BRC Internal Audit Checklist: Free Template for Issue 8

What a BRC audit readiness checklist is

A BRC internal audit checklist is the working tool a site uses to test its own operation against the BRC Global Standard for Food Safety before a certification body does the same thing. It turns the standard's clauses into questions you can answer with evidence — a document, a record, an observation on the floor — so that you find gaps while there is still time to close them. This checklist covers the first three sections of the standard: senior management commitment, the food safety plan and HACCP, and the food safety and quality management system. It is written for managers who need to evaluate the organization's readiness for certification to Issue 8.

Why it matters

Certification to the BRC Global Standard is evidence to your customers that you control product safety, legality and quality in a documented, repeatable way. An internal audit against the standard is how you find out whether that is actually true at your site rather than only true on paper. The checklist follows that logic. Clause 1.1.12, for instance, asks you to show that the root causes of non-conformities identified at the previous audit were effectively addressed so they do not recur, and clause 1.1.4 requires an at-least-annual review attended by senior management that weighs internal and external audit results, customer complaints, incidents, corrective actions, out-of-specification results, non-conforming materials, and the effectiveness of your HACCP, food defense and authenticity systems. Running that discipline internally means the external audit is a confirmation rather than a discovery.

What a good BRC audit covers

**Senior management commitment.** The standard starts at the top. There must be a documented policy signed by the person with overall responsibility for the site and communicated to all staff; a plan for developing and continuously improving food safety and quality culture; documented objectives with targets or success measures that are communicated, monitored and reported to site management at least quarterly; and an annual review of performance against the standard and those objectives. Below that sit the practical mechanisms: a meeting program that brings food safety, legality, integrity and quality issues to senior management at least monthly, a confidential reporting system for staff concerns with records of how each was evaluated, the human and financial resources to produce food safely, and a system for tracking scientific and technical developments, industry codes of practice, new raw material authenticity risks and relevant legislation in the country of sale. The standard also sets expectations around the audit itself: announced recertification audits must take place on or before the date on the certificate, the most senior production or operations manager on site must attend the opening and closing meetings, and relevant department managers must be available as required. **The food safety plan and HACCP.** The plan is developed and managed by a multidisciplinary team — quality assurance, technical management, production operations, engineering and other relevant functions — led by someone with in-depth knowledge of Codex HACCP principles. The checklist follows the Codex sequence step by step: product description, intended use including vulnerable consumer groups, construction and on-site verification of the flow diagram, hazard listing and analysis, consideration of control measures, determination of CCPs, establishment of critical limits and their validation, monitoring systems and their records, corrective action, verification, documentation and records, and periodic review. Prerequisite programs — cleaning and disinfection, pest control, maintenance, personal hygiene, training, purchasing, transport, cross-contamination prevention and allergen control — are documented with their own control measures and monitoring, and feed into the development and review of the plan. **The food safety and quality management system.** This is where the manual, document control, record control and internal audit program live, along with supplier and raw material approval. Records must be legible, retrievable, authorized for change and retained for at least the shelf life of the product plus 12 months, with the possibility of a consumer extending shelf life considered where the label indicates it. The internal audit program needs at least four different audit dates spread over the year, every activity audited at least once a year, frequency set by risk and previous performance, and a scope that takes in the HACCP or food safety plan, prerequisite programs, food defense and food fraud prevention plans and the procedures used to achieve the standard. A separate documented inspection program covers the factory environment and processing equipment, with hygiene and production inspections at a risk-based frequency and at least monthly in open product areas. Supplier control is grounded in a documented risk assessment for each raw material or group of raw materials, including primary packaging. It considers allergen contamination, foreign bodies, microbiological and chemical contamination, cross-contamination of varieties or species, substitution or fraud, and raw materials subject to legal control. Approval of suppliers is risk-based — valid certification to the applicable BRC Global Standard or a GFSI benchmarked standard, supplier audits covering product safety, traceability, HACCP review and good manufacturing practice, or a completed questionnaire for low-risk suppliers with robust justification reviewed by a competent person.

How to carry it out

Plan the internal audit the way the standard expects the audit program itself to be planned. Work out which activities are high risk or have performed poorly before, and schedule them sooner and more often. Cover everything at least once across the year. Audit against evidence, not against intent. For each clause, ask what document, record or observation demonstrates it, and check the date on it. A HACCP flow diagram last verified two years ago fails clause 2.6.1. A supplier questionnaire last reissued four years ago fails clause 3.5.1.3. Monitoring records missing the date, time, result or the signature of the person responsible fail clause 2.10.2. Keep the auditor independent of the work being audited, as clause 3.4.2 requires, and make sure reports state both conformity and non-conformity with the objective evidence behind each finding. Agree corrective and preventive actions with the staff responsible, set timelines, and verify completion. Treat the findings as the input to the annual senior management review rather than as a stand-alone list, so that unevaluated objectives, complaints, incidents and out-of-specification results feed into revised objectives and agreed actions.

Frequently Asked Questions

Target the gaps rather than the whole standard. BRC Issue 8 clause 3.4.1 expects a scheduled internal audit program covering at least four different audit dates spread over the year, in which all activities relevant to the requirements of the standard are audited at least once. The frequency for each activity is set by the risks associated with it and by previous audit performance, so weak or high-risk clauses should come round more often.

The two are separate and both are expected. Clause 3.4.1 covers the internal audit program, whose scope includes the HACCP or food safety plan, prerequisite programs and the food defense and food fraud prevention plans. Clause 3.4.4 sets up a separate documented inspection program to confirm the factory environment and processing equipment are maintained in a condition suitable for food production, split into hygiene inspections and production inspections, at a frequency set by risk and at least monthly in open product areas.

A documented risk assessment must exist for each raw material or group of raw materials, including primary packaging, covering allergen contamination, foreign bodies, microbiological and chemical contamination, cross-contamination of varieties or species, substitution or fraud, and any risks linked to raw materials subject to legal control, as well as the impact on finished product quality. It must be updated when a raw material, its processing or its supplier changes, when a new risk emerges, after a product recall or withdrawal involving that raw material, and at least every three years.

Clause 2.6.1 requires the HACCP food safety team to verify the accuracy of the flow diagrams by on-site audit and to challenge them at least annually, taking daily and seasonal variations into account. Records of the verified flow diagrams must be kept.

No. Clause 3.4.2 requires internal audits to be carried out by appropriately trained, competent auditors who are independent of the activity being audited, meaning they must not audit their own work.

The site must retain records for a defined period, taking legal or customer requirements and the shelf life of the product into account, and must consider the possibility of the consumer extending shelf life, for example by freezing, where the label indicates this. Records must be kept for at least the shelf life of the product plus 12 months.

Written by

Arne Reis

Founder

Process optimizer with 25 years of expertise, focused on operational excellence in quality, maintenance, EHS, and commissioning. Emphasizes innovative solutions and top-quality standards.

View LinkedIn profile