A practical Australian guide to running an internal food safety audit: build a self-audit checklist, set frequency, score results, and close corrective…
An internal food safety audit is a planned self-check where you compare what your business actually does against your food safety program and the Food Standards Code. Set a scope, work through a written checklist covering temperature control, cleaning, personal hygiene, pest control and records, score each item, then log corrective actions with owners and due dates. Many businesses audit monthly or quarterly. Confirm specific obligations with your council or state regulator. Key takeaways: An internal audit verifies that your food safety program is being followed in practice, not just written down — it is your early-warning system before a council or third-party audit.. Use a written, scored checklist that mirrors the Food Standards Code and your own program: temperature control, cleaning and sanitising, personal hygiene, pest control, allergen management and record-keeping.. Frequency should match your risk — many businesses run a light self-check monthly and a full internal audit quarterly; higher-risk operations audit more often.. A finding is not closed until the corrective action is done, verified and dated — assign an owner and a due date to every non-conformance.. Keep the completed audit, the score and the corrective-action records; they demonstrate active management of food safety and support your due-diligence position.. What an internal food safety audit is (and isn't) An internal food safety audit is a structured self-assessment where a member of your own team compares day-to-day practice against your documented food safety program and the requirements of the Australia New Zealand Food Standards Code. It is different from a routine daily check (like recording fridge temperatures) because it steps back and asks whether the whole system is working: are the records actually being filled in, is the cleaning schedule real, do staff follow it when no one is watching? It is also different from an external audit — the inspection carried out by your local council environmental health officer (EHO) or an approved third-party auditor. Standard 3.2.2A generally requires many food service, catering and related retail businesses that handle unpackaged, potentially hazardous, ready-to-eat food to manage food safety through a set of tools: a food safety supervisor, food handler training in skills and knowledge, and (for higher-risk 'Category 1' businesses) substantiation records that show key controls are working. An internal audit is how you check those controls are genuinely in place before someone external does. Think of it as a dress rehearsal that also improves the show. Internal = you checking your own compliance, on your schedule. External = council EHO or approved third-party auditor, sometimes unannounced. A daily temperature log is a control; the internal audit checks that the control is working and documented. Why bother — the business case for self-auditing Beyond staying on the right side of the regulator, internal audits catch small problems while they are still cheap to fix. A cool-room drifting up a couple of degrees, a hand-wash sink used to thaw chicken, a cleaning chemical decanted into an unlabelled bottle — these are the drifts that become a failed council inspection, a customer complaint, or worse, a foodborne illness incident. Regularly demonstrating that you actively find and fix issues also supports a due-diligence position: if something does go wrong, contemporaneous audit and corrective-action records show you were managing food safety systematically rather than leaving it to chance. Confirm how due diligence and record-keeping are treated in your state or territory, because food safety is enforced under state and territory legislation (administered largely by councils), not by FSANZ directly. Build your self-audit checklist A good checklist mirrors both the Food Standards Code and your own food safety program, broken into clear sections so nothing is missed. Keep each line item specific and observable — 'cool-room at or below 5°C, verified with calibrated probe' is auditable; 'fridges okay' is not. Base the content on the hazards relevant to your operation, and align allergen items with the Plain English Allergen Labelling (PEAL) requirements under Standard 1.2.3 where packaged-food labelling applies, and with the requirement to give accurate allergen information for unpackaged food on request. Below are the core sections most food businesses should include. Temperature control: cold storage at or below 5°C, hot holding at or above 60°C, cooking to safe core temperatures, two-stage cooling (generally 60°C to 21°C within 2 hours, then 21°C to 5°C within a further 4 hours), calibrated probe thermometers. Cleaning and sanitising: documented schedule followed, correct chemicals and contact times, food-contact surfaces cleaned then sanitised, cloths and equipment managed. Personal hygiene: hand-washing facilities stocked and used, clean clothing, no working while ill (particularly with vomiting or diarrhoea), cuts covered with a waterproof dressing. Cross-contamination: raw and ready-to-eat separated, colour-coded boards/utensils where used, correct storage order in fridges (ready-to-eat above raw). Allergen management: accurate allergen information available, PEAL-aligned labelling where packaged food applies, controls against cross-contact, staff able to answer allergen questions. Pest control: no signs of pests, proofing intact, bait stations serviced, pest reports on file. Receiving and storage: goods checked on delivery (including temperature of cold/hot items), stock rotation (FIFO), date marking, food covered and off the floor. Structure and equipment: surfaces sound and cleanable, adequate lighting, working sinks and hot water. Records and program: temperature logs, cleaning records and corrective-action logs completed and current; food safety supervisor details up to date. Skills and knowledge: staff trained appropriately for their role and able to describe ke
How to run an internal food safety audit, step by step
Decide what this audit covers (whole site or a specific area), pick a date, and choose an auditor — ideally someone competent but not solely responsible for the area being checked, to keep it honest.
