How do you prepare for a food safety audit?

Keep readiness continuous rather than cramming: reconcile documents to the current standard, sample your records for gaps, close out every corrective action, run a traceability and mass-balance exercise, walk the floor for GMP issues, prime operators to answer the basics for their line, and assemble supporting evidence (calibration, training, supplier approvals) so retrieval takes minutes. A pre-audit checklist and a mock audit tie it together.

What do food safety auditors look for?

Evidence and behavior, not intentions. Auditors review records (monitoring logs, CCP records, verification reviews, corrective actions), walk the floor for GMP and facility condition, interview operators about hazards and what they do when controls fail, and follow a thread, a lot or an ingredient, end to end. Most findings are missing, late, or inconsistent records, and gaps between the written procedure and what happens on the floor.

What is a mock audit?

A mock audit is a full rehearsal of the real thing: someone plays the auditor, works from the actual checklist, reviews records, walks the floor, and interviews staff, then writes up findings. It's the most useful preparation activity because it surfaces gaps while they're still free to fix. Use fresh eyes, simulate an unannounced version and off-shifts, and turn every finding into a real corrective action.

Are food safety audits announced or unannounced?

Both. Since GFSI's 2020 updates, recognized schemes (SQF, BRCGS, FSSC 22000) require at least one unannounced audit within the three-year certification cycle, alongside announced audits. That's why real preparation means being ready any day rather than for a scheduled date, you can't cram for an audit whose timing you don't control. Confirm the exact rules with your scheme and certification body.

How long do you have to close audit corrective actions?

It varies by scheme and finding severity, but non-conformances from a certification audit typically must be addressed with root-cause analysis and corrective action within a defined window, commonly around 28 days, to secure or maintain certification. Critical findings can carry tighter deadlines or trigger a follow-up audit. Check the specific timelines for your scheme and certification body.

What is a gap assessment for a food safety audit?

A gap self-assessment is auditing yourself against every clause of your standard before the auditor does, marking each requirement met, partial, or gap, honestly. It converts a vague sense of readiness into a ranked fix list. Treat each gap as a mini corrective action with an owner and due date, done a few weeks out, so the real audit confirms work you've already completed rather than delivering a verdict.

Food Safety Audit Preparation

The audit doesn't test your plant. It tests whether your records can prove what your plant did, every shift, not just this week.

Food safety audit preparation is the ongoing work of keeping your records, facility, and people ready to be checked at any time. It covers document readiness, mock audits, a clean corrective-action history, a practiced traceability exercise, and a gap self-assessment against the standard you're certified to. Done right, it's a habit, not a fire drill.

The uncomfortable truth is that an audit doesn't really test your plant, it tests whether your evidence can prove your plant did what it was supposed to, on every shift, not just the good days. Most findings aren't broken equipment; they're missing records, late reviews, and gaps between the written procedure and the floor. This guide gives you a pre-audit checklist, the readiness areas that matter most, and how to prepare for the unannounced audit that's now part of every GFSI scheme.

What does audit preparation actually mean?

It means being able to prove, on demand, that your food safety system works as documented. An auditor spends their time doing four things: reviewing documents and records, walking the floor, interviewing your people, and following a thread (a lot, an ingredient, a corrective action) to see if the system holds end to end. Preparation is making sure each of those goes well because the underlying reality is sound, not because you staged it.

The distinction matters because of what changed in 2020: GFSI now requires an unannounced audit at least once every three-year certification cycle. BRCGS, SQF and FSSC 22000 all build in unannounced audits. You can't cram for an audit you don't know is coming, which quietly reframes the whole exercise: the goal isn't to be ready for a date, it's to be ready on a random Tuesday.

The four things an auditor does, and the shift unannounced audits force: readiness has to be a daily state, because you no longer control the date.

What goes on a pre-audit checklist?

Run this checklist before any audit, and periodically regardless, since the next one might be unannounced. Work it in order of what auditors hit hardest:

Reconcile documents to the current standard. Confirm your HACCP/food safety plan, prerequisite programs, and procedures reflect the version of the standard you're certified to and the way the plant actually runs today.
Pull and sample your records. Check that monitoring logs, CCP records, sanitation records, and verification reviews are complete, signed, dated, and free of gaps, sample them the way an auditor will, at random.
Close out corrective actions. Every non-conformance from the last audit, internal audit, and complaint should be closed with root cause and verified effectiveness, open actions from last year are a red flag.
Run a traceability and mass-balance exercise. Pick a lot and trace it both directions within the time target, reconciling quantities in against product and waste out.
Do a GMP and facility walk. Fresh eyes on the floor: condition, hygiene, pest control, allergen segregation, calibration tags, and anything obviously out of place.
Prime your people. Make sure operators can answer the basics for their line, allergens, CCPs, what they do when a control fails, who they tell. Confident floor answers are worth more than a polished binder.
Assemble supporting evidence. Calibration certificates, training records, supplier approvals, pest-control reports, internal audit reports, and management review minutes, where an auditor asks, retrieval should take minutes.

The pattern across all seven: the work is retrieval and reconciliation, not creation. If you're creating records the week before an audit, that's the finding.

How do you get your documents audit-ready?

