Audit of allergen controls and relevant open audit actions

Foreword

The Food Standards Agency (FSA) is the Competent Authority (CA) responsible for feed and food safety and standards legislation and for ensuring risk-based official controls are carried out at feed and food business establishments in Wales, England, and Northern Ireland. 

Feed and food official controls aimed at verifying food business compliance are fundamental to safeguarding public health and contribute to the FSA’s strategic outcome that ‘food is safe and what it says it is’. 

Day-to-day monitoring and enforcement of feed and food business compliance is the responsibility of local authorities (LAs). 

In Wales, the power to set standards and monitor LA feed and food law enforcement services was conferred on the FSA under Section 12 of the Food Standards Act 1999 and Regulation 7 of the Official Feed and Food Controls (Wales) Regulations 2009.  The FSA is required to monitor and audit local authority feed and food law enforcement services under this legislation and the assimilated Official Controls Regulation (EU) 2017/625. In developing its audit arrangements, the FSA has taken account of the European Commission guidance on how such audits should be conducted.  

In addition to assessing the delivery of official controls against legal requirements and statutory guidance, the audit process also provides the opportunity to identify and disseminate good practice and to provide information to inform FSA policy on the execution and enforcement of feed and food law.

FSA audit programmes assess local authorities’ conformance against the requirements of the assimilated Official Controls Regulation (EU) 2017/625 and the Feed and Food Law Enforcement Standard within the Framework Agreement on Official Feed and Food Controls by Local Authorities (Framework Agreement). Assessments were also made against the Food Law Code of Practice (Wales) 2021 (FLCoP) along with related centrally issued guidance including the Food Law Practice Guidance (Wales) 2021 (FLPG).  A new Code of Practice and Practice Guidance has been published and will be applied to ongoing recommendations where applicable.

This report is available in hard copy from the FSA’s Regulatory Audit and Assurance Team, Asiantaeth Safonau Bwyd yng Nghymru / Food Standards Agency in Wales, Llawr 4 / 4th Floor, Adeilad Llywodraeth Cymru / Welsh Government Building, Parc Cathays Park, Caerdydd / Cardiff, CF10 3NQ, and electronically on the FSA’s website.

Table of Contents

1.0 Introduction
Background
Scope of Audit Programme

2.0 Executive Summary

3.0 Audit Methodology

4.0 Audit Findings
Organisation and Management
Authorised Officers
Food Premises Inspections, Records & Reports
Food Inspection and Sampling
Food and Food Premises Complaints
Enforcement 
Internal Monitoring
Relevant Open Audit Actions

Annex A - Audit plan

Annex B - Allergen controls action plan

1.0 Introduction

Background

1.1    Audits of LA feed and food law enforcement services are part of the FSA arrangements to improve consumer protection and confidence in relation to feed and food. Implementing official controls in food businesses at appropriate frequencies based on risk is essential to protect public health and ensure the safety of food for consumers.

1.2    Following the Covid pandemic, from 1 April 2023, LAs should be planning to:    
 

• Carry out due interventions for establishments that are back in the routine programme of interventions in accordance with the frequencies set out in the FLCoP. 
•  Work towards realigning with the provisions set out in the FLCoP from 1 April 2023, using the full range of flexibilities already offered by the FLCoP. These flexibilities including exemptions can be found in Chapter 4 of the FLCoP and Chapter 4 of the FLPG. 
•  Continue to exercise a risk-based approach to the requirements set out in the FLCoP based on available resource.  

 
1.3    A key part of the FSA’s remit in its role as a CA is to provide assurance for stakeholders and the public that food authorities, such as LAs, are correctly delivering and implementing any legislation, advice and guidance issued in relation to the services they provide. This audit programme, in tandem with the bi-annual performance surveys, provides a key element of the FSA’s overall assurance framework. 

1.4    In Wales, the power to set standards and monitor LA feed and food law enforcement services was conferred on the FSA under section 12 of the Food Standards Act 1999 and regulation 7 of the Official Feed and Food Controls (Wales) Regulations 2009. 
 
1.5    The Framework Agreement on Local Authority Food Law Enforcement sets out the arrangements through which the FSA monitors and audits LA enforcement activities to help ensure that LAs are providing an effective service to protect public health.

Scope of Audit Programme

1.6    This programme consists of a series of audits across Wales to assess compliance with legislation relating to the provision of allergen information to consumers and the risk posed to hypersensitive consumers, as well as reviewing any relevant open audit actions following previous audits. The audits assess whether LAs are undertaking interventions involving allergen assessments based on a programme of interventions that is in accordance with the FLCoP.  

1.7    The audit assessment considered:   

• Food standards service planning, delivery and review,
• Resources available to the service and the risk-based prioritisation of activities, including the assessment of new food businesses.
• Authorisation and competence of officers  
• Interventions (programmed and reactive) and Enforcement 
• Sampling Policy, procedures and programme  
• Internal monitoring 
• Any other matters relating to allergen controls 
• Open audit actions – review of any relevant open actions from previous audits and associated update of the LA audit action plan.  

