Correct, check the correction, and record the result |
The exact timing depends on the size of your scope and the planning of your certification body. A realistic plan is set up in preparation, not at the last minute.
Who carries out the internal audit?
Choose someone who does not manage the process they check. A quality officer who writes the HACCP plans will find it hard to assess those plans objectively. A colleague from another department, or an external expert, often sees things more clearly.
The auditor must understand the requirements and know the company well. A personal certificate is not the starting point, but the auditor must be able to ask what an employee does and why. Training for internal auditors is a worthwhile investment. Read how to divide roles and knowledge on the training page.
An example of an internal audit
A fictional cheese processor with one production line and one cold room has the following scope for its internal audit:
- Receipt of milk and herbs;
- Production and packing;
- Chilled storage of finished product;
- Cleaning and cleaning records.
For the cold room, the auditor picks a specific point: the temperature logs for the last two weeks. They ask the employee to explain what happens when the temperature is too high. The employee shows the procedure, but does not know where the corrective action is recorded.
The finding is recorded as follows: the temperature procedure is present, but responsibility for a deviation is not known on the shop floor. The cause is insufficient training. The action is a toolbox meeting and a written deviation procedure at the cold room, with a check after two weeks.
What to include in the report
A good report contains the following elements for each finding:
| Element | Example |
|---|---|
| Requirement or component | Chilled storage and temperature monitoring |
| Location and moment | Cold room 2, check on Monday morning |
| What you saw | Logs are complete, but the deviation procedure is not visible |
| Evidence | Log book, interview with employee, photo of the procedure board |
| Cause | Training is missing for new employees |
| Action and owner | Toolbox meeting, owner shift leader, date within two weeks |
| Check | Repeat check with the result |
Write briefly and concretely. A fifty-page report full of vague text helps nobody.
Common mistakes
- Only checking the office. Production, cleaning and goods receipt are where most findings are.
- The same person checks their own work. Then the mistakes do not come to light.
- Findings without a cause. An action that only treats the symptoms will come back.
- No check after the action. A corrected finding that has not been checked is not yet closed.
- All internal audits just before the external audit. Then you have no time to fix anything, and the programme does not cover the year.
Frequently asked questions
Must an internal audit cover the full scope?
Yes, the full scope you certify. You spread the audits across the year, but every activity must be covered at least once a year. Do not forget outsourced processes.
Does the internal audit replace the certification audit?
No. The external audit is carried out by the certification body and determines the certificate. The internal audit is the preparation, and does not produce a certificate.
How do I know whether my internal audit is good enough?
If you had already found most of the findings of the external audit, your internal audit is well focused. If the external auditor finds new findings that you could have seen internally, record why you missed them and improve your approach.