Auditing Management systems based on ISO19011 By Eng. Karam Malkawi - Jordan
A systematic and functionally independent
examination to determine whether activities and
related results comply with a conforming
standard, whereby all the elements MUST BE
Is done According to ISO19011:2002 and this
Standard describes in details:
The Audit Standards.
Managing the Audit.
The Internal audits are conducted by the
organization itself, or on its behalf, for management
review and other internal purposes (e.g. to confirm
the effectiveness of the management system or to
obtain information for the improvement of the
Internal audits can form the basis for an
organization’s self declaration of conformity. In
many cases, particularly in small organizations,
independence can be demonstrated by the freedom
from responsibility for the activity being audited or
freedom from bias and conflict of interest.
Set of policies, procedures or requirements used as
a reference against which audit evidence is
Examples; HACCP, ISO22000, Statuary
Regulations, … etc.
Records, statements of fact orotherinformation
which are relevant to the audit criteria and
Audit evidence can be:
Results of the evaluation of the collected audit
evidence against audit criteria.;
Indicate conformity or nonconformity.
Can lead to the identification of opportunities for
improvement or recording good practices.
If the audit crite ria are se le cte d fro m le g al o r o the r
re q uire m e nts, the audit finding is te rm e d co m pliance o r
no n-co m pliance .
Outcome of an audit afterconsideration of the
audit objectives and all audit findings.
Organization being Audited.
Person who conduct the Audit.
one or more auditors conducting an audit , supported
if needed by technical experts .
One auditor of the audit team is appointed as the audit
The audit team may include auditors-in-training.
person who provides specific knowledge or expertise to
the audit team.
Specific knowledge or expertise is that which relates
to the organization, the process or activity to be
audited, or language or culture.
Person who accompanies the audit team(3.9) but
does not audit.
An observer is not a part of the audit teamand does
not influence or interfere with the conduct of the audit .
An observer can be from the auditee , a regulator or
other interested party who witnesses the audit.
Person appointed by the auditee to assist the audit
arrangements for a set of one or more audits (3.1)
planned for a specific time frame and directed towards
a specific purpose.
Extent and boundaries of an audit.
The audit scope generally includes a description of
the physical locations, organizational units, activities
and processes, as well as the time period covered.
description of the activities and arrangements for an
effect of uncertainty on objectives.
Ability to apply knowledge and skills to achieve
Ability implies the appropriate application of personal
behavior during the audit process.
fulfillment of a requirement.
Non-fulfillment of a requirement.
the foundation of professionalism
Auditors and the person managing an audit programme
•— Perform their work with honesty, diligence, and
•— Observe and comply with any applicable legal
•— Demonstrate their competence while performing their
•— Perform their work in an impartial manner, i.e. remain
The obligation to report truthfully and accurately
•Audit findings, audit conclusions and audit reports
should reflect truthfully and accurately the audit
•Significant obstacles encountered during the audit and
unresolved diverging opinions between the audit team
and the auditee should be reported.
•The communication should be truthful, accurate,
objective, timely, clear and complete.
Due professional care;
The application of diligence and judgment in auditing.
•Auditors should exercise due care in accordance with
the importance of the task they perform and the
confidence placed in them by the audit client and other
• An important factor in carrying out their work with due
professional care is having the ability to make
reasoned judgments in all audit situations.
The basis for the impartiality of the audit and objectivity
of the audit conclusions.
•Auditors should be independent of the activity being
audited wherever practicable, and should in all cases
act in a manner that is free from bias and conflict of
•Auditors should be independent from the operating
managers of the function being audited.
•Auditors should maintain objectivity throughout the
audit process to ensure that the audit findings and
conclusions are based only on the audit evidence.
The rational method for reaching reliable and
reproducible audit conclusions in a systematic audit
Audit evidence should be verifiable
Internal audits play a critical role in :
•Basically Maintaining and Improving a Management System.
•Determine if the system is meeting requirements.
