A product safety audit for a small business: a one day audit a tiny team can actually run

Choice should follow risk, not convenience. The product to audit should be one with higher risk, higher sales, a recent complaint, a new supplier, or a recent change, because auditing a quiet, low risk product will flatter the business while leaving its real risks unexamined. A small business can audit only a sample, so the sample must be chosen to teach the most, not to pass most easily.

The audit should also vary its sample over time, so every product type is audited eventually, and no product becomes permanently unaudited because it was never chosen. A simple rotation list, noting when each product type was last audited, ensures coverage without requiring a large audit programme.

The morning should trace the chosen product end to end: supplier documents, incoming inspection, production or assembly records, batch identification, labelling as sold, listing as live, and sales records. The auditor, who should be someone other than the product's usual owner where the business allows, should follow the trace using only the records, noting every break, mismatch, or missing document. A trace that cannot be followed from the records is itself a finding, however good the product may be.

Morning work should also include a physical check: a sample unit from stock, inspected against its file and its listing, with labels, warnings, and parts compared. Illustration: a two person seller auditing a wooden toy finds the stock unit's label differs from the file's approved label, because a supplier reprint was never checked, a finding the paper trace alone would have missed.

The afternoon should review complaints and supplier evidence for the audited product and its neighbours. Complaints should be checked for patterns, for safety review, and for filing into the product record. Supplier documents should be checked for currency, scope, and change notification. Alerts for the product type should be checked for relevance and for any action taken. That afternoon review connects the product trace to the wider system that should be monitoring it.

Afternoon work should be time boxed, because a small team can easily spend a day on one product's complaints alone. The goal is a representative review that finds system gaps, not an exhaustive re investigation of every message ever received. A time box forces the auditor to focus on patterns and on the most serious complaints, which are the ones that matter most.

Findings should be written plainly, each stating what was found, what evidence shows it, and what risk it carries, graded so the team fixes the highest risk first. A finding that reads vague, such as file incomplete, helps nobody; a finding that reads test report for batch April missing, with the batch record cited, tells the team exactly what to fix. Grading should be simple: fix before next sale, fix within a stated period, or note for the next routine cycle, with the grade justified by risk.

Findings should also note strengths, because an audit that only lists faults demoralises a small team and hides what works. A strength, such as a well kept complaint log, deserves recording, because it shows the team what to preserve while fixing the gaps. An audit that balances findings and strengths is more likely to be repeated willingly.

Actions set on audit day, with owners and dates, are far more likely to happen than actions set later, when the audit's urgency has faded and ordinary work has resumed. The audit day should therefore end with a short action list, agreed by the team, with each action owned and dated, and with the next audit date set. That closing meeting, even if it lasts only half an hour, converts the audit from an exercise into a plan.

Actions should also include a routine change where the finding is systemic. A missing test report needs filing, but a pattern of missing reports needs a filing routine change. A single action that fixes the routine prevents the next audit from rediscovering the same finding, and that prevention is the audit's real return on the day's effort.

Keeping auditing going needs a calendar and a habit, not enthusiasm. The next audit date should be set at the close of the first, the product rotation should be updated, and the previous actions should be checked at the next audit's start. A business that checks previous actions first will learn whether its audit system works, because actions completed show a working system, while actions repeated show a system that audits without changing.

The habit should also survive staff changes and busy periods, by being written into a simple annual plan rather than depending on one person's memory. A one page annual audit plan, listing products, dates, and owners, is enough for most small businesses, and it is the document that turns a single audit day into an audit programme.