HACCP Audits & Reviews

How to Conduct an Internal HACCP Audit

Running an Effective Internal HACCP Audit in Your Food Business

An internal HACCP audit is your opportunity to find problems before an Environmental Health Officer does. Under EC Regulation 852/2004 (retained in UK law), food business operators must verify that their HACCP-based procedures work in practice, not just on paper. Internal auditing is how you do that. It is a structured, systematic check of your food safety management system against what actually happens in your kitchen. Done well, internal audits catch drift - the gradual gap between documented procedures and daily practice that accumulates in every food business. This guide covers how to plan, conduct, and act on an internal HACCP audit.

Key takeaways

Conduct a full HACCP system audit annually, supplemented by focused audits on specific areas at least quarterly.

The auditor must not be the person responsible for the area being audited - independence is essential for honest findings.

Grade non-conformances as critical (immediate risk), major (significant system failure), or minor (small drift) and set deadlines accordingly.

Track every non-conformance to closure and address root causes, not just symptoms, to drive genuine improvement.

Keep a running log of audit findings over time to demonstrate continuous improvement to EHOs.

Planning the Audit: Scope, Frequency, and Who Does It

Before starting, define what the audit covers. A full HACCP system audit reviews everything: prerequisite programmes, flow diagrams, hazard analysis, CCP monitoring, corrective actions, record keeping, and verification activities. This is comprehensive but time-consuming, so most businesses do a full audit annually and supplement it with focused audits on specific areas throughout the year. A focused audit might cover only temperature monitoring records, or only allergen controls, or only the cleaning schedule. Plan at least four focused audits per year, spread across different areas of your system. The auditor should not be the person responsible for the area being audited. In a small business where the head chef manages food safety, bring in an external consultant or a trained manager from a sister site. In larger operations, train a deputy manager or supervisor in audit techniques. The auditor needs food safety knowledge (Level 3 as a minimum), familiarity with HACCP principles, and the confidence to challenge what they see. Schedule audits at different times: some during peak service, some during prep, some during delivery windows. Problems often hide in specific time slots.

Conducting the Audit: What to Check and How

Start with documentation. Before entering the kitchen, review the HACCP plan, flow diagrams, hazard analysis, CCP records, corrective action logs, cleaning schedules, and training records. Are they complete? Are they up to date? Are corrective actions documented and closed out? Then move to the kitchen and observe. Watch how staff handle food, take temperatures, clean surfaces, and manage allergens. Do not announce the audit in advance if you want to see normal behaviour - a surprise element reveals actual practice rather than performance. Compare what you see against what the documentation says should happen. Key questions to ask during the audit: Are CCP monitoring records being completed at the documented frequency? Do probe thermometer readings match what you measure independently? Are corrective actions being taken when readings are out of range? Is the physical flow of food consistent with the flow diagrams? Are cleaning tasks being completed to the documented standard? Are staff able to explain what they would do if a CCP limit was breached? Interview staff at all levels. The kitchen porter may have more insight into actual cleaning practices than the head chef.

Grading Non-Conformances and Writing the Report

When you find something that does not match the documented procedure, record it as a non-conformance. Grade non-conformances by severity. A common grading system uses three levels: Critical - an immediate food safety risk that could cause harm (e.g. raw meat stored above ready-to-eat food, cooking temperatures consistently below 75C, no allergen controls in place). These require immediate corrective action, potentially stopping the affected process. Major - a significant failure in the system that increases risk but does not pose immediate danger (e.g. temperature logs incomplete for 3 days, cleaning schedule not followed for a specific area, flow diagram out of date by more than 6 months). These require corrective action within a defined timeframe, typically 7 to 14 days. Minor - a small deviation that does not affect food safety but indicates drift (e.g. a single missing signature on a log, a cleaning chemical stored in the wrong location but still separated from food, minor labelling error on a stored container). These should be corrected at the next opportunity. Write the audit report within 48 hours while observations are fresh. For each non-conformance, record: what was found, where, the evidence, the grade, the required corrective action, who is responsible, and the deadline.

HACCP Audits & Reviews

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

Follow-Up and Driving Continuous Improvement

An audit without follow-up is wasted effort. Track every non-conformance to closure. The person responsible for each corrective action should sign off when it is complete, and the auditor (or HACCP team leader) should verify that the action was effective. If the same non-conformance appears in consecutive audits, escalate it - the root cause has not been addressed. Common root causes include inadequate training, unrealistic procedures that staff cannot follow during busy service, broken or insufficient equipment, and lack of management oversight. Address the root cause, not just the symptom. If temperature logs are consistently incomplete during Saturday night service, the solution is not "remind staff to fill them in" - it might be switching to a digital monitoring system that automates the logging. Keep a running log of audit findings over time. This shows trends and demonstrates to EHOs that your food safety system is actively managed and improving. Many businesses find that their non-conformance count drops significantly after the first two or three audit cycles as staff become aware that practices are being checked. Present audit summaries to the HACCP team at each review meeting and use findings to update training priorities.

What to do next

Schedule your next four focused audits

Pick four different areas of your HACCP system (e.g. temperature monitoring, allergen controls, cleaning, supplier management) and assign dates and auditors for each. Spread them across the year.

Create an audit non-conformance tracker

Set up a simple spreadsheet or register that records each finding, its grade, the corrective action required, who is responsible, the deadline, and the closure date. Review it at every HACCP team meeting.

Train a second person in audit techniques

Identify a supervisor or deputy manager and invest in their audit skills. They need to understand HACCP principles, observation techniques, and how to write clear, objective non-conformance statements.

Common mistakes to avoid

Mistake

Only auditing when an EHO inspection is expected

Instead

Internal audits should run to a regular schedule regardless of inspection timing. Reactive-only auditing means you only catch problems after they have persisted for months.

Mistake

Treating audits as a tick-box exercise rather than a genuine investigation

Instead

An audit that asks "do you have temperature logs?" and accepts "yes" without checking the content, completeness, and accuracy of those logs adds no value. Verify the substance, not just the existence of documentation.

Frequently asked questions

How often should I conduct an internal HACCP audit?

Best practice is a full system audit once per year, with focused audits on specific areas (temperature monitoring, allergen controls, cleaning, etc.) at least quarterly. High-risk operations such as care homes, hospitals, and large-scale food manufacturers may audit more frequently. The key is consistency - four thorough audits per year is better than twelve rushed ones.

Can the head chef audit their own kitchen?

Ideally not for the formal internal audit, because they are too close to the daily operation to be objective. They may unconsciously overlook practices they have tolerated or normalised. However, they can and should conduct informal daily checks. For the formal audit, use a manager from another department, a colleague from a sister site, or an external food safety consultant.

What qualifications does an internal auditor need?

There is no legal minimum, but the auditor should have at least Level 3 food safety certification, a solid understanding of HACCP principles, and training in audit techniques. Several UK awarding bodies offer internal food safety auditor courses (typically one or two days). Practical experience in food operations is equally important - an auditor who has never worked in a kitchen will miss context-specific issues.

Should I share audit results with all staff?

Share a summary of key findings and actions with the whole team, not just the managers. Staff are more likely to maintain standards if they understand what was found and why it matters. Present findings constructively - the goal is improvement, not blame. Detailed non-conformance reports can be shared with the HACCP team and relevant managers.

HACCP Audits & Reviews