• Identify non-conformances.
• Drive continuous improvement.
• Measure compliance with the documented system.
• Auditorneeds to understand the principles of
• Auditorneeds to understand the process and the
product which is produced.
• Internal auditors must complete an internal
Internal auditors are responsible for verifying the
effective implementation of the food safety
Auditors have to:
Find objective evidence that the system is
implemented and effective.
Where the system is not implemented or
operating as planned.
Where the system does not meet requirements of
There are three main types of audit:
a) First Party
b) Second Party
c) Third Party
Also known as internal audit is being conducted
systematically and periodically to evaluate the
organization’s own process, procedures, and products.
“”“” Parties Involved = 1 (the Organization OnlyParties Involved = 1 (the Organization Only) “”) “”
“”“” The organization gets the reportThe organization gets the report ””””
Also known as external audits, customer audits or
supplier audits which is a very Flexible and commonly based on
customer requirements or what he wants.
“”“” Parties Involved = 2 (the Organization and the customerParties Involved = 2 (the Organization and the customer
Supplier) “”Supplier) “”
“”“” The reports goes to the customer””The reports goes to the customer””
Also known as registration audit and is Carried out by an
independent organization which characterized by flexibility
it must follow the audit process completely.
“”“” Parties Involved = 3 (Parties Involved = 3 (Organization, customer and the
certification body) “”) “”
“” Report goes to the organization and the certification
Focus on compliance to the organization as documented food
• Auditors will compare what is being done to the documented
policies, procedures and other FSS – documentation.
• Is the process done according to the plan?
• Are employees aware of, trained on and following ?
the FSMS documentation and requirements?
Many companies have GMP inspections or regularly scheduled
inspections of Prerequisite Programs but this completely differ
from audits because inspection is typically based on a standard
checklist that designed to look at each point individually and
determine if a requirement is being followed, BUT Internal
audits look at the system at all of it’s sides and include the
interaction of processes.
Firstly an audit program must be planned and implemented.
And the program is designate responsibility for an audit
coordinator that will:
• Maintain the audit schedule
• Assign auditors
• Initiate audits
The audit programme should include information and
resources necessary to organize and conduct its
•— objectives for the audit programme and individual
•— extent/number/types/duration/locations/schedule of the
•— audit programme procedures;
•— audit criteria;
•— audit methods;
•— selection of audit teams;
•— necessary resources, including travel and
When Preparing an audit schedule; Each area
must be audited at least one a year, but for an
effective program plan on auditing each area at
FST-L: ………… Date: ………….. Approved By: …………….. Date:
Dept. / Audit # 1 2 3 4 5 6
Management 15.01 21.06
Sales & Marketing 10.02
Quality Assurance 31.03
20.01 15.03 09.05
HR and Training 01.02 20.04 20.06
Identify what processes or procedures must be audited in each area
Department. And These will be included in the audit plan for the
Q.A Sales Production Purchasin
Document Control DC-01 X X X X X X
Q.C Records QC-02 X X X X X X
Training & HR HR-04 X X X X X X
Corrective Actions CA-05 X X X X X
When an internal audit is coming up on the schedule,
the audit coordinator will determine how much time
and how many auditors are required Based on the
status and importance, as well as the number of
procedures that apply to the area and must be
included in the audit.
The amount of time allotted has a direct effect on the
scope and depth of the audit.
The auditor/s assigned must be independent of the
area being audited.
Once the schedule is complete; after, it is time to
get ready for your first audit ; Prepare your audit
plan based on the processes and procedures that
has been identified.
AUDIT NUMBER Opening Meeting Place, Time & Attendees:
Areas to be audited Closing Meeting Place, Time & Attendees:
Scope of the Audit and
Time Process or
Team 1 Team 2 Notes
Corrective Actions to be achieved: ………………….
Additional Information: ………………………………
The continued auditing and verification of a HACCP system
demands more attention than the initial development of a
On-Site with Human interactions:On-Site with Human interactions:
-Completing Audit checklist and questionnaires with
- conducting document review with auditee participation.