1.10     As part of the development of the audit programme the FSA engaged with relevant stakeholders and produced an audit plan.  This is attached in Annex A.

2.0 Executive Summary

2.1    The audit examined Ceredigion County Council’s arrangements for the delivery of allergen related official food controls, a major part of the authority’s food standards function. This included a reality check at a food establishment to assess the effectiveness of official controls and more specifically, the checks carried out by the authority’s officers, to verify food business operator (FBO) compliance with legislative requirements.  The scope of the audit also included an assessment of the authority’s overall organisation and management, and the internal monitoring of food standards activities. 

2.2    The Corporate Lead Officer Policy, Performance & Public Protection had overall responsibility for the delivery of food standards services within the Public Protection Department.  Day to day management was the responsibility of the Trading Standards & Licensing Manager.
    
2.3    The authority had service planning arrangements in place together with systems for reviewing performance.  Service planning documents contained most, but not all of the information set out in the Service Planning Guidance, including the commitment to deliver Council’s full obligations, the requirement to review all elements of the previous year’s work and address all delivery shortfalls in the next plan. 

2.4    Arrangements were in place to ensure effective service delivery by appropriately authorised, competent officers who had mostly been authorised in accordance with their qualifications, training and experience. The authority needs to ensure all officers receive enough training and development and that records are fully maintained; including those for contractors. 

2.5    Database checks confirmed that whilst high risk interventions were being undertaken, a small number of medium and low risk establishments were overdue a food standards intervention and a significant number of unrated premises had yet to receive an intervention.  There was a plan in place to address the backlog and the authority were on track to fully re-align its intervention frequencies with the FLCoP during 2026/27. 

2.6    Intervention records showed that assessments of business allergen control compliance during food standards interventions were generally of good quality. Insufficient information was available in some cases to demonstrate that a thorough assessment had been undertaken by contractors.  Risk rating was generally correct but occasionally, there was a need to more accurately reflect business activities.  Follow up action was mostly correct but occasionally, revisits to check compliance had not been undertaken as required.  Where unsafe food was found on the market, the correct enforcement action was taken to remove it and prevent a recurrence, with some examples of good practice identified.

2.7    In general, food standards intervention reports were mostly comprehensive, however, the authority would benefit from ensuring this was consistently the case and all required information was provided.   

2.8    Food and food establishment complaints and food standards sampling had generally been undertaken as required.  There was evidence that appropriate follow up action was undertaken to remove unsafe food from the market and enforcement action taken to prevent a recurrence, with some examples of good practice identified.   

2.9    The authority had used a wide range of enforcement tools to secure improved business compliance with allergen control legislation. Where enforcement action had been taken it was generally appropriate and effective to remove unsafe food from the market and prevent a recurrence, with some examples of good practice identified.  However, some evidence of delays in checking compliance were also found.

2.10    There was evidence of some internal monitoring of food standards matters, including allergen controls.  The internal monitoring activity would benefit from improvement to ensure coverage of all official control activities, more use of bulk database checks and better recording.

3.0 Audit Methodology

3.1    The LA received a pre-audit letter including a pre-visit questionnaire along with details of documents required to assess completion of previously outstanding recommendations.  

3.2    The LA was also provided with a copy of any relevant audit reports /action plans and asked to provide evidence of their progress on outstanding actions. 

3.3    This was followed by a structured on-site audit involving a reality visit to a local business and meetings with the Head of Service, LA lead officer and other relevant staff about current and future service delivery arrangements as well as an examination of a selection of food official controls records.  

3.4    The audit took place from the 13th – 15th January 2026.  The on-site element of the audit took 2½ working days. 
 
3.5    The LA received this written audit report and an updated audit action plan, which will be published on the FSA website.  

4.0 Audit Findings

4.1 Organisation and Management

4.1.1    Food law enforcement was overseen by the Corporate Lead Officer Policy, Performance & Public Protection.  The authority’s Constitution set out its decision-making arrangements.  Under the Constitution, decisions on food-related operational matters had been delegated to the Corporate Lead officer.  

4.1.2    A ‘Food and Feed Service Plan 2025-26’ (‘the Service Plan’) had been developed by the authority.  Evidence of the approval of the Service Plan had been provided.  

4.1.3    The Service Plan contained most of the information set out in the Service Planning Guidance, including a profile of the authority, the scope of the service and organisational structure chart for the Public Protection department.  The times of operation, service delivery points and aims and objectives of the service were clearly set out, although it would benefit from recognising the burden of the necessary out of hours work.

4.1.4    The service plan indicated that there were 1114 food establishments in Ceredigion.    The profile of businesses was provided by establishment type.  The number of planned interventions due, by risk rating, had also been provided including those that were overdue.

4.1.5    The targets and priorities for food standards included a commitment to deliver all inspections / interventions due at high-risk and unrated establishments as required by the FLCoP but there was no commitment for the delivery of all medium and low risk establishments in accordance with the law and the FLCoP.  

