How to Prepare for an Unannounced Audit

Preparing for an unannounced audit requires shifting from a culture of periodic preparation to one of permanent operational readiness where Food Safety Management Systems (FSMS) are executed consistently every shift. To succeed, manufacturers must embed Good Manufacturing Practices (GMPs) into daily routines, ensure all documentation is completed in real-time, and empower floor staff to follow protocols even when management is not present. This proactive approach ensures that whether an Environmental Health Practitioner (EHP) arrives for an R.638 inspection or a certification body performs a GFSI-mandated unannounced audit, the facility is always compliant.

Key Takeaways

• Permanent Readiness: Treat every day as audit day to eliminate the high-stress 'clean-up' phase before scheduled visits.
• Document Discipline: Transition to real-time record-keeping to prevent the common failure of back-dating or missing logs.
• Staff Empowerment: Ensure frontline workers understand the 'why' behind food safety so they maintain standards independently.
• Internal Verification: Use robust internal auditing to identify and close gaps before an external auditor finds them.
• Regulatory Alignment: Maintain full compliance with R.638 hygiene requirements as the non-negotiable legal foundation.

The Shift from Periodic to Permanent Readiness

For many South African food manufacturers, the term "audit prep" traditionally meant a frantic two-week period of painting floors, updating overdue training records, and deep-cleaning hidden corners. Under GFSI-benchmarked standards like FSSC 22000 and BRCGS, this reactive model is no longer viable. Unannounced audits are now a mandatory component of the certification cycle, designed to witness the facility in its true, day-to-day state.

The goal is to reach a state of "audit-readiness at any time." This means your prerequisite programmes (PRPs) must be functioning 365 days a year. If a visitor enters your high-care zone on a Tuesday afternoon or a Friday night shift, the standards of hygiene, PPE compliance, and process control must be identical. The "why" behind this is simple: pathogens and physical contaminants do not schedule their arrival; therefore, your controls cannot be scheduled either.

Legal vs. Voluntary Requirements

It is critical to distinguish between what the South African law requires and what your customers or certification bodies demand. An unannounced visit could come from two primary sources:

1. The Regulatory Inspection (R.638)

Under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, specifically Regulation R.638, an Environmental Health Practitioner (EHP) has the right to enter your premises at any reasonable time. They are checking for your Certificate of Acceptability (CoA) and adherence to fundamental hygiene requirements. Failure here can result in fines or the closure of your facility. A common failure mode during these inspections is the inability to produce a valid CoA on-site or having a CoA that does not reflect the current owner or activities of the business. Manufacturers should consult a guide on food premises requirements in South Africa to ensure structural compliance.

2. The Certification Audit (GFSI Standards)

Standards like BRCGS and FSSC 22000 require at least one unannounced audit every three years. These are much broader in scope, covering everything from food fraud mitigation plans to complex traceability exercises. While losing a certificate doesn't necessarily mean legal closure, it usually means losing your listing with major South African retailers. The pressure of an unannounced audit often reveals "shadow systems"—informal ways of working that bypass official procedures when the QA team isn't looking.

Operational Steps for Unannounced Success

To survive an unannounced audit, you need to focus on four operational pillars: Site Standards, Documentation, Traceability, and People.

1. The 60-Minute Rule for Documentation

During a scheduled audit, you might have time to dig through archives. In an unannounced audit, the auditor will often request specific records (like a CCP monitor log from three months ago) and expect them within minutes. If you cannot produce them quickly, it signals a lack of control. Transitioning to a digital system like QMSURE ensures that all records are timestamped and instantly searchable, preventing the "lost folder" syndrome. For those still on paper, a dedicated "Audit Box" containing the most commonly requested files (training matrix, water test results, pest control reports) must be kept current.

2. Frontline Staff Training

The auditor will spend significant time on the floor, interviewing operators. They don't just want to see the QA Manager; they want to know if the person on the line knows their Critical Limits. If an operator cannot explain what to do when a metal detector rejects a pack, you will face a major non-conformity. Regular HACCP training for supervisors and staff is essential to build this confidence. Common failure mode: Operators answering "I just do what the supervisor tells me" instead of explaining the hazard and the control measure.

3. The "Auditor Protocol"

Who meets the auditor at the gate? If the QA Manager is off-site, does the security guard or receptionist know the protocol? You must have a written Unannounced Audit Procedure that identifies:

• Who verifies the auditor's credentials and records the time of arrival.
• Who escorts them to the meeting room immediately to prevent "unsupervised wandering."
• Which members of the Food Safety Team are the designated backups for the QA Manager.
• Where the "Audit Pack" (Site maps, CoA, Org charts, approved supplier list) is kept.

