ISO 22000 Internal Audit Programme NZ: Coverage and Priorities

An ISO 22000 internal audit programme connects the audits a food business needs over time. It helps a quality manager see what has been checked, what remains uncovered, why certain processes need earlier attention and whether previous findings have actually been resolved. A calendar full of audit dates cannot answer those questions on its own.

This guide helps New Zealand food manufacturers and quality teams build or review that programme. For the wider certification pathway, use the ISO 22000 certification guide. The practical worksheet below is a recommended planning approach, not a reproduction of the standard or a guarantee of certification.

Confirm the requirements and current edition

ISO’s current ISO 22000 publication page lists ISO 22000:2018 and Amendment 1:2024, with a revision under development. Establish the version your business is using and retain an authorised current copy. A draft revision is not automatically the requirement against which your present system is assessed.

Clause 9.2 requires planned internal audits addressing conformity and effective implementation. Programme arrangements cover frequency, methods, responsibilities, planning and reporting, informed by process importance, system changes, monitoring, measurement and previous audits. It also addresses audit scope and criteria, competent impartial auditors, reporting, records, correction, corrective action and verified follow-up. Use the standard for the complete wording.

ISO 19011:2026 provides management-system auditing guidance; it does not itself award certification. Its official public informative preview distinguishes an audit programme from an audit plan. Keep guidance, ISO 22000 requirements and any additional certification-scheme or customer requirements separately identified. This article does not set a universal yearly or monthly audit frequency.

Separate the programme from an audit plan

On a phone, swipe sideways to read all columns. Keyboard users can focus the table region to scroll horizontally.

For example, one well-run allergen-control audit may be useful without covering the whole food safety management system. The programme makes that limitation visible and schedules the remaining work. Management review can then consider the overall picture; it is not completed merely by filing individual audit reports. See the ISO 22000 management review guide for that distinct decision process.

Map coverage across the actual system

Begin with a current description of the system boundaries: sites, products, activities, supporting functions and relevant outsourced processes. Use that description to build a coverage map. The recommendations here concern how to organise your evidence; they are not a substitute list of ISO clauses or a claim that every example applies to every business.

• Connect requirements to processes. Show where the relevant standard, internal procedures and other agreed criteria will be examined. Avoid an unexplained tick beside a clause number.
• Include the work that supports production. Consider procurement, maintenance, competence, document control, communication and corrective action alongside operational controls, where within scope.
• Identify interfaces. Record where information or responsibility passes between teams: for example, an ingredient change moving from purchasing to hazard review, production instructions and finished-product information.
• Make operating coverage visible. Consider whether selected shifts, lines, locations or seasonal activities give a suitable view of implementation. Record the basis for the selection and any limitations.
• Show remaining coverage. Link completed reports to the map and retain the next planned activity for areas not yet adequately examined.

A process approach can examine connected requirements in one audit rather than running an isolated visit for every clause. Keep the mapping explicit so that efficiency does not conceal gaps. Where the business integrates several management systems, identify which criteria were actually assessed; a shared meeting or checklist is not evidence that every system requirement was covered.

Set priorities and intervals with reasons

Build the schedule from evidence before allocating convenient dates. Use the programme inputs required by ISO 22000, then explain what they mean for the business. A practical priority note might identify the process’s importance, recent change, previous findings and relevant performance trends, followed by the reason for the proposed timing and depth.

Consider an illustrative manufacturer that has introduced a new ingredient approval route while a previous handover finding remains open. An early audit of the changed route may be more useful than automatically repeating the previous calendar order. The audit can examine how information reaches the food safety team and production, rather than only checking whether a new form exists. This is a planning example, not an AFVA client case.

Do not use risk-based prioritisation to abandon the rest of the agreed system scope. Keep a visible route to the required coverage. Conversely, do not give every process identical time solely because a spreadsheet has equal-sized rows. Explain decisions to combine activities, increase attention, defer work or revisit an area.

Assign competence, objectivity and resources

Match the auditor to the work being examined. A useful competence review considers auditing ability, understanding of the relevant requirements and sufficient food/process knowledge to evaluate the evidence. Record how any gaps will be addressed, including specialist support where appropriate. Attendance at a course alone is a weak explanation for every possible assignment.

Objectivity needs attention when the programme is assigned, not only when a report is signed. Identify whether the proposed auditor designed, manages or carries out the activity being examined. Consider reporting relationships and earlier consulting work. Choose arrangements that protect impartial assessment; an external invoice alone does not establish independence.

For a small team, discuss a suitable cross-function assignment or appropriately scoped external support rather than quietly accepting self-review. Keep responsibility for the organisation’s programme clear. When commissioning an individual engagement, use the separate outsourced internal food safety audit briefing guide for the scope, evidence and deliverables to agree.

