Internal audits are self-conducted evaluations used by food businesses to verify that their own processes meet internal and regulatory standards, while external audits are performed by independent third parties to verify compliance for legal or certification purposes. In the South African food manufacturing sector, internal audits serve as a critical diagnostic tool to ensure that a facility is ready for the mandatory external inspections required by the Department of Health and voluntary GFSI-benchmarked certifications.
Key Takeaways
- Internal audits are proactive and identify gaps before they become regulatory or safety failures.
- External audits provide the official "stamp of approval" required for market access and legal compliance (R.638).
- An effective internal audit programme is a mandatory requirement for HACCP, ISO 22000, and FSSC 22000.
- Internal auditors must be independent of the process they are auditing to remain objective.
- Closing findings through robust Root Cause Analysis is more important than the audit score itself.
- South African law (R.638) mandates a Certificate of Acceptability, which is verified through external municipal inspections.
Defining the Two Pillars of Food Safety Verification
In any South African food manufacturing facility—whether you are a small-scale bakery in Gauteng or a large-scale meat processor in the Western Cape—audits are the primary mechanism for verification. However, the intent and execution of internal and external audits differ significantly. Understanding this distinction prevents the common mistake of treating an internal audit as a "light" version of a third-party inspection.
What is an Internal Audit?
An internal audit (often referred to as a first-party audit) is a process where the company audits itself. The primary goal is not just to find faults, but to ensure that the Food Safety Management System (FSMS) is functioning as intended. Under R.638 regulations, the person in charge is legally responsible for ensuring hygiene standards are met; internal audits are the most effective way to prove this oversight is happening.
Effective internal auditing goes beyond a simple "tick-box" exercise. It involves reviewing records, interviewing floor staff, and observing practices during a live shift to ensure that prerequisite programmes (PRPs) are effective. For example, rather than just checking if a floor is clean, the auditor should verify the concentration of the chemical used, the training of the cleaning staff member, and the disposal method of the waste water.
What is an External Audit?
External audits are conducted by parties outside of your immediate organisation. These generally fall into two categories:
- Second-Party Audits: These are supplier audits conducted by a customer (e.g., a major retailer auditing their private label manufacturer) to ensure their specific standards are being met. In South Africa, these often focus heavily on batch traceability and ethical sourcing.
- Third-Party Audits: These are conducted by independent certification bodies (like those auditing for FSSC 22000) or regulatory authorities (like Environmental Health Practitioners). These auditors have no vested interest in your business success, only in your compliance with the standard.
Legal Requirements vs. Voluntary Standards in South Africa
It is crucial for South African QA managers to distinguish between what the law requires and what customers demand. The Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and its associated regulation R.638 (Regulations Governing General Hygiene Requirements for Food Premises) set the legal baseline. An Environmental Health Practitioner (EHP) from your local municipality conducts external inspections to issue or renew a Certificate of Acceptability (CoA).
Failure to pass a municipal inspection can result in a fine or the immediate closure of the facility. Conversely, standards like HACCP (SANS 10330) or GFSI-benchmarked standards like BRCGS are often voluntary from a legal standpoint but mandatory for doing business with major retailers. These standards have very strict requirements for internal audits, requiring they be scheduled, risk-based, and performed by trained personnel. While an EHP focuses on basic hygiene and infrastructure, a BRCGS auditor will look deeper into food fraud mitigation plans and food defence plans.
Comparison Table: Internal vs. External Audits
| Feature | Internal Audit (1st Party) | External Audit (3rd Party) |
|---|---|---|
| Who Performs It? | Trained employees or hired consultants on behalf of the firm. | Independent Certification Bodies or Regulatory EHP. |
| Primary Objective | Continuous improvement and audit readiness. | Verification of compliance for certification or license to operate. |
| Frequency | Scheduled throughout the year (e.g., monthly or quarterly). | Usually annually or bi-annually. |
| Outcome | Internal CAPA and management review. | Certification, CoA, or regulatory enforcement action. |
| Scope | Can focus on specific high-risk areas or the whole system. | Full scope of the standard or regulation being audited. |
| Cost Factor | Time of internal staff; largely an operational overhead. | Certification body fees, travel, and registration costs. |
The Internal Audit Process: South African Best Practice
For a manufacturer in the South African context, the internal audit is the "dress rehearsal." If your internal audit doesn't catch a missing cleaning record or a broken sieve, you can be certain an external auditor will. A common failure in South Africa is the "Friday afternoon audit," where a staff member quickly ticks off a form without actually visiting the production floor. This is a significant risk to food safety culture.
1. The Requirement for Independence
One of the most common findings in common food safety audit findings is a lack of auditor independence. An internal auditor should not audit their own work. The QA Manager should not audit the QA lab; instead, the Production Manager (if trained) should audit the lab, while the QA Manager audits the production floor. This ensures fresh eyes are on the process. In smaller SMEs where staff numbers are limited, this can be achieved by using a cross-departmental team or an external consultant to conduct GMP audits.
