## 


## Audit Manual Auditing Official Control Delivery Systems In Northern Ireland Contents

1.0 
Introduction 
..................................................................................................... 4 
1.1 
Background ............................................................................................... 4 
1.2 
Purpose ..................................................................................................... 4 
1.3 
Scope ........................................................................................................ 5 
1.4 
Principles of the audit system .................................................................... 5 
1.5 
References to regulatory frameworks, codes and guidance ...................... 6 
Local Authorities / District Councils 
............................................................ 6 
DAERA ...................................................................................................... 7 
2.0 
Managing the audit function 
............................................................................ 8 
2.1 
Document control....................................................................................... 8 
2.2 
Independence and independent scrutiny ................................................... 8 
Independence 
............................................................................................ 8 
Independent scrutiny ................................................................................. 8 
2.3 
Risk based audit programme planning ...................................................... 8 
2.4 
Auditor ethics and competency 
.................................................................. 9 
Auditor ethics 
............................................................................................. 9 
Competency: Training and experience .................................................... 10 Technical auditors and technical experts 
................................................. 10 
2.5 
Co-ordination with other audit systems 
.................................................... 11 
2.6 
Complaints process ................................................................................. 11 
2.7 
Customer satisfaction .............................................................................. 12 
2.8 
Continuous improvement and lean auditing 
............................................. 12 
Continuous Improvement 
......................................................................... 12 
Lean Auditing 
........................................................................................... 12 
2.9 
Audit system management review 
........................................................... 15 
3.0 
The audit engagement process .................................................................... 16 
3.1 
Audit engagement planning ..................................................................... 16 
Audit plan: scope, objectives and criteria 
................................................. 16 
Audit team ............................................................................................... 16 Types of audits ........................................................................................ 16 Audit methods 
.......................................................................................... 16 
Audit Evidence 
......................................................................................... 17 
3.2 
Conducting the audit engagement 
........................................................... 17 
Audit team responsibilities ....................................................................... 17 Working documents ................................................................................. 18 Opening and closing meetings................................................................. 18 
| Checklists and aide memoires                                              |    18 |
|---------------------------------------------------------------------------|-------|
|                                                                           |       |
| Auditor notes 18                                                          |       |
|                                                                           |       |
| Audit findings 19                                                         |       |
|                                                                           |       |
| 3.3                                                                       |       |
|                                                                           |       |
| Audit reporting 19                                                        |       |
|                                                                           |       |
| Individual reports 19                                                     |       |
|                                                                           |       |
| Summary reports 20                                                        |       |
|                                                                           |       |
| Audit opinions and recommendations                                        |    20 |
|                                                                           |       |
| Audit Action plans                                                        |    22 |
|                                                                           |       |
| 3.4                                                                       |       |
|                                                                           |       |
| Audit follow up 22                                                        |       |
|                                                                           |       |
| Timing of follow-up                                                       |    22 |
|                                                                           |       |
| Evidence of implementation of actions 22                                  |       |
|                                                                           |       |
| Annexe A - FSA In NI Audit System Process 23                              |       |
|                                                                           |       |
| Annexe B - Independent Scrutiny 24                                        |       |
|                                                                           |       |
| Annexe C - Risk Based Audit Planning                                      |    25 |
|                                                                           |       |
| Annexe D - Audit System Management Review Process 26                      |       |
|                                                                           |       |
| Annexe E - Example Of Audit Opinion                                       |    27 |
|                                                                           |       |
| Annexe F - Glossary                                                       |    28 |
|                                                                           |       |
|                                                                           |       |
| Table 1 - Principles of the audit system 5                                |       |
|                                                                           |       |
| Table 2 - Auditor ethics and behaviours 9                                 |       |
|                                                                           |       |
| Table 3 - Lean principles Applied to auditing 13                          |       |
|                                                                           |       |
| Table 4 - Practical examples of lean                                      |    14 |
|                                                                           |       |
| Table 5 - Timing for reporting on an audit                                |    19 |
|                                                                           |       |
| Table 6 - Categories used for auditor opinion                             |    20 |
|                                                                           |       |
| Table 7 - Priority rating for auditor recommendations                     |    21 |
|                                                                           |       |
| Table 8 - Topics / areas to be discussed during each management review 26 |       |
|                                                                           |       |
| Table 9 - Evidence required for each audit system management review 26    |       |
|                                                                           |       |

## 1.0 Introduction 1.1 Background

1.1.1 The primary purpose of Food Standards Agency (FSA) audits1 of competent 
authorities (CAs) is to provide assurance that the delivery of official controls for feed and food is compliant with UK legal requirements and official guidance.  
1.1.2 These audits are also designed to verify the effective implementation of planned 
arrangements and to assess whether the planned arrangements are suitable to achieve the objectives of the relevant legal requirements and guidance. 
1.1.3 In Northern Ireland (NI) for the purposes of food and feed, CAs include, FSA, 
District Councils (DCs) and the Department of Agriculture, Environment and Rural Affairs (DAERA).  
1.1.4 The FSA in NI audit system is operated by an audit team which comprises a 
full-time audit manager and part-time technical auditors selected from policy 
teams within the FSA in NI or the FSA's Audit and Assurance team. 

