United States Department of Agriculture 

Agricultural Marketing Service 

Federal Grain Inspection Service 

Directive FGIS 9180.89 January 1, 2024 

INTERNAL AUDIT PROGRAM 

Contents 

1. PURPOSE .............................................................................................................................. 2

2. BACKGROUND ...................................................................................................................... 2

3. AUTHORITY ........................................................................................................................... 2

4. SCOPE ................................................................................................................................... 2

5. FREQUENCY ......................................................................................................................... 3

6. ROLES AND RESPONSIBILITIES ......................................................................................... 3

7. INTERNAL AUDIT PROCESS OVERVIEW ........................................................................... 5

8. ADDITIONAL INFORMATION ................................................................................................ 9

In accordance with Federal civil rights law and U.S. Department of Agriculture (USDA) civil rights regulations and policies, the 

USDA, its Agencies, offices, and employees, and institutions participating in or administering USDA programs are prohibited 

from discriminating based on race, color, national origin, religion, sex, gender identity (including gender expression), sexual 

orientation, disability, age, marital status, family/parental status, income derived from a public assistance program, political 

beliefs, or reprisal or retaliation for prior civil rights activity, in any program or activity conducted or funded by USDA (not all 

bases apply to all programs). Remedies and complaint filing deadlines vary by program or incident.

Persons with disabilities who require alternative means of communication for program information (e.g., Braille, large print,

audiotape, American Sign Language, etc.) should contact the responsible Agency or USDA's TARGET Center at (202) 720-2600 

(voice and TTY) or contact USDA through the Federal Relay Service at (800) 877-8339. Additionally, program information may be 

made available in languages other than English.

To file a program discrimination complaint, complete the USDA Program Discrimination Complaint Form, AD-3027, found online 

at How to File a Program Discrimination Complaint and at any USDA office or write a letter addressed to USDA and provide in 

the letter all of the information requested in the form. To request a copy of the complaint form, call (866) 632-9992. Submit your 

completed form or letter to USDA by: (1) mail: U.S. Department of Agriculture, Office of the Assistant Secretary for Civil Rights, 

1400 Independence Avenue, SW, Washington, D.C. 20250-9410; (2) fax: (202) 690-7442; or (3) email: program.intake@usda.gov. 

Distribution: FGIS, OSP, Industry Originating Office: QACD
FGIS Directive 9180.89 January 1, 2024 

Page 2

1. PURPOSE

This directive will establish a minimum framework for the Internal Audit Program, (IAP). IAPs are 

designed to be tailored to fit your organization, culture, management, infrastructure, risks, and goals.

The IAP builds a framework for Official Service Providers (OSP) to assess and track their compliance 

with statutory and regulatory requirements by proactively addressing issues and preparing for 

external audits. 

OSPs consisting of authorized Federal Grain Inspection Service (FGIS) Field Offices (FO) and state 

or private agencies designated or delegated to provide official services, must have sound internal 

audit controls and a risk management framework in place. Leadership sets the tone for successful 

compliance and quality management. Commitment to successful internal audits is key for OSPs to 

assess compliance with requirements under the United States Grain Standards Act (USGSA) and, 

where applicable, the Agricultural Marketing Act of 1946 (AMA).

2. BACKGROUND

Quality Management Systems (QMS) help an organization’s leadership, ensure compliance, and 

improve performance. Criteria is established via statutory requirements of the USGSA and AMA, 

regulatory requirements via 7 CFR 800 and 868 series and instructions. OSPs, including designated 

and/or delegated Official Agencies (OA), FGIS FOs and AMA Cooperators may create their own 

internal requirements to further define internal processes. However, they cannot omit, waive, or 

modify official requirements. FGIS recommends creating internal quality manuals and standard 

operating procedures tailored to OSP operations, to maintain compliance with the associated 

requirements. 

An IAP is vital for QMS success. It establishes internal audit objectives, defines audit processes, 

identifies and mitigate risks, and creates a corrective and preventive action framework. This program 

helps OSPs assess their compliance with requirements and manage risk exposure. 

QACD will provide a sample reference checklist, however, OSPs may adjust this as appropriate for 

their own internal auditing process. IAPs should be tailored to the needs of their organization. OSPs

may elect to expand or define the requirements identified in this directive, as long as the internal audit 

meets the minimum requirements. 

3. AUTHORITY 

This directive is established under the authorities of the USGSA, as amended (7 U.S.C. 71-87), the 

AMA (7 U.S.C. 1621-1627), and the regulations established under both Acts. It does not alter, relax, 

or amend any statutory or regulatory obligations applicable to OSPs.

