An audit is a systematic, independent and documented process for gathering evidence and judging it objectively against set criteria. An auditor does not run the system, and does not decide how to fix it. The auditor shows whether the system meets the criteria, and on what evidence.
| Type | Who audits | Food example | Main independence risk |
|---|---|---|---|
| First party (internal) | The organisation itself, or someone acting for it | A QA manager audits the dispatch area against the site's own plan | Auditing your own work, or your manager's |
| Second party | A customer, or someone acting for it | A caterer audits a sauce supplier before listing it | The customer's commercial interest in the outcome |
| An independent body, such as a . Some definitions also count government agencies | A audit against a food safety standard, or a regulatory audit by an approved auditor | Selling advice to the same business, or being paid by the business being audited |
Integrity
Honest and ethical work, within your own competence.Fair presentation
Report truthfully and accurately, including obstacles and unresolved disagreements.Due professional care
Diligence and sound judgement, in proportion to what depends on the audit.Confidentiality
Protect what you learn, and use it only for the audit.Independence
Stay free from bias and conflict of interest. Do not audit your own work where that can be avoided.Evidence-based approach
Conclusions rest on verifiable evidence, sampled sensibly, not on impressions.Risk-based approach
Put audit effort where the risks and opportunities are greatest.These are the seven principles of auditing listed in ISO and IAF guidance on . The descriptions are our own short summaries. ISO 19011 is guidance. A 2026 edition replaced the 2018 edition in May 2026, so check the principles against the current text.
Skills
Asking open questions, listening, sampling, reading records against the floor, recognising what is missing, and writing a finding that the auditee can act on.Attributes
Fair, observant, open-minded, firm when challenged and tactful with people. A good auditor can say what is working as well as what is not.Food knowledge
, , microbiology, food law and the sector being audited. An auditor who does not know the process may not see what is wrong.Lead auditor training teaches how to plan, lead and report an audit, usually with an exam. It is a course, not a licence to audit. The length and content are set by whoever relies on it. For example, one widely used scheme asks that the lead of an team in a multi-site organisation has completed a 40-hour lead auditor course, and other internal auditors a 16-hour course. Always read the rule for the scheme in question.
Personnel is a separate step, where an independent body confirms that a person meets a defined competence scheme, and maintains that over time. sets requirements for bodies that certify people. GFSI does not approve or train auditors. Scheme owners set the auditor rules and certification bodies apply them.
| Jurisdiction | Regulator-approved auditing | Notes |
|---|---|---|
| Australia, national | Standard 3.2.1 requires a , where one applies, to be audited by a : a person approved under the Act as competent to audit that class of business. | A national guideline and audit policy aim for consistent criteria. Approval by one regulator does not carry to another, even within the same state. Approvals should be finite, and the guideline recommends no longer than four years. |
| New South Wales | The Food Act provides for food safety auditors. A licensed business needs Food Authority approval before using an external auditor for a program audit. | Mutual recognition exists, but the Authority may still assess under its own Act. |
| Victoria | Audits must be done by an whose covers that class or category of premises. | Class 1 premises and class 2 premises with a non-standard program are the audited classes. |
| Queensland | The Food Act has a chapter on approving auditors. Queensland Health oversees auditors under that Act; a separate agency covers primary production. | Published criteria: IV or higher in food science or a related field, 40 hours of food microbiology, three national units of competency, relevant experience, suitability and a criminal history check. |
| Western Australia | The Department of Health approves regulatory food safety auditors and publishes a list with scope and expiry. | Approval lasts four years. It requires a witness audit and commitment to a code of conduct. Adding a competency needs a separate application. |
| South Australia, Tasmania, ACT, Northern Territory | Each has audit provisions for businesses that must have a , and South Australia and Tasmania have specific auditor approval provisions in their Acts. | Check the local regulator's register before engaging an auditor. |
| New Zealand | Not called auditors. are checked by verifiers from recognised agencies or recognised persons under the Food Act 2014. | MPI publishes a competency covering qualifications, , auditing and industry experience. |
What counts as a conflict of interest for a regulatory auditor?The Australian national guideline gives examples: giving a business specific direction on managing a risk in the system you will audit, or drafting that system. Delivering training with company-specific solutions. A direct financial interest in the business. Favouring someone because of a past association. A close tie to a direct competitor, where the proprietor should be told and may decide.
Is being paid by the auditee a conflict?The guideline says that being paid for the audit is not, in itself, a conflict. General advice that is freely available is not one either, and neither is discussing non-conformances found during the audit.
What should happen when a conflict appears?The auditor tells the regulator's responsible officer as soon as possible. The guideline says that failing to declare a potential conflict should at the very least lead to a review of the approval, if not suspension or cancellation.
Can someone audit internally and also work in the area?Good practice and several schemes say auditors should not audit their own work. In a small business, where that is hard, use a person from another area, swap with another site or bring in outside help, and record how it was handled.
Can a consultant who built a plan then audit it?It is the classic case of auditing your own work. Under the guideline it is treated as a potential conflict. Check the regulator's or scheme's rule, and look at the period that must have passed, if one is given.
Sources: ISO and IAF, ISO 9001 Auditing Practices Group, Guidance on Effective Use of ISO 19011, 2020 (read 3 Nov 2026)SIS, SS-EN ISO 19011:2026 listing (read 3 Nov 2026)ANAB, 1st, 2nd and 3rd party audits explained, search extract only (read 3 Nov 2026)ISO/IEC 17024 catalogue entry, search extract only (read 3 Nov 2026)GFSI, Frequently asked questions, search extract only (read 3 Nov 2026)Food Safety News, GFSI auditor benchmarking requirements, 2021, search extract only (read 3 Nov 2026)FSSC 22000 Version 7.0 scheme, multi-site internal audit rules (library checked 14 Oct 2026)Food Standards Code, Standard 3.2.1 (library checked 14 Oct 2026)National Regulatory Food Safety Auditor Guideline, v1.2, 2009 (read 3 Nov 2026)National Food Safety Audit Policy (located 3 Nov 2026, not read in full)Queensland Government, Food safety auditors (read 3 Nov 2026)WA Department of Health, Regulatory food safety auditing for auditors (read 3 Nov 2026)Food Act 1984 (Vic), s 19K (library checked 14 Oct 2026)Food Regulation 2025 (NSW), s 47 (library checked 14 Oct 2026)NSW Food Authority, auditor information, search extract only (read 3 Nov 2026)Food Act 2014 (NZ), s 50 (library checked 14 Oct 2026)MPI, Competency profile for verifiers, September 2025, search extract only (read 3 Nov 2026)