## 1.2 Purpose

1.2.1 The FSA recognises the competent authorities it audits are committed to 
providing a quality service to the public and food business operators (FBOs). The purpose of this audit manual is to demonstrate the FSA shares this 
commitment and endeavours to continually improve how the audit function in NI 
delivers consistently high levels of quality in the context of changing regulatory 
requirements and official control delivery landscape and expectations. 
1.2.2 This audit manual documents the principles and processes used in the FSA in 
NI audit system2 to plan, carry out, report and followed up on the delivery 
system for feed and food official controls in NI. A flow chart summarising the NI 
audit system can be found in Annexe A.  
1.2.3 It also provides principles and policy information on: 
- Independence 
- Auditor ethics and competency 
- Risk based planning 
- Independent scrutiny 
- Customer satisfaction 
- Continuous improvement and lean 
————————————————— 
2 References to the audit system and the audit team in this manual refer specifically to 
the system and team in Northern Ireland. 
- Audit system management review 

## 1.3 Scope

1.3.1 This audit manual, the policies, processes and procedures referenced in it, are 
applicable to FSA audits of the delivery of official controls by CAs in Northern 
Ireland. 

## 1.4 Principles Of The Audit System

1.4.1 The following are the principles setting out how the audit system will conduct its 
activities. 

## Principle

1. All audit programmes must be selected based on a documented risk 
prioritisation process which clearly records and disseminates prioritisations 
to stakeholders, on an annual basis. 
2. Before the commencement of any audit programme a clearly defined audit 
plan must be provided to and agreed with the competent authority (auditee). 
3. Every audit programme plan must ensure the audit team is resourced with 
the appropriate/specific technical competency to achieve the objectives of the audit programme. 
4. Every audit programme must include clear objectives and the audit team 
must be able to demonstrate these objectives have been met at the end of the audit programme. 
5. The audit team will apply and practice progressive auditing techniques, 
such as lean methodologies and continuous improvement principles, to all areas of the audit system. 
6. The audit team will be proactive in providing clarity to competent 
authorities including, communication before, feedback during and feedback after all audit engagements.  
7. Each CA will be provided with a written report of the audit engagement. 
They will be given the opportunity to comment on the report before it is finalised.  
8. CAs will, through recommendations made in the audit report, have a clear 
understanding of what improvements are required and agreed dates for 
there implementation through the action plan. This will also include when the audit team will carry out follow-ups to confirm the implementation of 
actions to address recommendations. 
9. The CA (auditee) will be given the opportunity to provide feedback during 
and after every audit engagement. Feedback after an audit engagement will be recorded and independently reviewed. The feedback will be used to 
inform continuous improvement of the audit system. 

## 1.5 References To Regulatory Frameworks, Codes And Guidance

1.5.1 In Northern Ireland, the power to set standards and monitor Enforcement 
Authorities' food law enforcement services was conferred on the FSA under 
section 12 of the Food Standards Act 19993 and Regulation 7 of the Official 
Feed and Food Controls (Northern Ireland) Regulations 20094.  
1.5.2 Audits are carried out against a range of criteria: 
- 
NI food and feed regulations 
- 
EU food and feed regulations 
- 
Statutory codes of practice and practice guidance 
- 
DAERA VPHP's Manual of Official Controls5 
- 
The Framework Agreement on Official Feed and Food Controls by Local Authorities 
- 
CA policies and procedures 

## Local Authorities / District Councils

1.5.3 The Framework Agreement on Local Authority (LA) Food Law Enforcement6 
sets out the arrangements through which the FSA audits LA enforcement activities to help ensure that LAs are providing an effective service to protect public health 
1.5.4 The overarching aims of the LA audit scheme are to: 
- 
Help to protect public health by promoting effective local enforcement of food law  
- 
Maintain and improve consumer confidence  
- 
Assist in the identification and dissemination of good practice to aid consistency  
- 
Provide information to aid the formulation of FSA policy  
- 
Promote conformance with the 'Food Law Enforcement - Standard' and 
any relevant central guidance or Codes of Practice  
- 
Provide a means to identify underperformance in LA food law enforcement  
- 
Promote self-regulation and peer review  
- 
Identify continuous improvement  
1.5.5 A statutory code of practice is also in place which gives instructions that local 
authorities in NI must consider when enforcing food law. It relates to Northern 
Ireland only. There are also similar codes of practice in England and Wales. 
1.5.6 The Food Law Code of Practice7 for NI is issued under Article 39 of The Food 
Safety (Northern Ireland) Order 19918 (the Order), regulation 22 of The Food Hygiene Regulations (Northern Ireland) 20069, which empower the Department 
of Health, Social Services and Public Safety (DHSSPS) to issue codes of practice concerning the execution and enforcement of that legislation by competent authorities.  

