What Certification Bodies Look for During Food Safety Audits

The Auditor’s Perspective: More Than a Checklist

During a food safety audit, certification bodies look for evidence that a food safety management system (FSMS) is not only documented but effectively implemented, maintained, and continuously improved. Auditors scrutinise the alignment between site practices and the requirements of standards like FSSC 22000 or BRCGS, focusing on hazard control, traceability, and the underlying food safety culture of the organisation.

The shift in modern auditing has moved from "Compliance" (obeying the rules) to "Effectiveness" (proving the rules actually work). An auditor is trained to look for the 'why' behind every action. If a staff member washes their hands, the auditor is evaluating if the water temperature is correct, if the soap is anti-bacterial and fragrance-free for food use, and if the drying method prevents re-contamination. This holistic view ensures that the FSMS protects the consumer and the brand from the devastating costs of a product recall.

Key Takeaways

• Legal Compliance: Proof of a valid Certificate of Acceptability under R.638 is the non-negotiable baseline.
• System Maturity: Auditors look for a "lived" system, not a dusty manual pulled out once a year.
• Critical Control Points: Rigorous evidence of CCP monitoring, including what happens when limits are exceeded.
• Management Commitment: Evidence that leadership provides the resources and culture necessary for safety.
• Traceability: The ability to perform a full mass-balance exercise within specific timeframes (usually 4 hours).
• Continuous Improvement: The use of root cause analysis to ensure that once a problem is found, it never recurs.

1. Compliance with South African Regulatory Requirements

Before a certification body (CB) evaluates you against a GFSI-benchmarked standard, they must ensure you meet the legal minimums of South African law. In South Africa, the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 provides the framework, but the operational detail lies in R.638 (Regulations Governing General Hygiene Requirements for Food Premises, the Transport of Food and Related Matters).

An auditor will verify that you have a valid Certificate of Acceptability (CoA) issued by the local municipality. They will check if the person in charge is suitably qualified or trained as per R.638 requirements. If your facility lacks the basic structural and hygiene requirements mandated by law—such as adequate handwashing stations, pest proofing, or smooth, impervious surfaces—a CB cannot certify you, regardless of how good your paperwork looks.

Common failure modes in South African facilities include the lack of a designated "Person in Charge" during night shifts or weekends who holds the necessary training certification. Furthermore, auditors frequently cite poor maintenance of the food premises requirements, such as cracked floor tiles or pooling water in drainage channels, which violate the "impervious and easy to clean" mandate of R.638.

2. Prerequisite Programmes (PRPs) and GMPs

Certification bodies spend a significant portion of the audit walking the factory floor to observe Good Manufacturing Practices (GMPs). They aren't just looking for clean floors; they are looking for the sustainability of your prerequisite programmes. Detailed observations typically include:

• Maintenance for Food Safety: Are there temporary repairs (like string or duct tape) that could become physical hazards? Is there a preventative maintenance schedule for scales and probes? Auditors check for "peeling paint" above open product lines, a common finding in older South African processing plants.
• Cleaning and Sanitation: Can the site prove that cleaning is effective? Auditors will look at cleaning validation records (swab results) rather than just the sign-off sheets. They will scrutinise the concentration of chemicals used, ensuring they match the manufacturer’s technical data sheets.
• Personnel Hygiene: Are staff wearing PPE correctly? Is the movement of people controlled to prevent cross-contamination between high-risk and low-risk areas? This includes checking the condition of staff change rooms and the availability of single-use towels.
• Waste Management: Is waste removed frequently enough to prevent pest attraction? Auditors look for lidded bins and the separation of "edible" vs "inedible" waste to prevent accidental mix-ups.
• Pest Control: Beyond just having bait stations, the auditor checks the GMP audit findings for trends. If there is consistent activity in one area, they expect to see a documented investigation into the entry point.

3. HACCP Implementation and Critical Control Points

At the heart of HACCP for food manufacturers in South Africa is the Hazard Analysis. An auditor will challenge your HACCP team’s logic. They look for:

• Scientific Justification: Why did you choose a specific temperature or time as a critical limit? You must have the validation data (e.g., thermal death time studies or peer-reviewed journals) to back it up. In a bakery context, this involves proving that the core temperature of the bread reaches a level sufficient to kill pathogens like Salmonella.
• Monitoring Accuracy: If a CCP record shows exactly the same temperature every hour for a week, it raises a red flag regarding "dry labbing" (falsifying records). Auditors look for natural variance. They may cross-reference the CCP log with the pasteurizer's automated chart recordings.
• Corrective Actions: Auditors love to see audit findings and nonconformities that you found yourself. It proves the system works. They will track a deviation to see if the product was put on hold, the root cause identified, and the corrective action verified through a formal CAPA process.

