How to Build a BRCGS Internal Audit Programme That Protects Your Certificate

By Robert Low, Director, Lead Auditor & BRCGS Approved Trainer

Internal audits are a Fundamental requirement across BRCGS standards, and in my experience they are the single best predictor of how a certification audit goes. A site with a healthy internal audit programme finds and fixes its own findings, and presents the certification auditor with a short list. A site whose programme is a box-ticking exercise donates its findings to the audit report instead. Here is how to build the healthy version.

Risk-Based, Not Calendar-Based

The lazy programme audits everything once, in one annual blitz, usually the month before the certification audit. The expectation across BRCGS standards is the opposite: audit frequency set by the risk of the activity and its previous performance, with the programme spread across the year on multiple non-consecutive dates. High-risk activities and past problem areas get audited more often. Everything gets audited at least annually. And spreading the programme means your system is being challenged in February and July, not just the panicked fortnight before the CB arrives.

Weight the Fundamentals

Not all requirements carry equal consequence, so your audit effort should not be spread equally. A major non-conformity against a Fundamental requirement costs you the certificate, not just grade positions, so risk assessment methodology, traceability, incoming goods control, process control and training deserve the deepest, most frequent internal scrutiny. When I build programmes with sites, the Fundamentals get roughly double the attention of everything else, and it pays back every time.

Independence and Competence

Auditors must not audit their own work, which in a small site takes creativity: swap auditors between departments, borrow a competent person from a sister site, or bring in external support for the areas nobody can independently cover. And train your auditors properly, because an internal auditor who cannot raise a finding against a colleague is a chocolate teapot. Findings need objective evidence, and reports should record conformity as well as non-conformity, so the record shows what was checked, not just what failed.

Close the Loop or Do Not Bother

An internal audit programme that raises findings nobody closes is worse than none, because it documents that you knew. Every finding gets corrective action, root cause where warranted, and verification that the fix worked, the CAPAVA discipline I set out in my CAPA article. Feed the results into management review, and use the trend data to reset next year’s audit frequencies. That loop, findings to fixes to frequencies, is what protects your grade and your certificate.

I build and health-check internal audit programmes remotely, and deliver internal auditor training to go with them. Buttons below.