ISO 22000 clause 9.2: audit the food safety system for useful evidence

What clause 9.2 requires in practice

Clause 9.2 requires internal audits at planned intervals. They provide information on whether the FSMS conforms to the organisation's own requirements and to the standard, and whether it is effectively implemented and maintained.

To achieve that, the organisation plans and maintains an audit programme covering frequency, methods, responsibilities, planning and reporting, taking account of the importance of processes, changes to the FSMS, and results of monitoring, measurement and earlier audits. Each audit has defined criteria and scope. Auditors are competent, and the process is objective and impartial. The food safety team and the managers concerned receive the results, and evidence of the programme and its results is kept. Necessary correction and corrective action are completed within an agreed time frame. The audits also test whether the FSMS delivers what the food safety policy and objectives set out to achieve. Follow-up includes verifying actions taken and reporting that verification. The standard points to ISO 19011 for audit guidance.

Plan a programme around the system's needs

Establish and maintain an audit programme covering frequency, methods, responsibilities, planning and reporting. Consider process importance, FSMS changes, monitoring and measurement results and earlier audits. These factors should influence priorities rather than every area receiving identical attention by habit.

Define scope and criteria for each audit. The scope identifies the relevant activities and boundaries; criteria establish the requirements against which evidence is evaluated. Include the organisation's own applicable arrangements as well as the standard.

Use information from performance analysis. Recurring verification concerns or a significant process change may justify a focused audit.

Why internal audit finds what routine checks miss

Daily monitoring tells a team whether a limit was met today. Internal audit asks a different question: is the whole arrangement working, including the parts nobody looks at often. It finds the instruction that was never updated, the handover where responsibility is unclear, and the record that exists only because someone fills it in at the end of the week. Finding these internally is far cheaper than hearing about them from a customer audit or an inspector. A credible internal audit also gives top management an independent view that is not filtered by the people running the process. For customers who rely on supplier assurance, evidence of audits that have raised real findings and followed them through is a sign of maturity, not weakness.

How to implement clause 9.2

Design the audit programme to follow risk and change, and to produce findings people can act on.

1. List the processes, sites and shifts in scope and rank them by food safety importance, recent change and performance data.
2. Set the programme so that high-risk or recently changed areas are covered more often and in more depth than stable ones.
3. Choose auditors who combine audit skill with enough technical understanding to question hazard-control decisions, and protect them from auditing their own work.
4. Write the criteria and scope for each audit, including the organisation's own procedures as well as the standard.
5. Audit by following product, people and evidence through real operations, including nights and weekends where relevant.
6. Report findings clearly, linking requirement, evidence and gap, and send them to the food safety team and relevant managers.
7. Verify each corrective action in a follow-up and report the result, so closure means the problem is gone.

Use competent auditors and impartial methods

Follow evidence from requirement to outcome

Use interviews, observation and relevant records to examine implementation. For a control change, an audit can follow the technical decision, updated plan, personnel competence, actual monitoring and response evidence.

Evaluate whether the FSMS meets the intent of its food safety policy and objectives. A system may have many completed activities while failing to deliver the intended arrangements or address known weaknesses.

State findings clearly, connecting the requirement, evidence and gap. Avoid vague criticism or unsupported conclusions based on a single unexplored impression.

Report and follow through

Report results to the food safety team and relevant management. Retain evidence of programme implementation and audit results. Necessary correction and corrective action must occur within the agreed timeframe.

Follow-up includes verifying actions taken and reporting the verification results. Closing a finding because an action owner says it is complete does not establish that the issue has been resolved effectively.

Illustrative food-manufacturing example

Illustrative catering example

A caterer audits an evening service after verification results suggest a handover weakness. The auditor observes the actual arrangement and samples records and responsibilities across both teams.

The audit identifies a gap that daytime document review had not revealed. Its timing and scope follow the evidence about process importance and earlier performance.

Evidence and common mistakes