Forty audit days, three sites and two auditors with conflicts
A food manufacturer has three production sites (A, B, C) and a head office, and is certified to ISO 9001 and ISO 22000. The 2026 internal audit programme must be built from 40 audit days: Auditor 1 contributes 25 days and Auditor 2 contributes 15. Both are part-time auditors - Auditor 1 also manages supplier approval and incoming inspection, and Auditor 2 is the site A hygiene supervisor. Travel between head office and any site takes one full day each way; the sites are 400 km apart, so visiting two sites in one week is not practical. Last year every site received a two-day audit. Site C had a product recall in March, two customer complaints since, and both of last year's major findings recurred there; sites A and B had no major findings. Top management wants 'all sites audited every year, equally'. The allergen changeover process was introduced four months ago and has never been audited; the outsourced cold store has also never been covered. Document review can be done remotely.
1. Propose a defensible day allocation for the programme and justify departures from equal coverage. Show your arithmetic.
Read the worked answer
Reserve programme overhead before allocating audits: 2 days programme management and updates, 3 days report writing and distribution across all audits, 1 day follow-up verification, 1 day competence development = 7 days. That leaves 33 days for audit activity including travel.
Travel is expensive: each site visit costs two travel days. A workable allocation:
- Site C (recall, recurring majors, allergen process): 9 audit days + 2 travel = 11, plus a 1-day remote follow-up later in the year.
- Site A (stable): 5 + 2 = 7.
- Site B (stable, allergen changeover introduced here): 4 + 2 = 6, plus 1 remote day of document review.
- Head office (management review, scope, supplier approval, CAPA): 4 days, no travel.
- Outsourced cold store: 1 audit day + 1 travel day = 2.
- Remote document review and programme administration: 2. Total 32, with 1 day contingency = 33.
Justification: ISO 19011:2018 requires the programme to reflect risk, the importance of processes, results of previous audits and the level of maturity - not equal shares. Site C's recall, recurring findings and never-audited allergen process justify more than double the effort of site A.
Handling top management: present the risk rationale and the consequence of strict equality (less depth at C). If top management still insists, record the decision and the accepted risk in the programme - the client owns the objective, the programme manager owns the professional advice.
2. Assess the competence and impartiality limits of the two auditors and explain how you would resource the programme around them.
Read the worked answer
Impartiality. Auditor 1 manages supplier approval and incoming inspection, so they cannot audit 8.4 or incoming inspection - that is auditing their own work. Auditor 2 is the site A hygiene supervisor, so they cannot audit site A hygiene or PRPs and in practice cannot audit site A at all.
This is a resourcing constraint, not a preference. Supplier approval and site A hygiene must be covered by someone else. Options: (a) swap - Auditor 2 audits supplier approval after targeted competence development, supported by a technical expert; (b) commission an external auditor or a qualified auditor from another site in the group for site A; (c) defer the specific process and record the coverage gap in the programme.
Competence. Build a competence matrix against ISO 19011:2018 clause 7.2 (auditing knowledge and skills) plus the food-safety knowledge ISO 22000 demands - HACCP principles, PRPs, allergens, applicable legal requirements. Neither auditor has audited allergen changeover, so plan specific development or bring in a technical expert before that audit. Remember that an expert supplies knowledge; the auditors still collect evidence, reach conclusions and sign the report.
Record both the competence and the impartiality assessment so the programme can show why each audit was staffed as it was.
3. Define the objectives, scope and criteria for the site C audit, and state what you would do if site C announces a production shutdown during the scheduled week.
Read the worked answer
Objectives: verify conformity with ISO 9001, ISO 22000 and internal procedures at site C; evaluate the effectiveness of corrective actions taken after the recall; verify the allergen changeover process, which has never been audited.
Scope: site C processes across all shifts, plus interfaces to head office (supplier approval, distribution) and to the outsourced cold store; state explicitly what is excluded and why.
Criteria: the two standards, the food safety and PRP procedures, the allergen plan, and the customer and legal requirements the organisation has adopted.
If a shutdown is announced for the audit week: do not accept it silently. Auditing an idle plant removes observation of actual practice and shift hand-overs; you would be testing documents and memory. Preferred option: move the audit to a production day. If that is impossible, audit records and interviews and then state clearly in the report that observation of operations was not possible and operational control was therefore not verified. That limitation belongs both in the report and in the programme risk review.
What must not happen is an unqualified conclusion issued on an empty plant.