Keystone
by CloudVoro
Free resource

The 18-point audit-readiness checklist
Irish food producers use to pass FSAI, BRCGS and SFPA.

We built this checklist with the QA team at our founding partner ahead of their last BRCGS audit. They passed without a single non-conformance. The full checklist is below, read it here, or take the PDF. No email gate; the optional email course is exactly that: optional.

  • 18 actionable checks across traceability, QC, documentation, dispatch and audit log
  • Cross-referenced to BRCGS clauses (§3.9, §3.11, §4.7, §5.4)
  • Built with Cashel Farmhouse Cheesemakers ahead of their last audit
  • Free PDF, no email required. Optional 5-part audit-prep email course if you want it
01 · Traceability

Traceability, 5 checks.

The section auditors spend the most time on, and the one the vertical audit tests live.

01
Backward trace works, timedBRCGS §3.9
Pick any finished-product lot from the last 3 months. Can you name every raw-material and packaging lot in it, supplier, delivery date, supplier lot code, with documents? Time it. Target: well inside 4 hours including mass balance.
02
Forward trace works, timedBRCGS §3.9
Pick any raw-material delivery. Can you list every batch it entered and every customer who received those batches, with quantities per dispatch line?
03
Supplier deliveries linked to intake recordsBRCGS §3.5
Every goods-in entry carries the supplier lot code and links to its COA or conformance evidence, including packaging deliveries.
04
Rework and intermediates carry identityBRCGS §3.9
Rework, silo runs, brines and work-in-progress have their own lot identity linking parent and child batches, with weights. This is where mass balances die.
05
Mock recall / traceability test on scheduleBRCGS §3.9.2 / §3.11.3
At least one documented traceability test and one recall-procedure test in the last 12 months, with timings, mass balance and corrective actions recorded.
02 · QC documentation

QC documentation, 4 checks.

06
Per-batch QC records completeReg. 852/2004 Art. 5
CCP checks exist for every production day at the frequency your HACCP plan promises, signed, timed, by people on the training matrix.
07
Allergen declarations currentFIC Reg. 1169/2011
Product specs and labels match current recipes; allergen changes have dated spec revisions and label change evidence.
08
Deviations carry product dispositions
Every monitoring excursion records what happened to the affected product, identified by batch, not just what happened to the equipment.
09
Records retention meets the strictest rule you carry
Traceability and QC records retrievable for 5 years (or your strictest customer/sector requirement). Test it: pull last February's CCP logs in under 10 minutes.
03 · Dispatch & customer evidence

Dispatch and customer evidence, 3 checks.

10
Dispatch notes carry batch codes per line
Every dispatch line names the batch/lot dispatched, in the format each customer expects. Retailer-formatted templates where contracts require them.
11
Customer SKU mapping is a maintained document
Private-label codes map to internal products with effective dates, resolvable by anyone, not just the person who built the spreadsheet.
12
COAs issued and archived per dispatch
Where customers require COAs, evidence exists that the right COA went with the right dispatch, and you can re-produce any of them on demand.
04 · Audit log & change control

Audit log and change control, 3 checks.

13
Records are attributable and protected
Who recorded what, when, and history cannot be silently edited. For paper: indelible ink, single-line corrections, initials. For systems: immutable audit trail.
14
Access is role-based
People can only amend the records their role owns; leavers are removed. A shared login for the whole floor destroys attributability.
15
Spec and recipe changes are versionedBRCGS §5.4
Historic batches resolve against the spec that was current when they were made, critical for claims and for private-label queries after a spec change.
05 · Recall & withdrawal

Recall and withdrawal, 3 checks.

16
Documented recall procedure with named rolesBRCGS §3.11 / EU food safety regulations Art. 19
Who decides, who calls the FSAI, who contacts customers, who talks to press, named people with deputies, contact lists dated within 12 months.
17
Drill cadence honoured
The recall procedure tested at least annually (twice-yearly if own-label retail contracts require it), with written exercise reports.
18
Evidence pack reproducible
For any lot, you can produce the full chain, suppliers, batches, customers, quantities, as a document an authority could take away. This is the artifact the whole checklist builds towards.
How to use it

Print it. Mark it green, amber, red. Sleep better.

Run through the list two weeks before your audit window opens. Mark green, amber, red. The amber items are usually where Keystone helps; the red items are where you need to make a decision before the auditor walks in. If you want a free hour on a call to talk through your reds, drop us a note, no quota, no commission.

Free 5-part email course
Get audit-ready in five short emails.
The 18-point checklist PDF, the 30-second traceability test, what BRCGS auditors actually flag, and how Cashel Blue got audit-ready, one email every few days. No spam, one-click unsubscribe.
GDPR-friendly: we store your email for this course only. Unsubscribe link in every email.
FAQ

Questions buyers actually ask.

Is the checklist BRCGS-approved?
No certification body 'approves' third-party checklists. This is the working document our founding partner used ahead of a successful BRCGS audit. Use it as a guide, not a substitute for the BRCGS standard itself.
Will you email me marketing?
Only if you opt in. The checklist is open, full text on this page, PDF downloadable with no email gate. Separately, there's an optional 5-part audit-readiness email course; every email has a one-click unsubscribe.
Can I share it with my team?
Yes, that's the whole point. CC your QA Manager.
Do you do audit-prep consulting?
We don't sell audit-prep as a service. We will do one free hour of prep coaching with any prospect on a discovery call.

Ready to see if Keystone fits your floor?

20-minute discovery call. No sales pitch. Written scope within 48 hours if we fit, referral to someone better if we don't.

Talk to us
Compliance & trust

How we keep your
data and your audits safe.

Enterprise-grade controls as standard, encryption, MFA for every user, tenant isolation and immutable audit trails, on EU cloud or your own servers. Privacy queries go to privacy@cloudvoro.com. Sub-processor list at /legal/sub-processors. Full security posture at /site/security.

Live
Hosted in EU / Ireland, or on-premise
Customer data resides on AWS Ireland (eu-west-1) and never leaves the EU. Local on-premise deployment available where policy requires it.
Live
GDPR · Privacy Contact named
Internal Data Protection Lead handles subject access requests. Owner is ADPO Ireland member.
Live
MFA for every user
TOTP multi-factor authentication across all roles, with rate limiting, brute-force lockout and reCAPTCHA bot protection on public forms.
Live
ISO 27001 · aligned controls
Security controls mapped to the ISO/IEC 27001:2022 Annex A framework, access management, encryption, logging, incident response.
Live
NIS2 · supporting evidence
Tenant isolation, MFA and immutable audit trails give customers in NIS2 scope direct supporting evidence for their obligations.
Live
Encryption · at rest & in transit
TLS 1.3 in transit, industry-standard symmetric ciphers at rest, KMS-managed keys.