4. SCOPE

During each audit cycle a representative sample of mandatory criteria established by the USGSA 

and/or AMA, must be reviewed as part of the full internal audit cycle. A representative sample is a 

subset of the criteria, large enough to reflect the compliance performance of the overall category 

being examined. OAs must review designation and/or delegation criteria of the USGSA, and OSPs

must confirm compliance with AMA requirements, if applicable. 
 

FGIS Directive 9180.89 January 1, 2024 

Page 3 

5. FREQUENCY

OAs must conduct an internal audit by the halfway date of their designation period. The designation 

halfway date is when the internal audit will be turned into QACD. For example, for a five-year 

designation (1/1/20-12/31/24) the halfway date for the internal audit submission would be 6/1/22. The 

internal audit begins when planning activities start and the team is assigned. The internal audit is 

complete when any root cause analysis and corrective action plan are submitted and cleared by the 

QACD liaison. As such, we realize correcting a noted issue found in the audit may take additional 

time past the halfway date deadline.

FGIS FOs must conduct an internal audit every other fiscal year (FY). The end of the FY date (Sep 

30) is when the internal audit will be turned into QACD. QACD will work with the Field Management 

Division and FOs to determine a suitable audit schedule. The cycle begins when planning activities 

begin, and the team is assigned. The internal audit is complete when any root cause analysis and 

corrective action plan are submitted and cleared by the QACD liaison in consultation with FGIS 

division management, as appropriate. 

Note: QACD recommends conducting the audit in smaller portions during the internal audit 

period. This may help balance workload and resources.

a. The OSP may schedule and scope the internal audit as appropriate. However, a representative 

sample of the USGSA and/or AMA, regulations and the instructions must be reviewed at each 

location during the required frequency for the full internal audit cycle to be considered complete.

For OAs, this will focus on the designation and/or delegation criteria under the USGSA and 

applicable requirements under the AMA as well as FGIS instructions. For FOs this will focus on 

the USGSA, AMA, regulations, instructions, and federal administrative requirements. 

6. ROLES AND RESPONSIBILITIES

a. QACD Responsibilities. 

(1) Provide guidance and assist OSP during the internal audit process, as needed.

(2) Review OSP internal audit checklists and assist in creation of value-added scope 

determination, confirming compliance with process requirements.

(3) Track the scheduling and completion of the OSP internal audit.

Note: The internal audit requirement for the OSP does not rely on the 

communication of the liaison, it is up to the OSP to schedule their internal audit and 

provide the information to their liaison. 

(4) Review audit results and file in the appropriate OSP folder. 

Note: For internal audits to be effective, OSPs must be thorough and transparent 

with their findings. QACD will work with the OSP to address corrective actions 

appropriately. This should be a collaborative and educational review.

(5) Advise OSPs on their IAP, root cause analysis, and corrective action planning.
 

FGIS Directive 9180.89 January 1, 2024 

Page 4 

(6) Review OSP root cause analysis and corrective action plans for thoroughness and 

accuracy.

(7) Confirm closure actions on identified findings by reviewing supporting materials.

(8) Review and assess all repeat findings. 

b. OSP Responsibilities. 

(1) OSPs are responsible for conducting an internal audit in alignment with the requirements 

of this directive during each internal audit cycle. 

(2) Build their internal audit checklist, ensuring a representative sample of the USGSA and/or 

AMA, regulations, and the instructions are reviewed across all locations, as applicable. For 

OAs, this will focus on the designation and/or delegation criteria under the USGSA and 

applicable requirements under the AMA. For FOs this will focus on the USGSA, AMA, 

regulations, instructions, and federal administrative requirements. 

Note: This requirement does not apply if the OSP decides to use the QACD 

provided checklist.

Note: If selecting a subset from each required criteria category, the OSP must 

rotate the audit items each internal audit cycle to ensure full coverage of 

requirements is achieved over a multi-year period. This helps ensure the OSP does 

not focus on the same line items for each internal audit and neglect to review other 

subset requirements.

c. OSP Management. 

Management plays a key role in ensuring employees understand the importance of the internal 

audit, overseeing its completion, and following up on all corrective actions. OSP management 

shall:

(1) At minimum, appoint one primary auditor (Lead Auditor) and provide training for the Lead

Auditor and any supporting team of auditors to oversee the audit and ensure compliance 

with the process requirements.