4.1.6    The expected number of revisits during the year, forms a required part of the intervention programme and an estimate of a small number of revisits was included in the intervention programme table.  There was a commitment to revisit establishments for food standards in accordance with the requirements of the law and the FLCoP.  

4.1.7    The authority’s priorities and intervention-targets as set out in the Service Plan, based primarily on delivering interventions in high-risk and unrated establishments was not fully risk based.  

4.1.8    The plan included an estimate of the likely demand for the food interventions programme, including the likely demand, based on previous years, for the reactive work required to be undertaken.  This would benefit from additional breakdown to include the demand created by the need to engage with home or originating authorities and the handling of food incidents.

4.1.9     Information was provided on the food standards sampling programme and included the resources allocated to undertake this work.  This included reference to risk-based sampling undertaken during inspections. 

4.1.10    The resources available to deliver food law enforcement services were detailed in the Service Plan as 578 working days for both food hygiene and food standards.  A figure of 779 working days was estimated as being required to deliver the service, indicating the need for an additional 201 working days on top of the current resources to fully deliver against requirements.  This additional resource was already available to a salary underspend created by existing job vacancies.

4.1.11    The Service Plan included information on the authority’s Enforcement Policy and its approach to staff development.  

4.1.12    Arrangements for internal monitoring or ‘quality assessment’ of the food standards service through quantitative reporting arrangements was referenced within the plan along with a brief description of the qualitative internal monitoring arrangements for the service.
    
4.1.13    The Service Plan was supplemented by a separate Business Plan.  Together, they contained information following a review of delivering food official controls against the previous year’s plan.  However, it was noted that whilst the review covered most areas of work, it did not cover all targets.  The review should include unrated establishments, low risk establishments, the number of samples taken against the food standards sampling programme and the amount of reactive cases responded to within target times.

4.1.14    Following the review, variances in achieving the targets set out in the previous Service Plan had not been identified in relation to the backlog of medium-risk (category B) interventions and unrated businesses and so, no explanations were given for these variances.

4.1.15    The authority had incorporated a number of areas for improvement in its Service Plan, however, this did not include addressing the variances in Category B and unrated establishment interventions in order to ensure re-alignment with the requirements of the law and the FLCoP.

Recommendations

4.1.16    The authority should:

• (i) Ensure future Service Plans for food standards are developed in accordance with the Service Planning Guidance.  In particular, a commitment and plan to deliver all due and overdue interventions, based on the requirements of the FLCoP, should all be provided.
• (ii) Ensure the annual performance review includes all information on the previous year’s performance against the food service plan and any specified performance targets, standards and outcomes. 
• (iii) Ensure all variances in meeting the food service plan are addressed in its subsequent plan.

[Articles 5(1)(a) & (e) of assimilated Regulation (EU) 2017/625; FLCoP 2.3.3, FLPG 2.3.18.2, 2.3.18.3 & Annex 1]

4.2 Authorised Officers

4.2.1    The authority’s Scheme of Delegation of Powers to Officers, contained within its written Constitution, provided the Corporate Lead Officer Policy, Performance & Public Protection with delegated powers to execute all duties relating to food services.  This includes the delegated authority to authorise other officers and the power to instruct the legal department with regard to instigating prosecutions.  

4.2.2    A documented procedure had been developed for the authorisation of food standards officers based on their qualifications and experience and this was in accordance with relevant requirements.  

4.2.3    The authority had appointed a suitably qualified and competent lead officer for food standards in accordance with the requirements of the FLCoP.  

4.2.4    The authority had identified, within its Service Plan, that the level of resources required to deliver food services was slightly higher than those available at the time; a deficit of 201 working days across both food hygiene and food standards.  Further, the dependence on a sole officer who is qualified to undertake interventions in food establishments with formal quality assurance systems posed a risk to the resilience of the service.  However, there was a plan in place to address the shortage in officer resources, by using external contractors and this was enabled by the existing salary underspend.  Auditors were advised that the authority’s plan to address the backlog of interventions is on track to be completed by the end of 2026/2027.  

4.2.5    Provision of officer training was dependent on a formal training needs assessment, although, until recently, this had not included the lead officer for food standards.  The authority was providing a combination of in-house and externally provided training and making good use of the opportunities afforded by the FSA’s local authority training opportunities.  All officers were required to achieve 10 hours of continual professional development (CPD) on core food matters in accordance with the FLCoP.  

4.2.6    An examination of the qualification and training records of six officers involved in the delivery of official food standards controls was undertaken. Records were being maintained by the authority for officers in the Council’s computer file & folder system.

4.2.7    Four officers had been authorised in accordance with evidence of their qualifications, training and experience.  Authorisations had been signed by an officer with the delegated authority and included all the key legislation required for the delivery of the range of official controls required for allergens.  

4.2.8    Academic and other relevant qualifications were available for all officers, and all but two contractors had received the minimum 10 hours of CPD on core food matters required by the FLCoP and the authority’s own policies, in keeping with their duties.  It was noted that the training records of three officers were incomplete, including two contractors.

