19 replies to this topic

[Nikko_Cal_fruit]

Hi, I was wondering if anyone has a template or program, they would be willing to share. I’m currently updating our SQF internal audit program to a quarterly breakdown. Previously, we were conducting audits every month, but it became a bit too much. I plan to break it down as follows:

• Q1 (Jan–Mar): Module 2, Sections 2.1–2.5

• Q2 (Apr–Jun): Module 2, Sections 2.6–2.9

• Q3 (Jul–Sep): Module 11, Sections 11.1–11.5

• Q4 (Oct–Dec): Module 11, Sections 11.6–11.9

If anyone has examples, templates, or tools that could help support this structure, I’d greatly appreciate it. Thank you!

[jfrey123]

I think the easiest is to download the actual excel checklist SQF provides alongside the code on their website.  Example for FSC 14 at this link: SQFI | Code Selector

 

Bear in mind the code requires objective evidence be recorded by you for non-compliance AND compliance with each code item.  You need to list the evidence from your own SOP's that makes you compliant with each item, and yes, it's doing your auditor's job for them.

 

There's nothing wrong with breaking it out the way you've described, though I would suggest making sure you've completed the full audit of your FSQMS against all sections before your audit each year.  E.g. if your audits are in October, maybe adjust those four sections to two-month windows so you're all done self-auditing by end of August.

[Tony-C]

Hi Nikko_Cal_fruit,

 

 

Welcome to the IFSQN forums

 

You can split up the SQF Checklist and use that to audit quarterly as jfrey123 has posted.

 

I prefer to schedule by procedure which I match to the SQF Code for ease of understanding compliance. An example of a monthly schedule based on risk is below. You could decide to split the whole lot into quarters and do that instead but I prefer to schedule monthly and keep on top of things.

 

 SQF FSMS Internal Audit Schedule.png   756.12KB   2 downloads

 

Kind regards,

 

Tony

[GMO]

Hi Nikko_Cal_fruit,

 

 

Welcome to the IFSQN forums

 

You can split up the SQF Checklist and use that to audit quarterly as jfrey123 has posted.

 

I prefer to schedule by procedure which I match to the SQF Code for ease of understanding compliance. An example of a monthly schedule based on risk is below. You could decide to split the whole lot into quarters and do that instead but I prefer to schedule monthly and keep on top of things.

 

SQF FSMS Internal Audit Schedule.png

 

Kind regards,

 

Tony

 

I was about to ask because I'm not as familiar with SQF.  Do you not have to decide frequency and schedule based on risk or is that not part of the standard?

[LostInTheWoods]

 You need to list the evidence from your own SOP's that makes you compliant with each item, and yes, it's doing your auditor's job for them.

Fairly standard in other industries. I came from automotive, and the external auditor ALWAYS started by reviewing 1) Last year's external audit, and 2) the current year's internal audit. When our SQF auditor last year used our internal audit as a jumping off point, the people who only had food experience were put off by him doing so. It seemed par for the course for me.

[Tony-C]

I was about to ask because I'm not as familiar with SQF.  Do you not have to decide frequency and schedule based on risk or is that not part of the standard?

 

There is no requirement to audit at a frequency based on risk in the SQF Food Safety Code, the requirement is:

‘Internal audits shall be conducted in full and at least annually. The methods applied shall ensure:

All applicable requirements of the SQF Food Safety Code: Food Manufacturing are audited per the SQF audit checklist or a similar tool;

….’

 

Auditing at a frequency based on risk is what I would expect to see in an organisation that operates to 'best practices' rather than the minimum requirements of the certification standard. I wouldn't be adverse to reducing the frequency once some history of satisfactory audits had been established in those areas visited multiple times in the example of a schedule.

 

Kind regards,

 

Tony

[GMO]

There is no requirement to audit at a frequency based on risk in the SQF Food Safety Code, the requirement is:

‘Internal audits shall be conducted in full and at least annually. The methods applied shall ensure:

All applicable requirements of the SQF Food Safety Code: Food Manufacturing are audited per the SQF audit checklist or a similar tool;

….’