Document readiness has two failure modes, and they're opposite. The first is missing evidence, a log with gaps, a review that never happened, a record you can't find. The second is a document that exists but doesn't match reality, a procedure that says every hour while the floor runs every two, or a plan that references equipment you retired. Auditors catch the second one by comparing the document to the floor, and it damages credibility more than a simple gap.

Three practices keep documents ready:

Version control. One current version of every controlled document, obsolete versions removed, changes dated and approved. Two conflicting copies of an SSOP in two binders is an easy finding.
Fast retrieval. "Show me the cook logs for this lot and the training record of whoever signed off" should take minutes. Binder archaeology extends the audit and sharpens scrutiny.
Records that match the floor. The strongest defense is that the document describes what actually happens, which comes from writing procedures around real practice and updating them when practice changes.

This is where a strong food safety culture shows: in a mature plant the records are right because the work is right, not because someone tidied up. It's also where the quality and safety systems should share one backbone, per our guide on food quality versus food safety one set of records, two lenses.

Why run a mock audit?

A mock audit is a full dress rehearsal, someone plays the auditor, works from the real checklist, reviews records, walks the floor, and interviews operators, then writes up findings as an auditor would. It's the single most useful preparation activity because it surfaces the gaps while you can still fix them for free.

Make it realistic:

Use a fresh set of eyes. Someone who didn't write the programs, another site's quality lead, a corporate auditor, or a consultant, sees what you've gone blind to.
Simulate the unannounced version too. Run one with little warning, and sample off-shifts. Night shift is where culture claims and record discipline go to die, and unannounced auditors increasingly sample there.
Treat findings as real. Every mock finding becomes a corrective action with root cause and verification. A mock audit whose findings don't get closed is theater.
Rehearse the interviews. The most common failure isn't the plan, it's an operator who freezes on "what are the allergens on this line?" Practice builds the confidence auditors read as culture.

How do you prepare a traceability exercise?

A traceability exercise proves you can track product both directions, back to the ingredients and suppliers in a finished lot, and forward from a raw material to every product and customer it reached, within a time target, usually a few hours. It pairs with a mass-balance check: reconcile the quantity of an ingredient that came in against what went out as product, rework, and waste. If the numbers don't add up, you've either lost track or you're missing records.

A traceability exercise runs both directions from a lot and closes with a mass balance. If the quantities don't reconcile, you've either lost track of product or you're missing records, and an auditor will find the gap.

Auditors love traceability exercises because they test the whole system at once: your records, your lot coding, your traceability practices and your ability to move fast in what would, in a real recall, be a genuine emergency. Some schemes and customers run one during the audit and expect a second on file. Practice it before the auditor arrives, the first time you attempt a full trace should never be live. It's the same muscle a mock recall builds, and the two exercises reinforce each other.

How do you run a gap self-assessment?

A gap self-assessment is you auditing yourself against every clause of the standard before the auditor does, going line by line through the SQF, BRCGS, or FSSC 22000 requirements and honestly marking each as met, partial, or gap. It converts a vague sense of readiness into a specific list of things to fix, ranked by risk.

The value is in the honesty. A self-assessment that rates everything green is worthless; the point is to find the yellows and reds while they're cheap to fix. Treat each gap as a mini corrective action with an owner and a due date, and re-check before the audit. Done a few weeks out, it turns the audit from a verdict into a confirmation of work you already did. Where the gaps cluster, a specific program that's always partial, is also your signal for where to invest, whether that's GMP a food fraud vulnerability assessment or your lubricant control documentation.

The audit facts worth pinning

What the schemes now require, from primary sources:

GFSI-recognized schemes require unannounced audits since the 2020 benchmarking updates, a facility must undergo at least one unannounced audit within its three-year certification cycle, so readiness has to be continuous (GFSI).
Corrective actions carry defined timelines non-conformances raised in a certification audit must be addressed with root-cause and corrective action within the scheme's set window, commonly around 28 days, to secure or keep certification (FDA FSMA underpins the U.S. regulatory baseline behind these schemes).
Traceability is a baseline expectation both GFSI schemes and FDA's FSMA framework require the ability to trace product through the supply chain, which is why the traceability exercise is a fixture of audits (FDA FSMA 204).

Confirm the exact timelines and unannounced-audit rules against your specific scheme and certification body, the details vary between SQF, BRCGS, and FSSC 22000, and between announced and unannounced programs.

Making readiness the default state

The plants that dread audits are the ones where preparation is a project: weeks of reconstructing records, chasing signatures, and rebuilding logs before every visit. The plants that barely notice audit week are the ones where the records are simply correct as a byproduct of how they work, and unannounced audits reward exactly that difference.

Getting there is mostly about capture that can't fall behind. When checks, logs, and corrective actions are recorded on a tablet at the station instead of a clipboard, a missed check is visible the same shift, records are time-stamped as they happen, and any document an auditor asks for is a search away instead of a binder hunt. That's the workflow Harmony digitizes on plant floors: paper logs, checklists, and forms become live, searchable data, and decades of specs, procedures, and production history become answerable in plain English, layered on the systems you already run, no rip-and-replace. One manufacturer serving premium spirits brands replaced paper production logging entirely and automated its daily reporting; the same foundation is what makes audit prep quiet. See how it connects on the features overview and make sure your HACCP and GFSI programs are current before the next visit, announced or not.