Recommendations

4.2.9    The authority should

• (i) Ensure that all officers undertake the minimum amount of continual professional development in accordance with the FLCoP and that it is appropriately documented.
  [Articles 5(1)(e) & 5(4) of assimilated Regulation (EU) 2017/625; para 3.3 FLCoP]

4.3 Food Premises Inspections, Records and Reports

4.3.1     The authority provided information in its service plan which confirmed there were 1114 rated food businesses on the authority’s food standards establishment database at the start of the year.  Immediately prior to the audit, the number of premises overdue an inspection were 24, including 4 high risk (cat A), 15 medium risk (cat B), 5 low risk (cat C) and 145 unrated establishments.  Whilst the high-risk premises have since been inspected, the remaining backlog are expected to be fully addressed during next year’s work programme using existing resources.  

4.3.2    Food standards intervention procedures had been developed and were in accordance with requirements. Food standards interventions were largely being undertaken in conjunction with food hygiene interventions. A joint aide-memoire had been developed for undertaking interventions which was primarily used by officers, however, contractors were using an older food standards proforma which did not capture the full detail required by the FLCoP.

4.3.3    Five food standards interventions carried out in the two years prior to the audit were examined.  It was noted that all files contained relevant food registration details, and all observations were legible and retrievable, in all cases. Only one business had received an intervention at the correct frequency.

4.3.4    Auditors were able to establish that, in all cases, the visits had been unannounced and the nature and extent of food activities had been documented. However, the correct aide memoire had only been used in three out of five cases. In the remaining two cases auditors were unable to determine whether there had been an assessment of any food standards management system or whether discussions with any staff having key allergen management / control responsibilities had taken place. 

4.3.5     Auditors were able to establish that assessment of incoming traceability requirements in relation to allergens including details of suppliers, other businesses that produce or import for the business and ingredient specifications, were available in three out of five cases. 

4.3.6    Compliance with composition and presentation requirements had been thoroughly assessed in three out of five cases. Whilst compliance with allergen labelling requirements had been assessed in four out of five files. Information available on the remaining file appeared to reference incorrect legislative requirement in relation to allergen labelling.

4.3.7    Auditors were able to determine that, as part of outgoing traceability, assessment of customer information product recall / withdrawal arrangements had been examined in three out of five cases.

4.3.8    Auditors were able to determine that risk ratings were consistent in all but one case. In the one case, the scoring relating to business activities did not align with the descriptors in the code of practice. The premises was rated as low risk and as such had not received an intervention for 11 years. This premises, however, poses a far higher risk than is currently being captured.

4.3.9    Information on whether any samples were taken or considered during the intervention was only available in one of the five files.

4.3.10      Auditors were able to determine that reports were sent to correct business address in a prompt manner to Food Business Operator / left on site in all cases. 

4.3.11    In all cases auditors were able to determine that the reports did not contain whether samples had been taken and the timescales for rectifying food standards non compliances. In another two cases, details of the documents examined during the intervention were not detailed as a summary sheet had been used.

4.3.12    In three out of five cases, auditors were able to determine that appropriate follow-up action had been taken in light of inspection findings. Revisits were not undertaken in one case where it was deemed necessary and there was insufficient information captured about the remaining case. 

4.3.13    Considerations as to the removal of unsafe food from sale were adequately explored or recorded where concerns were raised in relation to composition, labelling and allergen control requirements in three out of five cases. These actions included recall, withdrawal and enforcement action.

Best practice

The authority demonstrated that allergen control measures were fully applied to remove unsafe food from sale to protect consumers in a timely manner.

4.3.14    Inspection details on computer database and file were up to date, accurate & consistent.

Recommendations

4.3.15    The authority should: 

• (i) Ensure that food standards interventions/inspections are carried out at the minimum frequency specified by the FLCoP and that revisits are undertaken as required. [Articles 9(1) & (2) of assimilated Regulation (EU) 2017/625; FLCoP 4.2, 4.2.2, 4.2.4, 4.2.5 & 6.4.1]
• (ii) Ensure premises are rated correctly in relation to allergen matters.  [Articles 5(1)(a) & (b), 9(1), 12, 13 & 14 of assimilated Regulation (EU) 2017/625; FLCoP 4.2.2, 4.2.6, Annex 1]
• (iii) Ensure that observations made and/or data obtained in the course of a food standards intervention/inspection is captured on the correct aide memoire and that it includes complete information on:

• •    assessments of food standards management systems, including all control measures in place for allergens, 
  •    assessments of labelling, composition and presentation 
  •    incoming traceability requirements in relation to allergens including details of suppliers, other businesses that produce or import for the business and ingredient specifications
  •    product recall / withdrawal arrangements
  •    the consideration of whether to take samples/ what samples taken.
  [Articles 5(1)(a) & (b), 9(1), 12, 13 & 14 of assimilated Regulation (EU) 2017/625; FLCoP  4.3.3.1, 4.4, 4.6; FLPG 4.3.4.2, 4.3.4.3, 4.6]

• (iv) Ensure that intervention report letters/ post inspection forms contain all of the required information.
  [Articles 5(1)(f) & 13 of assimilated Regulation (EU) 2017/625; FLCoP 2.6, 2.6.3, 4.6; FLPG 4.3.4.3, 4.6]

Verification Visit to Food Establishment

4.3.16    A verification visit was undertaken at a food establishment with the authorised officer of the authority who had carried out the most recent food standards inspection. The main objective of the visit was to consider the effectiveness of the authority’s assessment of the systems within the business for ensuring that food meets the requirements of food standards law in relation to allergen controls.

