Review workplace documents –
content guide
Table of contents
Overview
2
Understanding products and processes
2
Understanding what goes into a food safety program
4
Setting up audit trails
5
Choosing the documents to review
6
Documentation related non-conformances
11
Summary
13
Further references
14
Food Safety Auditing Toolbox
Review workplace documents – content guide
1
Overview
Reviewing workplace documents is an essential part of conducting an audit.
The purpose of reviewing workplace documents is to ensure that the
company has a documented food safety program that is appropriate to the
activities of the food business and meets the requirements of the legislation.
Understanding products and processes
Before reviewing the workplace documents, an auditor needs an
understanding of the likely hazards, risks and control measures associated
with the food product and processing method used.
A good knowledge of food safety systems within food manufacturing
businesses, together with specific knowledge about the actual process being
audited, is essential.
The business’s food safety plan and HACCP documentation are the key
elements that require auditing when reviewing workplace documentation.
It is the food safety auditor’s responsibility to ensure that a food safety plan
and any HACCP documentation cover all the risks associated with the
process. If you are unsure as to some technical aspects of the process you
are auditing it is a good idea to research the risks. Often, this begins with
researching the types of hazards associated with given products, which is
directly related to the specific microbiological hazards associated with
certain food types. Pathogen/food associations or combinations are well
documented in government, scientific and industry literature, as are known
control measures applied by industry within their processes in order to
eliminate or reduce these risks to acceptable levels. Often, contacting the
peak industry body associated with a given food processing sector or
visiting the industry or associated websites can lead you in the right
direction with respect to finding this information.
When assessing the risks associated with products and processes, an auditor
needs to consider the following:
2

Is there any epidemiological evidence with respect to known food
poisoning outbreaks associated with the food?

Are there any known pathogens associated with the food?
Food Safety Auditing Toolbox
Review workplace documents – content guide

What industry knowledge and historical evidence of food safety is
required?

What scientific knowledge of the process and food type do I need?

How is the food packaged? Some forms of packaging (eg vacuum
packing of sliced meats) extend shelf life but may also favour
growth and survival of specific pathogens. So the business needs to
take measures to completely eliminate the presence of such
pathogens to produce a safe product.

What is the intended use of the food? Will it be sold to vulnerable
populations?

What known allergens are associated with the food or ingredients in
the food?

What supply chain risks are associated with raw materials? For
example, what chemical contamination risks are associated with the
primary production process of the food (the growing of the food) as
well as further processing? These may include risks associated with
residues from agricultural pesticides, antibiotics or hormones, as
well as residues left by cleaning chemicals, lubricants, etc.

What are the foreign object contamination aspects of the primary
production process, and are there any further processing of food
products that need to be considered? Foreign objects such as sticks,
stones, etc may be present, or in the case of fresh fruit or vegetables,
dirt, insects and snails may be present.
All the risks associated with food products and their production are far too
extensive to cover in this Content guide, and there are too many for an
individual to know them all. Indeed, newly emerging food safety risks are
being discovered all the time as scientific methods and technological
applications improve. Governments and industry continually strive for new
and innovative ways to process, package and sell food in an increasingly
globalised economy, so the food safety auditor will always be challenged
with a growing knowledge bank that needs continual research in order to
stay abreast of developments. Through experience and research, a solid
foundation of the most common risks associated with contemporary food
products and associated processes is paramount to becoming a competent
food safety auditor.
Some instances where an auditor applies this knowledge include:

checking that all process steps have been documented

confirming that all hazards have been identified and risks
appropriately assessed

checking that the control measures in place are appropriate for the
hazard

checking that relevant support programs are established and
effective.
Food Safety Auditing Toolbox
Review workplace documents – content guide
3
A well developed HACCP plan often references scientific literature as part
of its validation and the risks that need to be controlled are clearly set out.
How critical limits are derived, types of pathogens and preventative
measures to control growth or stop contamination at various stages of the
production process should be well documented in the hazard analysis and
hazard audit tables.
Understanding what goes into a food
safety program
According to the Australian Food Safety Standard 3.2.1 Food Safety
Programs, a food safety program must:
1.
Systematically identify the potential hazards that may be reasonably
expected to occur in all food handling operations of the food business.
2.
Identify where, in a food handling operation, each hazard identified
under point 1 can be controlled and the means of control.
3.
Provide for the systematic monitoring of those controls.
4.
Provide for appropriate corrective action when that hazard, or each of
those hazards, is found not to be under control.
5.
Provide for the regular review of the program by the food business to
ensure its adequacy; and
6.
Provide for appropriate records to be made and kept by the food
business demonstrating action taken in relation to, or in compliance
with, the food safety program.
Other requirements of food businesses relate to registration. These
requirements may differ according to State. For example, in Victoria:

The food safety plan must be submitted as part of food business
registration—failure to submit, or failure to comply with
requirements may lead to loss of registration.

