Platform overview
AuditCore is a cloud-based internal audit and compliance platform for food manufacturing and processing. It covers two disciplines in one system: food safety, aligned to BRC Global Standard Issue 9 and the other GFSI-recognised schemes, and health & safety, aligned to ISO 45001 and HSG65. A site can run either or both.
Who uses AuditCore
Quality & Technical
Define the annual audit programme, oversee NC trends, and generate evidence-led reports for management review.
Auditors & Site Managers
Execute shopfloor GMP inspections and structured system audits with photo evidence and clause references.
Operations & Production
Primary owners of the CAPA process — responsible for immediate corrections and root cause investigations.
Senior Management
Monitor real-time site health via the Risk Heatmap to satisfy BRC Clause 1.1.2 resource and management review requirements.
Health & Safety
Run safety tours and ISO 45001 or HSG65 audits on the same site, with findings landing in the same NC register as food safety.
Pre-loaded audit standards
The following standards are available from the moment your site is created. Which of them you are offered depends on what you told us the site audits:
- BRC Global Standard for Food Safety Issue 9
- FSSC 22000 v6
- IFS Food v8
- SALSA Issue 6
- SQF Edition 9
- ISO 45001 — occupational health & safety management systems
- HSG65 — the HSE's Plan, Do, Check, Act framework
Organisations & sites
AuditCore uses a strict three-level hierarchy to maintain data integrity and clear segregation of duties across complex business units.
Hierarchy
- Organisation — the top-level legal entity. Subscription settings and master GMP templates are managed at this level.
- Site — a physical factory or warehouse. All data (audits, NC registers, risk scores) is scoped to a specific site.
- Areas — specific locations within a site (e.g. "High-Care Packing" or "Raw Material Intake") used to pinpoint where an observation or failure occurred.
Site profile
During onboarding each site completes a profile which informs the risk assessment engine and report headers, and records which disciplines it audits.
| Field | Description |
|---|---|
| Site Name | Unique identifier, e.g. "BAKM — Manchester Bakery" |
| Production Areas | Total count of defined functional zones within the facility |
| Employee Count | Staffing levels used to contextualise the scale of operations |
| High-care Flag | Boolean indicator of whether the site contains high-care or high-risk production environments |
| What this site audits | Food safety, health & safety, or both. Decides which standards are offered and which registers appear. Changed later in Settings → Site Settings |
Managing production areas
Areas are managed via Settings → Sites → [Site Name] → Areas. Precise area definition is critical for the evidence trail required by auditors.
- Area types: Production, Storage, Despatch, Welfare, Utilities, or Other
- High-care status: A toggle to identify zones requiring enhanced hygiene and segregation controls
- Status & order: Admins can set areas to Active/Inactive (hiding defunct areas without losing historical data) and adjust sort order for auditor efficiency
User roles
AuditCore uses an additive permission model. Each successive role inherits all permissions of the roles below it, ensuring a clear chain of command and data security. There are four roles — there is no separate "auditor" role, because conducting audits is what site users and site managers already do.
| Role | Primary permissions | Key restrictions |
|---|---|---|
| site_user | View the dashboard and My Work; conduct assigned inspections and system audits; raise non-conformances; complete assigned CAPA phases; log Proactive Actions | Restricted to their assigned site(s). Cannot build or schedule programmes, manage inspection templates, or access site and organisation settings |
| site_manager | All site_user permissions plus: build and schedule programmes; reassign audits; manage inspection templates, areas and site settings; view site reports | Restricted strictly to their assigned site(s) |
| org_admin | All site_manager permissions plus: every site in the organisation; invite and deactivate users; organisation settings and billing; run manual risk assessments | Cannot access data from other organisations (multi-tenancy lock) |
| super_admin | All org_admin permissions plus: support-level access; log in on behalf of users; global organisation management | Reserved for AuditCore technical service team only |
Two-factor authentication
Any user can protect their own account with an authenticator app, whatever their role — see Security & 2FA. It is worth insisting on for org admins, who can see every site in the organisation.
What roles do not control
The Focus switcher between food safety and health & safety is a view filter, not a permission. Everyone working on a site sees the disciplines that site runs; who may build a programme or assign work is governed by the roles above.