 

Auditing at a frequency based on risk is what I would expect to see in an organisation that operates to 'best practices' rather than the minimum requirements of the certification standard. I wouldn't be adverse to reducing the frequency once some history of satisfactory audits had been established in those areas visited multiple times in the example of a schedule.

 

Kind regards,

 

Tony

 

Brilliant, thanks.  I was about to go through the standard but figured someone would know the clause by heart. 

 

Surprised that's not part of a GFSI requirement but I suppose in reality, lots of people only tick the box on BRCGS which is the one standard I do know has it.  You're right that I would see some level of risk assessment related to intrinsic risk of that part of the standard not being correct but also how much you touch on that with facility inspections and GMP audits anyway but also recent audit results.

[SHQuality]

There's nothing wrong with breaking it out the way you've described, though I would suggest making sure you've completed the full audit of your FSQMS against all sections before your audit each year.  E.g. if your audits are in October, maybe adjust those four sections to two-month windows so you're all done self-auditing by end of August.

@jfrey123 With the increase of unannounced audits, wouldn't you give yourself slightly more time to be ready within the expected audit time-frame? Or are unannounced audits not a thing within SQF?

[TimG]

I was under the impression you don't need to have the internal audit done by the inspectors visit, you need to have it done by the end of the year. And of course, previous years needs to be completed and buttoned up.

I still attempt to get it finished before the auditor comes, but this year I was short my tech for 4 months and had to train someone twice (which means I have been short a tech practically all year). I even told the auditor this during the audit a couple weeks ago. He looked at how much was done and said 'yeah you're fine as long as you finish the rest by end of year.'

[jcieslowski]

I was under the impression you don't need to have the internal audit done by the inspectors visit, you need to have it done by the end of the year. And of course, previous years needs to be completed and buttoned up.

 

Generally speaking, you need the audit to be done WITHIN a year of the last internal audit.  Annual review.  So if you do it all at the same time, and do it at the end of the year, then fine.  But if you do an internal audit of say, Allergen Management, in October of 2024, you're now late and overdue. 

 

I use conditional formatting on my document register to highlight any documents that will come due in the next 30 days and make sure I internally audit their associated program (I do all docs associated with that program at the same time so usually it's a 'chunk' of yellow highlights telling me to go do that internal audit).

[TimG]

Generally speaking, you need the audit to be done WITHIN a year of the last internal audit.  Annual review.  So if you do it all at the same time, and do it at the end of the year, then fine.  But if you do an internal audit of say, Allergen Management, in October of 2024, you're now late and overdue. 

 

I use conditional formatting on my document register to highlight any documents that will come due in the next 30 days and make sure I internally audit their associated program (I do all docs associated with that program at the same time so usually it's a 'chunk' of yellow highlights telling me to go do that internal audit).

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

[SHQuality]

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

I don't think we were talking about doing it in less than a year for compliance reasons, but to make sure everything has been covered recently prior to the audit to ensure that one item is not consistently late in its cycle. 

[jcieslowski]

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

 

Let's say my audit was November 2025.  If I did my last audit in January 2024 and have it scheduled to be done this year in December 2025, I might expect to get a minor for it.  That means the program wasn't audited in 23 months.   I guess you could make an argument that it's complying with the letter of the code because you'll be doing one each year but...  Well, I would have questions if I was the auditor.

[GMO]

It's always fascinating to look at different GFSI schemes and how they're audited. When BRCGS says annual, it really means annual.  It's even in the glossary:

 

"Within 12 months since the action was last conducted."

 

So make that audit section Feb 2025 when the last audit was Jan 2024 and that's a non con... 23 months might even be looking at a major depending on how much and which sections are impacted.

[SHQuality]

It's always fascinating to look at different GFSI schemes and how they're audited. When BRCGS says annual, it really means annual.  It's even in the glossary:

 

"Within 12 months since the action was last conducted."

 

So make that audit section Feb 2025 when the last audit was Jan 2024 and that's a non con... 23 months might even be looking at a major depending on how much and which sections are impacted.

I totally agree with GMO here. There's really no wiggle room.

 

That's why I feel it's important to give yourself that room.

I would suggest that if the standard says to audit every 12 months, then you should audit every 9 months so you have 3 months left to address issues on time before they become a problem during an external audit by the certifying body that could put your certification in danger.

