BRC Standard 3.4.1
I am the only QA on site for a small manufacturing company (ice cream). In 2024, I made a matrix of all the BRC programs with associated audit date depending on the risk level. It worked relatively well but it seems like its just a repeat, rinse, flush of my audit notes as not much changes here month to month. Its also hard cause I am the only one doing the internal auditing. I know it states 4x per year for audit dates, but how can I concise this? To me - it makes more sense to do the prereq programs its in quarter 1 (before our busy season) and then quarter 3 after busy season where I can see trending, issues, etc and keep it there.
TIA
You must do what the standard requires. So it says 4x/year, you must follow that
What you audit when is up to you, so do the heavy lifting when it makes sense to you to do so and make the other quarters lighter
I've always interpreted that as "you must conduct at a minimum, 4 internal audits throughout the year". The standard lists 4 bullet points which you could use as your 4 audits with different scopes and schedule them at different times throughout the year.
I might be misinterpreting what you are asking about the prerequisite program audits but as far as I see it you only need to audit the prerequisite programs once per year if you have 3 other audit scopes conducted in that same year. Are you currently running multiple internal audits for the same scope in one year?
Hi blissdairycow,
:welcome:
Welcome to the IFSQN forums.
Compliance here is important, Section 3.4 Internal audits requirements are regarded as ‘FUNDAMENTAL’ and crucial to the establishment and operation of an effective food quality and safety operation. Clause 3.4.1 has been one of the BRCGS Food Standard Top 10 Non-Conformances in the past - requirements that sites have failed to meet in their certification audit.
So your audit schedule needs to include 4 separate dates spread throughout the year, that is the bear minimum and you also neeed to consider if you are complying with the requirement for the frequency to be established in relation to the risks associated with the activity and previous audit performance. Also consider if you really can cover all of your food safety and quality systems and the requirements of the standard in just 4 audits. BRCGS Requirements and Guidance posted below.
BRCGS Global Standard Food Safety (Issue 9) Section 3.4 Clause 3.4.1:
There shall be a scheduled programme of internal audits.
At a minimum, the programme shall include at least four different audit dates spread throughout the year. The frequency at which each activity is audited shall be established in relation to the risks associated with the activity and previous audit performance. All activities that form a part of the site’s food safety and quality systems, including those relevant to food safety, authenticity, legality and quality, shall be covered at least once each year.
etc…..
BRCGS Guidance for 3.4.1 states:
All the internal audits should not be conducted on a single day; nor should every internal audit attempt to cover all aspects of the food safety and quality management system or the Standard. A once-a-year check against all the requirements of the Standard may be of value as a gap analysis when preparing for an audit or confirming the contents of the food safety and quality management systems, but is insufficient to cover the full requirements of an internal audit programme as it will not provide the depth of assessment or level of confidence required.
Here is a link to specific BRCGS - Food Safety Forums where I’m sure you can find other relevant information, for example BRC Quarterly Audit coverage
Kind regards,
Tony
I can say that we received a minor because, while we had our audit dates spread out over four separate dates throughout the year, there was not at least one internal system audit date per quarter.
"Prerequisites" is a HUGE scope though.
Personally having worked in big and tiny companies, I'd still approach this in the same way. Risk assess each section of the standard. Take off areas we're already auditing elsewhere, so for example, I would not go into huge depth on areas concerning housekeeping, hygiene and fabrication if they're already covered in frequent and effective GMP audits.
Once I determine risk, I determine frequency and then I would determine who can audit it. Tricky for a small company but you will need to have more than one auditor. Because someone is going to have to audit things like the HACCP plan and unless you're doing what I've always wanted and having HACCP run by operations, I'm guessing you're the team leader, right?
So risk assess what you need to do, make sure you have independent auditors (and that may need a consultant for one or two audits for a small company*) then set your plan.
*To add. If you have friends in Technical in other businesses and you're not competitors, or you're a multi site operation and just a small site within that business, do think laterally. A consultant could be someone who doesn't cost a fortune. And even if you do buy in resource for one day, the few hundred quid it will cost you, for an effective and independent audit is pretty good value.
... make sure as well
internal auditors are independent of the work.
SO if you have written all of the QA documents, you CANNOT audit your own work.... i had an NC for this.... but got around it as i had just started within 8 months of an audit, so was not auditing my own work. Now i have to have external consultant x4 per year, or the MD or HR manager as long as you can show that they are trained and competent.
-
3.4.2 Internal audits shall be carried out by appropriately trained, competent auditors. Auditors shall be independent (i.e. not audit there own work).