4.3.17    The officer was able to demonstrate their knowledge of the business and provide auditors with an assurance that assessments of allergen controls had taken place as part of the inspection.

4.4 Food Inspection and Sampling

4.4.1    The authority’s Service Plan contained information on the food standards sampling plan indicating participation in projects or surveys and included allergens and targeted local producers and takeaways.  

4.4.2    The procedure for taking food samples outlined how to take samples as well as steps to take following receipt of results. The procedure would benefit from detailing the procedure for taking samples out of hours.

4.4.3    The authority had appointed a Public Analyst for carrying out analyses of food. The laboratory was on the recognised list of UK designated Official Laboratories. 

4.4.4    Five food standards samples carried out in the two years prior to the audit were examined. All samples had been taken by appropriately trained and authorised officers and sample results were available on file. Auditors were able to confirm that, all food business operators had been informed of the results and where appropriate, the Primary Authority had also been notified.  Appropriate follow up action had been taken in all cases.

Best practice

The authority demonstrated that a full range of enforcement tools were used for dealing with unsafe food. Following unsatisfactory sampling results, a Remedial Action Notice was appropriately served to prevent the risk of harm to consumers.

Recommendations

4.4.5    The authority should

• (i) Include in the sampling procedure for taking food samples the arrangements for samples taken out of office hours.  [Articles 9(1), 14, 137 & 138 of assimilated Regulation (EU) 2017/625; FLCoP 2.3.1, 4.2, 4.3, 4.3.3.1 & 4.4]

4.5 Food and Food Premises Complaints

4.5.1     The authority had developed a procedure for undertaking food and food premises related complaints which outlined the criteria for investigations which was in accordance with the requirements. 

4.5.2    An examination of records relating to five complaints or service requests received by the authority were undertaken. Auditors were able to confirm that complaints had been investigated within a timely manner in all cases.

4.5.3    In all cases, auditors were able to determine that the cases had been appropriately investigated and where appropriate complainants had been notified of the results of the investigation. Appropriate follow up action had been taken where appropriate.

4.5.4    Auditors were able to determine that, where appropriate, the authority had liaised with Primary Authority/ Home Authorities and the Food Standards Agency Incident.

4.6 Enforcement

4.6.1    The authority had developed a Corporate Enforcement Policy which had been approved by the Cabinet.  The Policy advocated a graduated approach to enforcement and was generally in accordance with Food Law Code of Practice and other official guidance.  The Policy provided criteria for the taking of all enforcement actions, referred to the Primary Authority scheme and included information to direct action in establishments where the Council itself has an interest, such as schools, care homes, and leisure centres.  

4.6.2    The food safety and standards department has specific enforcement procedures relating to improvement notices, prohibition notices, seizure and detention, certification of food, voluntary surrender and voluntary closures. All aligned with the code.
  
4.6.3    Two Food Information Regulation Improvement Notices {FIRIN) had been served within the scope of the audit and the files relating to these notices were reviewed. The notices were fully compliant with requirements. The notices had been served by appropriately approved officers and were the correct course of action. Proof of service was available for both. Unfortunately revisits to check compliance had not been undertaken in a timely manner. However, auditors did note that further enforcement action had been undertaken in both premises therefore demonstrating a graduated enforcement approach to deal with unsafe food.

 4.6.4    One Voluntary Closure case was reviewed. The closure had been undertaken by an appropriately authorised officer and was found to be the correct course of action. The Voluntary closure was documented correctly and signed by the relevant persons. Proof of withdrawal of the voluntary closure was also documented as required.
 
4.6.5    No detention, seizure, certification or voluntary surrenders relating to allergens had been undertaken within the scope of the audit and were therefore not assessed. 
   
4.6.6    The authority had provided documented procedures for the commencement of prosecutions and undertaking simple cautions.  A separate procedure was available for compliance with Police and Criminal Evidence Act 1984 considerations which was also satisfactory.  These considered most aspects of this work but would benefit from further development to document considerations with regard to the appointment of criminal procedures and investigation roles and responsibilities.

4.6.7    Auditors reviewed one case file relating to allergen controls that had been escalated for a decision by the Prosecuting Officer within the scope of this audit.  That case resulted in a decision to proceed with prosecution, which was appropriate and was in accordance with the Enforcement Policy and the Code for Crown Prosecutors.