On-Site with No Human Interactions:On-Site with No Human Interactions:
-Conducting Document Review (e.g. Records and Data
-Observation of work performed.
Steps to Audit
Audit the entire HACCPplan
– Include prerequisite programs.
– Review the entire 12 step HACCPprocess.
howeveraddress each component separately
–Compare to Codex Alimentarius.
• Communicate to all parties to be audited
• Use the process audit approach
Review the documentation,Review the documentation,
The auditors should consider if:
•— the information in the documents provided is:
•— complete (all expected content is contained in the
•— correct (the content conforms to other reliable
sources such as standards and regulations);
•— consistent (the document is consistent in itself and
with related documents);
•— current (the content is up to date);
•— the documents being reviewed cover the audit
scope and provide sufficient information to support the
• — the use of information and communication
technologies, depending on the audit methods, promotes
efficient conduct of the audit: specific care is needed for
information security due to applicable regulations on
protection of data (in particular for information which lies
outside the audit scope, but which is also contained in
Document review can give an indication of the
effectiveness of document control within the auditee’s
• Verify documentation to what is really occurring.
• Condition of facility
Monitoring - Observe employee performing task.
• Compare to written procedures.
• Use of calibrated instruments.
• Interview the employee.
–Ask open ended questions?
–What are their authority?
–Do they understand what and why they are
doing their task?
• Review their training records
• Review past deviations.
• Look for trends.
• Were actions complete?
• Was suspect product contained?
• Review records
• Observe and compare
• Review records.
• Who is verifying?
• How were deviations handled?
• If it is not recorded, assume it is not being done!
• Review records for completeness
–Signature of person monitoring
–Time and date
–Critical limit recorded
–Correcting mistakes on paperwork
• Electronic data
–Assurance of integrity
• Biggest challenge for small and very small plants
• Review documentation
• Supporting documents sufficient and credible
• Review records.
• Ask about changes in process.
Common HACCPFailures:Common HACCPFailures:
• Too many CCPs identified
Ineffective monitoringIneffective monitoring
• CCP not monitored frequently enough to control
• Personnel unsure of task
• Not performed as described in HACCP Plan
Missing HACCPPlanMissing HACCPPlan
• Each product orproduct group has to have their
Lackof trainingLackof training
• General staff
• Quality Assurance/HACCP Monitors
• Do not understand the “whys”
• Lack of documentation to support training
• Proper monitoring procedures
Instruments used in monitoringInstruments used in monitoring
• Not calibrated .
• Not calibrated correctly.
• Calibrated inconsistently.
• Record of calibration missing.
• No procedure or action for handling an instrument.
•found to be. out of calibration
Documentation missingDocumentation missing
• CCP decision tree
• Hazard analysis
• Identification of food safety team
Corrective Action not completedCorrective Action not completed
• Root cause not identified
• Observe reoccurrence of problem
• Four criteria of corrective action not met
Methods not validatedMethods not validated
• Is there scientific proof to support control
and critical limits?
• Is supporting documents from a credible source?
Lackof HACCPPlan reviewLackof HACCPPlan review
• Minimum requirement is annually
• Required to review whenever there is a change in
1. Senior Management Ensures that the
responsibilities and authorities are defined and
communicated within the company
1. There is a clear communication and reporting
channel between senior management and personnel
3.Process performance and product conformity
4.Status of preventive and corrective action
5.Follow-up action from previous management reviews
6.Planned changes that could effect the quality system
7.Recommendations for improvement
1. A quality manual with appropriate procedures exists
Control of documents
1.Document control procedures are in place including approval for
adequacy prior to use, updates and re-approval, identification of current
version, availability, legibility
2.Records are controlled (identifies which records should be kept and
3.The following records are as appropriate to the product (e.g. GMP,
production records, master record file)
1.Internal audit are performed on scheduled intervals to assess the
effectiveness of the QMS
2.Personnel identified and trained to perform internal audit.
