Most companies only find out how good their compliance records are when someone asks to see them. A customer requests proof on short notice. A regulator opens an inquiry. An auditor arrives. At that point it's far too late to discover that the declaration is missing, the test report covers a different formulation, or nobody can say who approved the change last year.
An internal product regulatory compliance audit is how you find those gaps on your own schedule instead. It's a structured check of whether your products meet the rules that apply to them and, just as important, whether you can prove it. Here's how to run one without turning it into a months-long project.
A compliance audit compares what you should have in place against what you actually have. It asks two questions for each product:
Does the product meet its requirements?
Can we show evidence of that?
It's not the same as a certification audit by an outside body, and it's not a legal opinion. It's a practical internal review, and its main value is surfacing gaps while there's still time to fix them.
If you don't yet have a structured way of organizing your compliance records, our guide tobuilding a product compliance management system is a useful starting point, since an audit is much easier when the system underneath it is clear.
Decide what you're auditing before you begin. Trying to review every product and every requirement at once is the fastest way to stall.
Choose a boundary such as:
One product line or a sample of products
One market, for example all products sold in a particular region
One topic, such as food contact materials or labelling
Your highest-risk products first
A first audit on a limited scope that you complete is worth far more than a comprehensive plan you never finish.
You need two things to compare against: the requirements and your records.
Requirements. List what applies to each product in scope: material and ingredient requirements, labelling rules, testing obligations, documentation duties. A structured list like the one in our guide to aproduct safety compliance checklist can be used as the audit baseline.
Records. Collect the evidence you hold: supplier declarations, test reports, specifications, formulations, label artwork, approval records and change histories.
For anything beyond a small range, audit a sample rather than everything. A sensible sample includes:
A mix of product types
Products with recent changes, which are the most likely to have gaps
Products from different suppliers
Your highest-risk or highest-volume items
If you find problems in the sample, widen the review. If the sample comes back clean, you have reasonable confidence in the rest.
For each product in the sample, work through the requirements one by one and look for supporting evidence. For every item, you're aiming for one of three outcomes:
Compliant, with evidence on file
Probably compliant, but evidence missing or weak
Non-compliant or unknown
The middle category is where most findings land. The product may well be fine, but if you can't show it, you have a documentation gap that needs closing.
Pay particular attention to the quality of supplier paperwork. A declaration should name the applicable rules, identify the specific product, state the conditions of use it covers, and be dated. If it says only that the material "complies with applicable regulations," that's a weak document. OurFood Contact Compliance 101 course explains how to judge this properly.
A product can be compliant at launch and drift out of compliance later. For each audited product, compare what was approved with what's actually being made and sold now.
Look for:
Supplier changes that weren't reviewed
Material or formulation changes without a compliance check
New markets entered without a requirements review
Label changes not re-approved against the rules
This part of an audit often turns up the most surprising findings, because change is where informal processes tend to fail.
Write findings down clearly and consistently. For each one, record:
A simple severity scale helps you prioritize. For example, separate issues that create a potential safety or legal problem from those that are documentation gaps or housekeeping items. The first group needs fast action. The second can be scheduled.
Keep the tone factual. The aim is to improve the system, not to assign blame.
Every significant finding needs a corrective action with an owner and a deadline. Typical actions include:
Requesting updated or more specific supplier declarations
Commissioning missing tests
Correcting labels
Adding a missing review step to the change process
Holding a product until a gap is closed
Equally important is the root cause. If one product has an outdated declaration, fix that. If five do, the underlying problem is how declarations are requested and tracked, and fixing the process will prevent repeats.
Summarize the audit for management in plain terms: what was reviewed, what was found, what is being done, and by when. Then schedule a follow-up check to confirm that actions were completed.
Audits only create value when findings turn into changes. An audit report that sits unread, with the same issues reappearing the following year, is a sign the follow-up step got skipped.
There's no single right frequency. A common pattern is to review higher-risk products more often, perhaps annually, and lower-risk ones less often. Trigger additional reviews when something significant changes, such as a major supplier switch, a new market, a regulatory change, or an incident.
Scoping too wide. An audit that tries to cover everything rarely gets finished.
Checking that documents exist, not what they say. The content of a declaration matters more than the fact you hold one.
Ignoring changes since launch. Drift over time is a major source of gaps.
Treating findings as blame. People hide problems when audits feel punitive.
No follow-through. Without tracked actions, the same findings come back.
Relying on one person's knowledge. If only one person understands the requirements, the audit reflects their view and their blind spots. Spreading knowledge across the team, for example through shared access to ourteam subscription plans, makes audits more reliable.
Pick one product line, run through the steps above, and treat the first audit as a pilot. You'll learn quickly which parts of your records are strong and which need work, and the next one will be faster.
Build the knowledge behind a solid audit withProduct Safety 101 andFood Contact Compliance 101, or browse the fullcourse catalog for food contact, packaging and labelling training.
