The Foundation of Audit Readiness
Food safety auditors typically request records that demonstrate the continuous and effective implementation of your Food Safety Management System (FSMS), specifically focusing on CCP monitoring, staff training, and traceability. In the South African regulatory context, these records prove compliance with the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and the mandatory hygiene requirements of R.638.
Key Takeaways
- Regulatory vs. Voluntary: Distinguish between legal R.638 requirements (minimum safety) and GFSI-level certification records (customer best practice).
- The Traceability Link: Most auditors start with a finished product and work backwards through 15+ different record types to verify the chain of custody.
- Real-time Accuracy: Records must be completed at the time of the event, not backdated or "tidied up" for the audit. This is a core tenet of data integrity.
- Verification is Non-Negotiable: A record without a supervisor's verification signature is often considered incomplete by auditors, as it shows a lack of oversight.
1. Certificate of Acceptability (CoA)
For any South African food manufacturer, the Certificate of Acceptability is the first document an Environmental Health Practitioner (EHP) or third-party auditor will check. Governed by R.638, this certificate is person- and site-specific. If you have moved premises or changed ownership without updating your CoA, you are technically operating illegally, regardless of how clean your facility is. Ensure the CoA is prominently displayed and that the name of the person in charge matches the current management structure. A common failure mode is an expired CoA or one issued under a previous company name following a merger.
2. Training Records and Competency Assessments
Auditors look beyond simple attendance registers. They want to see that the person responsible for a Critical Control Point (CCP) actually understands the why behind the limit. This includes records of food safety culture training and basic hygiene inductions as mandated by R.638. Be prepared to show the training material used and the subsequent assessment that proved the employee’s competence. Documentation should include the date, the trainer’s name, the trainee’s signature, and a clear pass/fail grade for the assessment. For staff handling allergens, specific competency records regarding cross-contact prevention are essential.
3. CCP Monitoring and Deviation Records
Your HACCP plan identifies where food safety risks are controlled. Auditors will pick a specific date and ask for the monitoring logs for that day (e.g., pasteurisation temperatures, metal detector checks, or pH levels). Crucially, if a limit was exceeded, they will look for the associated deviation record and proof of corrective action. Silence in the logs when a machine was known to be down is a significant red flag. Use CCP examples to calibrate your forms; every CCP log must have a defined critical limit printed clearly on the form so the operator knows exactly when to trigger a deviation report.
4. Traceability Exercise Results
A standard audit requirement is a timed traceability exercise (usually 2 to 4 hours). You must provide records that link raw material batch numbers to finished goods and vice versa. This involves a traceability exercise checklist that covers primary packaging, ingredients, and processing aids. If your records cannot account for 100% of the mass balance, the auditor will suspect a failure in your recall readiness. Practice involves documenting the "work in progress" (WIP) and rework, which are common areas where traceability breaks down in South African factories.
5. Supplier Approval and Monitoring Records
Under FSSC 22000 and other GFSI standards, you are responsible for your inputs. Auditors will ask for your approved supplier list and the records used to vet those suppliers, such as their own audit certificates or completed supplier questionnaires. For high-risk ingredients, expect them to ask for the most recent Certificate of Analysis (CoA) provided by the vendor for a specific batch currently in your warehouse. A common audit finding is using a supplier that has been suspended or whose certification has expired without a recorded supplier risk assessment to justify the continued use.
6. Equipment Calibration Records
A temperature log is useless if the thermometer is inaccurate. Auditors will request the calibration certificates for all measuring equipment (scales, probes, data loggers). They specifically look for "traceability to national standards" (e.g., SANAS accredited labs in South Africa). Internal calibration checks (like daily ice-point checks for thermometers) must also be recorded and signed off. Ensure the serial numbers on the certificates match the physical equipment on the floor. If a scale is found out of calibration during an audit, you must provide a CAPA record assessing the impact on all batches produced since the last successful check.
7. Internal Audit Reports
This is often where manufacturers fail. Auditors want to see that you are finding your own problems before they do. They will ask for your internal audit schedule and the subsequent reports. If your internal audits always show "100% compliance," but the external auditor finds multiple issues, it proves your internal process is ineffective. You must demonstrate that audit findings and nonconformities were documented and that the loop was closed through verified corrective actions. External auditors will specifically look for the root cause of repeated internal findings.
8. Cleaning and Sanitation Logs
This is a fundamental Prerequisite Programme (PRP). Auditors check the daily, weekly, and deep-cleaning schedules. They will often cross-reference these with chemical titration records (to prove the sanitiser was at the correct concentration) and ATP swab results or microbiological swabs that verify the cleaning was effective. Ensure the logs clearly distinguish between "cleaning" (removal of dirt) and "sanitation" (reduction of microorganisms). In South Africa, EHPs often check that chemicals used are registered and that the material safety data sheets (MSDS) are accessible to the staff mixing them.
9. Pest Control Service Reports
While a third-party pest control company usually handles this, the record belongs to the food business. Auditors will check the site map (bait station locations), the trend analysis of pest activity, and the MSDS (Material Safety Data Sheets) for all chemicals used on-site. Any recommendations made by the pest technician in their report must show evidence of being addressed by the facility manager. If a report mentions a gap under a door, the auditor will look for a corresponding maintenance record showing the gap was sealed. Failure to act on service provider recommendations is a frequent cause of major non-conformances.
10. Medical Screening and Health Declarations
R.638 requires that food handlers be medically fit. Auditors look for records of daily pre-shift health checks (asking about symptoms like diarrhoea or jaundice) and annual medical screenings. This is a sensitive area regarding POPIA (Protection of Personal Information Act), so records should show "fitness for work" rather than private clinical details. In the event of an outbreak or suspected illness, these records are vital for the environmental health practitioner to conduct a proper contact-tracing investigation within the facility.