Internal Auditing: Your Best Defence

The most effective way to prepare for an unannounced external audit is to conduct your own internal audits with the same level of rigour. An internal audit shouldn't be a checklist exercise done in an office; it should involve physical inspections and "interrogating" the system. Use root cause analysis whenever a non-conformance is found to ensure it doesn't reappear during the external visit.

Audit and Documentation Failure Modes Table

Area of Focus	Common Unannounced Audit Failure	Preventative Action	Documentation Verification
Personal Hygiene	Staff wearing jewellery or dirty protective clothing.	Daily pre-shift inspections by supervisors with documented sign-off.	Review GHP checklists for missed days or "perfect" scores that don't match floor reality.
CCP Monitoring	Logs showing the same temperature for 8 hours (dry-labbing).	QA lead must verify logs mid-shift and sign off to confirm accuracy.	Check for identical handwriting or pen ink across multiple hours, indicating late completion.
Housekeeping	Accumulation of dust on overhead pipes or behind machinery.	Implement a "Clean-as-you-go" policy and weekly deep-clean schedules.	Verify cleaning logs against hygiene audit swabbing results to ensure cleaning was effective.
Chemical Control	Unlabelled cleaning chemicals left on the production floor.	Strict "lock and key" policy for chemicals; daily inventory checks.	Review the chemical register and Safety Data Sheets (SDS) for all on-site substances.
Maintenance	Temporary repairs (e.g., cable ties, duct tape) used permanently.	Specific training for maintenance staff on hygienic engineering.	Audit the maintenance log to ensure "temporary repairs" are converted to permanent fixes within 48 hours.

Managing the Audit Day

When the auditor arrives, the clock starts. Most standards allow a very short window (usually 30 minutes) between the auditor’s arrival and their entry into the production area. This is to prevent the facility from doing a "quick clean." If your team spends 45 minutes looking for keys to the change room, the auditor will note this as a lack of readiness.

Traceability Under Pressure

Expect a traceability challenge. You will likely be given a batch number for a finished product or a raw ingredient and asked to trace it forward and backward within four hours. This includes mass balance—accounting for every gram of material used, wasted, or remaining. If your product traceability records are manual and fragmented, this is where most SME manufacturers fail. Practice these exercises monthly under different scenarios (e.g., a packaging error vs. a raw material contamination). A common mistake is forgetting to include primary packaging (like the film or bottles) in the traceability scope.

Food Defence and Fraud

Unannounced auditors are increasingly focused on site security. They may try to enter through an unauthorised door or check if visitors are being challenged. Ensure your food defence plan is active. Are external silos locked? Are gates closed? These are simple physical checks that, if failed, indicate a systemic breakdown in security culture. For fraud, ensure your food fraud mitigation plan is updated to reflect recent South African supply chain disruptions, such as ingredient substitutions due to port delays.

The Role of Food Safety Culture

Ultimately, unannounced audits test your food safety culture. If your team only follows the rules when they think they are being watched, the system will eventually fail. Building a culture where food safety is "the way we do things here" is the only sustainable strategy. This involves leadership in food safety—senior management must provide the resources for repairs, training, and proper equipment so that staff feel supported in maintaining high standards.

Advanced Readiness Checklist for Management

• Daily: Verify all CCP and OPRP logs are complete, legible, and within limits before the end of each shift. Use the 5 whys method if a limit was exceeded to find the true cause.
• Weekly: Conduct a "GMP Walkthrough" of the entire site, including the perimeter, waste areas, and staff canteens. Look for evidence of pests or structural damage.
• Monthly: Perform a gap audit on one specific department (e.g., Receiving or Packing) using the full BRCGS or FSSC 22000 checklist for that section.
• Quarterly: Run a full mock recall and traceability exercise, including a mass balance calculation and contact with one supplier.
• Annually: Review your HACCP plan and risk assessments to ensure they reflect any changes in equipment, ingredients, or personnel.
• Ongoing: Monitor the CAPA system to ensure that non-conformities from previous audits are not just closed, but that the solutions are still effective.

Conclusion: Embracing Transparency

Unannounced audits should not be feared; they are an opportunity to demonstrate the excellence of your operations. By focusing on consistent execution, real-time documentation, and a strong food safety culture, you ensure that your facility is always ready for scrutiny, protecting both your customers and your business reputation. The cost of a failed audit—lost contracts, brand damage, and legal penalties—far outweighs the investment in daily discipline.

If you are concerned about your site's readiness for an upcoming unannounced visit, Shilux offers comprehensive readiness audits to identify gaps before the external auditor does. Our team can assist with food safety consulting to streamline your processes, or you can explore the QMSURE paperless system to ensure your documentation is always audit-ready at the touch of a button. For more specific needs, consider our GMP audits to baseline your facility's hygiene performance.