To audit your food safety system effectively before an external auditor arrives, you must conduct a rigorous internal audit that mirrors the scope and intensity of the upcoming assessment. This involves verifying that your physical site meets R.638 hygiene requirements, validating that Critical Control Points (CCPs) are monitored according to your HACCP plan, and ensuring all personnel follow documented Prerequisite Programmes (PRPs) in real-time. Effective auditing is not just a box-ticking exercise; it is a critical diagnostic tool to identify systemic weaknesses before they manifest as product recalls or audit failures.
Key Takeaways
- Conduct a vertical audit by following one production batch from raw material receiving to final dispatch.
- Prioritize compliance with South African R.638 regulations as the legal baseline for any food facility.
- Test your food safety culture by interviewing floor-level staff, not just management.
- Use a robust internal audit checklist to ensure no clause of your chosen standard is overlooked.
- Verify that all previous audit findings and nonconformities have been closed with effective corrective actions.
1. The Foundation: Regulatory vs. Certification Audits
In the South African manufacturing context, you are balancing two distinct sets of requirements. First is the legal mandate: The Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and specifically Regulation R.638. Every facility must possess a valid Certificate of Acceptability (CoA) issued by the local municipality's Environmental Health Practitioner (EHP). Failure to comply with R.638 is a criminal offence and can lead to immediate site closure, regardless of your private certification status.
Second is the voluntary or commercial requirement, such as FSSC 22000, BRCGS, or ISO 22000. While an EHP focuses on basic hygiene and structural compliance (e.g., floor-to-wall coving and ventilation), a GFSI-recognised auditor will dig deeper into management commitment, food safety culture, and hazard validation. Understanding the difference between a CoA and FSSC 22000 is vital; one grants you the legal right to operate, while the other grants you market access to major retailers like Woolworths, Checkers, or Pick n Pay. Your internal audit must cover both to be truly effective.
2. Step-by-Step Internal Audit Execution
Phase 1: The Facility Walkthrough (The "EHP Eye")
Start where the auditor starts: the perimeter. In many South African industrial areas, such as those in City Deep or Germiston, pest control and waste management are significant challenges due to neighboring properties. Check that your waste area is enclosed and that bait stations are secured and serviced. Inside the facility, look for the "silent" nonconformities: flaking paint on non-food contact surfaces, leaking overhead pipes, or worn seals on cold room doors. These are the red flags that suggest a lack of maintenance oversight.
During the walkthrough, pay specific attention to food premises requirements. A common failure mode is the "temporary" repair—using duct tape or cable ties on machinery—which becomes a permanent foreign body risk. If you find these, document them immediately as a non-conformance rather than fixing them silently. This demonstrates to the external auditor that your GMP audits are actually identifying risks.
Phase 2: The Vertical Traceability Challenge
Select a production run from three months ago. An auditor will ask to see the full trail. You must be able to produce the following within a four-hour window, as per GFSI benchmarks:
- Raw material COAs (Certificates of Analysis) and receiving logs linked to specific batch codes.
- Cleaning logs for the specific line used that day, verified by a supervisor.
- CCP monitoring records (e.g., pasteurisation temperatures or metal detector checks) with evidence of corrective action if limits were exceeded.
- Staff training records for the operators on shift during that run, including their basic food safety training certificates.
- Final product dispatch records and mass balance calculations (ensuring the volume of raw materials used equals the volume of finished goods produced plus waste).
If there are gaps in this paper trail, you have a traceability failure that could lead to a major nonconformity. Use a traceability exercise checklist to ensure you haven't missed secondary packaging or rework ingredients in your calculation.
Phase 3: Personnel Interviews
Auditors no longer just look at paperwork; they talk to the people doing the work. During your internal audit, ask a packer: "What do you do if you see a cockroach?" or "What is the critical limit for this metal detector?" If they look at the supervisor for the answer, your food safety culture needs intervention. The auditor needs to see that food safety is decentralised and understood by everyone. Effective food safety culture training ensures that every employee, from the cleaner to the CEO, understands their role in preventing contamination.
