CFSQA common mistakes
CFSQA · Understand the traps and how to avoid them.
Treating an auditor's personal preference (e.g., 'I always require two signatures on sanitation records') as a codified requirement when justifying a nonconformity, and writing the finding as a violation of 'good practice' rather than citing a specific clause, regulation, or scheme requirement.
Candidates learn audit technique from mentors and internal procedures, so tacit house rules feel authoritative. Under exam pressure, citing a remembered practice is faster than locating the actual citation, and many candidates have never had to defend a finding to an appeal.
What to do instead
For every finding you draft in practice, write the exact citation next to it (standard clause, regulation section, scheme requirement, or the auditee's own documented procedure). If no citation exists, downgrade it to an observation or opportunity for improvement. Drill the hierarchy: regulation > scheme standard > customer/contract requirement > auditee's own documents > auditor preference.
Confusing independence and objectivity failures with competence failures, for example calling an auditor 'unethical' when the real issue is that they audited a process they personally designed, or missing a conflict-of-interest scenario because the auditor was technically excellent.
Ethics codes list several distinct principles, and candidates memorize the labels without mapping realistic scenarios to the right one. Impartiality, independence, confidentiality, and competence all sound like 'being professional,' so the distinctions blur.
What to do instead
Build a four-column table (principle, definition, typical scenario, correct auditor response) covering integrity, impartiality/independence, confidentiality, competence, and evidence-based judgement. Practice classifying short vignettes: prior consulting for the client (impartiality threat), auditing own department (independence threat), lacking HACCP training (competence), disclosing client data (confidentiality). Note that threats are managed, not automatically disqualifying, unless safeguards cannot reduce them.
Building an audit programme that is a fixed annual calendar with every site and every clause audited once per year, ignoring risk, performance data, complaint trends, and previous findings when allocating time and frequency.
Annual full-coverage audits are the most familiar template, and schedules are often inherited. Risk-based programme design requires justifying reduced or increased frequency, which is harder to defend internally than 'we audit everything yearly.'
What to do instead
Practice writing a programme justification: list inputs (previous audit results, complaint and recall history, regulatory inspection outcomes, change in product/process, site performance metrics), show how each input shifts frequency or duration, and state the resulting schedule with rationale. Be able to explain why a low-risk, stable site may be audited less often and why a site with repeat findings gets more scope, not just an earlier date.
Writing audit objectives, scope, and criteria as interchangeable statements, e.g., listing 'FSSC/ISO 22000 and customer requirements' as the objective, or omitting what is explicitly excluded from scope (shift patterns, warehouses, seasonal products).
The three terms appear together in templates and are rarely tested separately in day-to-day work. Exclusions feel like weakness, so candidates leave them out rather than stating and justifying them.
What to do instead
Memorize the distinction: objective = what the audit is meant to determine; scope = the boundaries (sites, processes, products, time period, shifts); criteria = the requirements used as the reference. When practicing, write all three for a scenario and add an explicit 'out of scope' line with a reason. Check that every objective can be answered by evidence you plan to collect.
Relying on a single evidence type - typically document review or a brief management interview - and concluding conformity without tracing the claim to records, observation, or product. For example, accepting 'we do daily pre-op inspections' after seeing the procedure and one signed form.
Documents are fast, tidy, and easy to cite in a report. Live observation requires waiting for a shift, following a batch, and risking awkward findings, so under time pressure candidates default to paper.
What to do instead
Adopt a triangulation habit: for each significant requirement, plan at least two independent evidence sources (document + record, record + observation, interview + record). Practice vertical traceability exercises - pick one lot and trace from receiving through CCP monitoring, deviation handling, release, and distribution - and horizontal traceability across a single day's records. In your notes, label each piece of evidence by type so gaps are visible before you conclude.
Asking leading or closed questions in interviews ('You do calibrate the thermometers, right?') and accepting a supervisor's answer as evidence of operator practice, rather than interviewing the person actually performing the task.
Interviews are often squeezed between document checks, and confirming questions feel efficient and polite. Interviewing frontline staff requires scheduling around production and can surface uncomfortable gaps.
