How third-party HACCP and GFSI certification audits work in Australia, how they differ from council inspections, and a practical way to prepare and pass with…
A third-party certification audit is a voluntary, in-depth check of your food safety management system against a recognised standard such as HACCP or a GFSI-benchmarked scheme (SQF, BRCGS, FSSC 22000). Unlike a council inspection, which verifies you meet the Food Standards Code, a certification audit is usually driven by customers or supply-chain contracts. It reviews your documented system, records and practices, and results in a graded certificate. Key takeaways: Certification audits are voluntary and usually customer- or contract-driven, whereas council inspections are regulatory and verify the Food Standards Code.. HACCP certification checks your seven-principle plan; GFSI-benchmarked schemes (SQF, BRCGS, FSSC 22000) add wider management-system and prerequisite requirements.. Auditors rely heavily on records. If it isn't written down and retrievable, it effectively didn't happen.. Findings are graded as minor, major or critical non-conformances; you'll need documented root-cause corrective actions to close them out.. Preparation is a year-round habit, not a week-before scramble: keep the system live, run internal audits, and fix gaps as they appear.. Council inspection vs certification audit: Feature, Council/EHO inspection, Certification audit. Why — Legal compliance, public health — Customer, contract or market access. Standard — Food Standards Code + state/territory law — HACCP or GFSI scheme (SQF/BRCGS/FSSC 22000). Notice — Can be unannounced — Usually scheduled (some unannounced). Focus — Compliance on the day — Whole documented system over time. Result — Findings; possible enforcement — Graded certificate for a set period. What a certification audit actually is A third-party certification audit is an independent assessment of your food safety management system against a published standard, carried out by an accredited certification body rather than by government. You choose to be audited because a customer, retailer, exporter or head-office contract requires it, or because certification opens doors to markets that expect it. The auditor examines three things: your documented system (policies, your HACCP or food safety plan, procedures), your records (the evidence the system runs day to day), and what actually happens on the floor. Success is measured against the standard's clauses, not simply whether food is being handled safely on the day. How certification audits differ from council inspections Council or state Environmental Health Officer (EHO) inspections are regulatory. They check that you comply with the Australia New Zealand Food Standards Code and any state or territory requirements, they can be unannounced, and non-compliance can lead to enforcement action. Certification audits are voluntary and commercial: they are scheduled, far more document-heavy, benchmarked to a private standard, and result in a certificate and a grade rather than a licence. One does not replace the other. You still need to meet your regulatory obligations regardless of any certificate you hold, so treat the two as complementary. Driver: council = law and public health; certification = customer, contract or market access.. Notice: council can be unannounced; certification audits are usually booked (some schemes add unannounced audits).. Scope: council focuses on Code compliance on the day; certification assesses your whole documented system over time.. Outcome: council issues findings and can enforce; certification issues a graded certificate valid for a set period.. Auditor: council uses EHOs; certification uses auditors employed or approved by an accredited certification body.. HACCP certification vs GFSI-benchmarked schemes HACCP (Hazard Analysis and Critical Control Points) is the internationally recognised method for identifying and controlling food safety hazards, built on seven principles. A HACCP certification audit checks that your hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification and record-keeping are sound and being followed. GFSI (the Global Food Safety Initiative) does not audit anyone itself; it benchmarks whole schemes so retailers can accept one recognised standard instead of many. GFSI-benchmarked schemes common in Australia include SQF, BRCGS and FSSC 22000. These build on HACCP but add broader requirements: management commitment, prerequisite programs, food fraud and food defence, supplier approval, and continuous improvement. Choose the standard your customers actually ask for before you invest. HACCP: focused on the hazard-control plan and its seven principles.. SQF: HACCP-based food safety and quality codes, widely accepted by retailers.. BRCGS: strong on product, process and facility controls; common for manufacturing and packing.. FSSC 22000: built on ISO 22000 plus sector prerequisite programs; suits management-system-driven sites.. Confirm which scheme your customer requires and to which version and category before booking.. The audit day: what to expect Most certification audits follow a predictable rhythm. There is an opening meeting to confirm scope, the version of the standard and the plan for the day. The auditor then works through your documented system and samples records, often tracing a product or batch end to end to test whether your written system matches reality. Expect a facility walk-through covering hygiene, pest control, maintenance, storage, temperature control and staff practices, plus interviews with team members to confirm they understand their roles. The auditor typically evaluates evidence, not opinions, so have records retrievable. A closing meeting summarises findings, classifies any non-conformances and explains next steps and timeframes for corrective action. Non-conformances and corrective actions Findings are usually graded to reflect risk and system