How to Conduct an Internal Food Safety Audit

An internal food safety audit is a planned self-check where you compare what your business actually does against your food safety program and the Food Standards Code. Set a scope, work through a written checklist covering temperature control, cleaning, personal hygiene, pest control and records, score each item, then log corrective actions with owners and due dates. Many businesses audit monthly or quarterly. Confirm specific obligations with your council or state regulator. Key takeaways: An internal audit verifies that your food safety program is being followed in practice, not just written down — it is your early-warning system before a council or third-party audit.. Use a written, scored checklist that mirrors the Food Standards Code and your own program: temperature control, cleaning and sanitising, personal hygiene, pest control, allergen management and record-keeping.. Frequency should match your risk — many businesses run a light self-check monthly and a full internal audit quarterly; higher-risk operations audit more often.. A finding is not closed until the corrective action is done, verified and dated — assign an owner and a due date to every non-conformance.. Keep the completed audit, the score and the corrective-action records; they demonstrate active management of food safety and support your due-diligence position.. Suggested audit cadence: Cadence, What to do. Daily/weekly — Quick line checks built into normal operation (temperatures, cleaning sign-off). Monthly — A focused self-check on a rotating area or the highest-risk items. Quarterly — A full internal audit against the complete checklist, scored. After a trigger event — An unscheduled audit following a complaint, failed inspection or major change. What an internal food safety audit is (and isn't) An internal food safety audit is a structured self-assessment where a member of your own team compares day-to-day practice against your documented food safety program and the requirements of the Australia New Zealand Food Standards Code. It is different from a routine daily check (like recording fridge temperatures) because it steps back and asks whether the whole system is working: are the records actually being filled in, is the cleaning schedule real, do staff follow it when no one is watching? It is also different from an external audit — the inspection carried out by your local council environmental health officer (EHO) or an approved third-party auditor. Standard 3.2.2A generally requires many food service, catering and related retail businesses that handle unpackaged, potentially hazardous, ready-to-eat food to manage food safety through a set of tools: a food safety supervisor, food handler training in skills and knowledge, and (for higher-risk 'Category 1' businesses) substantiation records that show key controls are working. An internal audit is how you check those controls are genuinely in place before someone external does. Think of it as a dress rehearsal that also improves the show. Internal = you checking your own compliance, on your schedule. External = council EHO or approved third-party auditor, sometimes unannounced. A daily temperature log is a control; the internal audit checks that the control is working and documented. Why bother — the business case for self-auditing Beyond staying on the right side of the regulator, internal audits catch small problems while they are still cheap to fix. A cool-room drifting up a couple of degrees, a hand-wash sink used to thaw chicken, a cleaning chemical decanted into an unlabelled bottle — these are the drifts that become a failed council inspection, a customer complaint, or worse, a foodborne illness incident. Regularly demonstrating that you actively find and fix issues also supports a due-diligence position: if something does go wrong, contemporaneous audit and corrective-action records show you were managing food safety systematically rather than leaving it to chance. Confirm how due diligence and record-keeping are treated in your state or territory, because food safety is enforced under state and territory legislation (administered largely by councils), not by FSANZ directly. Build your self-audit checklist A good checklist mirrors both the Food Standards Code and your own food safety program, broken into clear sections so nothing is missed. Keep each line item specific and observable — 'cool-room at or below 5°C, verified with calibrated probe' is auditable; 'fridges okay' is not. Base the content on the hazards relevant to your operation, and align allergen items with the Plain English Allergen Labelling (PEAL) requirements under Standard 1.2.3 where packaged-food labelling applies, and with the requirement to give accurate allergen information for unpackaged food on request. Below are the core sections most food businesses should include. Temperature control: cold storage at or below 5°C, hot holding at or above 60°C, cooking to safe core temperatures, two-stage cooling (generally 60°C to 21°C within 2 hours, then 21°C to 5°C within a further 4 hours), calibrated probe thermometers. Cleaning and sanitising: documented schedule followed, correct chemicals and contact times, food-contact surfaces cleaned then sanitised, cloths and equipment managed. Personal hygiene: hand-washing facilities stocked and used, clean clothing, no working while ill (particularly with vomiting or diarrhoea), cuts covered with a waterproof dressing. Cross-contamination: raw and ready-to-eat separated, colour-coded boards/utensils where used, correct storage order in fridges (ready-to-eat above raw). Allergen management: accurate allergen information available, PEAL-aligned labelling where packaged food applies, controls against cross-contact, staff able to answer allergen questions. Pest control: no signs of pests, proofing intact, bait stations serviced, pest reports on file. Receiving and storage: goods checked on delivery (including temperature of cold/hot items), stock rotation (FIFO), date marking, food covered and off the floor. Structure and equipment: surfaces sound and cleanable, adequate lighting, working sinks and hot water. Records and program: temperature logs, cleaning records and corrective-action logs completed and current; food safety supervisor details up to date. Skills and knowledge: staff trained appropriately for their role and able to describe key controls. Decide how often to audit There is no single legislated frequency for internal audits — it depends on your risk profile, your history and what your