Combined QHSE and Food Safety Internal Audit: A Three-Plant Case

What was this food group’s starting point?

A Moroccan fruit and vegetable group with three sites, six standards and four internal audit programmes that did not talk to each other. This case study is a composite: it brings together situations we meet on assignments, without describing a real company.

The Souss is the farming region around Agadir; the Loukkos lies in north-western Morocco. The group had trained internal auditors at each site, mostly quality technicians. A group QHSE manager, based at head office, ran the integrated system, prepared the management review and kept the shared document control. Each site also ran the programme of its own food safety scheme.

The diagnosis carried out at scoping found five weaknesses:

1. Four programmes, four checklists. The same packing line was audited several times a year, from different angles, by different auditors.
2. Requirements never audited. At the IFS site, the programme did not prove that every requirement of the standard was covered within 12 months, although requirement 5.1.1 is KO No. 8. At the BRCGS site, the food defence plan did not appear in any audit.
3. Bunched dates. Audits were concentrated in the weeks before each certification audit, far from the four dates spread throughout the year that BRCGS requires (3.4.1).
4. Incomplete independence. The group QHSE manager audited the management review and document control herself, although she ran both.
5. Health and safety under-audited. Combined checklists existed for quality, but hardly any for chemical storage, forklift traffic or lockout during maintenance.

Why a combined programme, partly outsourced?

Because the problem was not the number of audits, but how they were organised and how independent they were. ISO 19011:2026 adopts the principle of the combined audit: one programme can cover several standards, audited together. The group kept its internal auditors and assigned to an external auditor what they could not cover alone.

The split adopted:

The group QHSE manager remained the audit client in the sense of ISO 19011:2026: she validates the programme, receives the reports and presents the results at the management review. The full framework for this split is described in our guide to outsourced internal audits.

How did the programme build in each scheme’s rules?

By treating each rule as a scheduling constraint, then combining everything that could be combined. Each audit looks at a process from the quality, environment, health and safety and food safety angles; each finding is linked to a standard and a clause.

An example of a combined finding: at two sites, cleaning chemicals were stored without containment near a drain. One finding, linked to emergency preparedness (ISO 14001), to the operators’ chemical risk (ISO 45001) and to the control of chemicals in production areas (the site’s food safety scheme). One action, handled at group level for all three plants.

Integration matters for certification too. The Global ACI-TECH-3-008 document of Global ACI (Global Accreditation Cooperation Incorporated), applicable since 28 August 2026, lists an integrated approach to internal audits among the characteristics of an integrated management system that the certification body assesses. The combined checklists became one more piece of evidence to show.

How was independence organised?

Through rules written into the engagement letter and applied audit by audit:

• no site quality manager audits their own site;
• processes run by the group QHSE manager are audited by the external auditor;
• ACG had supported the revision of the Meknes site’s HACCP plan: that plan was audited by an auditor other than the consultant who had revised it;
• the external auditor does not write the corrective actions they must later verify;
• no ACG auditor takes part in the certification audit of any of the three sites; ISO/IEC 17021-1, moreover, forbids a certification body to carry out the internal audits of its certified clients.

What did the first cycle of combined audits show?

Fewer audits for production teams, but longer and better-prepared ones. The findings changed in nature: fewer documentation remarks, more shop-floor gaps, linked to several standards at once.

Three effects were observed:

• Gaps recurring from one site to another, invisible while each site had its own programme: they were dealt with once, at group level.
• Demonstrated coverage: the IFS matrix and the BRCGS calendar make it possible to answer the certification auditor without reconstructing the history.
• More confident internal auditors after the paired audits, on requirements they used to avoid.

Reports, action status and a dashboard by site and by standard are shared in the Inspirra client space; the group QHSE manager draws from it the summary presented at the management review, as BRCGS requires (3.4.3).

What lessons for a group certified to ISO standards and GFSI schemes?

That a combined internal audit is built first on a matrix of requirements, then on a calendar, and only then on the allocation of auditors. Before launching yours, check:

• A matrix links every requirement of every standard and scheme to at least one audit.
  
• Each scheme’s scheduling constraints are written into the programme: BRCGS dates, IFS coverage within 12 months, FSSC 22000 requirements.
  
• A single checklist links each finding to a standard and a clause.
  
• Processes run by the group team are audited by someone outside that team.
  
• Internal auditors audit outside their own site, in pairs on the difficult requirements.
  
• Hygiene inspections remain a separate programme, run by each site.
  
• The ISO 9001:2026 and ISO 14001:2026 transitions and the FSSC 22000 Version 7 upgrade each have a dedicated audit.
  
• A consolidated summary feeds the group’s management review.
  

The steps on the site’s side are detailed in our how-to on preparing for an outsourced internal audit, and building an integrated programme in our article on the ISO 9001, 14001 and 45001 cross-reference matrix.