Recommendations

4.6.8 The authority should:
 

• (i) Review and amend its enforcement procedures for prosecution files in order to document considerations with regard to the appointment of criminal procedures and investigation roles and responsibilities.
  [Articles 5(1 (a) & (b), 12, 13, 137 & 138 of assimilated Regulation (EU) 2017/625, FLCoP 2.3, 2.3.1 & FLPG 2.3.10] 
• (ii) Ensure that timely compliance checks are undertaken on notices served to ensure non-compliance is remedied.  This should include following relevant enforcement procedures relating to escalation of enforcement action and ensuring there is no undue delay in progression that may jeopardise future potential cases.  [Articles 5(1 (a) & 138 of assimilated Regulation (EU) 2017/625; FLCoP 6.4.1 & 6.4.2 FLPG 6.4.10]

4.7 Internal Monitoring

4.7.1    Internal monitoring is important to ensure performance targets are met, services are being delivered in accordance with legislative requirements, centrally issued guidance and the authority’s procedures. It also ensures consistency in service delivery. 
  
4.7.2    Key performance targets have been identified in line with the FLCoP and the authority has arrangements in place for both quarterly and annual quantitative internal monitoring across the food services.  Performance was reported through the corporate performance monitoring system.  
 
4.7.3    A documented internal monitoring procedure had been developed for the food standards service including officer responsibilities, accompanied visits and a sample of file checks relating to interventions, adverse sample follow ups and reactive work including service requests / complaints.  The procedure detailed sample sizes and frequencies but would benefit from expansion to include the periodic review of officer authorisations and bulk database checks.  

4.7.4    The team managers and senior officers were responsible for internal monitoring of the food enforcement services at an operational level.

4.7.5    Auditors were able to verify that some qualitative internal monitoring had been undertaken across the service including record checks.  

4.7.6    Where internal monitoring had taken place, evidence was available in the form of records, for the nature and extent of that monitoring, covering the matters that required feedback to officers.  However, the system would benefit from ensuring records are maintained for all activities specified within the procedure, including sample follow ups and service request investigations as well as those interventions delivered by contractors.  

4.7.7    The records relating to internal monitoring that were available, were being maintained by managers for at least two years.

Recommendations

4.7.8 The authority should:
 

• (i) Revise its documented internal monitoring procedures to ensure all relevant activities are subject to proportionate monitoring. This should include the periodic review of officer authorisations and bulk database checks.

  (ii) The internal monitoring taking place in practice should include records for sample follow ups and service request investigations as well as those interventions delivered by contractors.
  [Articles 5(1)(a), 5(1)(b) & 12 of assimilated Regulation (EU) 2017/625, FLCoP 2.3.1 & FLPG 2.3.2]

4.8 Relevant open audit actions

4.8.1    Relevant open audit actions from previous audit programmes were followed up.  This includes those from the full audit programme of 2013 - 2017 and the Food Hygiene Rating Scheme focussed audit of 2017.  

4.8.2    An updated action plan has been published on the FSA website.

Auditors:

Craig Sewell
Angela Phillips

Division:

Regulatory Audit and Assurance Team, 
Asiantaeth Safonau Bwyd yng Nghymru / Food Standards Agency in Wales, 
Llawr 4 / 4th Floor, 
Adeilad Llywodraeth Cymru / Welsh Government Building, 
Parc Cathays Park, 
Caerdydd / Cardiff, 
CF10 3NQ

Annex A: Audit Plan

Sarah Maddox
Head of Regulatory Audit and Assurance, FSA in Wales 
Email: Sarah.Maddox@food.gov.uk

Craig Sewell
Senior Audit Manager, FSA in Wales - Lead Auditor
Email wales.audit@food.gov.uk

Background

1.    In Wales, the power to set standards and monitor local authority (LA) feed and food law enforcement services was conferred on the Food Standards Agency (FSA) under section 12 of the Food Standards Act 1999 (the Act) and regulation 7 of the Official Feed and Food Controls (Wales) Regulations 2009 (OFFC).

2.    The Act provides the FSA with statutory powers to strengthen its influence over enforcement activity and to ensure national priorities and objectives will be delivered at a local level. It gives the FSA powers to carry out the following duties:

• set standards of performance in relation to enforcement of feed and food law
• monitor the performance of feed and food law enforcement authorities
• require information from LAs relating to food law enforcement and to inspect any records
• enter LA premises, to inspect records and take samples
• publish information on the performance of LAs
• make reports to individual LAs, including guidance on improving performance

3.    Assimilated Regulation (EU) 2017/625 on official controls and other official activities performed to ensure the verification of compliance with feed or food law includes a requirement, under Article 6, for competent authorities to carry out internal audits or to have external audits carried out. 

4.    To fulfil this requirement the FSA provides assurance for stakeholders and the public that competent authorities (CAs) such as LAs, are correctly delivering and implementing any legislation, advice and guidance issued in relation to the services they provide. This audit programme, in tandem with the bi-annual performance surveys, provides a key element of the FSA’s overall assurance framework.