3.Documentation the corrective and preventive action were performed as
an outcome of the internal audit.
1.Procedures exists for the review and evaluation of food safety
hazards in the event of new or changed quality.
2.Buildings and grounds are adequately and routinely maintained.
3.Buildings are maintained in reasonably clean and orderly manner.
4.Buildings are of suitable construction to minimize access to rodents,
birds, and other pets.
5.Building provides adequate space and lightening.
6.All equipment maintained in reasonably and orderly manner.
7.All equipment are of suitable size, design, construction, precision,
and accuracy for its intended needs.
8.All equipments are maintained to prevent lubricants and coolants
introduction as unsafe additive to food.
Site standard cont.,
9. All equipment are designed, constructed and maintained to facilitate
inspection and use of cleanout procedure.
10. work areas and equipment used to manufacture and storage of
food are kept separate from chemicals.
11. All equipments are properly cleaned to prevent unsafe
contamination of food.
12. There are procedures in place controlling calibration of
13. There is a master sheet of all equipments.
1.Evidence that ingredients specifications are
provided to supplier exists
2.Traceability procedures exists to facilitate product
3.Established inspection procedures or other
inspection activities to ensure that purchased material
specification are in place, including contamination.
Control of production
1.Master record file is maintained for each product which include
product specs, formulation, label, and special manufacturing instruction.
2.Frequency and number of samples needed during production for each
3.Proper identification and date of production are provided.
4.Production records are maintained that provide formulation, date of
production, date of shipment to facilitate recall of products.
5.Work instructions for proper manufacturing procedures are available
6.Production records are inspected for accuracy at scheduled intervals.
7.Equipments is suitable for manufacturing of product to specification
8.Monitoring devices are available and used.
Validation of production process
1. Validation procedure are in place and conform to science
based performance standards.
Identification and Treacibilty
1.Finished products are properly packaged and labeled for
identification and should include name, product description, net
weight (or bulk statement), lot number, shelf life date, and label
2.Procedures for product traceability are documented
3.Retained samples are identified for traceability (shelf life).
Control of monitoring and measuring devices.
1.Monitoring and measuring devices use to manufacture
product are properly maintained, calibrated and recorded.
2.Instrumentation and devices used to calibrate monitoring
and measuring devices are verified at specified intervals
Monitoring and measurements of process
1.Monitoring procedures have been established to evaluate
the manufacturing processes, where appropriate.
2.Scheduled monitoring activities have been established.
Monitoring and measurement of product
1. Procedures are in place to ensure products conforms to
Storage of products
1. Products are properly identified, stored, handled, and
controlled to maintain their identity and integrity
1. Procedure for recording and evaluating complaints exists.
Control of non-conforming products
1.Procedures to control non-conforming products have been
established and are in place.
2.N0on-conforming products are properly identified and stored
in specified location
3.Documentation of final disposition of non-conforming products
which may include rework or re-verification.
4.Procedures have been established for product recall or
customer notification if non-conforming product is detected after
5.Procedures for handling returned goods are established.
6.Documented procedures that established requirements for
reviewing and preventing non-conformities including customer
complaints, determine reason of non-conformity, recorded of
results of action taken and reviewing corrective action taken.
1.Records are available that demonstrate personnel
competence and training.
2.Job description are available that include the responsibility
and skills required by the employees.
3. personnel and are properly trained in personal hygiene
where appropriate to avoid contamination.
4.Training matrix is in place.
5.Refreshing training procedure is in place.
6.Training records are available for personnel dealing with the
1.The HACCP team has been trained and the training has been
a- includes the names of HACCP team
and training/ experience of HACCP
b- the individual developing the hazard
analysis, including delineating control measures successfully
completed training in the application of HACCP principles.
c- the individuals developing a HACCP plan that is appropriate for
specific site successfully completed training in the application of
d- the individual verifying and modifying the HACCP plan
successfully completed training in the application of HACCP
e- the personnel preforming the record review successfully
completed training in the application of HACCP principles.
