What should be scoped before the external auditor arrives?
What the audit must verify, over what scope, against what criteria, and with what guarantee of independence. Scoping is written down, and it is validated by your audit programme manager, the audit client in the sense of ISO 19011:2026, not by the auditor.
Element | Question to settle | Written evidence |
|---|---|---|
Objective | Scheduled audit, pre-transition audit, audit after an incident or complaint? | Annual programme, audit request |
Scope | Which processes, lines, teams, sites, off-site storage? | Audit plan |
Criteria | Which standards and clauses, internal procedures, customer specifications, legal texts? | Audit plan, checklist |
Dates | When is the audited activity really running? | Schedule agreed with production |
Methods | What is done on site, and what can be done remotely? | Audit plan |
Independence | Did the auditor design or run what they are auditing? | Declaration of no conflict of interest |
Confidentiality | Who receives the report, and what data may leave the site? | Engagement letter |
Reporting | Report format, severity scale, response time for process owners | Engagement letter, report template |
For a food site, check at scoping that the audit fits into the programme your scheme requires. For BRCGS Food Safety Issue 9, that means at least four audit dates spread throughout the year and every activity covered each year (clause 3.4.1 of the site self-assessment checklist). For IFS Food Version 8, every requirement audited within a 12-month programme carried out within 15 months at most (5.1.1, KO No. 8). The overall framework of the programme is set out in our guide to outsourced internal audits.
An example: a citrus packhouse in the Gharb plain, around Kenitra in north-western Morocco, that schedules its HACCP audit outside the packing season audits an empty hall. The audit of operations belongs in the season; the document audit of the management review can wait for the off-season.
Which documents should be sent to the auditor, and when?
Those that let the auditor target their questions, about a week before the audit, according to the lead time set at scoping. The rule is simple: send what exists, write nothing for the audit. A document produced the day before shows, and it says nothing about the real system.
Area | Useful documents | Why the auditor asks for them |
|---|---|---|
All | Previous internal and external audit reports, open actions, changes since the last audit | Follow up findings and target the areas that have changed |
Quality | Process map, procedures for the audited process, indicators, complaints | Compare what is prescribed, what is measured and what is done |
Environment | Environmental aspects and impacts analysis, register of legal requirements, waste records | Check compliance and operational control |
Health and safety | Risk assessment, accident investigations, minutes of the safety and hygiene committee | Link the declared risks to the shop floor |
Food safety | HACCP plan, prerequisite programmes, verification results, food defence and food fraud plans, sanitary authorisation or approval from ONSSA, the national food safety office | Prepare floor tests and traceability |
Customers | Specifications, customer audit reports | Add their requirements to the criteria |
Also prepare access to the day’s records: control sheets, CCP records, work permits, cleaning logs. That is where the auditor samples. Reports and the status of actions can be shared in a single document space; at ACG, that is the Inspirra client space.
How should interviews and the floor walk be organised?
By putting the auditor in front of the real work and the people who do it. The audit plan, circulated in advance, gives the times, the places and the people to be met; the site makes sure they are available.
The opening meeting. Short: objective, scope, schedule, safety and hygiene rules, contacts, time of the closing meeting. Management or the programme manager attends.
Interviews. Plan for management on system management topics, each process owner on their process and, above all, operators at their workstations, night shift included if the scope warrants it. An auditor who meets only the quality manager is auditing a story, not a system. For a combined QHSE audit, add the maintenance manager, a member of the safety and hygiene committee (comité de sécurité et d’hygiène) if your headcount requires one, and the person who manages waste.
The floor walk. In production, on the lines within scope. Have protective equipment ready, the hygiene rules that apply to visitors, and a guide who opens doors without answering in place of the operators.
Tests. The auditor may ask for an exercise: tracing a batch, checking a CCP, reviewing a work permit, testing an alarm. Prepare the availability of the data, not the answer.
The remote part. ISO 19011:2026 expands remote audit methods and allows them to be combined with on-site auditing. A document review, an interview with a process owner at another site or the verification of closure evidence lend themselves to it; observing a workshop does not. Test the connection and the screen-sharing rules before the day.
The closing meeting. Findings are presented there before the auditor leaves. Under the ISO 19011:2026 principle of fair presentation, unresolved diverging opinions are to be recorded: challenge on the evidence, not on the tone.
How should findings be handled after the audit?
In three distinct stages: correct what must be corrected straight away, deal with the cause, then prove that the action worked. The schemes describe this cycle in the same terms.
- BRCGS Food Safety Issue 9 requires results to be reported to the personnel responsible for the activity audited, actions and their timescales to be agreed and their completion verified, and a summary to be reviewed at management review meetings (3.4.3).
- IFS Food Version 8 requires documented audits, results communicated to senior management and to the persons responsible, and compliances, deviations and non-conformities documented and communicated (5.1.3).
- For a group certified to FSSC 22000 on a multi-site basis, version 7 adds a technical review of reports by the central function and the demonstration that corrective actions are effective (2.5.18.2).
Step | Who | Deadline | Evidence |
|---|---|---|---|
Report received | Programme manager | As set in the engagement letter | Report circulated to process owners |
Immediate correction | Process owner | From the closing meeting, for a serious finding | Dated record |
Root cause analysis | Process owner, with their team | Set in the action plan | Written analysis |
Corrective action | Process owner | Deadline agreed with the programme manager | Evidence of completion |
Verification of completion | External auditor or programme manager | On receipt of the evidence | Documented closure |
Effectiveness check | Auditor, at follow-up or at the next audit | Based on risk | No recurrence observed |
Management review | Management | At the next review | Summary of results and decisions |
The deadlines for closing certification non-conformities do not apply to internal audits: your procedure sets them. Align them with severity and with the schedule of your certification audits.
Which mistakes destroy the value of an outsourced audit?
Those that turn the audit into a formality. We see them in our assignments in Morocco, whatever the size of the site:
- Staging a showroom. Tidying the workshop the day before, filling in overdue records: the auditor mainly sees what is usually missing.
- Scheduling the audit when nothing is running. Line stopped, off-season, construction site shut down.
- Giving the audit to the person who built the process. A consultant who wrote the procedure does not audit it.
- Letting the auditor write the actions. The auditor loses their impartiality for the follow-up, and the process owner takes ownership of nothing.
- Closing on a statement. “Done” is not evidence; a dated record is.
- Forgetting the strengths. A report that also identifies conformity, as BRCGS requires (3.4.3), shows what to keep.
- Leaving the report in the quality department. If it does not reach the management review, it changes nothing.
A checklist for each audit:
The audit method seen from the internal auditor’s side is described in our article on the first ISO 9001 internal audit, and the choice between internal auditors and an outsourced audit in our analysis of the cost of each model.