Writing Internal Food Safety Audit Findings NZ: Connect the Criterion, Evidence and Gap

A useful nonconformity finding in an internal food safety audit connects a requirement to specific evidence and an accurately described gap. A sentence such as “staff need more training” may sound practical, but it does not tell a manager what requirement was missed, what the auditor actually checked or why training is the appropriate response.

This guide is for New Zealand food businesses developing their own internal auditors and reviewing draft reports. Audit findings can confirm conformity as well as identify nonconformity. This guide focuses on writing a defensible nonconformity finding; do not force a gap where the evidence demonstrates conformity. It does not set statutory verification outcomes, certification grades or a universal audit schedule.

Start with the criterion for internal food safety audit findings

A criterion is the requirement used for the comparison. It might come from an applicable food-safety plan, a customer specification, a certification requirement or the business’s own controlled procedure. Confirm that it applies to the product, activity, site and period being audited before writing a nonconformity.

ISO’s explanation of auditing distinguishes audit criteria from audit evidence: criteria provide the reference, while evidence is relevant information that can be verified. The distinction matters when a checklist contains a broad question such as “Are staff trained?” A checklist prompt helps the auditor investigate; the finding still needs the actual requirement that was not met.

Record the document title, current version and relevant section. If two instructions disagree, establish which one is authorised rather than choosing whichever makes the finding easier. A finding about unclear document control may be justified by its own evidence; an uncertain instruction should not silently become a firm production requirement.

Separate what you observed from what you inferred

Describe the evidence in a way another reviewer can trace. Identify the record or item, relevant date or time, location and the sample examined. “Three of five sampled start-up records did not show the required review” is more bounded than “start-up records are never reviewed”. The wider claim needs wider evidence.

IANZ’s guidance on useful internal audits encourages evidence-led assessment and using more than document review alone. In practice, compare a procedure with the records it generates, the activity observed and relevant staff explanations. When these disagree, record the difference and investigate before concluding.

• Write “no record was provided during the audit” when that is what happened; do not automatically write “the check was not done”.
• Treat an interview statement as evidence of what was said. Seek supporting information when the conclusion depends on what occurred earlier.
• Distinguish an empty field, an illegible entry and a result outside an acceptance criterion. They are different observations.
• Keep photographs or screenshots linked to their context and protect confidential information. A cropped image should not imply facts outside its view.

Build a finding with three connected parts

AFVA recommends checking every draft finding against the following three fields. This is a writing aid, not a prescribed regulatory report form. A report may combine the fields into one paragraph as long as the connection remains clear.

Three fields to complete

For example, a hypothetical site procedure requires a supervisor to review each completed pre-start sheet before the line starts. If the audit finds missing review entries, the next questions include whether review occurred by another approved route and whether the sampled procedure applies. The finding should describe what the evidence establishes after those questions are answered.

Challenge weak findings with practical examples

The examples below are hypothetical training exercises, not AFVA client findings. The dates, counts and local procedure requirements illustrate writing choices only; they are not universal food-safety rules.

Example: incomplete pre-start review evidence

This wording does not establish that the line was dirty, that every shift failed or that the supervisor lacks competence. Those are separate propositions. If later evidence shows another authorised review route was used, reconsider the finding rather than preserving it simply because the report was drafted.

Example: a missing supplier document

A missing document does not by itself prove that the ingredient was unsafe. Conversely, an assurance that the supplier is familiar does not satisfy an explicit document requirement. Keep the conclusion tied to the criterion and the evidence, then assess any product implications through the appropriate process.

Resolve factual disagreements before finalising

Give the process owner an opportunity to check the evidence references and explain relevant context. This is a factual review, not a vote on whether an uncomfortable issue belongs in the report. Record a material disagreement and the evidence considered when it cannot be resolved during the audit.

If the auditee produces another record, check its identity, timing and relationship to the sampled activity. If a requirement has been misread, correct the finding. If the original conclusion remains supported, explain the criterion-to-evidence link plainly. Avoid expanding the wording as a response to disagreement.

The Manitoba government’s food-safety audit glossary provides general definitions of criteria, evidence and nonconformance. It is useful background, not New Zealand law or a source of grading rules for your audit. Use the actual scheme or internal programme when deciding whether and how a supported finding is classified.

Keep the gap separate from the cause and corrective action

“Retrain the operator” is an action, not a finding. Before choosing it, the business may need to examine unclear instructions, unavailable equipment, workload, supervision or a system design problem. The auditor can identify the gap without claiming to know its cause from the first observation.

Record immediate containment or correction separately when needed. This allows the business to see both what was wrong and what was done, without erasing the original evidence. Do not wait for polished report wording when a potentially unsafe situation needs prompt escalation through the site’s procedures.

Likewise, a completed action is not automatically evidence that the cause has been addressed. The report should leave a usable reference for follow-up: which requirement was missed, which records or activities were affected and what evidence would demonstrate the relevant control is working.

A practical review checklist before issuing the finding

1. The criterion is applicable and its document/version reference is correct.
2. The evidence can be located without relying on the auditor’s memory.
3. The sample, date range and activity are explicit.
4. The conclusion does not exceed the evidence.
5. Missing evidence is distinguished from proof that an activity never occurred.
6. Any factual disagreement and additional evidence have been considered.
7. A proposed cause or solution is separate from the finding.
8. Any classification uses the actual audit rules, with the reason recorded.
9. The wording gives the responsible manager a clear issue to investigate.

Common mistakes that weaken an otherwise useful audit

• Copying a generic checklist question into the finding without an applicable requirement.
• Using blame or motive, such as “staff do not care”, instead of observable facts.
• Combining unrelated problems into one sentence that is difficult to correct or close.
• Assigning a major, minor or critical grade from another scheme’s terminology.
• Removing a finding because an immediate correction occurred, without preserving what was observed.

How AFVA can support your internal audit team

AFVA’s internal audit service includes audit planning, execution, reporting and corrective-action follow-up. We can discuss the process, criteria and report support your business needs. The separate guide to commissioning an internal audit helps managers define an outsourced assignment; this article addresses the wording and evidence behind an individual finding.

For learning options, review the current AFVA training page and confirm that the available course matches the role. Training does not itself appoint someone as a recognised verifier or certification auditor. ISO 19011:2026 is current management-system auditing guidance; this article does not reproduce the standard or claim that it confers certification.

Frequently asked questions

Make the finding useful to the person who must act

Before issuing the next report, ask a reviewer to find the criterion, evidence and gap in each proposed nonconformity. Where one is missing, clarify the facts or narrow the conclusion. A short defensible finding is more useful than a strong accusation that the evidence cannot support.

General information only: Apply the current requirements, scope and reporting rules for your business and audit. This writing framework does not determine statutory verification outcomes, certification decisions or the safety of an affected product.