The registration authority must be given a copy of any revisions to
the program within 14 days of the revision being made.

Each business must nominate a food safety supervisor who:
– knows how to recognise, prevent and alleviate the hazards
associated with the handling of food
– knows which food safety competency standards apply, and how
they apply
– has the ability to train other people to safely handle food.

4
An independently prepared food safety plan must be audited by an
approved third party auditor at least annually (this will depend on the
type of business—high-risk operations may require more frequent
third party audits).
Food Safety Auditing Toolbox
Review workplace documents – content guide
Setting up audit trails
Reviewing the documentation before you conduct the ‘hands on’ part of the
audit should give you an indication of how the business is operating and
what aspects of their activities you might want to take a closer look at. As
you review documents, you should start noting down any gaps or issues that
warrant closer attention. This is known as setting up audit trails. The audit
trails will guide you in making decisions about what activities or practices
you need to observe more closely when walking around the business and
reviewing workplace practices.
Audit trails help focus your attention on areas of greatest concern. So, for
example, you are likely to be using an audit checklist as a prompt to cover
all aspects of the audit but once you have established the audit trails you
want to investigate, you might revise the order in which you want to tackle
the activities so you devote time and attention to areas that are most likely to
be of concern.
Closed loop and open loop audit trails
Audit trails can be ‘closed loop’ or ‘open loop’. Where you identify closed
loop audit trails, you will need to review the procedures and documentation
through to a conclusion within a defined work area. However, where you
identify open loop audit trails, you may need to further investigate evidence
in other functional areas of the business in order to be satisfied a system is
working. An example of an open loop audit trail may be the investigation of
how the business handles customer complaints with respect to foreign
objects. If the complaint has been completed or ‘closed out’ by the business,
an auditor may review the documentation and be satisfied that the customer
complaint procedure has been followed correctly. The auditor would need to
see that:
1. the date and all relevant details of the customer complaint, including
when it was received, have been logged
2. the foreign object has been returned (where possible) to aid in the
investigation
3. the foreign object has been identified
4. the origin of the object can be explained
5. the root cause of how the foreign object ended up in the product has
been investigated by the company
6. investigations have ruled out any other products being affected
7. corrective action has been taken that will prevent a recurrence of the
complaint. This may take the form of :
–
–
staff counselling
changes to procedures in the HACCP plan
Food Safety Auditing Toolbox
Review workplace documents – content guide
5
–
–
increased checking or new checks
banning certain equipment (eg replacing loose bristled
brushes used for cleaning with a more robust variety that
won’t leave bristles behind that end up in the product)
8. follow up audits in the work area where the foreign object originated
confirm the corrective action has taken place and is effective
9. appropriate feedback has been given to the customer.
The above is a single, open loop audit trail, as all that the auditor needs to
verify is that the corrective action taken by the company is in place. In the
case of replacing certain types of cleaning equipment (see point 7) the
auditor needs to check that the types of brushes that caused the complaint
have been replaced as indicated in the complaint records.
Choosing the documents to review
There are different types of documents an auditor will be interested in
reviewing. Systems documentation is the key set of documents that detail
the food safety plan. Some State legislation mandates that certain businesses
develop a HACCP-based, food safety plan in order to operate. In Victoria,
the proprietors of declared food premises (under section 19C of the Food
Act) must operate under a food safety plan. State legislation establishes the
minimum requirements that reflect HACCP principles but are not strictly the
same as a full HACCP program. Some businesses may voluntarily develop
their own HACCP food safety programs in order to access certain markets,
so the terminology used may differ. In this Content guide, the term HACCP
is used to encompass all food safety programs.
There are a range of documents that support food safety in the workplace.
These documents include:
6

HACCP documentation: this includes the food safety policy, the
HACCP plan, which includes a process flowchart, HACCP analysis
tables, HACCP audit tables, a description of the product and
intended use tables.

Process documentation: for example, HACCP team minutes and
training records.

Validation documentation: these documents outline the basis upon
which controls are determined, for example, codes of practice,
industry standards, lab reports, etc.

Programs and procedures: examples of support programs include
change management, personal hygiene, pest control, calibration,
cleaning/sanitation, approved supplier, sampling/testing and product
recall.

Previous audit reports, the Corrective action request (CAR)
register and related documentation.
Food Safety Auditing Toolbox
Review workplace documents – content guide

Records: for example, production logs, test results, etc.
HACCP is a tool or technique developed specifically to deal with potential
hazards within a process. It identifies specific hazards, and establishes
preventative measures to control the hazards. The desired result is maximum
assurance of food safety.
HACCP on its own is not a total quality management system. It is only one
of the tools required to effectively and efficiently establish quality
objectives. Some companies combine food safety with related policies and
programs such as quality.
There are various quality systems, each with a different approach, and with
different emphases. Some examples of quality systems used in the food
industry are shown in the table below.
Table 1: Quality systems used in the food industry
Quality
system
Key points
Total quality
control
(TQC)
Total quality
management
(TQM)
AS3900
ISO9000
BS5750
Food Safety Auditing Toolbox
Review workplace documents – content guide

assumes that the operator has the most knowledge about the product,
has greatest effect on the quality and, as such, is the most important in
quality control

employees are encouraged to contribute ideas in improving quality and
reducing costs

uses statistical measuring and charting of processes and outputs

the process is divided into stages and each stage is viewed as a
customer of the previous stage.

encompasses all aspects of the business

requires commitment by top management, demonstrated by the
authorisation of a quality policy

concentrates on prevention of problems by improving processes and
introducing control mechanisms

ensures effective communication by eliminating barriers through the
company hierarchy

places effort on training of employees and on improvement of plant and
equipment

measures results in all aspects of the business.

requires commitment by top management

formation of a steering team

selection of a registrar

training in the quality system requirements

formation of a quality manual containing policies, systems and detailed
procedures of all related activities

commencement of internal audits

assessment and amendment, registration with an accreditation body (eg
7
Standards Association of Australia).
Approved
quality
assurance
(AQA)

a quality assurance program developed by the Commonwealth
government in accordance with AS and ISO, and in response to
developments in industry

recognises the inadequacy of the traditional methods of inspection

uses audit procedures to determine whether quality, safety and
conformity to regulation is assured

has a fee for an audit and at least two audits are conducted per year

more comprehensive than AS and ISO as the legislation pertaining to
the particular commodity is also included in the program

differs from TQM, only in that it does not include emphasis on
improvement

in order to apply for AQA, a manual describing the quality system must
be produced.
The extent of document review will depend on the purpose of the audit—
that is, whether it is specific to food safety or whether it is a combined food
safety and quality audit. This Content guide focuses specifically on food
safety issues.
Table 2: HACCP documents
HACCP documents
Content to be covered (as appropriate to the
product)
Company information
Current certificate of food business registration
Organisational chart
Product description &
intended use
Detailed description of products manufactured by the business
Process flow chart
Hazard analysis
HACCP audit tables
For each CCP establish:

critical limits

method and frequency of inspection

identification of personnel responsible

record keeping requirements

corrective action procedures required if process is out
of control.
Process documents
The process of designing and monitoring the HACCP plan is as important as
its content. An auditor should check to see who was involved in putting the
plan together, what processes are used to communicate information about
roles and responsibilities and what training is provided to support
implementation.
8
Food Safety Auditing Toolbox
Review workplace documents – content guide
In small workplaces, the plan might be developed by the production or
quality manager. In medium and larger workplaces, you would expect the
business to convene a team of people from different work areas to provide
input to the plan development. There should also be a clear procedure to
upgrade operating documents, such as Standard operating procedures
(SOPs), to reflect any changes to the food safety plan.
It is a requirement that food businesses have a system in place to regularly
review and update their food safety plan. In Victoria, for example, this
review needs to be undertaken every 12 months (or as required where there
is a change in process). The auditor should confirm that there is a process
for regular review and that the frequency of review meets legislative
requirements.
By legislation, food businesses are responsible for ensuring that employees
have the competencies (skills and knowledge) required to support their role
in producing safe food. Some businesses choose to do this by requiring
employees to participate in formal training programs. Others may provide
instruction in-house. Unless State-based legislation mandates minimum
qualifications for food handlers this choice is up to the business. The auditor
needs to be satisfied that the business has an effective way of ensuring its
employees understand and can carry out their food handling responsibilities
safely. In medium and larger workplaces, this would usually be supported
by a record keeping system to keep track of the food handling competencies
of each employee.
Validation documents
The HACCP-based approach to managing food safety uses risk management
rather than prescriptive standards to support production of safe food. This
means that it is up to each food business to determine and justify appropriate
and safe production methods. In most cases, businesses will follow
recognised industry standards. For example, pasteurised products must be
heated to a temperature of not less than 72°C for not less than 15 seconds and
immediately shock-cooled to a temperature of 4.5°C or less (Export Control
Milk and Milk Products) Orders 2005.
However, a business may opt to use different processing methods provided
they can produce credible scientific evidence to support their practices. This
information is sometimes referred to as validation evidence and it should be
provided to support processing methods and corrective action procedures.
An auditor should cite evidence, particularly for non-standard processes,
and determine whether the evidence presented is adequate and credible.
Examples of the types of evidence that is acceptable for validation purposes
include:

existing (Australian) legislative requirements

challenge tests
Food Safety Auditing Toolbox
Review workplace documents – content guide
9

peer reviewed scientific papers

targeted scientific reports

validation already carried out in other jurisdictions and recognised
by the responsible authority

mathematical modelling (eg predictive microbiology models)

industry codes of practice (where implementation by the food
business is verified during audits).
Programs
Support programs will depend on the nature of the products and processes,
but there are some common programs that apply to any food business. These
include:

personal hygiene

pest control

calibration

cleaning/sanitation

approved supplier list, procedures and test results

sampling/testing (eg end product testing, work in progress product
testing, environmental swabbing or cleaning)

product recall.
Procedures
Each program will usually be supported by a procedure. The content to be
included in the procedures will vary depending on their purpose. Some
common information includes:
10

What purpose, procedure and standards are to be met?

What are the method(s) to be used?

What outcomes are required? In some cases this can include critical
limits (eg in designing a cleaning procedure). Where information on
critical limits is provided, advice on what to do if these limits are not
met should also be included.

What are the record keeping requirements? This includes the
frequency of inspection, the information to be recorded and who is
responsible for recording it.
Food Safety Auditing Toolbox
Review workplace documents – content guide
Recording: check sheets, log sheets and records
For each Critical control point (CCP), records should be available to show
how a process is performing and whether it is within the limits or standards
set. Increasingly, these records are logged electronically but many
businesses still use paper-based recording systems. These data collection
instruments need to be appropriately designed and should include:

the date and time the information was recorded

advice on how information is to be recorded (eg, is it adequate to
tick off an item, or do the actual parameters such as time/temperature
need to be recorded?)

how often the information needs to be recorded

directions on action to take in the event HACCP measurements show
a process is not conforming to requirements

who recorded the information

who needs to sign off the record sheet (if appropriate).
Check sheets are also commonly used to record results and the efficacy of
support program activities. Hygiene check sheets or cleaning records
indicating that the work has been carried out and that it is satisfactory are a
common example of this type of record.
Other relevant records include internal audit documentation.
Document design and management
Apart from including relevant content and designing documents to fit their
purpose, it is important that the business has a way of managing and
controlling documents. At a minimum this requires a system for keeping
track of the current version of documents such as specifications and SOPs.
This is usually done by ‘controlling’ documents. This is a system for
managing documents according to status (draft, version, current, etc) and
records effective date, number/date of review and sign off from a document
manager. Where documents are in draft, it records who needs to/has
reviewed and signed off the draft document. These systems are designed to
make sure that everyone is following the same procedures.
Documentation related to nonconformances
The main purpose of reviewing documents is to get a better understanding
of the business and its food safety program as well as to establish audit
trails to be followed up when conducting the workplace inspection. In
some cases, shortcomings or gaps in the documentation could constitute a
non-conformance.
Food Safety Auditing Toolbox
Review workplace documents – content guide
11
Examples of non-conformances related to documentation could include:
12

the business being unable to locate HACCP documentation

documentation is out of date

there are no records of cleaning and sanitation

there is no system for controlling and managing food safety
documents

samples of documented records indicate the process is out of control
with no record of corrective action being taken

activities that should be described as part of the food safety program
but for which there is no supporting documentation (eg no cleaning
schedule)

record sheets inadequately designed—examples could include
records that do not cover all the process parameters as indicated by
the HACCP plan or do not show adequate accountability (ie there
are no sections for operator sign off or date of recording, etc).
Food Safety Auditing Toolbox
Review workplace documents – content guide
Summary
Reviewing workplace documents is critical in the process of conducting the
audit. The process of reviewing workplace documents is sometimes referred
to as a ‘desk audit’. In itself, this step cannot be considered an ‘audit’ but it
is an essential part of the evidence gathering process within an audit.
Businesses vary in their approach to documentation. Some will have the
bare minimum while others will be drowning in detail. As an auditor, you
won’t have time to read everything so it is important to make informed
decisions about which documents you need to look at.
Food Safety Auditing Toolbox
Review workplace documents – content guide
13
Further references
CSIRO Publishing (1997), A guide to the implementing and auditing of
HACCP, SCARM report 60, CSIRO publishing, Collingwood.
Foley K (2000) The quality auditor, Quality Assurance Services Pty
Limited, Consensus Books, Sydney.
Sutherland, P. S. and R. J. Porritt (1997) ‘Listeria monocytogenes’, In A. D.
Hocking, G. Arnold, I. Jenson, K. Newton and P. Sutherland (eds),
Foodborne microorganisms of public health significance, 5th ed, AIFST
(NSW Branch), Sydney, Australia.
14
Food Safety Auditing Toolbox
Review workplace documents – content guide