Major food safety audit findings are typically triggered by systemic failures in prerequisite programmes, inadequate monitoring of Critical Control Points (CCPs), and a lack of documented evidence for corrective actions. In the South African regulatory context, failing to meet the basic hygiene requirements of R.638 or neglecting the verification steps in a HACCP plan are the most frequent causes of nonconformities that can jeopardise a facility’s Certificate of Acceptability or GFSI certification.
Key Takeaways
- R.638 is the Foundation: Legal compliance with South African hygiene regulations is mandatory before any GFSI standard can be achieved.
- Documentation vs. Reality: Auditors look for the “say-do” gap; if it isn’t recorded, it didn’t happen.
- RCA is Critical: Failure to perform effective root cause analysis leads to repeat findings and major nonconformities.
- Personnel Hygiene: Handwashing and protective clothing remain the most visible indicators of a site’s food safety culture.
1. Inadequate Knowledge of R.638 Regulations
In South Africa, the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 governs food safety, specifically through Regulation R.638. A common mistake is focusing entirely on high-level standards like FSSC 22000 while neglecting the basic food premises hygiene requirements outlined in R.638. Auditors frequently flag issues related to the Certificate of Acceptability (CoA). If your CoA is outdated, or if the person in charge has not been formally designated and trained as per the regulation, it is an automatic finding.
2. Superficial Root Cause Analysis (RCA)
When a nonconformity occurs, many QA managers simply record a “correction” (fixing the immediate problem) rather than a “corrective action” (preventing recurrence). Auditors look for evidence that you have used tools like the 5 Whys explained in your internal processes. A finding becomes “Major” when an auditor sees the same issue repeated across multiple months because the initial root cause analysis was insufficient.
3. Lack of Senior Management Commitment
Food safety is no longer just the QA department’s responsibility. Under FSSC 22000 and BRCGS Issue 9, leadership in food safety is a core audit pillar. If senior management cannot demonstrate they provide the necessary resources—such as budget for facility repairs or time for staff training—it triggers a finding. Auditors often interview plant managers to see if food safety objectives are integrated into business KPIs.
4. Ineffective Internal Auditing
An internal audit should be more rigorous than the external one. However, many SMEs treat internal audits as a “tick-box” exercise. If an external auditor finds a glaring physical defect (like a leaking roof or flaking paint) that was not identified in your last internal audits, it indicates a failure of the monitoring system itself. This suggests the internal auditor is either not competent or not impartial.
5. Poor Cleaning Validation and Verification
There is a significant difference between seeing a clean surface and proving it is safe. Mistaking visual cleanliness for microbiological safety is a major pitfall. Auditors require evidence of HACCP verification and validation. This includes ATP swabbing, microbial testing of contact surfaces, and ensuring that cleaning chemicals are used at the correct concentrations according to the manufacturer's data sheets.
6. Mismanaging the Approved Supplier List
South African manufacturers often struggle with supplier management, particularly when sourcing raw materials from smaller vendors. A major finding is often issued when a manufacturer uses a supplier who is not on the approved supplier list, or when the supplier’s CoA has expired. You must demonstrate a risk-based approach to how you vet and monitor your providers.
7. Incomplete Traceability Exercises
During an audit, you will be asked to perform a traceability challenge (forward and backward). The common mistake here is not accounting for mass balance—the quantity of raw materials in minus the quantity of finished goods out (including waste and rework). If you cannot account for 100% of the product within a specific timeframe (usually 2 to 4 hours), it is considered a failure in product traceability explained protocols.
8. Neglecting Food Defence and Food Fraud
Since the introduction of GFSI-aligned standards, what is TACCP (Threat Assessment) and what is VACCP (Vulnerability Assessment) have become mandatory. Many sites fail because their food fraud plan is generic. In South Africa, you must consider local risks, such as the adulteration of spices or the theft of high-value ingredients. A “Major” finding is often issued if the site security is breached easily or if the food fraud mitigation plan has not been reviewed annually.
9. Incorrect CCP Monitoring
Critical Control Points are the heart of your food safety system. Findings occur when:
- Monitoring frequency is not met (e.g., checking temperatures every 2 hours when the plan says every hour).
- The person monitoring the CCP does not understand the HACCP critical limits.
- Corrective actions for deviations are not documented.
10. The "Say-Do" Gap in Prerequisite Programmes (PRPs)
If your policy says employees must wear blue detectable plasters, but the auditor finds a staff member wearing a standard tan plaster, it is a nonconformity. These prerequisite programmes form the foundation of your house of food safety. When the foundation has cracks, the whole system is viewed as unstable.
Comparison: Legal Requirements vs. Certification Standards
| Feature | R.638 (SA Law) | FSSC 22000 / BRCGS (Certification) |
|---|---|---|
| Authority | Department of Health (Local Municipality) | Private Certification Bodies (GFSI) | Requirement | Certificate of Acceptability (CoA) | Annual Certification Audit | Focus | Basic Hygiene & Infrastructure | Management Systems & Continuous Improvement |
| Food Safety Culture | Implicit (General Hygiene) | Explicitly required and measured |
Audit Readiness Checklist
- Is your CoA displayed and reflecting the current owner/activity?
- Are all staff trained on the specific hazards of their workstations?
- Is your CAPA process resulting in actual changes to procedures?
- Are your pest control records up to date with a signed map of stations?
- Have you conducted a mock recall in the last 12 months?
Avoiding these mistakes requires a move away from paper-heavy, reactive systems toward proactive, digital management. Shilux offers comprehensive food safety consulting and readiness audits to help South African manufacturers identify these gaps before an official auditor arrives. For those looking to eliminate documentation errors, our QMSURE paperless system provides real-time monitoring and automated alerts to ensure your facility remains compliant 365 days a year.