What an auditor looks for in a cold store

The opening meeting and document review

Every audit starts in an office, not on the floor. The auditor confirms scope first: which chambers, which product categories, and whether the audit covers the whole site or a defined section of it, because a facility that stores both ambient dry goods and frozen seafood under one roof but is only certified for the frozen side needs that boundary stated before anyone walks anywhere. They will also confirm who from the site is available for the day, since a pest control trend review and a trace exercise both need someone who can pull records on request, not just someone who can unlock doors.

Before the floor walk, the auditor asks for the previous audit report and the corrective action log against it. This single document sets the tone for the rest of the visit: a facility that closed every finding from the last visit with dated evidence gets a lighter-touch walk, while one with open items from twelve months ago gets those items checked first and in detail. An auditor who finds the same non-conformance twice in a row, with no evidence of a fix in between, treats that as a management-system failure, not just a repeat finding.

The document review also covers the site's HACCP or food safety plan and its list of approved suppliers for anything that touches the product, packaging suppliers and pest control contractors included.

The site walk: receiving

The walk begins at the goods-in dock because this is where temperature control can fail fastest and least visibly. The auditor checks the receiving log against the delivery vehicle's own temperature record, usually a printout or download from the trailer's data logger, and looks for a defined rejection threshold, not a vague instruction to reject anything that looks wrong. A workable standard reads something like: reject any frozen delivery arriving above minus 15 degrees Celsius, or any chilled delivery outside 0 to 4 degrees Celsius, with the rejection itself logged and the carrier notified in writing.

They will physically check product temperature at receiving with a calibrated probe, not trust the driver's paperwork alone, and compare that spot check against what the log says was recorded that day. A gap between the two, say the log shows product accepted at minus 18 but the auditor's own probe on a similar delivery today reads minus 12, is treated as evidence the receiving check is a formality rather than a real control.

Dock design gets checked too: whether there is a temperature-controlled vestibule between the trailer and the chamber, and how long product typically sits on the dock before it moves into storage. An auditor who sees pallets staged in an unrefrigerated dock area for twenty minutes with no record of how often that happens will ask for evidence it is monitored, not just assume it is fine because nothing has failed yet.

The site walk: storage

Inside the chambers, the auditor checks three things in sequence: the displayed temperature against the recorder's chart, the recorder's chart against the calibration certificate for the sensor feeding it, and the physical arrangement of stock against the principle that airflow reaches every pallet. A chamber reading minus 20 on its display but storing pallets stacked hard against the evaporator, blocking return air, will still show as compliant on paper while running warm pockets the digital record never captures.

Rotation is checked here too, first-expired-first-out or first-in-first-out depending on the product, verified by physically pulling a pallet label and checking it against the stock system rather than taking the warehouse manager's word for the rotation discipline. Defrost cycles get reviewed against their logged frequency, since a chamber that defrosts on a schedule too infrequent for its load will show slow temperature creep between cycles that a daily spot-check can miss.

The auditor also looks at door discipline: how long chamber doors are held open during pick operations, whether there are strip curtains or air doors in place, and whether the site has any record of a door-open alarm and how staff responded to it. This connects directly to the alarm log review that comes later in the records stage, so an auditor who sees a door propped open during the walk will specifically pull that chamber's alarm history afterward.

The site walk: dispatch and ancillary areas

Dispatch gets the same scrutiny as receiving, in reverse: product temperature checked immediately before loading, the outbound vehicle's temperature verified and logged before the door closes, and a defined maximum loading window tracked against how long the vehicle actually sat at the dock. A facility that logs departure time but not loading start time cannot demonstrate how long product was exposed to ambient conditions during the load.

Ancillary areas often get less attention from the site than from the auditor: staging areas for returns or rejected product, and any repack or labelling room where product leaves temperature control briefly for a defined task. Each of these needs its own time limit and its own record that the limit was respected, because an auditor who finds a repack room with no logged time-out-of-chamber will flag it even if every chamber reading on site is perfect.