food safety program specifies. A common and defensible approach is to run a short self-check frequently and a full internal audit on a longer cycle. Higher-risk operations (for example, those cooking and cooling large volumes, serving vulnerable groups such as in aged care, hospitals or childcare, or handling ready-to-eat food extensively) generally warrant more frequent auditing. Increase frequency temporarily after a failed external audit, a customer complaint, a new menu, a kitchen refit, or significant staff turnover. Set the cadence in writing so it actually happens rather than slipping. Daily/weekly: quick line checks built into normal operation (temperatures, cleaning sign-off). Monthly: a focused self-check on a rotating area or the highest-risk items. Quarterly: a full internal audit against the complete checklist, scored. After a trigger event: an unscheduled audit following a complaint, failed inspection or major change. Score the audit consistently Scoring turns a checklist into a trackable measure you can compare over time and use to prioritise. Keep the method simple and consistent so different auditors reach similar results. Two common approaches work well. The first is a straightforward compliant / non-compliant / not-applicable tally, expressed as a percentage of applicable items met. The second weights items by risk severity, so a critical failure (for example, ready-to-eat food stored in the temperature danger zone) costs more than a minor one (a missing date label on a low-risk item). Classifying findings by severity is more useful than a single number because it tells you what to fix first. Whatever you choose, define the categories in writing and record the score each time so trends are visible. Critical / major non-conformance: a direct food-safety risk requiring immediate action (e.g. unsafe temperatures, evidence of pests, no hand-washing facilities). Minor non-conformance: a lapse that should be corrected but is not an immediate hazard (e.g. an incomplete record, a small structural repair). Observation / opportunity: not a breach, but a chance to improve before it becomes one. Score as a percentage of applicable items met, and track it audit-over-audit to spot decline early. Close out corrective actions The audit only delivers value when findings are fixed and verified. For every non-conformance, record what the issue was, the root cause where you can identify it, the corrective action, who is responsible, the due date, and — critically — the date it was verified as complete with evidence. Immediate corrections (discarding food left in the danger zone, sanitising a surface) should happen on the spot, but also address why it happened so it does not recur. A finding stays 'open' until someone has confirmed the fix actually worked; closing an item simply because time passed defeats the purpose. Review any overdue actions at the next audit and escalate them. Keep these records with the audit itself. Describe the finding and, where possible, the root cause — not just the symptom. Take immediate corrective action for any live food-safety risk. Assign a single owner and a realistic due date to every action. Verify and date the close-out with evidence (a photo, a corrected record, a re-check reading). Carry unresolved actions forward and escalate anything overdue. Keep the evidence and follow up Retain the completed checklist, the score, photos, and the corrective-action log. These records show a regulator — and yourself — that you are actively managing food safety rather than reacting after the fact. Under the risk-based Standard 3.2.2A framework, being able to substantiate that controls are working is central for Category 1 businesses, so treat your internal audit records as part of that evidence. Set a retention period in your program (a rolling period such as the last one to two years of records is a common practical approach, but confirm what your regulator, licence conditions or program actually require) and store records so they can be produced on request. Finally, close the loop: brief the team on what the audit found, acknowledge what is working, and confirm the fixes stuck at the next cycle. Worked examples: Closing out a corrective action: An audit finds a cleaning chemical decanted into an unlabelled bottle. The auditor logs the finding and root cause, corrects it on the spot, and assigns an owner and due date to fix the labelling system. The finding stays open until someone confirms the fix worked and dates the close-out with evidence - closing it simply because time passed would defeat the purpose. Auditing during real operation: Rather than signing off records at a desk, the auditor walks the floor during service. They watch hand-washing, probe cool-room food themselves with a calibrated thermometer, and check storage order. This reveals whether practice matches the written program - the whole point of an internal audit, as opposed to just confirming a log has been filled in. Checklist: Scope, date and auditor decided in advance. Written checklist current and aligned to your program and the Code. Temperatures verified on the day with a calibrated probe (cold ≤5°C, hot ≥60°C). Cleaning, personal hygiene, cross-contamination and allergen controls observed in practice. Pest control, receiving, storage and structure inspected. Records checked for completeness (temperature, cleaning, corrective-action logs). Each item scored and non-conformances classified by severity. Corrective actions logged with owner, due date and root cause. Immediate risks corrected on the spot. Actions verified, dated and closed with evidence; overdue items escalated. Audit, score and corrective-action records filed and retained. Results shared with the team and next audit scheduled. Common mistakes: Auditing on paper only — signing off records without walking the floor to see whether practice matches the program. Using a vague checklist ('fridges okay') instead of specific, observable, measurable items. Letting the person responsible for an area audit their own work with no independent check. Recording findings but never closing them — an open corrective action that drifts for months is a failed control. Treating every finding as equal instead of ranking by risk, so critical issues wait behind trivial ones. Auditing only when an external inspection is looming, rather than on a consistent schedule. Not verifying the fix — assuming a corrective action worked without a re-check or evidence. Throwing away old audits, losing the trend data and the due-diligence record they represent.