Onboarding & setup
New accounts start with a 14-day full-access trial. Signing in for the first time takes you straight into setup — you come out of it with a real audit programme for the year rather than an empty dashboard.
Onboarding wizard
- Your site — the site name that appears on every report and NC reference
- What you audit here — food safety, health & safety, or both. This decides which standards you are offered and which registers you see, and you can change it later in Settings
- High care / high risk — flags the zones that need tighter controls during inspections
- Your standard and schedule — pick from BRC Issue 9, FSSC 22000, IFS, SQF, SALSA, ISO 45001 or HSG65, choose when your cycle starts, and AuditCore drafts the year's audits
- Your team — invite the colleagues who will run the audits
Only the person who created the account goes through setup. Colleagues invited afterwards join a site that is already configured and land straight on the dashboard.
Account states
- Trial — 14-day full-access period for new registrations
- Active — live paid subscription; full platform access
- Expired — subscription lapsed; login blocked until renewed
- Suspended — account suspended based on payment status
GMP inspections
Inspections are checklist-based walk-rounds. For food safety they evaluate Prerequisite Programmes — hygiene, maintenance, pest control and so on. For health & safety they are safety tours covering fire, machinery, COSHH, work at height and the rest. Both use the same screens, the same evidence capture and the same route into the NC register. In the app they are under Inspections, with the checklists themselves under Inspection Templates.
Conducting an inspection
- Select the template for the area you are inspecting — the list shows the checklists for the disciplines your site runs, plus any your organisation has created
- Mark each item as Pass, Fail, or N/A
- For any failure: add notes and up to 5 photos as evidence
- Record the Area, Shift, and Product Reference in the metadata fields
- On failing an item, use the Auto-NC button to immediately raise a linked Non-Conformance
Inspection templates
AuditCore ships 17 checklists: eight GMP templates for food safety and nine safety tours for health & safety. These are built in and shared by every customer, so they cannot be edited — copy one and adjust the copy if you want your own wording.
Templates you create belong to your organisation and are visible only to it. Org admins and site managers manage them under Inspection Templates.
Offline support
AuditCore uses Service Workers and local caching to support audits in Wi-Fi dead zones — cold stores, external yards, or areas with poor signal.
System audits
System audits evaluate the facility against the full breadth of a standard, clause by clause — BRC, FSSC 22000, IFS, SQF and SALSA for food safety, ISO 45001 and HSG65 for health & safety. They can be scheduled via the Audit Programme or raised as one-off or triggered audits.
Audit lifecycle
- Schedule — create manually or let the Audit Programme generate it automatically
- Execute — work through clauses using the Audit Mode: Desk, Shopfloor, Interview, or Combined
- Report — on completion a PDF generates automatically with overall compliance score, embedded photo evidence, and a summary NC table
Audit modes
| Mode | Use case |
|---|---|
| Desk | Document review — procedures, records, HACCP plans |
| Shopfloor | Physical walkthrough of the production environment |
| Interview | Staff competency and awareness checks |
| Combined | Mixed approach covering all of the above in a single audit session |
Triggered audits
Outside the routine plan, triggered audits are initiated by specific events:
| Trigger | Example case |
|---|---|
| Customer Complaint | Significant complaint requiring a deep-dive audit response |
| Product Recall | Audit conducted as part of a formal recall or withdrawal |
| Post-Incident | Conducted following a food safety incident or near-miss |
| Process Change | Triggered by new line installations or process modifications |
| Supplier Failure | Targeted audit following a significant supplier non-conformance |
Health & safety audits
AuditCore runs health & safety alongside food safety, in the same programme, with the same non-conformance and CAPA workflow. A site can do one or both.
Turning it on
Setup asks what you audit at each site. If you did not pick health & safety then — or you have added it since — go to Settings → Site Settings and switch it on. Turning a discipline off hides its work; it never deletes anything.
