Outsourced Internal Food Safety Audits NZ: What to Include in Your Brief

An outsourced internal food safety audit can help a New Zealand food business examine its own system when capacity, specialist knowledge or objectivity needs attention. Its value depends on a clear brief: what is being assessed, against which requirements, and what the business will receive.

This guide helps managers commission that work. For general staff and record preparation before an assessment, use the food safety audit preparation guide.

Define the internal food safety audit you need

Start with a decision: do you need to assess a particular process, complete identified work in your audit programme, investigate recurring findings, or review a wider system? State that purpose before requesting a visit.

ISO’s public ISO 19011:2026 preview distinguishes internal audits carried out by or for the organisation from supplier and certification audits. Its terms connect the audit’s boundaries and reference requirements with verifiable evidence and findings. Hiring an outside person does not change whose internal audit programme the work serves.

The current ISO 19011 auditing guidance covers audit programmes, audit conduct and competence; it does not itself confer certification. Use the actual applicable food-safety-system or customer requirements as criteria. This article is a commissioning aid, not a full standard or scheme checklist.

Write a brief that defines the work

The following is a recommended briefing checklist, not a mandatory ISO form. Send current versions, identify missing information and agree secure document access.

• Purpose: name the question the audit should answer and how its findings will be used.
• Criteria: identify the applicable plan, procedures, standard and edition, customer conditions or other agreed requirements. Supply the documents the auditor needs.
• Boundaries: specify sites, departments, products, processes, shifts and the evidence period. Identify outsourced activities and exclusions.
• Programme context: provide previous reports, open findings, significant changes and what other internal audits cover.
• People and access: identify the site contact, process owners, operating times, induction needs and access restrictions.
• Auditor arrangements: confirm relevant competence, prior involvement and how objectivity will be protected.
• Outputs: agree the plan, report format, findings, evidence references, reporting recipients and delivery arrangements.
• Follow-up: state who owns actions, who checks evidence and effectiveness, and what further review is included.

For example, an enquiry might request an internal audit of allergen changeover controls on one packing line across named shifts, against specified procedures, with observation and records review. That hypothetical scope does not cover the entire factory or prove the product label is correct. Make those limits explicit.

Check competence and objectivity before appointment

Ask who will perform the work and what demonstrates relevant auditing ability, food-process knowledge and understanding of the agreed criteria. A general qualification or experience in a different sector does not answer every scope question. Ask for evidence and relevant references; avoid assuming an unverified accreditation or scheme status.

Disclose previous consulting, document-writing and operational involvement. Agree how conflicts or self-review will be addressed, and whether another auditor is needed. Being external to the payroll does not by itself establish objectivity.

For Hazard Analysis and Critical Control Point (HACCP) systems, the Codex General Principles of Food Hygiene, section 19.11.2 includes auditing among verification activities. It recommends separation from the person responsible for monitoring and corrective actions, and allows suitable external expertise where activities cannot be performed in-house. That technical HACCP use of “verification” must be distinguished from New Zealand statutory verification.

MPI’s guidance on hiring a food consultant also states that a consultant cannot evaluate or verify a plan or programme they created. Assess any proposed recognised engagement separately. For broader provider comparisons, see how to choose a food safety consultant.

Agree how evidence will be obtained

Discuss which activities need direct observation, staff explanation, records review or another appropriate method. Set the visit around relevant production, changeovers and shifts rather than choosing a quiet time that excludes the work being assessed.

• Identify representative records and product or process trails within the agreed period. Let the auditor select and extend samples where needed.
• Arrange access to current procedures, previous findings and relevant staff without inventing or backdating missing evidence.
• Record activities that could not be observed and information that was unavailable. Decide whether further work is needed before drawing a conclusion.
• Agree confidentiality, file-sharing arrangements and who can receive the report.

Remote document review may contribute to agreed internal work, but it cannot show every physical practice. Record the method and its limits. It does not establish eligibility for remote statutory verification. No universal sample size, audit duration or frequency is prescribed by this briefing checklist.

Specify a useful report and follow-up

Agree these outputs before comparing proposals. They are suggested commissioning deliverables; adapt them to the actual programme and requirements.

Distinguish an immediate correction from work addressing the cause of a recurring problem. Do not close an action solely because someone intends to act or has uploaded a revised procedure. Agree evidence appropriate to the finding and check whether the action worked.

An internal auditor’s review does not close a separate regulator, customer or certification-body finding on that body’s behalf. Confirm any external acceptance conditions and deadlines with the party that issued it.

Avoid scope and quote mistakes

• Booking “an audit” without criteria: agree the specific reference requirements and purpose.
• Comparing visit prices alone: clarify preparation, site time, report, travel, GST treatment and follow-up. No standard price is stated here.
• Treating a limited review as whole-site assurance: retain the boundaries and unassessed areas in the report.
• Assuming a gap visit completed the programme: identify which planned audit work was actually performed and what remains.
• Buying a report without action ownership: assign resources, responsibilities and follow-up before the findings become an unused file.

Discuss an internal audit scope with AFVA

AFVA’s published internal-audit service includes planning and scheduling, checklist development, audit execution and reporting, and corrective-action follow-up. Agree the actual criteria, scope and outputs for your business; no particular accreditation, fixed duration or successful external-audit outcome is promised here.

Send a site/process summary, the criteria you need assessed, previous findings and the main gap in your current audit programme. This provides a practical starting point for a scoped discussion.

Frequently asked questions about commissioning an internal audit

General information only: This is a commissioning guide, not complete audit criteria, a legal classification, a recognised verification report or a certification decision. Confirm the requirements and independence conditions applying to the actual business, programme and engagement. Information checked on 20 October 2026.