Operational Detail: The "Why" of Verification

Auditors distinguish between monitoring (checking the temperature now) and verification (checking that the person who checked the temperature did it correctly). A common failure is the lack of timely manager review on CCP records. If a deviation occurred on Monday and the manager only signs the record on Friday, the auditor will issue a non-conformity because the "Hold and Release" protocol was not verified in time to prevent potentially unsafe food from leaving the site.

4. Traceability and Mass Balance

One of the most stressful parts of a food safety audit is the traceability exercise. The auditor will select a finished product batch or a raw material lot and ask you to trace it. In FSSC 22000 traceability audits, they look for:

A failed mass balance is often a critical non-conformity because it suggests the manufacturer has lost control of the product flow, potentially allowing contaminated or fraudulent material into the supply chain. Auditors will specifically look at how you handle "work in progress" (WIP) that sits overnight—if it isn't labeled with a batch code, the traceability chain is broken.

5. Supplier Management and Food Fraud

Modern standards like FSSC 22000 V6 and BRCGS Issue 9 place heavy emphasis on supplier management. Auditors are no longer satisfied with just a list of names. They want to see a supplier risk assessment that considers both food safety and food authenticity.

The VACCP and TACCP Framework

Auditors will check if you have performed a food fraud vulnerability assessment (VACCP) and a food defence threat assessment (TACCP). In the South African context, this involves assessing the risk of economically motivated adulteration—such as the dilution of olive oil or the mislabeling of meat species. The auditor will look for mitigation strategies, such as tamper-evident seals on bulk tankers or independent lab testing of high-risk ingredients.

6. Food Safety Culture and Management Commitment

This is the "soft" side of the audit that has become a hard requirement. Auditors look for evidence that food safety is a priority for top management, not just the QA Manager. They look for:

• Resource Allocation: Has management approved budgets for necessary repairs or new equipment? If the auditor sees a leaking roof that has been on the "to-fix" list for six months, they will cite a lack of management commitment.
• Communication: Do floor workers understand the food safety policy? An auditor will often stop an operator and ask, "What do you do if you see a foreign object in the product?" If the operator doesn't know the procedure, it indicates a failure in food safety culture training.
• Internal Audits: Is the audit programme robust, or is the internal auditor "blind" to the site's own faults? Auditors look for internal audits that actually find problems. If your internal audits always return a 100% score but the external auditor finds 10 issues, your internal process is considered ineffective.

7. Documentation and Record Keeping

The golden rule of auditing is: "If it isn't written down, it didn't happen." However, auditors are now looking deeper into the integrity of those records. They look for signs of "contemporaneous recording"—meaning the records were filled out at the time of the activity, not at the end of the shift. Indications of poor practice include identical handwriting using the same pen for three different shifts, or records that are too clean to have been used in a production environment.

Documentation Best Practice Checklist

• Version Control: Ensure the form being used on the floor matches the latest version in the master document index.
• Error Correction: Mistakes should be crossed out with a single line, initialed, and dated. The use of correction fluid (Tipp-Ex) is an automatic red flag for data integrity.
• Electronic Records: If using a digital food safety system, the auditor will check user access levels and audit trails to ensure records cannot be backdated or deleted.

Checklist: Are You Audit-Ready?

1. Is the R.638 Certificate of Acceptability displayed and current?
2. Are all measuring devices (thermometers, scales) calibrated with valid certificates from SANAS-accredited labs?
3. Is the Approved Supplier List up to date with current GFSI certificates or audit reports?
4. Can you produce a training record for every employee currently on the shift, including temporary staff?
5. Are the verification activities (like micro testing) being done according to the frequency in your plan?
6. Is the site exterior free from clutter, stagnant water, and potential pest harbourage?
7. Do you have a documented food recall plan and evidence of a successful mock recall performed in the last 12 months?
8. Are all chemicals stored in a locked, bunded area away from food production?

Conclusion

Certification bodies are looking for a system that functions in the auditor's absence. Whether you are working toward FSSC 22000 certification in South Africa or maintaining a local HACCP programme, the focus remains on risk prevention and continuous improvement. By focusing on the substance of your records and the behaviour of your staff, you move beyond "audit prep" into a state of permanent audit readiness.

Ensuring your team is prepared requires more than just templates; it requires deep technical knowledge and the right tools. Shilux provides expert food safety consulting and specialised food safety management training to help South African manufacturers bridge the gap between compliance and excellence. For those looking to eliminate the risks of paper-based systems, our QMSURE paperless system provides real-time oversight of your FSMS, making traceability and mass balance exercises a matter of clicks, not hours. This digital transition not only satisfies the auditor's need for data integrity but also empowers the facility to move from reactive firefighting to proactive quality assurance.