HACCP guide
HACCP internal audit and verification: what to check, from the flow diagram to the last deviation
How to verify your own HACCP system: validation versus verification, a risk-weighted audit programme, the checks at each CCP and in the hygiene practices, independent auditors, and findings closed with evidence and fed back into reassessment of the plan.
Key points
- A HACCP internal audit is one of the verification activities of Principle 6: it asks whether the plan is being followed and whether it still controls the hazards it was written for.
- Validation comes first and proves the critical limits and the plan can work; verification, including internal audit, then confirms they are working day after day.
- Audit the floor, not the folder: walk the flow diagram, watch a CCP being monitored, check the probe, and trace one deviation from reading to disposition.
- The good hygiene practices carry the plan, so they belong in every internal audit programme alongside the CCPs.
What HACCP verification and internal audit mean
A HACCP internal audit is your own check, made by people trained to audit, that the HACCP system on paper is the system running in the plant, and that it still keeps the significant hazards under control. In the Codex General Principles of Food Hygiene it sits under Principle 6, which asks a food business to validate the HACCP plan and then set up verification procedures confirming the system works as intended. Internal audit is one of those procedures, alongside the review of monitoring records, calibration, product or environmental testing and a periodic reassessment of the whole plan.
Keep these activities apart:
| Activity | The question it answers | When it happens | Typical record |
|---|---|---|---|
| Monitoring (Principle 4) | Is this CCP within its critical limit right now? | During production, at the frequency the plan sets | CCP log signed by the operator at the time of the reading |
| Validation (Principles 3 and 6) | Will this limit, and this plan, actually control the hazard? | Before the plan is relied on, and again after significant change | Validation study, scientific reference or regulatory value behind each limit |
| Verification (Principle 6) | Is the system being applied as designed, and is it effective? | On a planned schedule, plus after incidents and changes | Record reviews, calibration certificates, test results, internal audit reports, reassessment minutes |
| Internal audit (a verification activity) | Across the whole system, does practice match the plan and the hygiene programmes, and is anything drifting? | Programmed over the year, with the full scope covered | Audit programme, audit plan, checklist notes, report, corrective action and closure evidence |
The detail of how the seven principles and twelve steps fit together belongs to the HACCP requirements guide; this guide concerns only how you check them.
Planning the audit programme
Codex does not prescribe an audit frequency, so the programme is yours to design and justify. A defensible pattern is to cover the entire HACCP system and every prerequisite programme at least once a year, and to visit the CCPs, allergen controls and high-care areas more often. A new product, a changed supplier, a complaint or repeated near misses at one CCP should each pull an audit forward.
For each audit, write a short plan giving the scope (which lines, shifts and HACCP studies), the criteria (your HACCP plan, the hygiene procedures and the Codex text or national document you are certified against), the auditors, the date and the records to sample.
Before a first certification audit, compress the programme so that a full-scope internal audit has happened, its findings have been acted on, and the corrective actions have had time to show results. Certification bodies commonly expect a period of operation before they audit, and they will look for your internal audit inside it.
What to check: the plan, the CCPs and the records
Work through the system in the order the hazards move through it.
| Area | What the auditor checks | Evidence to ask for |
|---|---|---|
| HACCP team and product descriptions | Team members still employed and competent; descriptions match current recipes, packaging and intended consumers | Team list with training records; latest product specifications against the description on file |
| Flow diagram | Every step, rework loop and bypass on the floor appears on the diagram | The diagram carried along the line and marked up during the walk |
| Hazard analysis | Reasoning exists for each hazard kept or dismissed; new raw materials and allergens are included | Worksheets with dates, compared with the current ingredient list |
| CCPs and critical limits | Operators can name their CCP, its limit and what they do at a deviation; each limit has a validation reference | Short interviews at the line; the validation file for each limit |
| Monitoring | Readings are taken at the stated frequency, written at the time, and include the misses | Logs sampled across different weeks and shifts, compared with production records |
| Measuring equipment | Thermometers, probes, metal detectors and timers used at CCPs are calibrated or checked | Calibration records, daily test-piece checks, identification on each instrument |
| Corrective actions | Affected product was identified and held, the cause found, disposition decided by an authorised person | One deviation traced from log entry to hold record, investigation and release or disposal |
| Verification and reassessment | Record reviews are signed by someone other than the operator; the plan was reassessed after changes | Reviewer signatures, test results, dated reassessment records |
A worked trace
Pick a cooking CCP. Ask the operator to take a reading while you watch, then check the probe's identification against the calibration list. Pull the log for three production days a month apart and compare the number of readings with the batches produced that day. Find one reading outside the limit, or ask why there is none in six months, and follow it to the held product, the root cause and the person who authorised release.