impact. A minor non-conformance is an isolated lapse against a requirement; a major indicates a systemic breakdown or a requirement not being met; a critical relates to a serious food safety risk or a breakdown in a fundamental control and can put certification at risk. Exact grading terms and timeframes vary by scheme and certification body, so confirm the definitions in your standard. For each finding you generally submit a documented correction (the immediate fix), a root-cause analysis (why it happened), and a corrective action (the systemic change to stop recurrence), often with supporting evidence. Address the cause, not just the symptom, or the same finding returns next year. Records: the backbone of any pass Certification auditors verify your system through evidence, so complete, legible, dated and retrievable records are what carry you through. Gaps, back-filled entries or records that contradict each other are among the most common reasons for findings. Keep monitoring logs (temperatures, cooking, cooling, cleaning), calibration records for probes and equipment, receival and supplier documents, training records, internal audit and management review notes, and your corrective-action history. Digital record-keeping helps by timestamping entries, flagging missed checks and making retrieval instant during an audit, but paper systems pass too when they are disciplined and current. Whatever the format, make sure staff record in real time rather than reconstructing later. Checklist: Correct standard, version and scope confirmed in writing. HACCP/food safety plan current and matches actual practice. Prerequisite programs documented and running. Monitoring logs complete, legible, dated and retrievable. Probe and equipment calibration records up to date. Supplier approval and receival records in order. Training records current for all relevant staff. Internal audit and management review completed and documented. Previous corrective actions closed out with evidence. Team briefed on roles and where records are kept. Common mistakes: Preparing for the wrong scheme or an out-of-date version of the standard. Back-filling or reconstructing records just before the audit instead of recording in real time. Treating the audit as a one-week project rather than a live, year-round system. Fixing the symptom of a non-conformance without addressing the root cause. Assuming a certificate replaces regulatory obligations to council or the state regulator. A food safety plan that looks good on paper but does not match what staff actually do.
How to prepare for a certification audit
Check exactly which standard, version and product category your customer or contract requires. Preparing for the wrong scheme or an outdated version wastes months. Get this in writing from the customer or your certification body.
Work clause by clause through the standard and compare it to what you actually do and document. Note every gap. This becomes your action list and tells you honestly how much lead time you need before booking.
Refresh your HACCP or food safety plan, prerequisite programs and procedures so the written system reflects current practice. Make sure critical limits, monitoring and verification steps are clear, current and workable.
Audit yourself against the standard, then run a walk-through as if it were audit day. Trace a product end to end, pull records at random and interview staff. Fix what you find before the real auditor does.
Complete corrective actions from your internal audit and keep the evidence. Brief every team member on their role, where records live and how to answer questions honestly and simply.
The strongest sites treat compliance as ongoing: real-time records, scheduled internal audits, management reviews and prompt corrective actions. Then the certification audit becomes a confirmation, not a scramble.
Frequently asked questions
Do I need a certification audit if I already pass council inspections?
Not for legal compliance. Council inspections confirm you meet the Food Standards Code, which is the regulatory baseline. A certification audit is voluntary and is usually needed because a customer, retailer, exporter or head-office contract requires it. If no one in your supply chain asks for certification, focus on meeting your regulatory obligations first.
Which standard should I choose: HACCP, SQF, BRCGS or FSSC 22000?
Let your customers decide. Ask which standard, version and product category they require, and get it in writing. Many retailers accept any GFSI-benchmarked scheme (SQF, BRCGS, FSSC 22000), while some contracts specify one. HACCP certification alone may be enough for smaller supply relationships. Choosing before you invest saves significant time and cost.
What happens if I get a non-conformance?
You address it. Findings are graded, generally from minor through major to critical, reflecting risk and system impact. For each you usually submit an immediate correction, a root-cause analysis and a systemic corrective action with evidence, within a timeframe set by the scheme. Exact grading terms and deadlines vary, so confirm them with your certification body and standard.
How far ahead should I start preparing?
It depends on how mature your system already is. A site with current records, a working HACCP plan and prior internal audits may need only weeks; a site starting from scratch often needs several months to build prerequisite programs, generate a record history and run a mock audit. A clause-by-clause gap assessment early will tell you honestly how much lead time you need.
Are certification audits announced or unannounced?
Most are scheduled, so you know the date in advance. However, several GFSI-benchmarked schemes include an unannounced audit option or requirement on a cycle. The safest approach is to run your system so it would pass on any given day, rather than only preparing around a known booking. Confirm the specific rules with your certification body.