## Daera

1.5.7 DAERA is a NI central government department whose responsibilities include 
delivering official controls on behalf of the FSA in the areas of meat, dairy, egg and primary production hygiene. A Service Level Agreement (SLA) is in place to 
manage the delivery of these official controls.  
1.5.8 The FSA currently audits official controls and activities delivered by DAERA, as 
defined in the FSA / DAERA SLA, against the relevant criteria stated in 1.5.2.  
1.5.9 Whilst the policy for animal feedingstuffs rests with the FSA, DAERA is the 
competent authority for the enforcement and delivery of feed official controls in 
NI.  
 

## 2.0 Managing The Audit Function 2.1 Document Control

2.1.1 All documents10 used in the FSA in NI audit system are identified with a unique 
reference and recorded on the FSA in NI Document Master list. 
2.1.2 Each time a document is changed, the change is recorded in the FSA in NI 
Document Control Log. Changes to FSA in NI audit system documents can only 
be made by the FSA in NI Audit Manager. 
2.1.3 All documents listed on the Document Master list are stored on the FSA's 
document storage system (Wisdom). 

## 2.2 Independence And Independent Scrutiny

2.2.1 The principles for independence and the principles and process for independent 
scrutiny are based on the National Audit System (NAS) Network11 reference 
document - Independence and independent Scrutiny12.  

## Independence

2.2.2 The FSA in NI's audit system demonstrate independence on four levels: 
- Organisational - a clear mandate to conduct its audits - Functional - provision of adequately resourced, suitably qualified staff 
- Process - free from influence at all levels of the audit system - Auditor - behave objectively, impartially, and declare a conflict of interest 
when appropriate 
2.2.3 It is through the independent scrutiny process that the independence of the 
audit system is challenged and confirmed. 

## Independent Scrutiny

2.2.4 The process for independent scrutiny is documented in Annexe B.  

## 2.3 Risk Based Audit Programme Planning

————————————————— 
10 Examples of documents include - manuals, procedures, processes, checklists, 
forms. 
11 The NAS network is a network of officials (auditors) from national competent 
authorities, responsible for the performance of audits of official control systems as provided for by Article 4(6) of Regulation (EC) No 882/20041. The networks meet 
regularly, under the chairmanship of, and facilitated by, SANTE F of the EC, to exchange experiences in implementing national audit systems on official control activities. During the course of these exchanges; discussions, workshops etc. good principles and practices are identified and agreed by the network. 
12 NAS Reference Document - Independence and Independent Scrutiny 
2.3.1 The FSA in NI audit planning process is based on a risk prioritisation of an audit 
universe containing official controls, related control activities and other relevant 
areas. 
2.3.2 The principles and process for risk-based audit programme planning is based 
on the NAS Network reference document - Risk Based Planning for Audits of 
Official Controls13.  
2.3.3 FSA in NI's process for carrying out the annual audit planning can be found in 
Annexe C. 

## 2.4 Auditor Ethics And Competency

2.4.1 All members of the audit team are civil servants and as such will uphold the 
Civil Service code14.  

## Auditor Ethics

2.4.2 The following are ethics15 and behaviours which specifically apply to FSA in NI 
auditors: 

## Ethics And Behaviours

Integrity - auditors shall perform their work with honesty, diligence and responsibility. They shall not knowingly be party to any illegal activity or engage in acts that are discreditable to the FSA. 

Independence - auditors should be independent of the activities audited, wherever practicable and should in all cases act in a manner that is free from bias and conflict of interest. Objectivity - auditors shall not participate in any activity or relationship that may impair or be presumed to impair their unbiased assessment. They shall not accept anything that may impair or be presumed to impair their professional judgment. Confidentiality - auditors shall be prudent in the use and protection of information acquired in the course of their duties. They shall not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the FSA. 

## Competency: Training And Experience

2.4.3 Each auditor employed by the FSA in NI has a working knowledge of the Food 
and Feed Regulatory Framework in the UK. They must also have specific advanced auditor training which gives them an understanding of auditing management systems and systems auditing e.g. attended an ISO 9000 lead assessor training course. 
2.4.4 Auditors demonstrate the generic knowledge and skills needed as an auditor, 
including, audit principles, procedures and techniques, management / organisational skills. This is achieved by being a member of an audit team under the supervision of the Audit Manager. 
2.4.5 In principal, each auditor must complete at least one audit of an OC delivery 
system each year16. Two auditor development meetings are held in quarter one 
and quarter three of each financial year;  
2.4.6 Organised by the FSA in NI Audit Manager, development days are used to: 
- Plan and progress of audit programmes - Discuss new audit guidance / working papers - Discuss changes in legislation, codes of practice and statutory guidance 
2.4.7 As well as addressing auditor competency, development days are used to carry 
out the audit system management review.                                                                                 

## Technical Auditors And Technical Experts

2.4.8 The audit team comprises a full-time audit manager and part-time technical 
auditors selected from policy teams within the FSA or the FSA's Audit and Assurance team.  
2.4.9 Technical auditors, for the purposes of this audit manual, are trained auditors17 
with technical expertise in one or more areas of feed and food policy. Each 
team used for an audit must contain at least one technical auditor with the relevant technical experience applicable to the audit scope and criteria for each audit programme / engagement. 
2.4.10 From time to time, technical experts are selected from within the FSA or 
externally to participate in an audit programme / engagement. This will usually 
————————————————— 
happen when no suitable technical auditor can be provided to the audit team. Technical experts provide advice and opinions based on their expertise but are not considered auditors and do not perform the functions of an auditor during an audit programme / engagement. 