Auditing the good hygiene practices under the plan
Codex treats prerequisite programmes, including good hygiene practices, as the foundation for an effective HACCP system, so the internal audit tests them with the same rigour as the CCPs. Look at cleaning and its verification, pest control, zoning, personal hygiene at entry, allergen segregation, supplier approval, maintenance in production areas and transport.
The judgement to make is not whether each record exists, but whether the practice holds up the hazard analysis. If the hazard analysis dismissed cross-contamination at a step because of zoning, and the zoning is breached daily by a shared forklift, the plan's assumption has failed. Record that link in the finding. The prerequisite programmes guide covers how to set these programmes up.
Who should audit, and how it differs from the certification audit
Internal auditors need two kinds of knowledge: how to audit, and enough food technology to recognise whether a limit, a cleaning method or a hazard assessment makes sense. Train people from several departments to audit areas other than their own. The HACCP team leader should not audit the plan they wrote; a trained colleague or an external auditor can cover that part. ISO 19011, whose 2026 edition replaced the 2018 text in May 2026, is the usual guidance on audit method.
The certification body's audit is a different exercise. It samples your system over a short visit to decide whether a certificate can be issued or kept, and it is performed by an independent body. Your internal audit covers more ground, over a year, to find problems early. The external auditor will read your internal audit reports and test whether the findings were closed. The visits themselves are covered in the HACCP certification process guide.
How Sterling strengthens your HACCP verification
Trained internal auditors, a risk-based programme and findings closed with evidence.
In a Sterling HACCP engagement, internal auditor training is provided for your team as applicable, the audit programme and verification schedule are set up in Effivity, and the first full-scope internal audit of the plan and the hygiene practices is conducted or facilitated with your people before the certification body arrives. Effivity, used in 50+ countries, is included with the engagement, at no additional cost. Sustain™ keeps verification and reassessment running afterwards. We ensure successful certification for our clients. Sterling does not certify; an independent certification body audits and decides.
Book a free discovery callReporting, follow-up and reassessing the plan
Write each finding in three parts: the requirement (a line in your HACCP plan, a hygiene procedure or the certified document), the evidence another person could check, and the gap stated as fact. Grade them major or minor, as a certification body would.
Issue the report to the HACCP team leader and site management within days. The owner of each finding records the immediate correction, the root cause and the corrective action; the auditor returns to confirm the action worked. Fresh monitoring logs completed correctly for several weeks are proof of closure; a reprinted log template is not.
Feed the year's findings, deviations and complaints into the reassessment of the HACCP plan. Recurring findings at the same step are a signal that the hazard analysis, the CCP decision or the critical limit needs to be revisited, not just the operator retrained.
HACCP internal audit and verification: questions buyers ask
How often should a HACCP internal audit be carried out?
At least once a year across the full HACCP system and hygiene programmes is a common pattern; Codex sets no fixed frequency. Audit CCPs and high-risk areas more often, and add audits after changes, complaints or repeated deviations.
What is the difference between HACCP validation and verification?
Validation proves in advance that a critical limit or the plan can control the hazard; verification confirms afterwards that it is being applied and working.
Can the HACCP team leader do the internal audit?
They can audit other areas, but not the plan they wrote. An auditor who checks their own work finds what they expect, so use a trained colleague or an external auditor for that part.
Do HACCP internal auditors need formal training?
Codex does not name a qualification, but auditors must be competent in audit technique and in the food safety principles they are checking. A training record plus supervised audits is the clearest evidence to show a certification body.
Can we use a checklist for a HACCP internal audit?
Yes, to support the audit plan, but it must not replace observation, interviews and sampling. A checklist ticked at a desk will not reveal monitoring logs completed at the end of a shift.
Should verification findings change the HACCP plan?
Yes, when they point to a design weakness. Recurring deviations or findings at one step should trigger reassessment of the hazard analysis, the CCP decision or the critical limit.
More HACCP guides
Every guide in the HACCP series is written for one question and links back to the hub for the whole picture.
- HACCP certification cost: what moves the price
- HACCP certification process, step by step
- Effivity for HACCP: the guide
- HACCP vs ISO 22000 vs FSSC 22000
- Hazard analysis and the CCP decision tree: a worked example
- HACCP internal audit and verification: what to check
- Prerequisite programmes and good hygiene practices
- HACCP requirements explained: the twelve steps
- HACCP training: who needs what
- HACCP vs ISO 22000 vs FSSC 22000: which one, and when
Keep exploring
Explore more about HACCP
Watch a video on how to implement HACCP here.
Watch a video on HACCP requirements here.
HACCP resources
Services for HACCP
Industries
Talk to a consultant
Build HACCP verification that tests the line, not just the logbook.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice