.png)
A HACCP audit checks that your HACCP plan is complete, scientifically sound and actually followed on the floor. Auditors review the hazard analysis, CCPs and critical limits, then sample monitoring, corrective action and verification records. Use the checklist below, one table per HACCP principle plus prerequisite programs, to run an internal audit before the external one.
Last updated: October 29, 2026
The structure follows the seven principles in the FDA's HACCP Principles & Application Guidelines: conduct a hazard analysis, determine the CCPs, establish critical limits, establish monitoring procedures, establish corrective actions, establish verification procedures, and establish record-keeping. If you still need the plan itself, start with our step-by-step basic HACCP plan guide or the CCP decision tree.
HACCP Audit Checklist (Template)
Use this free HACCP audit checklist to check your plant before a customer, SQF or BRCGS, or regulatory audit. It has 41 items in 11 areas, each with the evidence an auditor will ask to see. Built on the NACMCF HACCP principles and 21 CFR 117; adapt it to your plan. Made by IONI.
Free download: HACCP audit checklist (PDF) and editable Excel version.
| # | Area | What the auditor checks | Evidence to have ready | Yes / No / N/A | Notes / owner |
|---|---|---|---|---|---|
| 1 | HACCP team and scope | A multidisciplinary HACCP / food safety team is named with roles | Team list with names, roles, training dates | ||
| 2 | HACCP team and scope | Scope of the plan is written: products, processes, hazards covered | Scope statement in the plan | ||
| 3 | HACCP team and scope | Team includes someone trained to develop the plan (e.g. a PCQI where 21 CFR 117 applies) | Training certificate | ||
| 4 | Product description and intended use | Each product has a description: ingredients, processing method, packaging, shelf life | Product description sheets | ||
| 5 | Product description and intended use | Storage and distribution conditions are stated (e.g. refrigerated, frozen) | Distribution temperature notes | ||
| 6 | Product description and intended use | Intended use and consumers are stated, including vulnerable groups | Intended-use statement | ||
| 7 | Flow diagram verified on the floor | A flow diagram covers every step from receiving to dispatch | Current flow diagram | ||
| 8 | Flow diagram verified on the floor | The diagram was checked against the real process on site, and by whom and when is recorded | Signed and dated on-site verification | ||
| 9 | Flow diagram verified on the floor | Diagram is updated after any process, line or ingredient change | Revision history | ||
| 10 | Hazard analysis | Hazards are identified at each step for biological, chemical (including allergens) and physical categories | Hazard analysis worksheet | ||
| 11 | Hazard analysis | Severity and likelihood are assessed and the reasoning is written down | Hazard evaluation notes | ||
| 12 | Hazard analysis | Allergen hazards cover cross-contact, labeling and rework | Allergen matrix, label review records | ||
| 13 | Hazard analysis | Hazards requiring a control are matched to a control measure | Control measure list | ||
| 14 | CCPs and critical limits | Each CCP is identified, with the decision logic or reasoning recorded | CCP determination record | ||
| 15 | CCPs and critical limits | Each critical limit is measurable (time, temperature, pH, aw, metal detection sensitivity, etc.) | Critical limit table | ||
| 16 | CCPs and critical limits | The scientific or regulatory basis for each limit is documented | Reference, study or regulation cited | ||
| 17 | Monitoring records | Monitoring procedure states what, how, how often and who for each CCP | Monitoring procedure | ||
| 18 | Monitoring records | Records are completed at the time of the check, not afterwards | Sample of last 30 days of records | ||
| 19 | Monitoring records | Each record is signed or initialed and dated by the person who did the check | Signed monitoring records | ||
| 20 | Monitoring records | Monitoring equipment is identified and the person has been trained to use it | Equipment list, training record | ||
| 21 | Corrective actions | A written corrective action procedure exists for each CCP deviation | Corrective action procedure | ||
| 22 | Corrective actions | Affected product is identified, held and a disposition decision is recorded | Hold tags, disposition record | ||
| 23 | Corrective actions | The cause is investigated and action is taken to prevent a repeat | Root cause record | ||
| 24 | Corrective actions | Corrective actions are reviewed and closed by a responsible person | Closed corrective action examples | ||
| 25 | Verification | Monitoring and corrective action records are reviewed by someone other than the person who made them, within a set time | Dated reviewer sign-off | ||
| 26 | Verification | Thermometers and other CCP instruments are calibrated at a defined frequency | Calibration log, certificates | ||
| 27 | Verification | Product or environmental testing is done where the plan calls for it | Lab results, sampling plan | ||
| 28 | Verification | Internal audits of the food safety plan are scheduled and done | Internal audit schedule and reports | ||
| 29 | Validation and annual reassessment | Each control has evidence that it works as intended (validation) | Validation studies, literature, process authority letters | ||
| 30 | Validation and annual reassessment | The whole plan is reassessed at least once a year, and when products, processes or hazards change | Dated reassessment record | ||
| 31 | Validation and annual reassessment | Customer complaints, recalls and audit findings feed back into the plan | Management review minutes | ||
