FSSC 22000 Internal Audit Checklist: The Essential 2026 Guide for Food Manufacturers

An FSSC 22000 internal audit checklist is the tool that shows your food safety management system works before a certification body tests it. Internal audits are a requirement of the scheme, not an optional extra, and weak audits are one of the most common reasons sites pick up avoidable nonconformities.

This guide explains what to audit, how to structure the checklist across the three layers of FSSC 22000, how to audit against the new Version 7 requirements and how to report and close findings. It is written for food safety managers and internal auditors in manufacturing and packaging sites. Dates and rules come from the scheme owner and your certification body, so confirm them with both before you plan your audit year.

What the FSSC 22000 internal audit must cover

FSSC 22000 is a certification scheme built on three layers: ISO 22000, the sector prerequisite program standards such as the ISO 22002 series, and additional scheme requirements. Your internal audit programme must cover all three, plus the regulatory and customer requirements that apply to your products. Our overview of the FSSC 22000 certification process shows how those layers fit together.

ISO 22000 requires internal audits at planned intervals to check that the system conforms to your own requirements and to the standard, and that it is effectively implemented and maintained. Plan the programme around risk and past results: areas with recent changes, repeated findings or high hazard potential get audited more often and more deeply.

Planning the audit programme

A workable programme is a schedule that covers every part of the system across the year, names the auditor for each audit and defines scope and criteria. Auditors must be competent and objective, so nobody audits their own work. Small sites sometimes share auditors across plants or hire an external person to preserve independence.

Base the schedule on risk. Allergen control, sanitation, foreign matter control and supplier approval typically deserve more frequent attention. Include the new or changed requirements of the scheme version you are moving to. Keep the plan, the auditor competence records and every report; these are standard requests from certification auditors.

Building your FSSC 22000 internal audit checklist

Write the checklist from your own procedures, not from a generic list. For each requirement, record the question, the place to look, the evidence seen and the conclusion. Include both document review and observation on the floor, because food safety failures usually appear in practice before they appear in paperwork.

Questions to include in every audit cycle:

Layer	What to audit	Typical evidence
ISO 22000 management system	Context, leadership, planning, support, operation, evaluation, improvement	Policy, objectives, management review, audit reports
Prerequisite programs	Sector PRPs such as the ISO 22002 series	Cleaning records, pest control, maintenance, supplier checks
HACCP and operational control	Hazard analysis, CCPs, monitoring, verification	Flow diagrams, hazard analysis, monitoring logs
FSSC additional requirements	Scheme rules on top of the standards	Food defense, food fraud, allergen, environmental monitoring records
Food safety culture	Leadership behavior and engagement	Culture plan, survey results, action records

• Is the food safety policy current, communicated and reviewed by top management?
• Are hazard analyses up to date and do they reflect product, process and ingredient changes?
• Are critical limits monitored and are corrections recorded when limits are exceeded?
• Are prerequisite programs implemented, and do cleaning and sanitation records match the schedule?
• Is allergen management verified, including changeover cleaning and labeling checks?
• Are suppliers approved and monitored, and are incoming materials verified?
• Are traceability and recall tests performed and timed?
• Are food defense and food fraud assessments current?
• Are calibrated instruments in date?
• Are corrective actions closed with root cause analysis?

Auditing prerequisite programs and scheme requirements

Prerequisite programs are the foundation: building design, layout, utilities, waste, equipment, cleaning, pest control, personnel hygiene and supplier control. The relevant sector standard defines them; see ISO 22002 prerequisite programs for the structure. Audit on the floor with a clipboard, not from an office.

For the additional requirements, review FSSC additional requirements and check each one that applies to your food chain category; our guide to food chain categories explains how category drives scope. Two areas that need their own questions are food fraud and food defense and food safety culture.

Preparing the audit against FSSC 22000 Version 7

The scheme owner published Version 7 in 2026. According to a UKAS technical bulletin, it was published on 7 May 2026 and audits must follow Version 7 from 1 May 2027, with transitions completing through upgrade audits within a defined window. Because bulletins and certification bodies phrase dates differently, ask your certification body for your own transition schedule in writing.

