How to Prepare for a Food Safety Audit: Complete Guide

Most audit stress isn't caused by the audit itself — it's caused by not knowing, until the auditor asks, whether a specific record actually exists and can be found in time. Good preparation removes that uncertainty well before audit day.

Preparing for a food safety audit means confirming your records are complete and findable, your team knows what to expect, and any known gaps are closed before an auditor finds them — not scrambling to assemble evidence once a date is confirmed. The specifics vary by standard (IFS, BRCGS, FSSC 22000, or an internal audit), but the underlying preparation looks similar across all of them.

Key takeaways

Most audit findings trace back to records that exist but can't be produced quickly, not to genuine food safety failures.
Preparation works best as an ongoing habit, not a pre-audit scramble — the closer your day-to-day records already look audit-ready, the less "preparation" is actually needed.
A self-assessment against the same checklist an auditor would use is the single most useful preparation step.
Unannounced audits, used by several GFSI-recognized schemes, only work if this becomes routine rather than something done before a scheduled date.
Digital records don't guarantee a good audit outcome, but they remove the specific risk of a record existing yet not being retrievable in time.

What do auditors actually check?

Beyond the specific clauses of whichever standard applies, most audits verify the same underlying thing: that what's written in your food safety plan matches what actually happens on the floor, and that you can prove it with records. That means checking your HACCP plan and hazard analysis, walking the physical site, reviewing monitoring and corrective action records, and interviewing staff to see whether documented procedures match what people actually do day to day.

A mismatch between paperwork and practice — a procedure that says one thing while staff do another — is generally a bigger red flag to an auditor than a single missed record, because it suggests the system isn't genuinely being followed rather than being an isolated slip.

How to self-assess before the audit

The most useful thing you can do before an audit is audit yourself against the same criteria first. Walk through your own checklist as if you were the auditor: are records for the last few months complete, dated and legible? Do corrective actions have an assigned owner and a documented resolution, not just a note that something happened? Would you, as an outsider, be able to find a specific record within a few minutes if asked?

This self-assessment is where most genuine gaps surface — and finding them yourself, with time to fix them, is a very different position than an auditor finding them for you.

What records need to be ready?

At minimum, most audits expect to see: your HACCP plan and supporting hazard analysis, monitoring records for critical control points (temperature logs, hygiene checks), non-conformance and corrective action records, supplier documentation, staff training records, and any internal audit history. The common thread across all of these is that they need to be both complete and quickly retrievable — a record that exists somewhere but takes twenty minutes to locate functions, in practice, like a missing one.

Preparing your team, not just your paperwork

Records only tell half the story. Auditors routinely ask staff direct questions — what do you do if a temperature reading is out of range, where do you record it, who do you tell — and inconsistent answers across different people are a common finding in their own right. It's worth confirming, ahead of an audit, that staff can answer these questions consistently, not just that the written procedure covers it.

What happens on audit day?

Most audits follow a broadly similar shape regardless of standard: an opening meeting to confirm scope, a document review, a physical walk-through of the site, staff interviews, and a closing meeting where findings are discussed before the formal report. Non-conformances are typically categorized by severity — minor, major, or critical — and most schemes give you a defined window (commonly around 28 days) to submit corrective action evidence before a final grade or certification decision is issued.

Common gaps that show up in audits

A few issues come up repeatedly across audits, regardless of the specific standard:

Records that exist but take too long to find — effectively equivalent to a missing record from the auditor's perspective
Corrective actions with no documented resolution — a deviation was noted, but there's no record of what was done about it
Inconsistent staff answers — the procedure is written correctly, but different staff describe it differently
Training records that don't match who's actually performing checks
Supplier documentation that's outdated — certificates or specifications that have technically expired

How does this differ by standard?

The core preparation above applies broadly, but each standard has its own emphasis and grading logic. IFS is known for a detailed points-based scoring system audited against specific requirements. BRCGS uses a letter-grade system (AA through C, or Uncertified) based on the number and severity of non-conformances found, with unannounced audits earning a "+" and being increasingly requested by UK retailers specifically. FSSC 22000 is built on ISO 22000 plus sector-specific prerequisite programs, which tends to suit businesses already operating within an ISO management framework. We cover the practical differences between these in more detail in a dedicated comparison, and go deeper on IFS- and BRCGS-specific preparation in their own articles.

FAQ

How far in advance should audit preparation start? Ideally, it's not a distinct phase at all — the closer your day-to-day record-keeping already resembles what an auditor would expect, the less separate "preparation" is needed. For a scheduled audit specifically, a focused self-assessment a few weeks out is a reasonable minimum.

What's the difference between an announced and unannounced audit? An announced audit has a confirmed date you prepare for directly. An unannounced audit can happen at any point within a window, which several GFSI-recognized schemes treat as a stronger signal of consistent, everyday food safety management rather than pre-audit readiness.

Do digital records guarantee a better audit outcome? No — the underlying food safety practice still has to be sound. What digital records reliably remove is the specific risk of a record existing but not being findable in time, which is a common and avoidable source of findings.

What's the single most useful preparation step? Self-assessing against the same checklist an auditor would use, ideally with enough lead time to genuinely close any gaps rather than just documenting that they exist.

Does preparation differ much between a first-time audit and a renewal? The core preparation is similar, but a renewal audit will also examine whether corrective actions from the previous audit were actually implemented and sustained, not just closed on paper.

See your records the way an auditor would

The best way to know if you're audit-ready is to look at your records exactly as an auditor would — complete, dated, and quickly retrievable.

Book a demo or email info@morefromfood.com.

How to Prepare for a Food Safety Audit: Complete Guide