| 32 | Record keeping | Records are legible, dated, signed and kept with the product or batch they relate to | Sample batch records | ||
| 33 | Record keeping | Retention periods are defined and followed (check your regulation and customer requirements) | Records retention procedure | ||
| 34 | Record keeping | Records can be retrieved quickly during an audit or inspection | Index of records; retrieval test | ||
| 35 | Record keeping | Changes to records are corrected with a line-through, initial and date, never erased | Record correction policy | ||
| 36 | Prerequisite programs | Sanitation procedures are written, with schedules, chemicals and verification (ATP, swabs, visual) | SSOPs, sanitation records | ||
| 37 | Prerequisite programs | A pest control program is in place with a service contract, a map and trend reports | Pest control reports | ||
| 38 | Prerequisite programs | Suppliers are approved and monitored; incoming ingredients are checked | Approved supplier list, COAs, receiving records | ||
| 39 | Prerequisite programs | Staff training covers hygiene, allergen control and their role in the plan | Training matrix, attendance records | ||
| 40 | Prerequisite programs | Allergen control covers segregation, changeover cleaning and label checks | Allergen control procedure, changeover records | ||
| 41 | Prerequisite programs | Traceability: one step back and one step forward, tested with a mock recall | Latest mock recall record |
Based on: FDA, HACCP Principles & Application Guidelines (NACMCF, adopted Aug 14, 1997): the five preliminary tasks and seven principles; 21 CFR Part 117, Subpart C (hazard analysis and risk-based preventive controls, §§117.126–117.190). Other schemes: 21 CFR Part 120 (juice), Part 123 (seafood), 9 CFR 417 (USDA meat and poultry). Accessed Oct 2026. This template is a starting point. Adapt it to your own food safety plan, your product risks and your certification body or customer requirements. It does not make a facility compliant or certified.
For the records behind items 17 to 19 and 32 to 35, see our guide to food safety documentation and recordkeeping.
HACCP Internal Audit vs External Audit
A HACCP audit is a formal evaluation of whether your HACCP system controls food safety risks. It checks that procedures exist, are documented and are followed day to day, by reviewing records, observing production and interviewing staff. The two main types differ in who runs them and what they are for.
| Internal audit | External audit | |
|---|---|---|
| Who runs it | Trained people in your own organization, independent of the area audited | Certification body, regulator or customer |
| When | On a planned schedule, and before an external audit | For certification cycles, inspections or supplier approval |
| Output | Findings and corrective actions for management | Audit report, certificate decision or inspection result |
| Audience | Management and the food safety team | Regulators, certification bodies and customers |
Think of the internal audit as your early-warning system: it finds weak points in a controlled, low-risk setting so you can fix them before a third party does. If an inspection does turn up observations, see our guide to what an FDA Form 483 is and how to respond to one.
Who needs HACCP audits?
Any business that handles, processes, packages, stores or distributes food can face audits, through law or through customers. That includes manufacturers and processors, packaging suppliers, cold storage and distribution, catering and importers. Large retailers and distributors often require suppliers to pass a HACCP or GFSI audit as part of approval even where regulation does not. For meat and poultry, HACCP is regulated by USDA FSIS under 9 CFR 417; for juice and seafood, by FDA under 21 CFR Parts 120 and 123.
How to Run a HACCP Internal Audit in 7 Steps
- Plan the scope. Define the products, processes and sites to review, set objectives, and schedule the audit when CCP monitoring can be observed.
- Pick an auditor independent of the area. Auditors should be trained and should not audit their own work. The SQF Code, for example, expects trained auditors who are separate from the function they audit.
- Review the plan documents. Before going on site, check the scope, product descriptions, flow diagram (verified on the floor), hazard analysis, CCP determination, validated critical limits, and that monitoring and verification records are complete, signed and retrievable.
- Walk the line and observe a CCP. Confirm monitoring happens as written and at the stated frequency, ask the operator what the critical limit is and what to do on a deviation, and check that instruments are calibrated.
- Sample records. Pull a set of recent batches and trace each CCP record, corrective action and verification sign-off. Check signatures, timestamps and that review was done by a second person.
- Write findings. Record conformities and non-conformities, cite the exact requirement not met, and classify severity: critical (potential food safety hazard), major (system gap that could lead to a hazard) or minor (isolated lapse).
- Close corrective actions and verify. Each finding needs an owner, a deadline, a root cause, evidence of the fix and a later check that the fix worked. Feed results into plan updates, training and management review.
In IONI, a facility can turn on Internal Audit Check Records in its settings. For a clause that requires retained records, Check records searches logs, training, deviations and other audits and marks the result found or missing, and a record kept on paper or elsewhere can be marked as external.
