Short answer: most sites that fail an audit do not fail because their food safety system is wrong. They fail because the evidence behind it is thin, stale, or contradicted by what happens on the floor. Audit readiness is not a week of tidying files before the certification body arrives — it is a state your system is either in or not in, on any random Tuesday. Below are twelve warning signs we repeatedly see in South African readiness audits, what an auditor will do when they spot each one, and what to fix first.
Why "we passed last year" is not evidence of readiness
A certification audit is a sample. An auditor sees perhaps two or three days of a year's worth of operation, and they choose where to look based on what the first hour tells them. If the opening document review is clean and your team answers confidently, the sample stays shallow. If early evidence wobbles, the sample deepens — more records, more traces, more interviews — and that is where major non-conformances come from.
Note the distinction throughout this article. In South Africa, some of these items are legal duties under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and its regulations (for example hygiene requirements for food premises under R638, and labelling requirements under R146), enforced by environmental health practitioners. Others are requirements of a certification scheme such as FSSC 22000, BRCGS or ISO 22000, or simply a customer contract. Both matter, but they carry different consequences, and confusing them leads to badly prioritised effort. Our food safety audits guide sets out that split in more detail.
The 12 warning signs
1. Records that are complete but unverified
CCP monitoring sheets filled in for every shift, with no signature or date from a supervisor or the food safety team leader, are the single most common finding we see. A record without verification only proves someone wrote something down. Auditors test this by pulling a month at random and looking for the second signature — and for what happened on the days a limit was exceeded.
2. Overdue or unsupported calibration
Thermometers, scales, metal detector test pieces and pH meters used for CCP or critical quality decisions must be calibrated on a defined frequency, traceable to a national standard where the scheme requires it. The warning signs: a calibration schedule with dates in the past, certificates that cannot be produced on the day, or in-house verification with no reference against a calibrated master. Ask yourself what happens to product released on a device found out of calibration — if you cannot answer, that is a finding waiting to happen.
3. Open or repeating corrective actions
A CAPA log with items open past their due date tells an auditor the system does not close its own loop. Worse is the repeat: the same non-conformance raised again a year later, closed both times with "operator retrained". That is a corrective action addressing a symptom. If your log shows recurrence, do the root cause work properly before the audit — see root cause analysis and CAPA effectiveness verification.
4. An internal audit programme that is behind or too shallow
Your internal audit schedule must cover the whole system across the cycle, including the parts nobody enjoys auditing: management review, document control, supplier approval, the HACCP plan itself. Warning signs are a schedule with unaudited months, every internal audit closing with zero findings, or the same person auditing their own area. Internal audits that never find anything are not proof of excellence — they are proof of a weak programme. The internal audit method and internal audit checklist cover how to raise the depth.
5. Uncontrolled documents on the floor
Walk your production area and check the version number on every work instruction, cleaning schedule and specification posted at a workstation. If any of them do not match the master list, you have a document control finding and, more seriously, people following superseded instructions. Laminated sheets and photocopies taped to machines are where this hides.
6. Competence evidence that is really just an attendance register
A signed training register proves attendance. Schemes expect evidence of competence: an assessment, a supervised practical sign-off, or a documented observation that the person can actually perform the task. This bites hardest for CCP monitors, internal auditors and anyone doing verification activities. Check that every named CCP monitor has current, task-specific evidence on file.
7. A hazard analysis that has not moved since the last change
New line, new supplier, new allergen, new pack format, new rework route, a change in intended use — each is a trigger to revisit the HACCP study, and each is a place auditors look first because change is where control breaks. Compare your last hazard analysis review date against your change log. If the change log is longer, that gap is your finding.
8. Traceability and mock recall exercises that were never truly tested
The warning signs: an exercise done once a year, always forward, always on an easy product, always during day shift, with no mass balance and no timing recorded. A credible test traces both directions, reconciles quantities to an acceptable percentage within a stated time limit, and includes at least one exercise involving rework or a shared ingredient. Under South African law, recall capability sits with the food business, and the National Consumer Commission oversees recalls under the Consumer Protection Act. See how to conduct a mock recall and the traceability exercise checklist.
9. Supplier approval gaps
Pull five raw material suppliers at random and ask for the approval file: risk assessment, current certificate or audit, agreed specification, and the last performance review. The common failures are expired certificates nobody tracked, a supplier used in an emergency and never formally approved, and specifications that do not match what is actually being delivered. Start with the supplier approval process.
10. A visible gap between the procedure and the practice
The procedure says the sanitiser dwell time is five minutes; the team gives it two because the line is waiting. The procedure says glass breakage triggers a documented line clearance; in practice someone sweeps up. Auditors find this by watching, not reading. Before an audit, walk three processes end to end against the written procedure and correct whichever one is wrong — sometimes it is the procedure.
11. Management review that exists as a meeting, not as evidence
Management review must show the required inputs (audit results, verification outcomes, customer complaints, incidents, resource needs, objectives performance), a decision, an owner and a due date. Minutes that record attendance and a general discussion, with no decisions tracked to completion, will not carry an auditor — especially where senior management commitment is being assessed.
12. Staff who cannot explain their own control or escalation route
Ask an operator what their critical limit is, what they do when it is breached, who they call, and what happens to the product made since the last good check. Hesitation here undoes a great deal of good paperwork, because it tells the auditor the system lives in a file rather than in people. It is also the clearest measure of food safety culture that any auditor has access to.
Your audit-readiness action plan
If several of the twelve apply to you, work in this order — it follows the risk, not the effort.
- This week: close or re-plan every overdue CAPA and every overdue calibration. These are the fastest majors to earn and the fastest to fix.
- Week two: verify a month of CCP records end to end, including deviations, and confirm every named CCP monitor has current competence evidence.
- Week three: run a full two-way traceability and mock recall exercise on a difficult product, with a mass balance and a stopwatch. Record what failed; that is the point of the exercise.
- Week four: reconcile the change log against the hazard analysis review date and update the study where change has outpaced it.
- Week five: audit document control by walking the floor, and pull five supplier approval files at random.
- Week six: hold a management review that produces dated, owned actions, then brief supervisors and run floor interviews to test escalation knowledge.
For a structured sequence with more detail, use the audit preparation guide and the final audit readiness checklist. If you want to know which findings tend to appear at South African sites, common food safety audit findings lists the recurring ones and their causes.
Where Shilux fits
Most teams can work through this list themselves. Where an outside pair of eyes helps is in the honest scoring: a readiness audit against your target scheme, or a gap audit if you are certifying for the first time, will tell you where you actually stand before a certification body does. If the weakness is in the internal audit programme itself, we also run internal audits and internal auditor training. And if the underlying problem is that records are on paper and impossible to verify at scale, that is what QMSure was built for.
This is the first article in our September audit readiness series. Talk to the Shilux team if you would like your site assessed before your next audit window.