 

In my experience, it's not so much the internal audit, but the follow-up actions that come from the audit that don't get enough attention.

Edited by SHQuality, 25 November 2025 - 08:47 PM.

[Lynx42]

Eh, I'd fight that one if an auditor wrote it as a NC:

2.5.4.1 The methods and responsibility for scheduling and conducting internal audits to verify the effectiveness of the SQF System shall be documented and implemented. Internal audits shall be conducted in full and at least annually.

 

You would lose that fight. Annually is different than calendar year.  If you do it in October one year, you would need to do it October (or earlier) the next year. If you audit something twice a year you are golden, but if you did it October last year, you will get an NC if you do it Nov or Dec this year.  

We almost got an NC because we had a document the showed the internal audit in May, but we made a revision in February and due to me being on vacation the end of May the remaining internal audits hadn't been completed until June.  I tried the calendar year argument and I mentioned we reviewed it in Feb when we made the change and got shot down super quick on both points.  I'm pretty sure it would have been an NC if it hadn't been our first audit.

[GMO]

You would lose that fight. Annually is different than calendar year.  If you do it in October one year, you would need to do it October (or earlier) the next year. If you audit something twice a year you are golden, but if you did it October last year, you will get an NC if you do it Nov or Dec this year.  

We almost got an NC because we had a document the showed the internal audit in May, but we made a revision in February and due to me being on vacation the end of May the remaining internal audits hadn't been completed until June.  I tried the calendar year argument and I mentioned we reviewed it in Feb when we made the change and got shot down super quick on both points.  I'm pretty sure it would have been an NC if it hadn't been our first audit.

 

I guess it is a GFSI thing then.  I know that in the last few years I've heard of A LOT of BRCGS sites ending up with this non con.  Honestly I think in part when they started to crack down on it, it was raised a lot because it's super easy to find for the auditor. I'd prefer it if they spent more time looking at the efficacy of the audit rather than quibbling about 13 months rather than 12 but that's just me...  23 months would be taking the p--- though and I guess a line has to be drawn somewhere.

[Lynx42]

I found this in the SQFI SQF365 digital seminars: https://www.sqfi.com...-sqf-excellence.

 

They specifically say it's 12 months, but if you do an internal audit July 31st one year, then Aug 5 the next, they will let it go because it meets the intent of the code.  Maybe there is a 1-2 week grace period?  

 

In my situation, I took the last two weeks of the month off and gave my backup and managers a list of things that needed to be completed by month end.  They didn't do a handful of things and since they didn't tell me they what they chose not to do   it was a full month late before I caught it.

[TimG]

Well, that's stupid. Now on top of real issues I have to worry about not dating the internal audit past the day I did the previous year because some pissant armchair warrior code jockey who's never worked in a plant in their life thinks it should be done within 12 months of the last one? Not to mention that will mean the audit creeps earlier and earlier into the year.

Yeah, you better believe I'd fight it. I might lose, but that doesn't stop me from fighting stupid shit. 

[Tony-C]

Well, that's stupid. Now on top of real issues I have to worry about not dating the internal audit past the day I did the previous year because some pissant armchair warrior code jockey who's never worked in a plant in their life thinks it should be done within 12 months of the last one? Not to mention that will mean the audit creeps earlier and earlier into the year.

Yeah, you better believe I'd fight it. I might lose, but that doesn't stop me from fighting stupid shit. 

 

  My, my Tim we are getting our knickers in a twist! Have you been on the pop?   

 

The SQF Food Safety Code requirement ‘Internal audits shall be conducted in full and at least annually’ is more than reasonable. I don’t think minor transgressions should be punished if they are a one off but if a business can’t commit to complying with that requirement then that is not a good sign.

 

Slightly off for this SQF topic, but I quite like this from BRCGS:

 

‘The site’s attitude towards its internal audit programme is also likely to indicate its food safety and quality culture. For example, a site with a poor food safety culture may be tempted to:

- reduce the number of internal audits and inspections to the minimum, rather than the level indicated by thorough risk assessment

- under-report non-conformity and near-misses (i.e. find less than exist in reality)

- not follow up on non-conformities (e.g. corrective, preventive actions and root cause analysis).’

 

Kind regards,

 

Tony