Use a written checklist that mirrors your food safety program and the relevant parts of the Food Standards Code. Update it if your menu, equipment or processes have changed since last time.
Audit during normal operation where practical, so you see real behaviour. Look, don't just ask: watch hand-washing, check temperatures yourself with a calibrated probe, open the cool room, inspect storage order and cleaning.
Review temperature logs, cleaning records, receiving checks and previous corrective actions. Confirm they are complete, current and match what you observed on the floor.
Mark each item compliant, non-compliant or not applicable, classify non-conformances by severity, and calculate the score. Note observations even where there is no breach.
For each non-conformance, log the issue, root cause, the fix, an owner and a due date. Action any immediate food-safety risk on the spot.
Follow up each action, confirm the fix worked, and date the close-out with evidence. Carry any unresolved items to the next audit.
Share the results with your team and food safety supervisor, store the audit and corrective-action records, and book the next audit.
Frequently asked questions
How often should I do an internal food safety audit?
There is no single legislated frequency; it depends on your risk and what your food safety program says. Many businesses run quick self-checks weekly, a focused monthly check, and a full scored internal audit quarterly. Higher-risk operations, or those recovering from a failed inspection or complaint, should audit more often. Set the cadence in writing and confirm any specific requirements with your council or state regulator.
Who should conduct the internal audit?
Someone competent in food safety — often the food safety supervisor or a trained manager. Where possible, avoid having a person audit only their own daily work, as independence makes findings more honest. For small businesses this can be hard, so the owner-operator may audit but should apply the checklist strictly and, ideally, have a second person spot-check periodically or use an external review from time to time.
How should I score a food safety audit?
Keep it simple and consistent. Mark each applicable item compliant or non-compliant and express the result as a percentage met, then classify non-conformances by severity — critical, minor or observation. Severity matters more than the headline number, because it tells you what to fix first. Define your categories in writing so different auditors score the same situation the same way, and track the score over time to spot decline.
What is a corrective action and when is it 'closed'?
A corrective action is the fix for a finding, plus, ideally, addressing why it happened so it does not recur. Record the issue, the action, an owner and a due date. It is only closed once someone has verified the fix actually worked and dated that verification with evidence — a re-check reading, a corrected record or a photo. Closing an item just because time has passed defeats the purpose.
Is an internal audit the same as a council inspection?
No. An internal audit is your own self-assessment, run on your schedule to catch and fix issues early. A council inspection is carried out by an environmental health officer (or an approved third-party auditor), sometimes unannounced, to check compliance under state or territory food legislation. A strong internal audit program is the best preparation for an external one, but it does not replace it.
Do I have to keep internal audit records?
Keeping them is strongly advisable. Under the risk-based Standard 3.2.2A framework, being able to substantiate that your controls are working is important for higher-risk businesses, and audit and corrective-action records are good evidence of active management. They also support a due-diligence position if a problem arises. Set a retention period in your program and confirm any specific record-keeping requirements with your state or territory regulator.