Common Reasons Plants Fail a HACCP Audit
| Finding | Why it happens | Fix |
|---|---|---|
| Missing or unsigned monitoring records | Records are filled in afterwards, or the form has no reviewer step | Record at the time of the check; sign, date and have a second person review |
| Critical limits without validation | Limits are copied from a template or habit with no supporting evidence | Document the scientific or regulatory basis and keep the validation file |
| Corrective actions with no root cause | The product is held and released but the cause is never investigated | Require a cause, a preventive action and a follow-up check before closing |
| Hazard analysis not updated after a process change | Changes to a line, ingredient or supplier bypass the HACCP team | Make a change request trigger a hazard analysis review; reassess the plan at least annually |
| Verification not done or not recorded | Calibration, record review and internal audits slip when the team is busy | Schedule verification with named owners and keep dated evidence |
| Prerequisites (sanitation, pest) without records | The work is done but not written down | Keep sanitation, pest control, training and supplier records current and retrievable |
For the failures behind the first row, see 9 common mistakes in HACCP plans, and for the wider picture, why small food manufacturers fail food safety audits.
Food Safety Audit Checklist vs HACCP Audit Checklist
A HACCP audit checklist covers the plan: hazard analysis, CCPs, limits, monitoring, corrective actions, verification and records. A food safety audit checklist is broader. A GFSI audit such as SQF or BRCGS assesses the whole food safety system, including management commitment, document control, supplier approval, training and more, with HACCP as one part. Use the table above for the plan, then the scheme checklist for the rest. See our SQF audit checklist for small food manufacturers and what a BRC audit involves.
How Software Keeps You Audit-Ready
Checklists work when the evidence behind them is easy to find. IONI covers the parts of an audit that software can support, and it does not run the audit for you:
- HACCP validation. An AI task compares your HACCP plan with the requirements and your facility data, proposes fixes you can confirm, and lets you re-check any requirement. Re-export the plan as a PDF afterwards. See the HACCP builder.
- Internal audits against certification standards. Choose standards in facility settings (SQF Edition 10, BRCGS, IFS, and FSSC 22000 when enabled), open one internal audit and see each standard as not assessed, in progress, covered, partial or limited. Re-check a section's open gaps, use Fix gaps to get recommended documents to create or update, and close the audit to lock the clauses.
- Logs. Each log keeps who filled it in and who reviewed it. A person cannot confirm their own log, and a failed check stays a fail.
- Deviations and CAPA. A failed check can auto-draft a non-conformance and corrective action.
- Record sampling. A batch audit view and a traceability PDF help you sample records for a lot.
More on the platform: food safety software and our comparison of the best HACCP software.
See the HACCP builder
Post-Audit: What to Do Next
- Review findings objectively. Separate critical, major and minor findings and read each against the requirement it cites.
- Assign corrective actions. For each non-conformity name the issue, the owner and a deadline.
- Find the root cause. Ask whether it was an unclear procedure, a training gap or equipment, then fix that rather than the symptom.
- Update the HACCP plan. Revise the hazard analysis, CCPs or limits, flow diagram and verification records as needed.
- Communicate and train. Explain what changed and why, so it holds across shifts.
- Close the loop. Schedule a follow-up internal audit to confirm the actions worked and keep the evidence ready.
FAQ
What is a HACCP audit?
A HACCP audit is a formal check that your HACCP system controls food safety risks: that the plan is complete and scientifically sound, and that monitoring, corrective action, verification and record-keeping are followed in practice. It can be internal or external.
How do I prepare for a HACCP audit?
Run an internal audit first using the checklist above. Confirm the flow diagram matches the floor, the hazard analysis is current, critical limits are validated, and the last months of monitoring, corrective action and verification records are complete, signed and easy to retrieve. Make sure staff can explain the CCPs they monitor.
What is included in a HACCP audit checklist?
A HACCP audit checklist covers the team and scope, product descriptions, the verified flow diagram, hazard analysis, CCPs and critical limits, monitoring, corrective actions, verification, validation and reassessment, record keeping, and prerequisite programs such as sanitation, pest control, supplier approval, training, allergen control and traceability.
How often should a HACCP internal audit be done?
Plan it on a schedule, and at least annually for every part of the system. The SQF Code, for example, expects every element of the system to be internally audited at least once a year. Check the wording of your own scheme or customer requirements, and audit again after significant process changes.
Who can do a HACCP internal audit?
Someone trained in auditing and the HACCP system who is independent of the area being audited, so no one audits their own work. This can be a trained employee, a colleague from another department or an outside consultant.
What are the most common HACCP audit failures?
Missing or unsigned monitoring records, critical limits without validation, corrective actions with no root cause, a hazard analysis not updated after a process change, verification not done or not recorded, and prerequisite programs without records.
Ready to see how this works in practice? Book a demo.