## 2.5 Co-Ordination With Other Audit Systems

2.5.1 The audit team recognises there are other CAs within the UK who also perform 
the same function. The audit team is represented at collaborative working meetings with these CAs. These include: 
- DAERA 
- Food Standards Scotland (FSS) 
- Department of Environment, Food & Rural Affairs (DEFRA) 
- Animal and Plant Health Agency (APHA) - Veterinary Medicines Directorate (VMD) 
- Welsh Government - Scottish Government 
2.5.1. The audit team collaborates with the Food Safety Authority of Ireland (FSAI). 
This collaboration can involve the exchange of audit system information (audit 
programmes, policies and procedures) and joint audit programmes. 

## 2.6 Complaints Process

2.6.1 There is a process in place for resolving complaints made by CAs arising from 
the conduct of feed and food service audits undertaken by the FSA in NI. The 
lead auditor is required to explain the complaints process to the CA at both the opening and closing meetings of the audit engagement. The complaints 
process, which includes escalation of the complaint, is also described in the 
audit plan for each audit programme. 
2.6.2 A CA is encouraged to raise any concerns with the lead auditor during the onsite audit or audit reality check visit with the aim of resolving any issue at the 
time. 
2.6.3 If the issue cannot be resolved with the lead auditor, the CA is advised to 
contact the Head of Consumer Protection, FSA in NI.  
2.6.4 If there is disagreement with the content of the draft report, the CA is advised to 
contact the Head of Consumer Protection. 
2.6.5 If the head of Consumer Protection cannot resolve the issue to the satisfaction 
of the CA, the CA is advised to contact the FSA Director with responsibility for Northern Ireland. 
2.6.6 If the FSA Director with responsibility for Northern Ireland cannot resolve the 
issue to the satisfaction of the CA, the CA is advised to contact the Chief Executive of the FSA / Board Member for NI. The Chief Executive of the FSA / 
Board Member for NI are the final arbiter for resolving complaints raised by CAs. 

## 2.7 Customer Satisfaction

2.7.1 A key component of the FSA in NI audit system is feedback from CAs. The 
process describes how CAs can provide feedback to FSA in NI on both the audit system and the conduct of the audit team. 
2.7.2 At the opening and closing meeting of every on-site element of an audit, 
auditees are given the opportunity to provide feedback to the audit team either specifically about the conduct of the audit or the FSA's activities in general. 
2.7.3 A customer satisfaction / feedback questionnaire is provided, along with the 
final report, to the auditee. The auditee is asked to complete the questionnaire 
and return it to the Head of Consumer Protection who reviews the questionnaire for independent evaluation. 
2.7.4 Results from customer satisfaction questionnaires are compiled and reported on 
as part of the audit system management review and independent scrutiny processes. 

## 2.8 Continuous Improvement And Lean Auditing

2.8.1 The audit team is committed improving processes within the audit system and 
to seek innovative ways to make the audit system more effective. It is also important to demonstrate the audit system is capable of adding value to both the CAs' official control delivery systems and FSA policies and guidance.  
2.8.2 The audit team uses continuous improvement and lean principles, tools and 
techniques to help achieve this. 

## Continuous Improvement

2.8.3 Continuous improvement techniques are applied to several processes in the 
FSA in NI audit system: 
- Risk based audit planning 
- Customer satisfaction / feedback - Audit system management review - Independent scrutiny 

## Lean Auditing

2.8.4 The audit team seeks to apply lean18 principles, tools and techniques to all 
processes in the audit system, for example: 
————————————————— 
18 https://www.lean.org/WhatsLean/ 
 

## Table 3 - Lean Principles Applied To Auditing The Application Of Lean Principles

Audit teams that are appropriately resourced - Use of trained auditors with the technical competency applicable to the audit scope and criteria, when available. This ensures targeted, effective and efficient use of auditor and technical resource. 

Communication must be clear and within agreed timescales - 
Communication, both written and verbal, with auditees before during and after audit engagements should be clear. It should be delivered in a format that avoids confusion and misinterpretation. It should also fulfil wider stakeholder expectations.  
The audit team should be open and transparent - The audit team should clearly communication to the auditee and relevant stakeholders the following information before the commencement of an audit engagement:  

- the reasons for an audit programme 
- the scope and objectives of audit programme - reasons for auditee selection 
- the audit engagement process including reporting and follow-up 
This also includes providing the auditee with the audit documentation (e.g. audit plan, checklist, aide memoir) used by the audit team during and audit engagement. 

Audit outputs clearly linked to audit objectives - The audit team must be able to demonstrate added value and deliver auditee / customer expectations for each audit programme. To do this the auditee / wider stakeholders must be able to consider the audit outputs (findings, conclusions, reports, recommendations, good practice, wider dissemination of issues) and judge the audit to have been valuable and carried out to their satisfaction. Measured through the customer satisfaction and independent scrutiny processes. Selecting the most appropriate audit method - The audit team must be critical in their selection of the audit methods to use during an audit engagement. Using the same methods for all audit programmes is not an effective or efficient use of resource for both the audit team and the auditee.  
Audit findings, reports and general communication are useful - Audit findings must be efficient, insightful and recognise the wider context of the challenges facing CAs. As well as confirming compliance with feed and food law auditors should add value to the auditee through recommendations which improve suitability and effectiveness as well as highlighting efficiencies to the CAs about their control systems. 

## Practical Examples Of The Application Of Lean Tools And Techniques

Audit programme planning based on risk prioritisation not risk management - selection of OC or OC activities to be audited must be based solely on the impact element of a risk assessment19. Auditors are not responsible for risk management therefore it is wasteful for the auditors to consider likelihood. Likelihood is considered later, during the audit, because to assess likelihood you must include the current level of controls in place to management a risk.  
It also encourages less complex scoring processes which can also reduce the level of resource in the audit planning process. 

Obtaining information in a timely manner - Each audit assignment includes the use of a pre-visit questionnaire (PVQ) requesting information on policies, processes, procedures and specific OC activity data. The PVQ is completed and returned for analysis by the audit team before the on-site element of the audit. The audit team gain a greater understanding of the auditees resources, control systems, including allowing the selection of specific areas to target while on-site. Using this method also allows the auditor to 'hit the ground running' and avoids wasting time learning about the auditees controls systems at the start of the on-site element of the audit. 

Defining timelines and communication channels - It is important to agree and define how long an audit will take and who will be involved. It sets expectation levels and responsibilities focusing on delivering the audit on time and defining auditor and auditee responsibilities. For example, the timing of audits is defined in the annual list of audit programmes and in the audit plan for each audit programme. Timetables are used to show how long 

## —————————————————

the on-site element will take. The roles of the auditors are set out in the opening meeting and an audit liaison officer20 is identified by the auditee.  
Direct access to information / data - the most efficient way to obtain and examine information / data is through direct access. This eliminates the need for the auditor to issue requests constantly and frees up the auditee to perform other duties. An indicator of a well performed audit is the level of impact / disruption caused to the auditee. A good example of this is auditors having direct access to CAs' data management systems.  
The use of Gemba21 - In the context of auditing official control delivery systems, this is referred to as a **reality check visit**. These are carried out at the food/feed business operators' premises. They are used to verify documented information recorded by the CA, allow officers delivering OCs to demonstrate their knowledge of FBO activities and confirm the comprehensiveness of OC delivery. 

Root cause analysis (RCA) - Basic root cause analysis is practiced by the audit team when preparing recommendations. Auditees are also encouraged to use RCA when preparing actions to address recommendations. 

## 2.9 Audit System Management Review

2.9.1 The objective of management review is to confirm the audit system remains 
suitable, adequate and effective. The review should: 
- Consider if the audit system is functioning as planned  
- Identify opportunities to improve  
- Identify non-conformities and monitoring corrective and preventive actions. 
2.9.2 The audit system management review is carried out twice a year at the same 
time as the auditor development day. It is carried out by the audit team and covers the topics listed in Annexe D. 
2.9.3 A record of each review is stored on Wisdom22. ————————————————— 
20 The audit liaison officer is the person nominated by the auditee / CA to act as the 
main contact for the audit team to clarify information provided in the PVQ, request information through and provide regular feedback to during the on-site element of the 
audit. 
21 Gemba is the Japanese word for the real place (e.g. the place where a news event 
takes place). The lean technique is to 'Go Look See' what is really going on. In the context of auditing official control delivery systems, it is carried out at the food/feed 
business operators' premises, as this is where OCs are delivered. 
22 Wisdom is the FSA's document storage system.  

## 3.0 The Audit Engagement Process 3.1 Audit Engagement Planning Audit Plan: Scope, Objectives And Criteria

3.1.1 An audit plan must be produced for each audit programme. It should contain the 
following headings: 
- Introduction (including reasons for the audit programme) 
- Scope, objective(s), and criteria - Notification arrangements 
- Documents used - Audit engagement process (including reporting & follow-up) 
- Feedback 
- Publication of reports 
- Complaints & disputes 
3.1.2 The audit plan must be agreed and distributed to auditee(s) before the 
commencement of the audit programme. 

## Audit Team

3.1.3 The lead auditor23 is responsible for selecting each audit programme / 
engagement audit team. The selection of auditors will be primarily based on availability of auditor(s) with the specific technical experience which matches 
the audit scope and criteria. Availability of all FSA in NI auditors to perform the 
audits within the time period detailed in the FSA in NIs annual list of audit programmes is also a factor in selecting the audit team for each audit programme / engagement. 