(2) When submitting the internal audit to QACD, complete the Verification of Statements, 

Records, and Training document and include it with their submission. 

d. OSP Auditor/s. 

(1) Whenever possible, the OSP should assign an internal unbiased party to conduct the 

audit of specific areas of work. 

 Note: This could be an internal quality manager or a person who manages a 

 Different function for the OSP. 

(a) Management will appoint one primary auditor (Lead Auditor) supported by a team of 

auditors to conduct the internal audit.
 

FGIS Directive 9180.89 January 1, 2024 

Page 5 

(2) All auditors must receive training on this directive, the IAP process requirements, USGSA 

and/or AMA requirements, to include the regulations and instructions, and auditing.

(3) Individuals will avoid auditing their own individual tasks and/or programs whenever 

possible. 

Note: In the event that it is a small audit team and there is no other option, the OSP 

may work with QACD to identify the challenge and receive guidance. As long as the 

person who conducts the initial work is not auditing their own work and the auditor 

is trained, the OSP should be compliant.

e. Training. 

(1) For auditors supporting minor review functions, FGIS recommends basic auditing training. 

For those leading internal audits, FGIS recommends a Lead Auditor training and/or the 

Compliance and Auditing for OSPs course, offered and provided by QACD when 

available.

(a) FGIS recommends auditor training every 3 years to ensure proficiency.

(2) Auditor training records must be maintained for the tenure of the employee in the 

employee’s personnel file. 

7. INTERNAL AUDIT PROCESS OVERVIEW

This section includes the minimum framework the OSP must include within their internal audits. The 

OSP is encouraged to further define and tailor this to suit the needs of the organization.

a. Select your internal audit team. 

(1) Assign audit lead and unbiased team members for criterion review.

(2) Ensure all assigned team members receive the required training.

b. Designing and planning your audit (scope of your internal audit). 

(1) Select a representative sample of the USGSA and/or AMA, regulations, and instructions. 

For OAs, this will focus in on the designation and/or delegation criteria under the USGSA 

and applicable requirements under the AMA. For FOs this will focus on the USGSA, AMA, 

regulations, instructions, and federal administrative requirements. 

(2) If both designated and delegated, then both must be included in the internal audit.

(3) If the OSP has multiple locations, each location must be reviewed for all associated 

requirements that are included in their operations.

(4) Build your checklist/s, including the selected representative samples, or use the checklists 

that QACD provides if you choose.

 
 

FGIS Directive 9180.89 January 1, 2024 

Page 6 

Note: Due to the nature of different locations having different scope of operations, 

different checklist or edited checklists may be used at different locations.

Note: After the audit, completed checklists must be retained in compliance with

records retention requirements.

(5) Share the checklist with your assigned QACD compliance officer/OSP liaison (if 

applicable). 

c. Scheduling your audit. 

(1) Once the audit scope and checklist are shared with your liaison and approved, coordinate 

with your team to determine the best audit schedule.

Note: QACD recommends conducting the audit in smaller portions during the 

internal audit period. This may help balance workload and resources.

(2) Conduct a preliminary review to get management’s approval of the proposed schedule.

 

(3) Notify internal offices of the proposed schedule to resolve any potential conflicts.

d. Gathering your supporting materials. 

(1) Once the scope and checklists have been approved by leadership, begin internal 

meetings to determine which supporting materials or activities are necessary to confirm 

compliance with each of the requirements.

Note: For routine tasks, supporting materials must be pulled from the date of the 

last internal audit to the date of the current internal audit. For some tasks, this will 

only include a subset of the available material, since the full scope of the work

records would be too large to review.

 

Note: QACD recommends a variety of the work records (random selections 

preferred) for each associated category for review during the internal audit with an 

established not to exceed number (e.g., 100). If the OSP wishes a different 

approach, they must work with their liaison to receive approval of their proposed 

methodology.

(2) Issue requests for materials, include deadline that will allow your team ample time to 

review and prepare for the onsite audit.

(3) Assign collection to the auditors leading the internal audit for each designation and/or 

delegation criteria and each of the associated requirements that are included in the audit 

scope.

e. Review your supporting materials. 
 

FGIS Directive 9180.89 January 1, 2024 

Page 7 

(1) Utilize these to either confirm compliance, where possible, or to research the area you 

plan to audit. If conducting preliminary research, build a list of any additional questions 

you may have based on the document review.

f. Planning your onsite review.

(1) Once the associated document review is complete and/or for all areas that can only be 

reviewed onsite, coordinate the onsite review for all associated locations.

