An Internal Audit That Finds Nothing Has Probably Failed: Why Food Factories Should Audit to Find Problems, Not to Pass

By Isaac Muthui, CEO, Tamalaki Business Network Ltd. Originally published at factoraerp.com.

Most food factories meet auditors from the outside first. A KEBS officer arrives for a permit inspection. A county public health officer walks the floor. A supermarket sends its supplier auditor. A certification body comes for an ISO 22000 or FSSC visit. In the week before each of these, the plant goes into a familiar mode: forms are filled in, files are tidied, the floor is scrubbed and everyone hopes the visit goes well.

An internal audit flips that around. The factory checks itself, on its own schedule, against its own procedures and the rules it has to meet, and finds the gaps before a customer, a regulator or a recall does. Done well, it is the cheapest food safety control a plant has. Done badly, it becomes one more form that is ticked "satisfactory" every month while the same problems come back.

This food safety internal audit checklist is written for dairies, millers, bakeries, juice, snack, edible oil and other Kenyan and East African food and agro factories. It does not replace your HACCP team, your certification body or the guidance of your competent authority. It sets out ten practical checks for running internal audits that find real problems and get them fixed.

What the standards actually say

What an audit is. ISO 19011, the international guideline for auditing management systems, was revised this year: the fourth edition, ISO 19011:2026, was published in May 2026 and replaces the 2018 edition. Its public preview defines an audit as a "systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled". It adds that internal audits, "sometimes called first-party audits, are conducted by, or on behalf of, the organization itself". The guideline lists the principles of auditing as integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. The ISO quality committee's release note puts it simply: "Effective audits are more than verifying conformity".

What Codex expects. The Codex General Principles of Food Hygiene, CXC 1-1969, says food hygiene systems "should be reviewed to determine if modifications are needed", periodically and whenever there is a significant change such as a new process, ingredient, product or piece of equipment. For good hygiene practices, it asks food businesses to verify that procedures are implemented, that monitoring happens and that corrective actions are taken, including by reviewing "GHP procedures, monitoring, corrective actions, and records" (13.1.5). For HACCP, it says verification "includes observations, auditing (internal and external), calibration, sampling and testing, and records review", that verification "should be carried out by someone other than the person who is responsible for performing the monitoring and corrective actions", and that it should include "a comprehensive review (e.g. reanalysis or an audit) of the HACCP system periodically" (19.11.2). It also says root cause analysis "should be conducted where possible" and that corrective actions should be reviewed periodically "to identify trends and to ensure corrective actions are effective" (19.10).

A useful benchmark for timing. US food safety rules are not binding in Kenya, but they put numbers on things Codex leaves open. Under 21 CFR 117.165, monitoring and corrective action records must be reviewed "within 7 working days after the records are created" (or a justified longer period), to ensure they are complete and that "appropriate decisions were made about corrective actions". Under 21 CFR 117.170, the food safety plan as a whole must be reanalysed "at least once every 3 years", and sooner after a significant change, new hazard information, an unexpected food safety problem or a control found to be ineffective.

The East African code. EAS 39:2001, the East African code of practice for hygiene in the food and drink manufacturing industry, reminds manufacturers that "on their own, inspection and testing of food products is insufficient to assure that food is free from contamination". It requires that records of all processes needed to assure food safety are inspected at least daily by a suitably qualified person and signed to show the inspection took place (4.3.6), and says records "can be used to demonstrate that appropriate action has been taken to assure the safety of the food" (14.1).

Kenya. One of the stated objects of the Dairy Industry (Dairy Produce Safety) Regulations, 2021 is "to promote self-regulation in the dairy industry through adoption of global best practices", and Part XIII requires operators to record and keep evidence of quality assurance and not to trade "without sufficient proof of maintenance of records". More broadly, the Food and Feed Safety Control Co-ordination Act, 2026 establishes an Office of the Food Safety Controller whose tools, according to Route to Food's summary, include a Multi-Annual Control Plan and the audit and verification of enforcement and compliance measures, with county governments playing a large role in enforcement. The direction is clear: more coordinated oversight, and more value in factories that can show their own controls are checked and working.

Why internal audits go wrong

Internal audits rarely fail because nobody does them. They fail because they are done to pass rather than to find.