Staff facilities and waste handling get a shorter look but are not skipped: whether waste and packaging debris routes avoid crossing back through clean storage areas.

Records verification, and the trace exercise

This is where most of the audit's real work happens, usually back in the office after the floor walk. Temperature records are checked for traceability to a specific instrument, and that instrument checked against a calibration certificate that is both current and shows the instrument was checked against a traceable reference standard, not just serviced. A logger with an expired calibration certificate makes every reading it produced since expiry unusable as evidence, regardless of what the numbers say.

Alarm logs are reviewed for pattern, not just presence: how many high-temperature alarms triggered in the review period, how quickly each was acknowledged, and what corrective action was logged for each one. An auditor treats a chamber with frequent alarms and fast, documented responses more favourably than one with zero alarms and no record of anyone ever checking whether the alarm system itself still works.

Pest control evidence is judged the same way: not the stack of monthly service dockets from the contractor, but a trend, catch counts over the preceding twelve months, plotted or tabulated, with any spike investigated and the investigation's findings on file. A site that can only produce dockets showing a technician visited is showing attendance, not control.

Cleaning verification needs to show a method, not just a schedule: swab or ATP testing results against a defined pass threshold, with a documented response when a result fails. Staff training records need to be current for everyone working in the audited areas, tied to the specific procedures relevant to their role, hygiene and cold chain handling for warehouse staff, allergen awareness for anyone in a repack area.

The trace exercise is the test that pulls all of this together. The auditor picks a lot number, either forward from a goods-in record to find every dispatch it fed, or backward from a dispatch note to the receiving record and every temperature reading in between, and times how long it takes the site to produce the full chain with matching quantities. A site that cannot reconcile the quantities, say goods-in shows 40 pallets received but only 37 can be accounted for across storage and dispatch records, has a traceability failure regardless of how clean the temperature charts look.

Certification audits versus customer audits

A certification audit, run against a scheme like BRCGS Storage and Distribution or a similar recognised standard, is scored against a fixed set of clauses, produces a formal grading, and carries real consequence: a critical non-conformance can mean immediate suspension of certification, and the auditor has no discretion to look past it because the standard's rules bind them too. These audits are typically unannounced or announced with only a short window, precisely so the site cannot stage a temporary clean-up.

A customer audit is narrower and more commercially direct. The customer's auditor is checking whether this specific site can be trusted with this specific customer's product, so they will often go straight to the categories that matter most to that customer's own risk profile, allergen segregation for a customer with allergen-free lines, or trace speed for a customer that has been burned by a slow recall before. There is no formal certificate at stake, but the consequence is just as real: a failed customer audit can mean an immediate stop to new orders, and a supplier that fails audits with multiple customers develops a reputation that outlasts any single relationship.

The practical difference for a site is preparation. A certification audit rewards having every element of the management system genuinely embedded, because the auditor will sample broadly. A customer audit rewards being able to demonstrate depth on the two or three things that specific customer cares about, and it pays to ask the customer's quality team in advance what those priorities are rather than guessing.

Recurring findings, and what closes them

The finding that recurs most is calibration drift: instruments serviced on schedule but not checked against a traceable reference, or a certificate that has quietly lapsed while the instrument keeps producing readings nobody questions. It closes with a calibration register that flags upcoming expiries before they lapse, not after an auditor catches one.

The second most common is the gap between having a corrective action process and using it, an alarm log with entries but no action recorded for several of them, or a pest trend with a spike and no note on what was investigated. It closes by making the action field mandatory at the point the event is logged, not completed later from memory.

The third is dwell time at the dock: product staged in a partially controlled area longer than the site's own procedure allows, with no record of how often it happens. It closes with a timestamp captured at goods-in and again at chamber entry, so the gap is measurable rather than assumed.

Closing a finding for good means the corrective action shows up in the next audit's document review with a date and evidence attached. An auditor who sees the same gap twice treats it as a system that does not learn, which is a harder finding to argue against than any single missed reading.