(2) Ensure the audit team has training on all safety risks that they may encounter at the 

location and has all required personnel protective equipment to ensure a safe audit

environment. 

(3) Ensure all checklists, requirements documents, and/or other supporting materials are 

accessible during the audit at all times.

g. Conducting your audit. 

(1) It is important to record which areas were reviewed and found to be in compliance during 

the audit and for which timespan supporting documents were reviewed. 

 

(2) Finding classifications listed in your audit results must be in accordance with those found 

within the definitions section of this directive. See below.

h. Finding Classifications. 

(1) The following are acceptable finding classifications:

 

(a) Compliance (C) – The OSP was effectively meeting requirements of this section 

during the audit. No additional action is required. 

(b) Opportunity for Improvement (OFI) – Assessment(s) identified during the audit 

where improvements can be made to increase overall effectiveness, reduce risk 

and/or improve quality.

(c) Observation (OBS) – Assessment(s) identified during the audit which could lead to 

potential NCs if not addressed. Observations do not require a formal corrective action 

plan.

(d) Non-compliance (NC) – The audit revealed that the performance or supporting 

materials was not in compliance with requirements.

(2) Your records must include the documents or supporting material that was used to 

determine the finding outcome. 

(3) Finding write-ups must include the appropriate level of detail to help the team determine 

root cause during the follow-up phase of the audit.

(4) All results and associated information listed above must be retained in compliance with 

record retention requirements.
 

FGIS Directive 9180.89 January 1, 2024 

Page 8 

i. Post audit process and responding to NC findings (when applicable).

(1) The OSP must respond to all NCs with a root cause analysis, corrective action plan, and 

when applicable, preventive action plan to bring the area into compliance.

(2) Identify your Root Cause Analysis (RCA). This should be addressed with a corresponding 

corrective action.

 Note: RCA is the initiating issue that caused an NC to occur.

 

(3) Select your RCA method. There are many forms of RCA available for the OSP to use. 

Which form the OSP selects is up to the OSP, as long as it yields the true root cause and 

associated corrective actions are tied into the root cause determination.

Note: For example, the “Modified 5 Whys” method is the simplest method for 

personnel who don’t commonly conduct RCA. The “Fishbone” method is also 

another simple method that is commonly used.

 

(4) Identify your corrective and preventive action. Through RCA, the team will address not 

only how to correct the NC (corrective action) but how to prevent it or a similar issue from 

happening again (preventive action) when applicable. These both can become part of 

your Corrective Action Plan (CAP). At a minimum, a corrective action is required for a NC. 

Preventive actions will depend on the situational outcome. 

(5) Once the team has conducted RCA and worked with leadership to confirm consensus, 

they may begin building the CAP.

Note: The CAP will be comprised of specific actions designed to correct and 

prevent the NC from happening again. During the RCA and CAP processes, the 

audit team, leadership, and the people who will be responsible for implementing the

correction should agree on the root cause and associated corrective actions. 

Preventive actions, which may expand beyond the scope of issues identified as 

root cause, may also be included in the process as the team examines proactive 

risk identification and reduction.

(6) Once the team agrees upon the RCA and CAP, they must implement the corrections and 

review their success. 

(7) The CAP must be sent to the QACD liaison for review and approval. 

Note: In the event the liaison has concerns that the root cause or corrective actions

will not address the finding, they will work with the OSP to advise them.

(8) Conduct a follow up on all CAPs to ensure compliance. It’s critical for the audit team and 

management to follow up to ensure all CAPs are fully implemented and that the NC no 

longer exists.
 

FGIS Directive 9180.89 January 1, 2024 

Page 9 

(9) Closure of findings. For findings to be closed, the OSP must send the supporting 

materials to their QACD liaison, who will then issue written confirmation once approved.

Note: To ensure this process runs smoothly, the OSP must document and provide 

supporting materials to the QACD liaison. Documenting and providing proof of 

actions taken are required. Hard copy proof (examples include, training attendance 

sheet, training slides, documented process, etc.)

(10) All NCs from the prior internal audit must be reviewed as part of the next internal audit. If

there is a repeat finding, it must be specifically highlighted to your QACD liaison. This will 

be a major indicator to the team that either the RCA, CAP, or implementation control were 

unsuccessful.

8. ADDITIONAL INFORMATION 

(1) Resources and additional information may be found at the FGIS IAP website. 

(2) Contact information: FGIS Quality Assurance and Compliance Division; 

FGISQACD@usda.gov.