Standards
- ISO 45001 — occupational health & safety management systems, 21 sections and 81 clauses
- HSG65 — the HSE's Plan, Do, Check, Act framework, 12 sections and 56 clauses
Safety inspections
Nine walk-round checklists ship with the platform, written against UK duties and phrased as things an inspector can see on the floor rather than documents to request:
- General Workplace Safety Tour
- Fire Safety — escape routes, fire doors, extinguishers
- Machinery & Guarding (PUWER)
- Manual Handling
- COSHH & Chemical Storage
- Work at Height
- Slips, Trips & Falls
- PPE Compliance
- Welfare Facilities
They work exactly like GMP inspections — same five response types, same photo and voice evidence, same route into the NC register.
Switching between disciplines
A site running both gets a Focus switcher in the sidebar: All, Food Safety, or Health & Safety. It filters every register, dashboard figure and report at once, so a safety manager can work without wading through food-safety records and vice versa. A site running only one discipline does not see the switcher at all.
Non-conformances
H&S findings raise non-conformances in the same register, tagged with an H&S badge, and follow the same corrective action, root cause and verification steps. One CAPA process for the whole site, not two.
NC & CAPA process
Every Non-Conformance in AuditCore follows a mandatory two-phase CAPA workflow. Unlike Proactive Actions — which are simple improvement logs requiring no formal verification — every NC must complete a structured, multi-stage process.
Who can raise one
Anyone can raise a non-conformance against a site they are assigned to — an operator who spots a problem should be able to log it without going through a manager. Org admins can raise one against any site in the organisation. Nobody can raise one against a site they do not work at.
NC reference format
Each NC is assigned a unique reference following the format: NC-{SITE}-{YEAR}-{SEQUENCE} (e.g. NC-BAKM-2026-0001). The site code is automatically generated from the first four characters of the site name, uppercase, no spaces.
Food safety and health & safety
Non-conformances carry a FOOD or H&S badge according to the audit or inspection that raised them, and sit in the same register. The Focus switcher filters the register to one discipline when you want to work on it alone. The CAPA workflow itself is identical for both.
NC source types
| Source | Description |
|---|---|
| System Audit | Auto-raised during internal audits against certification clauses |
| External Audit | Findings from third-party or certification body visits |
| GMP Inspection | Auto-raised from a failed shopfloor inspection item |
| Customer Complaint | Formal feedback requiring a technical response |
| Incident | Food safety incidents or near-miss events |
| Non-Conforming Product | Product failing specification or release criteria |
| Product Safety Point Failure | Failure of a CCP, OPRP, or other HACCP control |
| Cleaning Failure | Documented failure of cleaning and disinfection protocols |
| Supplier Issue | Non-conformance regarding delivery or supplier performance |
| Internal (Other) | Internally identified issues not covered by other sources |
| Manual / Ad Hoc | A manually created record for miscellaneous compliance failures |
Severity levels & due dates
| Severity | Definition | Due date |
|---|---|---|
| Critical | Immediate risk to safety or legality | Same day |
| Major | Substantial failure or potential risk | 3 days |
| Minor | Failure not posing significant immediate risk | 14 days |
| Observation | Weakness or area for improvement | 30 days |
The three-step CAPA workflow
- Phase 1 — Immediate correction. Document what was done immediately to prevent harm (e.g. "Batch isolated and quarantined"). Assign a Corrective Action Owner.
- Phase 2 — Root cause investigation & prevention. Record a Root Cause Analysis using methods such as the 5 Whys or Fishbone diagram. Then document the Preventive Action Plan that addresses the root cause finding.
- Verification & closure. A different person from the submitter must verify the actions taken. They may close the NC or return it for rework if evidence is insufficient.
Programme builder
AuditCore separates the library of audit requirements from the execution of the schedule. The Programme Builder defines what needs to be audited and how often. The Annual Plan puts those requirements on the calendar.
Programme builder vs annual plan
| Tool | Purpose | Answers |
|---|---|---|
| Programme Builder | The master library of Audit Events | What needs auditing, how often, and at what baseline risk level |
| Annual Plan | The site-specific 12-month calendar | When each audit event is actually scheduled throughout the year |
Building a programme quickly
Build programme for me starts you from a ready-made programme for the chosen standard — a sensible division of its clauses into named audits — which you then rename, re-risk and reschedule. It is a starting point, not a commitment; nothing is scheduled until you say so.