2. The HACCP plan is specific to the location and site.
3. The HACCP plan is specific to the ingredients, food process.
4. If ingredients, food or processes are grouped together in single
plan, evidence exists that share a common hazard.
5. The hazard analysis lists all hazard,
a- the written hazard analysis identifies hazards, for each process
step or includes the statement “ non identified at this time”.
b- the written hazard evaluation is based in scientific evidence,
considers hazard frequency and severity and has been performed for
every identified hazard.
c- the control measures for significant hazard have been identified.
d- the pre-requisite program is exist for significant hazards and are
correctly referenced to the HACCP plan.
e- the hazard analysis procedure included an evaluation of SOP and
modifications are performed when necessary.
f- critical control points exist for significant hazard.
g- the hazard analysis considered external and internal hazards.
h- evidence exists that the HACCP team considered, at
minimum, biological, chemical and physical hazard listed
in this section.
i- the hazard analysis considered possible sources of
adulteration including all process steps including
packaging, storage, transportation, intended use, facility
and equipment function and design, and plant sanitation
including personnel hygiene.
6. All identified hazards are evaluated fortheir
7. CCPs are assigned for significant hazard.
8. If applicable to process flow and hazard evaluation,
CCP’s are assigned forsignificant hazards outside the
9. Critical limits are identified foreach CCP.
10. Procedures exist formonitoring each CCP.
11. Monitoring frequency ensures adherent to the critical
12. The HACCPplan includes corrective action plans developed.
a- the corrective action plan describes steps to be taken and assigns
responsibility in response to deviations from critical limits and:
- ensure adulterated product is not distributed or used after the
deviation has been identified and before the corrective action has been
- corrects the deviation.
b- for deviation that occurs and the site does not have a corrective
action plan product is segregated and held, tested for acceptability not
used until product is bought into conformance with HACCP plan.
c- for deviations that occurs and the site doesn't have a corrective
action plan the cause of the deviation is corrected and verified by
trained personnel to determine whether HACCP plan requires
d- Records provide evidence that the corrective action were performed
as described in the HACCP plan
13. The HACCPplan lists validation and verification procedures and
a- evidence that the site reviews consumercomplaints and their
relationships to the HACCPplan’s performance orare a new hazard
b- verification that key manufacturing equipment are calibrated
according to the plan was performed.
c- Verification of process monitoring calibration performed.
d- verification that the site performs end-product testing if included
in the HACCPplan.
e- Verification within (7 days) that critical control points monitoring
records were completed, signed, and documented values were within
the critical limits.
f- procedures outlined in section were followed wheneverany
verification establishes the need forcorrective actions.
g- verification within (7 days) that calibration records forequipments
were performed in accordance to the HACCPplan
h- validation procedures were conducted at specific time
i- whenever no significant hazard have been identified, a
reassessment of the hazard analysis adequacy will be
performed annually or after process modification by
individual trained and recorded.
14. The HACCP plan includes a record keeping system for monitoring
a- written hazard analysis in place that has identified all significant
biological, chemical, and physical hazards.
b- written HACCP plan for this location for each type of ingredient.
c- monitoring of critical control points and their critical limits
d- calibration of key manufacturing equipments.
e- calibration of processing monitoring instruments
f- corrective action including disposition.
g- records documenting verification and validation of the HACCP
h- all records include the name and location.
i- All records includes the date and time.
j- all records includes signature or initial person performing the
operation or creating the records.
k- all records are signed and dated.
l- all records are included the identity of the
product and if required the production code.
m- all records include the processing
observations and other information entered
at the time observed.
n- records required are retained for 3 years
after the date of production ( electronic
records are acceptable)
o- Records required are available for review
and copying during certification audit.
A particular slide catching your eye?
Clipping is a handy way to collect important slides you want to go back to later.