The patterns are familiar. The QA manager audits the QA system they wrote and run. The checklist is the same every month, so the team learns the answers. The audit reads the records but never watches the work, so a temperature log filled in at the end of the shift looks perfect. Findings are written as "staff to be reminded", with no owner and no date. And the same finding appears in January, April and July, because nobody checked whether the fix worked. An audit like that produces paperwork, not control.

The 10-step food safety internal audit checklist

1. Write a yearly audit programme that covers everything

List every area and process that matters for food safety: intake, storage, production, CCPs, cleaning, pest control, hygiene, water, allergens, labelling, dispatch, calibration, training, complaints and traceability. Each one should be audited at least once a year.
Audit high-risk areas more often. ISO 19011 includes a risk-based approach among its principles: CCPs, allergen changeovers and areas with past problems deserve more attention than the office filing.
Add extra audits after significant changes, such as a new product, new line, new supplier or a serious complaint. Codex asks for review whenever there is a significant change.

2. Set clear criteria and scope for each audit

Before each audit, write down what you are auditing (scope) and against what (criteria): your HACCP plan, your own procedures, EAS 39, the relevant KEBS product standard, the dairy regulations, a customer's requirements.
Keep the scope realistic. One area done properly in two hours is worth more than the whole factory skimmed in one.
Pull the relevant procedures and last audit's findings before you start, so you know what "good" looks like and what to re-check.

3. Use auditors who do not audit their own work

Codex says verification should be carried out by someone other than the person who does the monitoring and corrective actions. ISO 19011 lists independence among its audit principles.
In a small plant, swap areas: the production supervisor audits stores, the stores lead audits cleaning, QA audits dispatch. Where that is not possible, bring in an outside expert for some audits.
Train auditors in what to look for and how to write a finding. A short internal course and a few audits alongside an experienced auditor go a long way.

4. Go to the floor and watch the work

Read the records, then go and watch the activity they describe. Watch a CCP check being done. Watch a changeover clean. Watch a delivery being received. Our HACCP CCP monitoring checklist explains what a good CCP record looks like.
Ask operators to show you, not tell you: "Show me how you check this", "Show me where you write it", "What do you do if it fails?"
Look for the gap between the procedure and what really happens. That gap is usually the most useful finding of the day.

5. Test the records, not just their existence

Pick a sample of records and check them properly: complete, signed, filled in at the time, within limits, and with a corrective action wherever a limit was missed. EAS 39 expects safety records to be inspected at least daily by a suitably qualified person and signed.
Watch for warning signs: identical handwriting and readings across a whole week, entries made in advance, blank fields, correction fluid.
Check that someone reviewed the records. The US rule's 7-working-day benchmark for reviewing monitoring and corrective action records is a useful target even where it is not required.

6. Trace a batch end to end

Pick one finished batch and follow it backwards and forwards: raw material lots and suppliers, intake checks, production and CCP records, cleaning before the run, label and pack checks, QA release and the customers who received it.
This one exercise tests supplier intake, label control, the QA hold and traceability at the same time.
Time it. If it takes more than a few hours, run a full mock recall and fix the gaps.

7. Check the supporting programmes

Audit the prerequisite programmes that the HACCP plan depends on: cleaning and sanitation, pest control, personal hygiene, calibration, water, maintenance and training.
For each one, ask three questions: is there a procedure, is it being followed, and is it working? A pest contractor's report that says "no activity" while staff report rodents is a finding.
Look at trends, not just today. Codex asks for periodic review of corrective actions to spot trends.

8. Write findings as facts, with evidence

Each finding should say what the requirement is, what you saw, where and when, and why it matters. ISO 19011 describes audit findings as the result of evaluating evidence against criteria, and lists an evidence-based approach among its principles.
Grade findings, for example critical, major and minor, so the most serious get fixed first. A critical finding, such as a CCP not being monitored, should be escalated the same day, not saved for the report.
Record good practice too. ISO 19011 notes that findings can also identify opportunities for improvement or record good practices. People listen to audits that are fair.

9. Fix the cause, with an owner and a date

Every finding needs a root cause, a corrective action, an owner and a due date. Codex says root cause analysis should be conducted where possible. "Staff reminded" is not a root cause.
Ask "why" until you reach something you can change: the procedure, the training, the equipment, the layout, the schedule or the workload.
Link audit findings to the same corrective action system you use for customer complaints and process deviations, so nothing lives in a separate file that nobody opens.