What to do instead
Practice open-question stems: 'Walk me through what you do when…', 'Show me how you decide…', 'What happens if…'. Always ask to see the task performed or the record produced. Cross-check the same topic with an operator and a supervisor separately and note discrepancies. Keep a short question bank per process (CCP monitoring, allergen changeover, sanitation verification, calibration, hold/release) so you are not improvising.
Treating sampling as 'pick a few records at random' without stating the population, the sampling basis (attribute vs. variable, random vs. judgement), the sample size rationale, or the limitation of the conclusion drawn from it.
Sampling theory is taught abstractly and rarely connected to audit practice, so candidates sample intuitively and then overstate what the sample proves. Small samples of records are also easy to obtain quickly.
What to do instead
For each sampling activity, document population definition, size, selection method, and sample size, and phrase conclusions as 'no nonconformity observed in the sample' rather than 'the process conforms.' Practice explaining when a statistically valid sample is impractical in an audit and how judgemental sampling is then targeted at risk (new staff, recent changes, prior deviations, end of shift). Be able to explain why a zero-defect sample does not prove zero defect rate.
Misclassifying hazards and controls: labelling a hazard by its control (calling 'allergen' a control), confusing prerequisite programmes with critical control points, or assigning a CCP where no critical limit can be validated, and vice versa.
Hazard analysis language is dense, and terms like control measure, critical control point, operational prerequisite programme, and critical limit overlap in everyday plant speech. Candidates memorize definitions without practicing the decision logic.
What to do instead
Work through decision-tree logic repeatedly on realistic process steps, writing for each: hazard (biological, chemical, physical, allergen, radiological), source, likelihood/severity rationale, control measure, whether it is a CCP or PRP/OPRP, critical limit, monitoring, deviation action, and verification. Pay attention to allergen cross-contact and to controls that lack a measurable critical limit. Be ready to justify why a step is not a CCP.
Answering sanitation and prerequisite programme questions at the level of 'we have a cleaning programme' without specifying the elements that make it verifiable: cleaning validation versus verification, concentration/temperature/contact time, ATP or microbiological verification, environmental monitoring for pathogens, and corrective action when verification fails.
PRPs are treated as the 'easy' domain, so candidates skim the detail and rely on general familiarity. The distinction between validation (does the method work) and verification (did it work this time) is commonly blurred.
What to do instead
For each PRP area (cleaning and sanitizing, pest control, water, maintenance, personnel hygiene, allergen changeover, environmental monitoring), write the required documented elements and the evidence that proves each one works. Practice separating validation from verification in examples: sanitizer efficacy study or worst-case cleaning challenge versus ATP swabs, visual checks, and micro swabs after cleaning. Include what happens when a verification result is out of limit.
Writing nonconformity statements that describe a topic rather than a finding - 'HACCP documentation issues' or 'training not adequate' - with no evidence, no requirement cited, no location, and no statement of the actual condition versus the expected condition.
Findings are often jotted in shorthand during the audit and expanded later from memory, and vague wording avoids confrontation with the auditee. Candidates also fear that specificity invites dispute.
What to do instead
Use a fixed sentence structure: requirement (citation) + expected condition + actual condition + objective evidence (record ID, date, batch, person, location). Practice rewriting vague notes into this structure within 24 hours of taking them, while evidence is fresh. Test each finding by asking whether a different auditor could verify it from the written statement alone.
Closing corrective actions on the basis of a submitted form - a revised procedure, a training record, or an action plan - without verifying implementation, root cause elimination, or effectiveness, and without checking whether the same cause exists elsewhere.
Follow-up is time-constrained and often desk-based, and auditees are motivated to show closure. Accepting documentation as proof is quicker than returning to the site or sampling records after implementation.
What to do instead
For each corrective action, require three things: root cause analysis that goes beyond 'operator error' or 'retraining', evidence of implementation, and evidence of effectiveness after a defined interval (trend data, reduced repeat findings, verification sampling). Practice distinguishing correction, corrective action, and preventive action on the same scenario, and check for extension of the fix to similar processes or other sites. Record the verification method and date in the closure note.