## Types Of Audits

3.1.4 Selecting which type of audit to use during an audit engagement is an important 
decision as it will determine the amount of audit resources required. It can lead 
to wasted resource both in terms of the audit team and CA. The types of audits 
used by FSA in NI include: 
- Full audits - covering all sections of the Framework Agreement or the full 
range of OC activities of a CA. 
- Focused audits - can be based on Regulations, one or more areas of the 
framework agreement, feed or food law codes of practice or practice 
guidance, DAERA's Manual of Official Control (MOC). 

## Audit Methods

————————————————— 
23 The FSA in NI audit manager is currently the lead auditor for all audits carried out in NI. 

3.1.5 This is another important decision to make at the planning stage. Selecting 
which method or combination of methods to use during an audit can have a 
major influence on the level of added value to the CA and the usefulness of 
evidence is collected. The range of methods used by FSA in NI include: 
- Desktop assessment - e.g. PVQ information, FSA data (LAEMS, FHRS, 
FSA-DAERA Service Level Agreement (SLA data), published data (LA 
service plans and enforcement policies) 
- Documentation checks - e.g. records of interventions (audits, inspections, 
sampling, follow-ups, complaint investigations), formal enforcement 
notices, management records (training and competency evaluation, internal monitoring, delegated authority, authorisations, service delivery monitoring records)  
- Interviews - e.g. managers, officers, FBOs, policy leads 
- Reality check visits - i.e. visits to FBOs establishments 

## Audit Evidence

3.1.6 The principles, definitions and methods used in the FSA in NI audit system 
around audit evidence is based on the NAS Network reference document - 
Audit Evidence24. 
3.1.7 Consideration about what evidence should be collected and how it is to be 
collected must start at the planning stage of an audit programme. It is important 
to focus resources on gather evidence which supports findings associated to 
the audit scope and objectives.  
3.1.8 There will also be occasions when evidence is found identifying issues which 
are outside the audit scope and objectives. This evidence should be used by the lead auditor to investigate issues further, as appropriate, but not as part of the audit engagement where the evidence was found. 

## 3.2 Conducting The Audit Engagement Audit Team Responsibilities

3.2.1 The FSA in NI audit manager acts as lead auditor for all audit engagements. 
The audit manager is responsible for: 
- Preparing the working documents for each audit engagement 
- chairing the opening and closing meetings - drafting the audit report (including recommendations) - performing the follow-up to gather evidence to address recommendations 
3.2.2 At least one member of the audit team will be identified as the auditor with 
technical expertise relevant to the audit scope and criteria. It is their 
————————————————— 
responsibility to provide clarifications and direction regarding technical and regulatory issues during the audit. 

3.2.3 The role of each member of the audit team are agreed once the PVQ has been 
returned by the CA and before the on-site element of the audit begins. 

## Working Documents

3.2.4 The audit team will prepare and use a number of documents during the audit 
engagement to gather information from the auditee, record evidence and 
provide information to the auditee.  
3.2.5 As a minimum the following documents will be used: 
- PVQ 
- Request for specific officer and establishment records 
- On-site audit timetable 
- Opening meeting lead auditor notes - Closing meeting lead auditor notes 
- Checklist / aide-mémoire 

## Opening And Closing Meetings

3.2.6 Clear communication and understanding between the auditors and auditee is 
important to ensure the audit is conducted to auditee's satisfaction. It aids auditee's understanding of the audit findings, leading to better implementation 
of actions to address recommendations.  
3.2.7 Two formal meetings are always planned for each audit, an opening meeting 
and closing meeting: 
- Opening meeting - used to formally affirm the details of the audit plan 
(audit scope, objectives, criteria), practical process for the on-site element of the audit, complaints, reporting and follow-up procedure. 
- Closing meeting - used to present the audit findings, explain the process 
required after the on-site element has finished, re-affirm the complaints, 
reporting and follow-up processes. 

## Checklists And Aide Memoires

3.2.8 Both checklist(s) and/or aide-mémoire(s) can be used during audits to list 
specific questions / areas to cover during the audit. They are also one of the methods used to record evidence.  
3.2.9 It is at the discretion of the audit manager, during the audit planning stage, to 
decide the content of any checklist(s) and/or aide-mémoire(s) used. A library of 
previous checklist(s) and/or aide-mémoire(s) can be found on Wisdom. 

## Auditor Notes

3.2.10 Checklists and aide-mémoires can be supplemented by notes taken by the 
auditors. These are valid methods for recording evidence, providing feedback 
to the auditee, forming the basis of audit findings, and conclusions. 

## Audit Findings

3.2.11 Audit findings are based on evidence collected during the audit. Checklist(s), 
aide-mémoire(s) and auditors' notes are used to record evidence. Audit 
findings can also be based on evidence collected during the audit from the auditee or from other relevant sources such as publications, reports and data. 