11. Non-Conformance and CAPA Records
When something goes wrong, how do you fix it? The auditor will ask for your CAPA (Corrective and Preventive Action) logs. They aren't just looking for the "correction" (the quick fix); they are looking for the "preventive action" that stops the problem from happening again. This requires proof of root cause analysis using tools like the 5 Whys or Fishbone diagrams. Auditors will often follow a single non-conformance from its discovery through to the CAPA effectiveness verification to ensure the system is actually learning and improving.
12. Water Quality Testing
Water is a primary ingredient or a cleaning medium in most food plants. You must provide records of water testing (microbiological and chemical) to prove it meets SANS 241 standards. If you use municipal water, you still need records of your own point-of-use testing, especially if you have on-site storage tanks which can be breeding grounds for Legionella or E. coli. If you use borehole water, the testing frequency and parameters must be significantly higher, supported by a HACCP hazard analysis that accounts for seasonal groundwater fluctuations.
13. Management Review Minutes
Auditors need to see that senior leadership is involved in food safety. They will ask for the minutes of Management Review meetings. These records must show that the FSMS performance, audit results, and resource needs (like new equipment or staff) were discussed with top management. Empty minutes or generic "everything is fine" statements suggest a lack of leadership in food safety. The minutes should reflect the review of the food safety culture metrics and any changes to the organizational structure that impact food safety responsibilities.
14. Mock Recall Reports
A food recall procedure must be tested at least annually. Auditors will ask for the record of your last mock recall. This should include the scenario, the timeline of communications, the mass balance calculation, and a "lessons learned" section. If you couldn't find 100% of the affected product within the timeframe specified in your procedure (usually 2–4 hours), the auditor will want to see the corrective action plan. Practical details should include the contact list verification and the involvement of the recall team roles to ensure everyone knows their duty during a crisis.
15. Waste Management and Disposal Records
How do you ensure that rejected or expired product doesn't end up back in the food chain? Auditors look for records of waste disposal, particularly for "category 1" high-risk waste. This includes safe disposal certificates for condemned meat or expired products that require specialized destruction to prevent food fraud. Records should quantify the waste and show a clear disposal route, such as a signed receipt from a licensed waste contractor or a rendering plant.
16. Glass and Hard Plastic Registers
A specific requirement in most GFSI audits is the management of brittle materials. You must maintain a register of all glass, hard plastic, and ceramics in production areas. The records should show monthly inspections to ensure no items are cracked or missing pieces. If a breakage occurs, a breakage report must be filed, detailing the cleanup, the disposal of potentially contaminated product, and the verification that the area is safe to resume production. This is a common common food safety audit finding when new equipment is installed but not added to the register.
17. Visitor and Contractor Control Logs
Security and hygiene are linked. Every visitor or contractor entering the production zone must sign a health and hygiene declaration. This record proves that they understand the site rules (no jewelry, hairnets required, handwashing protocols) and that they are not suffering from communicable diseases. For contractors, you should also have records of their work permits, especially if they are performing "hot work" or maintenance that could introduce physical contaminants. Refer to visitor management in food facilities for best practices in maintaining these logs.
Audit Record Checklist for South African Manufacturers
| Record Category | Specific Document to Have Ready | Regulatory/Standard Basis |
|---|---|---|
| Legal Standing | Valid Certificate of Acceptability (CoA) | R.638 |
| Production Control | CCP Monitoring Logs (Hourly/Batch) | HACCP / SANS 10330 |
| Maintenance | Glass & Hard Plastic Monthly Register | FSSC 22000 / BRCGS |
| Validation | Microbiological Laboratory Results (Product/Environment) | ISO 22000 |
| Personnel | Visitor/Contractor Hygiene Declarations | R.638 / Site Security |
| Mitigation | Food Fraud Vulnerability Assessment | FSSC 22000 / GFSI |
| Defence | Food Defence Threat Assessment (TACCP) | ISO 22000:2018 |
Practical Tips for Managing Audit Records
In many South African SME manufacturing environments, records are still kept in lever-arch files. While paper is acceptable, it is prone to being lost, damaged by water, or "filled in later." Auditors are increasingly skeptical of perfectly clean paper records in a messy production environment. Moving toward a digital system like QMSURE provides timestamped entries and automated reminders, which significantly increases auditor confidence in the integrity of your data. Digital systems also prevent the "lost signature" syndrome, where a form is completed but never verified because the supervisor was in a meeting.
Verification is the most critical step. A supervisor should review records within 24 hours of completion. This allows for immediate corrections if a deviation was missed. If you discover an error on a paper record, never use Tipp-Ex or scribble it out. Draw a single line through the error, write the correct value next to it, and initial the change. This maintains the "audit trail" of the record itself.
Remember, the golden rule of auditing is: "If it isn't written down (and verified), it didn't happen." Ensure your team understands that their signature on a document is a legal claim that the task was performed according to the standard operating procedure. Training should emphasize that falsifying records is a disciplinary offense and a direct threat to consumer safety.
Ensuring your records are audit-ready is a continuous process of internal verification and culture building. Shilux offers comprehensive readiness audits and food safety consulting to help South African manufacturers transition from reactive record-keeping to proactive compliance. Whether you need to digitise your QMS with our QMSURE paperless system or require specialized training for your food safety team, our experts are ready to assist you in navigating your next audit with confidence. From internal audits to complex FSSC 22000 implementation, we provide the technical depth required to ensure your documentation stands up to the highest level of scrutiny.