10. Verify the fix and review the programme

Close a finding only after someone has checked that the fix worked, ideally at a follow-up visit, not just because the owner said it was done. Codex asks that corrective actions be reviewed to ensure they are effective.
Re-check last audit's findings at the start of the next audit in the same area. A repeat finding means the first fix did not work.
At least once a year, have management review the audit programme: what was found, what was fixed, what keeps coming back, and whether the HACCP plan needs reanalysis. The US rule's three-year reanalysis cycle is a useful outer limit.

The audit record

For each internal audit, the record should let a manager answer six questions without searching:

Question	What the record should show
What was audited, and against what?	Area or process, scope, criteria (HACCP plan, procedures, standards, regulations)
Who audited, and when?	Auditor names, date, and confirmation that they did not audit their own work
What evidence was looked at?	Records sampled, activities observed, batch traced, people spoken to
What was found?	Each finding with requirement, evidence, location and grade
What is being done about it?	Root cause, corrective action, owner and due date for each finding
Did the fix work?	Verification date, who verified, and the result, plus any repeat findings

If any answer is "it's in the QA manager's head", the audit programme is not yet under control.

Habits that make internal audits stick

Audit to find, not to pass. An internal audit that finds nothing for a year is more likely to be blind than perfect.
Swap auditors. Fresh eyes from another department see what the area owner has stopped noticing.
Watch, then read. Start on the floor, then check the paperwork against what you saw.
Small and often. Monthly audits of one or two areas beat one huge audit before the certification visit.
Close the loop in public. Share open findings and closed findings at the weekly production meeting, so fixes get done.

Where an ERP helps

Internal audits are hard to run on paper because the evidence is spread across many files, and the findings end up in a report nobody tracks.

FactoraERP keeps a compliance audit register for internal, external, surveillance and certification audits, with scope, auditor, outcome, findings, corrective actions and the next audit date. Its quality module records non-conformances with the source (including internal audit), severity, root cause, corrective and preventive action, responsible person, target date and verification method. Because batches, stock, QA holds and quality records sit in the same system, an auditor can trace a batch and check its records without hunting through binders. See factoraerp.com.

Free download: eTIMS readiness checklist for factories

Kenyan manufacturers increasingly need their operational records, stock records and invoices to tell one consistent story. If you want a free eTIMS readiness checklist for factories, sign up for the FactoraERP Insights newsletter at https://isaacmuthui.substack.com. You will get practical operations notes for food and agro manufacturers. No spam; unsubscribe anytime. For background, see our guide to eTIMS for food and agro manufacturers.

FAQ

What is a food safety internal audit?
An internal audit is a systematic, independent and documented check that a factory carries out on itself, or has carried out on its behalf, to see whether its food safety system meets its own procedures and the standards and regulations that apply. ISO 19011 calls internal audits first-party audits.

What should a food safety internal audit checklist include?
A yearly audit programme covering all areas, clear scope and criteria, auditors who do not audit their own work, observation on the floor, testing of records, an end-to-end batch trace, checks on prerequisite programmes, findings written with evidence, corrective actions with root causes, owners and dates, and verification that fixes worked.

How often should a food factory do internal audits?
Every food safety area should be audited at least once a year, with high-risk areas such as CCPs and allergen changeovers audited more often, and extra audits after significant changes. Codex asks for review periodically and whenever there is a significant change. Many plants find monthly audits of one or two areas easier to sustain than one large annual audit.

Who should carry out an internal audit?
Trained staff who are not responsible for the area being audited, or an outside expert. Codex says verification should be done by someone other than the person who performs the monitoring and corrective actions.

What is the difference between an internal audit and an external audit?
An internal audit is done by or for the factory itself. External audits are done by customers (second party) or by certification bodies and regulators (third party). A good internal audit programme makes external audits less stressful, because problems have already been found and fixed.

What happens after an internal audit finding?
The finding is graded, a root cause is identified, a corrective action is assigned with an owner and a due date, and the fix is later verified as effective before the finding is closed. Repeat findings show that the first fix did not work.

Isaac Muthui, CEO, Tamalaki Business Network Ltd