## 3.3 Audit Reporting

3.3.1 Each audit plan will describe how the audit programme will be reported. The 
reporting for an audit programme can range from one audit report to multiple 
audit reports and a summary report.  
3.3.2 The most common way to report an audit programme is to have an audit report 
for each CA in the audit programme. If more than one CA is included in an audit programme, then a summary report is usually produced once all the individual 
audit reports have been issued. 
3.3.3 The timing for drafting and issuing reports is set out in the table below. 

| Report Phase                                                | Time    |
|-------------------------------------------------------------|---------|
| Draft report                                                |         |
| Issued within 20 workings days of the audit closing meeting |         |
| Within 20 working days of receiving the draft report        |         |
| Auditee                                                     |         |
| comments on                                                 |         |
| draft report                                                |         |
| Issue of report                                             |         |
| Within 15 days of receiving auditee response                |         |

## Individual Reports

3.3.4 When an individual audit report is produced it will usually have content under 
the following headings: 
- Introduction 
- Background 
- Reason for audit - Scope and objectives of the audit programme - Audit criteria 
- Executive summary  
- Audit opinion - Audit findings - Action plan (including recommendations) - Glossary 
3.3.5 There is an expectation DC audit reports will be placed in the public domain. 
Audit reports will be issued to councils with the expectation that the reports will 
be presented to elected members within the appropriate local public forum. Copies of final audit reports will be placed on the Food Standards Agency website. 
3.3.6 Currently audits of DAERA are not placed in the public domain. 

## Summary Reports

3.3.7 Summary reports are used to: 
- Provide an overview of how the audit programme was carried out - Summarise the findings from all the audits - Present good practice found during audits 
- Identify and record recommendations for FSA policy 
3.3.8 Summary reports will usually have content under the same headings as 
individual reports and will also include the following heading: 
- Conclusions - Summary of recommendations 
- Recommendations for FSA 

## Audit Opinions And Recommendations

3.3.9 Each audit report will contain an overall opinion from the auditors about the 
CA's system for delivering official controls and official control activities covered 
by the scope of the audit. 
3.3.10 The opinion will be taken from one of the four categories listed in the table 6 
below. Before its introduction, these audit opinion categories will be subject to piloting in 2021. 

Audit Opinion 
Definition 
Substantial  
The sections of the Competent Authority's system for delivering official controls and official control activities covered by the scope of this audit report demonstrate effective implementation of planned arrangements suitable to achieve the objectives of the relevant legal requirements and guidance. The sections of the Competent Authority's system for delivering official controls and official control activities covered by the scope of this audit report requires some improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of the relevant legal requirements and guidance. The sections of the Competent Authority's system for delivering official controls and official control activities covered by the scope of this audit report requires significant improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives 
of the relevant legal requirements and guidance. 
The sections of the Competent Authority's system for delivering official controls and official control activities covered by the scope of this audit report requires substantial improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of legal requirements and guidance. 

3.3.11 Recommendations are made by the auditors to aid improvements to the 
system or to record issues which require action. When recommendations are made, they are recorded in an action plan.  
3.3.12 Action plans are used by the auditee to record actions / changes in policy, 
procedures, etc, to address recommendations. Action plans also include 
forecasted dates of when the auditee thinks the actions will be completed. These dates are agreed with the lead auditor. 
3.3.13 Prioritising recommendations allows the auditee to appropriately allocate 
resources. It also allows the reader to clearly gauge the importance of the 
recommendation. 

Priority Rating 
Definition 
High 
Should be implemented as soon as possible due to its potential or actual adverse impact on the system or process. 
Medium 
The weaknesses identified are less likely to affect the achievement of the objectives of the system or process. They are important issues which should be addressed by management in their areas of responsibilities. 
Low 
Minor weaknesses identified in the system or procedures that are unlikely to affect the achievement of the objectives of the system or process but wish to bring to the attention management to enhance risk management control. 

## Audit Action Plans

3.3.14 When a recommendation is made it is recorded in the audit report and in an 
action plan. The action plan details: 
1. The recommendation 2. Its priority rating  
3. Actions to address the recommendation 
4. Specific dates (month & year) for completing individual actions 
3.3.15 The CA is responsible for providing the lead auditor with updates on progress 
with actions plans. The lead auditor is responsible for amending the action plan with these updates and for indicating on the action plan when actions to address recommendations are completed.  

## 3.4 Audit Follow Up Timing Of Follow-Up

3.4.1 If there are no recommendations made, the process for drafting the audit report 
is followed and no follow-up is required. 
3.4.2 If there is an action plan, as a rule the lead auditor contacts the CA for an 
update on progress six months from the date the audit report was issued. 
3.4.3 At the discretion of the lead auditor and with the agreement of the CA, follow-up 
can take place as and when individual action due dates occur. 

