13 replies to this topic

[Nikko_Cal_fruit]

Hi, I was wondering if anyone has a template or program, they would be willing to share. I’m currently updating our SQF internal audit program to a quarterly breakdown. Previously, we were conducting audits every month, but it became a bit too much. I plan to break it down as follows:

• Q1 (Jan–Mar): Module 2, Sections 2.1–2.5

• Q2 (Apr–Jun): Module 2, Sections 2.6–2.9

• Q3 (Jul–Sep): Module 11, Sections 11.1–11.5

• Q4 (Oct–Dec): Module 11, Sections 11.6–11.9

If anyone has examples, templates, or tools that could help support this structure, I’d greatly appreciate it. Thank you!

[jfrey123]

I think the easiest is to download the actual excel checklist SQF provides alongside the code on their website.  Example for FSC 14 at this link: SQFI | Code Selector

 

Bear in mind the code requires objective evidence be recorded by you for non-compliance AND compliance with each code item.  You need to list the evidence from your own SOP's that makes you compliant with each item, and yes, it's doing your auditor's job for them.

 

There's nothing wrong with breaking it out the way you've described, though I would suggest making sure you've completed the full audit of your FSQMS against all sections before your audit each year.  E.g. if your audits are in October, maybe adjust those four sections to two-month windows so you're all done self-auditing by end of August.

[Tony-C]

Hi Nikko_Cal_fruit,

 

 

Welcome to the IFSQN forums

 

You can split up the SQF Checklist and use that to audit quarterly as jfrey123 has posted.

 

I prefer to schedule by procedure which I match to the SQF Code for ease of understanding compliance. An example of a monthly schedule based on risk is below. You could decide to split the whole lot into quarters and do that instead but I prefer to schedule monthly and keep on top of things.

 

 SQF FSMS Internal Audit Schedule.png   756.12KB   1 downloads

 

Kind regards,

 

Tony

[GMO]

Hi Nikko_Cal_fruit,

 

 

Welcome to the IFSQN forums

 

You can split up the SQF Checklist and use that to audit quarterly as jfrey123 has posted.

 

I prefer to schedule by procedure which I match to the SQF Code for ease of understanding compliance. An example of a monthly schedule based on risk is below. You could decide to split the whole lot into quarters and do that instead but I prefer to schedule monthly and keep on top of things.

 

SQF FSMS Internal Audit Schedule.png

 

Kind regards,

 

Tony

 

I was about to ask because I'm not as familiar with SQF.  Do you not have to decide frequency and schedule based on risk or is that not part of the standard?

[LostInTheWoods]

 You need to list the evidence from your own SOP's that makes you compliant with each item, and yes, it's doing your auditor's job for them.

Fairly standard in other industries. I came from automotive, and the external auditor ALWAYS started by reviewing 1) Last year's external audit, and 2) the current year's internal audit. When our SQF auditor last year used our internal audit as a jumping off point, the people who only had food experience were put off by him doing so. It seemed par for the course for me.

[Tony-C]

I was about to ask because I'm not as familiar with SQF.  Do you not have to decide frequency and schedule based on risk or is that not part of the standard?

 

There is no requirement to audit at a frequency based on risk in the SQF Food Safety Code, the requirement is:

‘Internal audits shall be conducted in full and at least annually. The methods applied shall ensure:

All applicable requirements of the SQF Food Safety Code: Food Manufacturing are audited per the SQF audit checklist or a similar tool;

….’

 

Auditing at a frequency based on risk is what I would expect to see in an organisation that operates to 'best practices' rather than the minimum requirements of the certification standard. I wouldn't be adverse to reducing the frequency once some history of satisfactory audits had been established in those areas visited multiple times in the example of a schedule.

 

Kind regards,

 

Tony

[GMO]

There is no requirement to audit at a frequency based on risk in the SQF Food Safety Code, the requirement is:

‘Internal audits shall be conducted in full and at least annually. The methods applied shall ensure:

All applicable requirements of the SQF Food Safety Code: Food Manufacturing are audited per the SQF audit checklist or a similar tool;

….’

 

Auditing at a frequency based on risk is what I would expect to see in an organisation that operates to 'best practices' rather than the minimum requirements of the certification standard. I wouldn't be adverse to reducing the frequency once some history of satisfactory audits had been established in those areas visited multiple times in the example of a schedule.

 

Kind regards,

 

Tony

 

Brilliant, thanks.  I was about to go through the standard but figured someone would know the clause by heart. 

 

Surprised that's not part of a GFSI requirement but I suppose in reality, lots of people only tick the box on BRCGS which is the one standard I do know has it.  You're right that I would see some level of risk assessment related to intrinsic risk of that part of the standard not being correct but also how much you touch on that with facility inspections and GMP audits anyway but also recent audit results.

[SHQuality]

There's nothing wrong with breaking it out the way you've described, though I would suggest making sure you've completed the full audit of your FSQMS against all sections before your audit each year.  E.g. if your audits are in October, maybe adjust those four sections to two-month windows so you're all done self-auditing by end of August.

@jfrey123 With the increase of unannounced audits, wouldn't you give yourself slightly more time to be ready within the expected audit time-frame? Or are unannounced audits not a thing within SQF?

[TimG]

I was under the impression you don't need to have the internal audit done by the inspectors visit, you need to have it done by the end of the year. And of course, previous years needs to be completed and buttoned up.

I still attempt to get it finished before the auditor comes, but this year I was short my tech for 4 months and had to train someone twice (which means I have been short a tech practically all year). I even told the auditor this during the audit a couple weeks ago. He looked at how much was done and said 'yeah you're fine as long as you finish the rest by end of year.'

[jcieslowski]

I was under the impression you don't need to have the internal audit done by the inspectors visit, you need to have it done by the end of the year. And of course, previous years needs to be completed and buttoned up.

 

Generally speaking, you need the audit to be done WITHIN a year of the last internal audit.  Annual review.  So if you do it all at the same time, and do it at the end of the year, then fine.  But if you do an internal audit of say, Allergen Management, in October of 2024, you're now late and overdue. 

 

I use conditional formatting on my document register to highlight any documents that will come due in the next 30 days and make sure I internally audit their associated program (I do all docs associated with that program at the same time so usually it's a 'chunk' of yellow highlights telling me to go do that internal audit).

[TimG]

Generally speaking, you need the audit to be done WITHIN a year of the last internal audit.  Annual review.  So if you do it all at the same time, and do it at the end of the year, then fine.  But if you do an internal audit of say, Allergen Management, in October of 2024, you're now late and overdue. 

 

I use conditional formatting on my document register to highlight any documents that will come due in the next 30 days and make sure I internally audit their associated program (I do all docs associated with that program at the same time so usually it's a 'chunk' of yellow highlights telling me to go do that internal audit).

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

[SHQuality]

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

I don't think we were talking about doing it in less than a year for compliance reasons, but to make sure everything has been covered recently prior to the audit to ensure that one item is not consistently late in its cycle. 

[jcieslowski]

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

 

Let's say my audit was November 2025.  If I did my last audit in January 2024 and have it scheduled to be done this year in December 2025, I might expect to get a minor for it.  That means the program wasn't audited in 23 months.   I guess you could make an argument that it's complying with the letter of the code because you'll be doing one each year but...  Well, I would have questions if I was the auditor.

[GMO]

It's always fascinating to look at different GFSI schemes and how they're audited. When BRCGS says annual, it really means annual.  It's even in the glossary:

 

"Within 12 months since the action was last conducted."

 

So make that audit section Feb 2025 when the last audit was Jan 2024 and that's a non con... 23 months might even be looking at a major depending on how much and which sections are impacted.