2. Risk-Based Scheduling
Don't audit everything at once. Divide your audit programme into manageable sections across the year. High-risk areas, such as Critical Control Points (CCPs) or allergen handling zones, should be audited more frequently—perhaps monthly. Low-risk areas like the dry goods warehouse or packaging store could be audited annually. This approach ensures resources are focused where a failure would most likely result in a product recall.
3. Operational Detail: The "Floor-to-Paper" Approach
In South African factories, we often see "perfect" paperwork that doesn't match reality. A robust internal audit uses the floor-to-paper approach: start by observing a task (e.g., hand washing or conveyor sanitisation), then check the corresponding record. If the record says it was done at 08:00 but you observed it wasn't done until 08:30, you have a food safety culture issue that needs addressing. Auditors should also verify that chemicals listed on the COA requirements checklist match the actual batch numbers found on the chemical store shelves.
The Critical Role of Documentation and Evidence
External auditors operate on the principle: "If it isn't written down, it didn't happen." Internal audits must mirror this rigor. Every internal audit report should include evidence of what was checked—not just a "Yes/No" answer. For example, instead of ticking "Thermometers calibrated," the internal auditor should record the specific serial numbers checked and the date of their last external calibration certificate.
Common Failure Modes in Documentation:
- Generic Findings: Writing "cleaning is poor" instead of "organic build-up observed on the underside of conveyor belt #4 in the high-care area."
- Lack of Photo Evidence: Internal audits are significantly more effective when photographic evidence is attached to the report, making it impossible for production teams to dispute the findings.
- Open Loops: Identifying a problem in an internal audit but failing to link it to a CAPA process. If an external auditor sees an uncorrected internal finding from six months ago, they will likely issue a Major Nonconformity for a systemic failure.
Preparing for External Audits: Closing the Gaps
External audits are stressful, but they shouldn't be unpredictable. If your internal audit system is working, the external audit should simply be a verification of what you already know. To prepare, ensure your audit readiness checklist is complete and that all previous internal nonconformities have been closed using root cause analysis.
In the weeks leading up to a third-party audit, many facilities conduct a readiness audit. This is a full-scale mock audit covering all clauses of the standard (e.g., FSSC 22000 requirements). This helps identify if the staff are comfortable answering auditor questions and if the traceability system can pull a full mass balance within the required timeframe (usually 4 hours).
"An external auditor is not there to help you fix your system; they are there to judge its effectiveness. The internal auditor is the one who helps you build the resilience needed to pass."
Management Commitment and the Audit Cycle
Both internal and external audits require "Top Management" commitment. In FSSC 22000 and BRCGS, if management is not involved in the opening and closing meetings, it can be flagged as a finding. Management must provide the resources (time, training, and budget) to fix the issues identified during internal audits. This is often where South African firms struggle—the QA team identifies the problem, but the Maintenance team doesn't have the budget to fix it. This disconnect is a primary cause of audit failure.
Audit Management Checklist for Supervisors:
- Review previous audit findings to ensure repeat issues are not occurring.
- Verify that the traceability records for the last three months are legible and complete.
- Ensure that all visitor management protocols are being followed at the security gate.
- Confirm that staff training records are updated following any changes to SOPs.
Root Cause Analysis: Beyond the Quick Fix
A major difference between internal and external auditing is the focus on the "Why." An internal audit is the perfect time to apply 5 Whys explained to a recurring hygiene issue. If an external auditor finds a cockroach in a production area, they will mark it down as a failure. If an internal auditor finds one, they should ask: Why was the pest control contractor late? Why was the screen door left open? Why was there food debris under the machine? Fixing the screen door is a correction, but ensuring the door closes automatically is a preventive action.
Digital Systems: The Future of Auditing in SA
Maintaining a paper-based internal audit schedule is becoming increasingly difficult for South African SMEs. Many manufacturers are moving toward digital solutions like QMSURE to track audit schedules, store evidence, and manage the CAPA process in real-time. Digital systems ensure that nothing falls through the cracks, providing a transparent audit trail for external auditors. With digital systems, a QA Manager can see at a glance if a hygiene audit was missed at a branch in Durban while they are based in Johannesburg.
Whether you are preparing for a FSSC 22000 certification or simply trying to improve your hygiene requirements under R.638, the relationship between your internal and external audits is the foundation of your food safety success. Treat internal audits as your most valuable tool for improvement, and external audits will become a routine verification rather than a business risk.
How Shilux Can Support Your Audit Success
At Shilux, we assist South African manufacturers in bridging the gap between internal discovery and external compliance. From conducting gap audits to training your team in advanced internal auditing, our consultants provide the technical expertise needed to secure your certification. We offer specialized HACCP implementation support to ensure your system is robust enough to withstand the most rigorous third-party scrutiny.
If you are struggling with manual paperwork, our QMSURE paperless system can digitise your entire Food Safety Management System for better audit performance. We also provide supplier audits to help you manage your raw material risks, ensuring that your approved supplier list is verified and compliant with GFSI standards. Contact us today at our Johannesburg or Cape Town offices for a consultation.