5.    The audits in this audit programme will be a systematic and independent examination of the delivery of official controls by LAs in relation to food law in Wales.

Programme Objectives

6.    The audit programme will look at official controls and official activities carried out from 01 April 2023. Management activities relating to the implementation of the legislation in the criteria before this date will also be included in the audit programme.

7.    The audits will demonstrate whether the implementation of official food controls relating to allergens in Wales has been effective. Failure to secure compliance with food law which could detrimentally affect the health and welfare of people in Wales could result in reputational damage to LAs and the FSA, as well as loss of confidence in the food industry.

8.    The focused audit programme will include an examination of the official controls, official activities and related results that are used by LAs to achieve the objectives of the Legislation below:

• The Food Safety Act 1990
• Assimilated Regulation (EU) No 1169/2011 on the provision of Food Information to Consumers 
• The Food Information (Wales) Regulations 2014

9.    The specific aims of this audit programme are to:

• provide assurance that the delivery of allergen labelling legislation that has been in operation since 2014 in Wales, has been effectively implemented by LAs; in that official controls are being delivered in accordance with the Food Law Code of Practice (Wales) (the Code), Food Law Practice Guidance (Wales), Framework Agreement and other centrally issued, official guidance and legislation.*  
• evaluate LA activities in relation to food businesses providing products Pre-Packed for Direct Sale (PPDS) to consumers which came into force in October 2021.
• identify and disseminate any areas of good practice and innovation to other LAs to improve the effectiveness and efficiency of controls being delivered  
• provide a means to identify under performance in the LAs food law enforcement systems
• provide information to aid the development of FSA policy.
• review LA progress in implementing any relevant outstanding recommendations from previous audits

* The Code used will be relevant to the timing of the delivery of the relevant controls.

Scope of the Audit Programme

10.    This programme will consist of a series of audits across Wales to assess the compliance with legislation relating to the provision of allergen information to consumers and the risk posed to hypersensitive consumers, as well as reviewing any relevant open audit actions following previous audits. The audits will assess whether LAs are undertaking interventions involving allergen assessments based on a programme of interventions that is in accordance with the Code.

11.    The audit programme will focus on the risks associated with the following areas of official control: -   

• Food standards service planning, delivery and review,  
• Resources available to the service and the risk-based prioritisation of activities, including the assessment of new food businesses. 
• Authorisation and competence of officers 
• Interventions (programmed and reactive) and Enforcement
• Sampling Policy, procedures and programme 
• Internal monitoring
• Any other matters relating to allergen controls

12.    Open audit actions – review of any relevant open actions from previous audits and associated update of the LA audit action plan.

Assessment Approach

13.    The audits will involve:

• a pre-audit questionnaire requesting copies of the LA service plans, planned/completed interventions and associated documentation  
• the LA will also be provided with a copy of previous audit action plans and will be asked to provide evidence of their progress on any outstanding actions 
• this will be followed by a structured on-site audit involving meetings with the Head of Service, LA lead officers and other relevant staff about current and future service delivery arrangements, a reality check visit and case file reviews.

Notification

14.    Prior notification of 4 weeks for the submission of pre-audit material and at least 6 weeks of an audit visit, will be given for each audit carried out under this audit plan. This will aid transparency and facilitate the effectiveness of the audit process by allowing plenty of time for each LA to collate documents and ensure appropriate staff and facilities are available.

Timing

15.  The audits will take place between May 2025 and February 2026.  The on-site element of the audit, for each LA, should take 2 working days for assessment work followed by a closing meeting on a third day.

Assessment and Follow Up

16.     All LAs in the programme will receive an individual report and an updated audit action plan, both of which will be published on the FSA website. An assessment of overall assurance for allergen controls will also be sent to  each local authority but will not be published.  

17.    At the end of the programme an anonymised summary report will be produced which will contain findings from the audit programme.  The summary report will include recommendations for LAs and the FSA to improve the delivery of official controls. The summary report will also highlight any common themes and emerging issues as well as any areas of good practice identified during the programme.

Planned Outcomes

Immediate Outcomes

• Provide assurance regarding the arrangements in place for the delivery of LA official controls in managing the food safety risk relating to hypersensitive individuals posed by exposure to Allergens  
• Improvements and actions taken by LAs contribute to more effective local food law enforcement 
• Wider dissemination of identified good practice will contribute to improvements in quality and effectiveness of LA delivery of official food controls 
• Findings and recommendations will be fed back to relevant FSA teams to inform policy making 
• The audits will ensure that the FSA is fulfilling its’ statutory function.