Clause coverage
As you assign clauses to events, the builder shows what percentage of the standard your programme reaches and lists the clauses it does not. The percentage tells you there is a gap; the list tells you what it is, which is what you need to close it.
Which site you are building for
The builder works on the site selected at the top of the page. Switch site there and the events, coverage and standards all follow.
Using the annual plan view
The Annual Plan View displays a 12-month grid. Quality Managers use it to schedule specific instances of Programme Builder events, ensuring even distribution of workload and audit coverage across the year.
Risk assessment engine
In accordance with BRC Clause 3.4, AuditCore automatically calculates compliance risk at the section level — rated High, Medium, or Low — using a multi-factor scoring model.
Risk weighting factors
| Factor | Impact on score |
|---|---|
| Recent compliance score | The primary driver of current section risk |
| Number of open NCs | Increases risk based on volume of unresolved issues |
| Overdue NCs | Significant negative factor indicating lack of control |
| Repeat NCs | High-priority flag — triggered when the same clause fails in two or more consecutive audits |
| Time since last audit | Risk increases linearly as the duration since the last check grows |
Reports & exports
AuditCore generates two primary reports designed to meet BRC Issue 9 evidence requirements and support management review.
Management review report
Directly supporting BRC Issue 9 Clause 1.1.2, this report provides Senior Management with the data required to review the effectiveness of the Food Safety Quality Management System.
- NC trends by severity
- Open vs. closed rates
- Average time to close
- Repeat NC list
- Audit completion rates
- Risk score trends over time
Report activity
Every management review and NC register you generate is recorded, and the Reports page lists the recent ones so you can see what has already been produced and when.
NC register export
Exports follow the site and date range selected on the Reports page — check the site is the one you mean before generating a file you intend to send to a customer or an auditor. The full register can be exported in two formats:
- CSV — for internal data manipulation and trend analysis
- PDF — a professionally formatted register suitable for direct submission during certification audits
System audit PDF
Generated automatically on audit completion. Includes the overall compliance score (percentage of compliant non-N/A responses), all embedded photo evidence, and a summary NC table.
Security & two-factor authentication
Your audit records, non-conformances and reports sit behind one password by default. Two-factor authentication adds a code from your phone, so a stolen password is not enough on its own.
Turning it on
- Go to Settings → Security
- Press Set up two-factor authentication
- Scan the QR code with any authenticator app — Google Authenticator, Microsoft Authenticator, 1Password, Authy. If your camera will not scan, the key is shown for typing in by hand
- Enter the 6-digit code the app shows. Nothing is switched on until a code works, so a QR scanned into the wrong app cannot lock you out
- Save the eight recovery codes
Recovery codes
Shown once, immediately after you turn 2FA on, and never again. Each works a single time and they are the way back in if you lose your phone — so keep them somewhere other than the phone running the authenticator app. A password manager or a printout in a drawer both work.
Settings → Security shows how many you have left and warns you when you are down to two.
Signing in afterwards
Email and password as usual, then a second step asking for the 6-digit code. If you have not got your phone, choose Use a recovery code instead. Codes are accepted for thirty seconds either side of their window, so a phone clock slightly out of sync still works.
Turning it off
Settings → Security → Turn off. Your password is required, so somebody who finds your screen unlocked cannot quietly remove it.
Who should use it
Anyone can turn it on for their own account. We would strongly recommend it for org admins, who can see every site in the organisation.
Sample data
New accounts are seeded with a handful of example non-conformances and proactive actions so the dashboard shows a working product rather than empty states on day one.
Spotting it
Everything seeded is titled "Sample — …" and carries an NC-DEMO reference. Nothing you create is ever marked that way.
Clearing it
Go to Settings → Sample Data. It shows how many example records remain, split by type, and removes them in one step. Only rows flagged as sample data are deleted — your own records are untouched. A banner on the dashboard and the NC register offers the same thing until the examples are gone.
Clearing is permanent and cannot be undone, so do it once you have had a look round and are ready to work with real records.
Video walkthroughs
Short screencasts covering the key workflows in AuditCore. More videos will be added as the product develops.
FAQ & troubleshooting
Common questions from Technical Managers getting started with AuditCore.