How to Prepare for a Food Safety Audit: A Practitioner Guide for South African Food Businesses

A food safety audit is rarely lost on the factory floor. It is lost in the file. Facilities that run clean operations still pick up findings because the records do not back up what the team actually does every day. This guide is written for the person who has to face the auditor: what a food safety audit checks, how HACCP, GMP and the South African regulations fit together, and the practical steps that separate a smooth audit from a stressful one. Pest control gets its own section, because it is one of the first files most auditors open.

What is a food safety audit?

A food safety audit is a structured, documented examination of whether a food business is controlling its safety hazards the way its system says it does. An auditor, internal or third-party, works through your processes, your records and your physical premises to confirm that hazards are identified, controls are in place, and evidence exists to prove it. It is not a surprise inspection looking for a single failure. It is a systematic check that your food safety management system is real and running, not just written down. The gap between what a facility does and what it can prove is where findings come from.

What do auditors actually check?

Auditors check three things in parallel: your documented system, your records showing the system runs, and the physical state of the premises. They will look at your hazard analysis, your critical control points and the monitoring logs behind them, then walk the floor to see whether reality matches the paperwork. Cold chain records, cleaning schedules, pest control reports, staff training files and corrective-action records all get pulled. The pattern is consistent: a control you claim but cannot evidence is treated as a control you do not have. Auditors trust records over reassurance, every time.

What are the seven principles of HACCP?

HACCP rests on seven principles set out in the Codex Alimentarius framework: conduct a hazard analysis, determine the critical control points, establish critical limits, establish monitoring procedures, establish corrective actions, establish verification procedures, and establish record-keeping. Every one of those principles produces evidence an auditor will ask for. Hazard analysis without documented critical limits is incomplete. Monitoring without records is unverifiable. Understanding the seven principles is really understanding what paperwork your system has to generate, because the audit tests the evidence, not your intentions.

How do HACCP, GMP and R638 fit together in South Africa?

In South Africa, GMP sets the baseline conditions, HACCP manages the specific hazards, and Regulation R638 is the legal hygiene requirement most food premises are measured against. Good Manufacturing Practices cover the foundational things: facility layout, hygiene, maintenance and pest control that make safe production possible. HACCP sits on top, targeting the particular hazards of your process. R638, the regulations governing general hygiene requirements for food premises, is the South African legal framework that local authorities enforce, and it is why many premises need a Certificate of Acceptability from their municipality. An audit often checks all three at once, so treating them as separate projects is a mistake.

How do you prepare for a food safety audit?

Preparing for a food safety audit means closing the gap between practice and evidence before the auditor does it for you. Run an internal audit against the same standard first, so you find the findings yourself. Pull every record the auditor will want and check it is complete, current and signed off: monitoring logs, cleaning records, pest control reports, training files and corrective actions. Walk the floor as if you were the auditor, looking for the small physical things, a propped door, a gap under a roller shutter, a cleaning task quietly skipped. Fix what you find and document the fix. The facilities that pass are the ones that audit themselves honestly first.

• Run an internal audit against the target standard and log the results.
• Confirm every monitoring, cleaning and training record is complete and current.
• Review pest-control reports for coverage, trends and closed-out actions.
• Walk the premises for physical gaps and entry points.
• Document every corrective action you take, with dates.

Why is pest control one of the first things auditors check?

Pest control is checked early because pest activity is a direct, visible indicator of whether a facility’s hygiene and structural controls are working. An auditor opening your pest-control file wants to see more than a service sticker on the wall. They look for a documented monitoring programme, dated service reports, trend analysis showing activity over time, and evidence that flagged issues were actioned and closed. A file that is just proof someone visited is a finding waiting to happen. A programme aligned to HACCP and GMP, with real trend reporting, is the version that holds up. EcoPest runs quarterly internal audits aligned to HACCP and GMP through our food safety auditing service, and the pest side is handled by the same team through our commercial pest management programmes. That is the difference between a folder and a defensible record.

What happens if you fail a food safety audit?

Failing a food safety audit usually means findings to close out within a set timeframe, not an immediate shutdown, though serious hazards can trigger stronger action. Most audits produce a list of non-conformances graded by severity, and you are given time to correct them and provide evidence. The facilities that struggle are the ones that treat each audit as a one-off scramble rather than maintaining the system year-round. The ones that pass comfortably keep their records current continuously, so the audit is a confirmation rather than a test. Preparation is not a week-before event. It is how you run the operation.