Quick answer
Audit food-safety and HACCP controls by comparing the current procedures with what happens in practice and the evidence of control. Use a risk-based scope, competent review, representative sampling and clear follow-up. An audit should identify whether important controls work; it is not simply a check that every form has a signature.
Define the question, scope and competence
Decide which products, processes, sites and time periods the audit covers and what requirements or approved procedures it will examine. Include relevant hygiene foundations as well as the HACCP study. An audit limited to CCP records can miss the cleaning, supplier or maintenance arrangement on which the plan relies.
MyHACCP’s verification guidance includes auditing records, checking controls, assessing staff understanding and considering wider evidence. Select reviewers who can understand the hazards and challenge the evidence. Where practical, provide independence from the work being reviewed.
Follow a control from design to operation
- Identify the hazard and the approved rationale for the control.
- Read the current instruction and check that staff can find and explain it.
- Observe the task, including the actual equipment and product conditions.
- Sample monitoring, deviations and verification records from a relevant period.
- Trace an exception through the authorised decision and follow-up.
Sampling should reflect risk, changes and known weaknesses. Looking only at the most recent tidy record or the day shift may give an incomplete picture. Record the sample and its limitations so the conclusion is not broader than the evidence.
Combine observation, documents and people
| Evidence | What to examine |
|---|---|
| On-site observation | Whether the real sequence and method match the approved procedure. |
| Staff discussion | Whether the person understands unacceptable results and escalation. |
| Monitoring records | Whether checks are timely, genuine, interpretable and connected to product. |
| Deviation and action records | Whether containment, decisions and effectiveness are supported. |
| Study and review evidence | Whether assumptions and controls remain applicable after changes. |
MyHACCP’s record guidance explains why current documents and operating records serve different purposes. A complete form cannot, alone, establish that the measurement was appropriate or actually taken.
Recognise remote and external-audit limits
A remote review can examine records and support discussions, but it may not provide the same view of layout, handling or equipment as direct observation. State what could and could not be assessed and obtain additional evidence where necessary. Do not describe a document-only review as proof of the entire operation.
For an external audit, organise access to current records and appropriate staff without creating replacement evidence for the occasion. Staff should explain normal practice honestly. The objective is to understand the system, not stage a different operation for the reviewer.
Turn findings into verified action
Illustrative finding: a record is signed, but the person taking the reading cannot explain the measurement location required by the procedure. Describe the evidence and the potential control gap; do not merely record “retrain staff” and close the issue. Check whether the instruction, equipment access, supervision or method needs changing.
Assign actions, owners and proportionate deadlines. Escalate an immediate safety concern through the business’s incident arrangements rather than waiting for the final report. Verify effectiveness and review repeated findings. Audit completion and the number of findings are not substitutes for restored control.
Next steps
- Agree a risk-based scope and competent reviewer.
- Trace important controls through design, practice and operating evidence.
- Record findings with the evidence and limits of the sample.
- Contain urgent concerns and verify that agreed corrective actions work.
Read the official practical guidance — Use the current source alongside the procedures for your own business.