Published summaries of the changes point to updated prerequisite program references, a stronger evidence-based approach to food safety culture and additional alignment with benchmarking requirements. Read the scheme documents yourself, then add the new items to your FSSC 22000 internal audit checklist. Our page on FSSC 22000 Version 7 goes through the changes in more detail. See also the UKAS technical bulletin on FSSC 22000 Version 7 transition.

Reporting, corrective action and management review

Report each finding with the requirement, the evidence and the classification your procedure defines. The auditee responds with correction, root cause and corrective action, and the auditor verifies closure. Findings that repeat cycle after cycle show that the corrective action process is not working, which is itself a finding.

Feed results into the management review as required. Leadership should see the number of findings by area, the trend, overdue actions and resource needs. Trends also guide the next year’s audit programme.

Unannounced audits and readiness

Certification under the scheme includes unannounced audits at defined intervals, so your site should be audit-ready every day. Use unannounced internal audits occasionally to test that. Read our guide on the FSSC 22000 unannounced audit for how those work.

If your site is new to the scheme, check cost and timelines in FSSC 22000 certification cost and compare the structure in FSSC 22000 vs ISO 22000.

Templates for your FSSC 22000 internal audit checklist

Audit programmes, plans, checklists, report forms and corrective action logs take time to draft. The FSSC 22000 Toolkit includes editable templates for internal audit and the rest of the system, written to cover the scheme requirements, so your team adapts proven documents rather than starting blank.

Templates help, but the audit itself must test your site’s real practice. Fill in the checklist with observations and records, not with assumptions.

How to run the floor audit

Begin at goods-in and follow the product through to dispatch. At each stage compare what you see with what the procedure says. Check hand washing and protective clothing, the condition of equipment and surfaces, whether cleaning was done before production started and whether verification swabs or tests were recorded. Stand at the critical control points and watch the monitoring being done, then compare the live reading to the log. Ask operators to explain why a limit exists and what they would do if it were exceeded. Answers like “I would call the supervisor and stop the line” show that training works; silence shows a gap.

Take photographs where your procedure allows and note the date, time and location. Record positive observations as well as problems, because management should see what works. Sample across shifts, since night and weekend production often reveals issues that day shift never sees. Finish with a short closing meeting so the team hears the results from you first and can start fixing them at once.

Root cause and effectiveness checks

A finding is not closed when the action is done; it is closed when the problem stops coming back. Require a real root cause, not a label such as operator error. Ask why the failure was possible and why the system did not catch it. Then schedule a follow-up check a few weeks later to confirm the fix works, and record the result. This is the habit that separates sites that improve from sites that repeat the same findings every year.

Using the FSSC 22000 internal audit checklist across several sites

Multi-site organizations should use one common checklist with a short local supplement for each site. Central teams can then compare results, identify patterns and share fixes, while local teams keep room for their own processes, products and regulatory requirements. Align the audit calendar with your certification schedule so no site is surprised.

Reviewing your FSSC 22000 internal audit checklist each year

At the end of each audit cycle, review the checklist itself. Remove questions that never find anything, add questions for new products, new equipment and new customer requirements, and update references when the scheme or sector standards change. Keep the previous versions so you can show how the checklist evolved, and make sure auditors always work from the current approved copy.

Common mistakes with an FSSC 22000 internal audit checklist

Typical errors include auditing only documents, using a generic checklist, letting the same person audit their own area, skipping night shifts or weekend operations and closing findings without checking that the fix works. Another is leaving Version 7 changes until just before the certification audit. Start gap checks now and schedule follow-up audits to confirm the new controls operate.

FSSC 22000 Internal Audit Checklist FAQ

Is an internal audit mandatory for FSSC 22000?

Yes. ISO 22000 requires internal audits at planned intervals, and the scheme expects a programme that covers the whole system.

How often should internal audits be done?

The programme should cover the whole system at planned intervals based on risk and past results. Many sites audit each area at least annually.

Can I use the same auditor for all audits?

Yes if the person is competent and objective, but auditors must not audit their own work.

What changes with Version 7?

Published summaries cite updated prerequisite program references and stronger evidence for food safety culture. Confirm details in the scheme documents.

Does the audit include the floor?

It should. Observation of practices on the production floor is essential for prerequisite programs, allergen control and sanitation.