## Evidence Of Implementation Of Actions

3.4.4 A CA must provide evidence of actions to address recommendations. The type 
and detail required must be confirmed and agreed with the lead auditor. Examples of the type of evidence accepted can include: 
- 
Re-drafted scheme of delegation 
- 
Authorisation 
- 
Qualification / Training records 
- 
Amendments to procedures / policies 
- 
Intervention reports 
- 
Samples results 
- 
Meeting minutes 

## Annexe B - Independent Scrutiny Fsa In Ni Independent Scrutiny Process Annexe C - Risk Based Audit Planning Annexe D - Audit System Management Review Process

1. An agenda for each management review should be produced by the audit 
manager. 
2. Minutes of each review should be made and stored on Wisdom. The minutes 
should also include a summary of the discussions on each topic listed in the table 8. 
3. The evidence listed in table 9 should be prepared and presented by the audit 
manager at each review. 

## Topic / Area:

- Adequacy of audit system documentation (e.g. policies, processes and 
procedures) 
- Discussion on the status of any issues or outstanding actions from the previous 
meeting 
- External and internal issues affecting the audit system - Review of available resources and their adequacy - Review of previous actions taken to improve the audit system identified - Identification of further opportunities for improvement 

## Table 9 - Evidence Required For Each Audit System Management Review Evidence For An Audit System Management Review:

- Minutes of previous management review meeting - Audit system documentation. - NI and other relevant audit reports. - Customer satisfaction questionnaires. - Complaints since the last review. - Corrective and preventive actions including follow-up and close-out of 
Management Information Reports. 

## Annexe E - Example Of Audit Opinion Audit Opinion For Xxxxxx

Moderate Assurance: the system for delivering official controls requires some improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of legal requirements and guidance. 


 
 

## Annexe F - Glossary

Name 
Description 
Audit 
A systematic and independent examination to determine whether activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives. 
Authorised Officer 
A suitably qualified officer who is authorised by the Local Authority to act on its behalf in, for example, the enforcement of legislation.  
Competent Authority 
(CA) 
The authority responsible for the organisation / delivery of official controls and of other official activities. 
Environmental Health Officer (EHO)  
Officer employed by the local authority to enforce food safety legislation.  
Food Business Operator (FBO) 
This refers to the natural or legal persons responsible for ensuring that the requirements of food law are met within the food business under their control. 
Food hygiene  
The legal requirements covering the safety and wholesomeness of food.  
Food Law Code of Practice (Northern Ireland) February 2016 
(FLCoP) 
Article 39 of the Food Safety (NI) Order 1991 (the Order), Regulation 22 of the Food Hygiene Regulations (NI) 2006 and Regulation 6 of the Official Feed and Food Controls Regulations (NI) 2009, which empower the Department of Health Social Services and Public Safety to issue codes of practice concerning the execution and enforcement of that legislation by district councils. This code is issued as guidance to competent authorities on the enforcement of food legislation. It relates to Northern Ireland only.  
Food Standards Agency (FSA) 
The Food Standards Agency is an independent Government department set up by an Act of Parliament in 2000 to protect the public's health and consumer interests in relation to food. Everything we do reflects our vision of Safe Food and 
Healthy Eating for all.  
Framework Agreement  
The Framework Agreement consists of: Chapter One Service Planning Guidance  
Chapter Two The Standard  
Chapter Three Monitoring of Local Authorities Chapter Four Audit Scheme for Local Authorities  
The Standard sets out the Agency's expectations on the planning and delivery of food law enforcement. 
Local Authority (LA) / District Council (DC) 
An organisation that is officially responsible for public services and facilities in a particular area. 
Food Law Practice Guidance (Northern Ireland) October 2016 (FLPG) 
Guidance issued by the Food Standards Agency to assist district councils with the discharge of their statutory duty to enforce the Food Safety (NI) Order 1991, Regulations made under it, and food law made under the European Communities Act 1972. 
Manual of Official Control (MOC) 
The Department of Agriculture, Environment and 
Rural Affairs (DAERA) Veterinary Public Health Programme (VPHP) Manual for Official Controls (MOC) explains the tasks, responsibilities and duties VPHP officers undertake in approved establishments supervised by the VPHP. 
Pre-visit Questionnaire (PVQ) 
Used by auditors to request information prior to an audit visit, to maximise the effectiveness of the time spent with a local authority. 
Service Level Agreement (SLA) 
An agreement negotiated between two parties where one is the customer and the other the service provider. The SLA records a common understanding about services, priorities, responsibilities. For this audit manual the SLA between FSA and DAERA. 
Service Plan  
A document produced by a Local Authority setting out their plans on providing and delivering a food service to the local community.  

 
 © Crown copyright 2020 This publication (not including logos) is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned. For more information and to view this licence:  

- visit the National Archives website - email psi@nationalarchives.gov.uk 
- write to: Information Policy Team, The National Archives, Kew, London, TW9 
4DU 
For further information, or enquiries about this publication, please contact the Food Standards Agency in Northern Ireland: Telephone:   028 9041 7700 
Email:           infofsani@foodgov.uk  
 
Follow us on Twitter: @FSAinNI    
Find us on Facebook: @FSAInNI