3. Critical Focus Areas Checklist
Use the following expanded table to assess high-risk zones that frequently result in audit findings in South African manufacturing plants.
| Focus Area | Standard/Requirement | Common Red Flags & Failure Modes | Verification Method |
|---|---|---|---|
| CCP Monitoring | SANS 10330 / HACCP | Missing signatures, "perfect" data (dry labbing), out-of-calibration probes. | Review CCP examples and cross-check against auto-logs. |
| Facility Hygiene | R.638 / ISO 22002-1 | Stagnant water in drains, dirty boot washes, lack of soap/towels at basins. | Visual inspection and ATP swab testing of "clean" surfaces. |
| Allergen Control | R.146 Labelling Regs | Shared scoops for different ingredients, poor labeling of work-in-progress. | Observe changeover cleaning and check regulatory compliance of labels. |
| Pest Management | PRP Requirement | Gaps under external doors, evidence of bird nesting in warehouses. | Review pest contractor reports for "open" recommendations. |
| Food Defence | FSSC 22000 / GFSI | Unsecured chemicals, open external gates, visitors without badges. | Perform a threat assessment walk-through. |
| Supplier Quality | FSSC 22000 V6 | Expired CoAs, unapproved suppliers used for "urgent" orders. | Check the approved supplier list against recent invoices. |
4. Documenting the Internal Audit Correctively
A common mistake is recording an internal audit where everything is "compliant." External auditors view 100% compliance during an internal audit as a sign of a weak auditing process. A real manufacturing environment has minor issues—a light bulb out in the warehouse, a slightly worn gasket, or a missing signature on a non-critical log. Finding and documenting them proves your system is working.
For every finding, you must initiate a CAPA process. This isn't just about fixing the immediate problem (correction); it's about identifying why it happened (root cause) and preventing it from happening again (corrective action). For example, if a hand-wash station is broken, the correction is to fix it. The corrective action is to update the weekly maintenance schedule to include plumbing inspections. Use tools like the 5-Whys explained or a fishbone diagram to ensure you are reaching the actual systemic cause of the failure.
5. Addressing Food Fraud and Authenticity
With the rise of economically motivated adulteration, auditors are placing higher scrutiny on how South African businesses handle raw material integrity. During your internal audit, review your vulnerability assessment (VACCP). Ask yourself: are you buying high-risk ingredients like honey, spices, or olive oil from unverified brokers? If you cannot prove the food authenticity of your high-value ingredients, you are at risk of a major non-conformity. Review your supplier approval and VACCP processes to ensure they include testing or origin verification for high-risk items.
6. Managing the "Paperwork Mountain"
One of the biggest hurdles for South African SMEs is the sheer volume of logs required for FSSC 22000 or BRCGS compliance. Before the auditor arrives, ensure your documentation is organised. An auditor’s frustration grows when they have to wait 20 minutes for a single cleaning log or a CoA requirements checklist. Consider digitising these records to ensure they are searchable, time-stamped, and tamper-proof.
Ensure that all prerequisite programmes are not just documented, but verified. Verification means a second person (usually a supervisor) has checked the work. If you have 500 logs but no verification signatures, the logs are practically worthless in the eyes of a certification body.
7. The Pre-Audit "Huddle" and Food Safety Culture
In the week leading up to the audit, hold a management meeting to review your Food Safety Culture. Ensure the food safety culture assessment results and the subsequent action plans are ready for review. The auditor will want to see that senior management is providing the resources (budget, time, equipment) necessary to maintain the system. This is a requirement of leadership in food safety; if the MD cannot explain the food safety policy, the facility may fail the audit regardless of how clean the floors are.
Practical Audit Day Tips
- Appoint a Guide: Choose someone who knows the plant and the system intimately. This person should be empowered to answer questions but should not "over-answer."
- Have a Scribe: Ensure someone is taking notes on every comment the auditor makes—these are hints for future improvements. Often, an auditor makes a verbal suggestion that isn't a non-conformity yet, but will be next year.
- Be Transparent: Never try to hide a mistake or falsify a record. If you found a problem and are already working on the how to close a CAPA process, show it to the auditor. It demonstrates a proactive, mature management system.
- Prepare the Boardroom: Have your food recall plan, HACCP manuals, and internal audit reports ready in the room. Delays in finding documents suggest a lack of control.
How Shilux Can Support Your Audit Readiness
Preparing for an audit can be overwhelming, especially when balancing production targets with strict compliance requirements. At Shilux, we provide expert readiness audits to identify your gaps before the formal certification body arrives. Our consultants specialize in the South African regulatory landscape, helping you navigate everything from how to apply for a CoA to implementing complex GFSI standards.
Whether you need specialized food safety training for your team, a deep dive into root cause analysis to stop recurring issues, or a transition to the QMSURE paperless management system to eliminate document stress, our consultants are here to ensure you achieve and maintain your certification with confidence. Don't wait for a food recall to find the gaps in your system—be proactive and audit-ready today.