Allow time for preparation, access to people and records, observation where needed, reporting and follow-up. Confirm confidentiality and access arrangements before the activity. A booked auditor with no access to the relevant shift or records may leave a coverage gap despite the calendar entry being marked complete.

Turn priorities into workable audit activities

The following example shows how programme-level decisions can become a set of connected activities. It is deliberately undated: the organisation needs to choose its own justified intervals and resources against its applicable requirements.

1. Map the changed process: identify the ingredient-approval interface, the procedures and requirements to examine, relevant teams and the evidence needed to understand the change.
2. Assign an objective reviewer: check competence and prior involvement, agree the work with process owners and reserve the resources needed.
3. Plan the individual audit: define the exact scope and criteria, suitable evidence selection and activities that can test implementation, not only document existence.
4. Connect findings to action: report to the appropriate people, agree correction and corrective-action responsibilities, and identify how completion and effectiveness will be checked.
5. Update programme coverage: record what was actually examined, any limitations and the effect on other planned work or future follow-up.

For each planned activity, retain a concise record of its purpose, scope, criteria, timing, assigned auditor, process contact, methods, report destination and follow-up arrangement. Link the evidence behind its priority. A separate detailed plan can expand the activity when the audit is prepared; the programme need not contain every interview question.

Track findings and improve the programme

Separate three stages in the tracker: the audit took place; the report was issued; and resulting actions were verified. Those stages can have different dates and owners. A report received is not the same thing as a problem resolved.

ISO 22000 requires follow-up to verify actions taken and report that verification. A useful recommended action record links the finding and underlying criterion to the correction, cause review, corrective action, responsible person, agreed timing and verification evidence. Use proportionate evidence to establish whether the response works, rather than treating an uploaded procedure as automatic closure.

At programme reviews, look for repeated findings, uncovered interfaces, overdue actions, cancelled audits and recurring evidence-access limitations. Ask whether the programme is producing useful information or repeatedly missing the same area. Feed the resulting priorities into later audits and management decisions. Keep revisions traceable so the business can explain what changed and why.

Check whether the programme is ready

Before approving the next programme version, use this recommended readiness check:

• The current system scope and applicable requirements are identified, with a map to planned and completed coverage.
• Priorities and intervals have reasons linked to current evidence rather than only last year’s calendar.
• Each activity has clear criteria, scope, an appropriate auditor and realistic resources.
• The assignments address competence, prior involvement and impartiality concerns.
• Reporting reaches the food safety team and relevant management, with recorded findings and limitations.
• Actions have owners, agreed timing and verification arrangements; overdue work stays visible.
• Someone owns programme changes and the review of whether the programme remains effective.

Common mistakes are marking a whole process covered after checking one form, repeating the same convenient daytime sample, counting a supplier audit as automatic coverage of the organisation’s own controls, and treating a completed calendar as proof of system effectiveness. Correct the underlying mapping or evidence problem rather than only changing the tracker’s colour.

Frequently asked questions

Does ISO 22000 require every process to be audited on the same annual date?

Clause 9.2 calls for planned intervals and a programme informed by the specified inputs. It does not provide a universal same-date calendar for all processes. Establish the timing against the applicable requirements and your evidence, including any additional scheme or customer commitments. Avoid an unsupported frequency copied from another site.

Can several smaller audits form the programme?

They can be organised as a connected set, provided the organisation establishes suitable scope, criteria, coverage, resources and follow-up. Show how the separate activities serve the programme’s purpose and applicable requirements. A collection of unrelated checklist visits with no coverage map is harder to evaluate.

Can the quality manager audit work they created?

Assess competence and impartiality for the actual assignment. Prior design or operational responsibility creates a self-review concern that needs a suitable arrangement. Do not assume a job title, an external contract or a signed declaration alone resolves it. Agree the safeguards before the audit.

Does an external certification audit replace the internal programme?

Keep the functions separate. An internal programme is conducted by or on behalf of the organisation; third-party certification is a different assessment. External findings can inform priorities, but filing an external report does not itself demonstrate implementation of the organisation’s internal audit arrangements.

Is ISO 19011:2018 still the current guidance edition?

ISO currently lists ISO 19011:2026, edition four, published in May 2026, replacing the 2018 edition. Check the current publisher record and your applicable requirements when maintaining references. The guidance supports management-system auditing; it does not itself confer certification.

Can AFVA help build or review an audit programme?

AFVA’s current services include internal audit planning and scheduling, audit execution and reporting, and corrective-action follow-up. Its ISO consulting service includes system review and certification preparation. Agree the actual scope and impartiality arrangements. AFVA provides support; it does not issue ISO certificates or guarantee a certification outcome.

Bring a defined programme question to AFVA

If coverage or priorities are unclear, gather your current programme, system scope, previous reports, open actions and recent change/performance information. AFVA’s ISO standards consulting support can help review the arrangements and identify practical next steps. Contact AFVA about your internal audit programme with the decision you need to resolve, rather than only asking for a generic audit date.