Strategic Outcomes

• The audits will raise the profile of the food service within LAs and help them maintain/enhance their resource allocation
• Robust assurance on the LA implementation of Official Feed and Food Control (OFFC) requirements
• Improved business compliance with food hygiene and standards contributes to improved public health and reduces the likelihood of foodborne illness, food incidents and food fraud
• Contribute towards FSA strategic risk management and compliance with UK obligations under OFFC requirements & the Food Standards Act 1999

Annex B: Allergen controls audit action plan

Action Plan for Ceredigion County Council 
Audit Date: 13th – 15th January 2026

TO ADDRESS (RECOMMENDATION INCLUDING STANDARD PARAGRAPH)	BY (DATE)	PLANNED IMPROVEMENTS	ACTION TAKEN TO DATE
4.1.16  The authority should: (i) Ensure future Service Plans for food standards are developed in accordance with the Service Planning Guidance.  In particular, a commitment and plan to deliver all due and overdue B & C category interventions, based on the requirements of the FLCoP, should all be provided	April 2026 (next service plan)	A clearer statement relating to LA commitments to deliver due and overdue interventions will be included.  A full review of the service plan will be undertaken to ensure full compliance with framework.	To be undertaken for the 2026/2027 service plan.
4.1.16 (ii) Ensure the annual performance review includes all information on the previous year’s performance against the food service plan and any specified performance targets, standards and outcomes.	April 2026	A performance review will be included in the 2026/2027 service plan.  The existing corporate performance review process will be included to show an integration of both processes	To be undertaken for the 2026/2027 service plan.    Corporate performance review has been provided pre-audit
4.1.16 (iii) Ensure all variances in meeting the food service plan are addressed in its subsequent plan.	April 2026	As above	As above
4.2.9 (i) Ensure that all officers undertake the minimum amount of continual professional development in accordance with the FLCoP and that it is appropriately documented.	January 2026	Training plan, and training needs assessment introduced across the service to ensure appropriate CPD is scheduled and managed	All internal officers have now received the minimum CPD.  Contractor use is suspended until such time they achieve the same
4.3.15 (i)  Ensure that food standards interventions/inspections are carried out at the minimum frequency specified by the FLCoP and that revisits are undertaken as required.	March 2026	A food standards contractor will be employed for a short period to ensure that relevant inspections and interventions are carried out in this respect.	Preparations for the appointment of a temporary food standards contractor are underway.
4.3.15 (ii)  Ensure premises are rated correctly in relation to allergen matters.	Completed	Staff training and contractor visit protocol reinforcement to ensure checks on contractor documents completed.  Monitoring visit to be undertaken periodically to ensure quality control	Contractor visits have been reviewed and action taken where issues raised.  Contractor visits suspended until training issues resolved.
4.3.15 (iii)       Ensure that observations made and/or data obtained in the course of a food standards intervention/inspection is captured on the correct aide memoire and that it includes complete information on: •           assessments of food standards management systems, including all control measures in place for allergens, •           assessments of labelling, composition and presentation •           incoming traceability requirements in relation to allergens including details of suppliers, other businesses that produce or import for the business and ingredient specifications •           product recall / withdrawal arrangements •           the consideration of whether to take samples/ what samples taken.	January 2026	Aide-memoir has been reviewed and regularised to ensure single controlled form used by all Officers and contractors.  Quality control processes of contractor documentation reinforced to ensure information completed.	Majority of adjustments to the pro-forma have been undertaken.
4.3.15 (iv)  Ensure that intervention report letters/ post inspection forms contain all of the required information.	April 2026	Intervention reports are currently under review and will be amended in accordance with this recommendation.	Currently under review
4.4.5 (i)  Include in the sampling procedure for taking food samples the arrangements for samples taken out of office hours.	Completed		Completed and supplied
4.6.8 (i) Review and amend its enforcement procedures for prosecution files in order to document considerations with regard to the appointment of criminal procedures and investigation roles and responsibilities.	Completed	The roles of investigating officer, officer in charge and disclosure officer are now recorded on the Case Management and Review Form.	Completed and supplied
4.6.8 (ii) Ensure that timely compliance checks are undertaken on notices served to ensure non-compliance is remedied.  This should include following relevant enforcement procedures relating to escalation of enforcement action and ensuring there is no undue delay in progression that may jeopardise future potential cases.	Completed	Food Hygiene and standards processes aligned, staff training on consistency of approaches	All enforcement notices to be included on the agenda of the “enforcement meeting” of senior officers to ensure all cases are progressed without delay.
4.7.8 (i) Revise its documented internal monitoring procedures to ensure all relevant activities are subject to proportionate monitoring. This should include the periodic review of officer authorisations and bulk database checks.	March 2026	Review monitoring procedures to include the enforcement safeguards/governance introduced across the service.  The monitoring procedure to reflect the working actions of the service.  Additional database checks added in line, or reflecting those of the FSA. Upskilling of RSO with IT skills to undertake database checks.	Appointment of single Senior Officer to co-ordinate monitoring processes.
4.7.8 (ii) The internal monitoring taking place in practice should include records for sample follow ups and service request investigations as well as those interventions delivered by contractors.	March 2026	The existing monitoring procedure that includes these steps will be implemented in its fullest (and reviewed as previous).	Non-documented checks were already undertaken through enforcement review meetings.  Nevertheless, the structure provided by the formal monitoring procedure will ensure quality control in addition to consistency.