How to Pass a Food Safety Audit in 2026

Before anything else, be clear which one you are preparing for, because two very different events get called an audit and preparing for the wrong one is why businesses get caught out.

Both look at your records. Both will ask you to produce something specific from a date they choose. The rest of this covers how to be ready for either.

What an EHO inspection looks at

An Environmental Health Officer arrives unannounced and assesses three things:

• Hygiene compliance. Food handling, temperature control, cross contamination, personal hygiene, cleaning.
• Structural compliance. Condition of the premises, layout, ventilation, pest proofing, equipment, facilities.
• Confidence in management. Your documented food safety management system and the evidence it is being followed. This is the one that carries the most weight and the one businesses prepare for least.

In the UK this produces a Food Hygiene Rating from 0 to 5. Display is mandatory in Wales and Northern Ireland and voluntary in England, and Scotland runs its own Food Hygiene Information Scheme instead. Ireland has no equivalent public rating scheme, though the FSAI publishes enforcement orders where they are served.

What a scheme audit looks at

A BRCGS, SALSA or ISO 22000 audit is broader and deeper. The auditor spends a day or more on site and works through:

1. Documentation review. Your HACCP plan, prerequisite programmes, allergen controls, supplier approval, standard operating procedures.
2. Facility inspection. Structural integrity, equipment maintenance, product flow and segregation, waste, contact surfaces.
3. Process observation. Watching the operation run, from goods in through storage, prep, processing and dispatch, comparing what happens to what the procedure says.
4. Staff interviews. Asking people at every level what they do and why. Auditors are testing whether food safety is understood or recited.
5. A timed traceability exercise. Pick a batch, trace it both ways, reconcile the quantities. This is the single most common place sites lose marks.

Where audits are actually failed

Rarely on hygiene. Almost always on one of these three.

Gaps in the records

An auditor picks a date at random and asks for the monitoring records. Three unexplained empty weeks in March is a non conformity regardless of how the site looks on the day. Weekends and bank holidays are where paper logs go quiet, and auditors know it.

The traceability exercise

Timed, and run in front of you. On paper it means delivery dockets, production diaries and dispatch notes on a table, cross referenced by hand while somebody watches the clock. See what Article 18 requires and how a withdrawal actually runs.

Food safety culture

Newer, and harder to fake. An auditor asks a member of staff what they would do if a fridge read 9°C. If the answer is confident and matches your procedure, that is culture. If they look at a supervisor first, it is not.

The six weeks before

1. Review the HACCP plan. Has anything changed since it was last reviewed? New product, new supplier, new equipment, new layout. An unreviewed plan is a finding on its own.
2. Audit yourself first. Walk the standard clause by clause and score yourself honestly. Everything you find is a finding the auditor now cannot make.
3. Run a mock recall and time it. Pick a batch, trace it both ways, produce the records, reconcile the quantities. Do it twice a year, not once before the audit.
4. Check every record set for gaps. Not the recent ones. Go back twelve months and look at the weeks nobody thinks about.
5. Verify calibration. Probes, sensors and scales, with the certificates to hand.
6. Confirm training records are current. Staff turnover is the usual reason they are not.
7. Close out the last audit. A non conformity from the previous visit that is still open is the worst possible start.

On the day

• Have the records retrievable, not just present. The question is never whether they exist. It is how long you take to produce the ones asked for.
• Answer the question asked. Volunteering extra detail opens doors nobody was going to knock on.
• Do not guess. "I will check and come back to you" is a better answer than a confident wrong one.
• Let staff answer for themselves. A manager who talks over the team signals that the team does not know.
• Take your own notes. Particularly on anything the auditor raises, so the closing meeting holds no surprises.

Afterwards

Almost every audit raises something. What matters is how you close it.

A non conformity needs a root cause, a corrective action, and evidence the action was implemented. Answering "staff retrained" without a training record and a date is how the same finding comes back next year, and repeat findings are treated far more seriously than new ones.

Frequently asked questions