A purchasing file can look complete while the factory floor tells a different story.
The approved supplier list may show one manufacturer, while the warehouse is receiving material from another. A procedure may require employees to check incoming goods, but nobody can explain what happens when the product name on the delivery note does not match the approved material record. An audit checklist may be fully ticked while an unresolved corrective action has remained open for months.
These are exactly the kinds of gaps an internal halal audit should expose.
For Malaysian businesses operating a Halal Assurance System, internal halal auditing is not simply an administrative rehearsal before an external inspection. Malaysia’s Halal Management System framework requires applicable companies to establish an internal audit procedure, use competent auditors, evaluate relevant halal controls, record findings and address non-conformities.
The practical objective is therefore not to produce a clean checklist. It is to establish whether the halal-management system described on paper is the system actually operating inside the business.
Start by auditing the real operation, not the halal file
A common mistake is beginning an audit in the document room and spending most of the available time there.
Documents matter, but they are only one source of evidence. Malaysia’s MHMS 2020 audit procedure example includes document review, interviews, cross-checking between departments, observation and reporting. It also identifies functions such as purchasing, receiving and warehousing, transportation, human resources, documentation and operations as relevant auditees.
That creates a better audit question:
Can the company demonstrate that its written controls are operating consistently across departments?
Instead of asking only whether an approved-material list exists, an auditor can select several materials from the list and trace what actually happened to them.
- Who is authorised to purchase the material?
- Which supplier and manufacturer are approved?
- What information appears on the purchase order?
- What did the warehouse actually receive?
- Was the incoming material checked against the approved information?
- Which production batch used it?
- Can the supporting halal documentation be connected to that exact material and source?
That is a system test rather than a document-presence test.
Build the audit around evidence chains
A useful internal halal audit follows information across departmental boundaries.
| Control Area | What the Auditor Should Test | Evidence to Compare |
|---|---|---|
| Procurement | Whether buyers purchase only approved materials and sources | Approved material list, supplier information, purchase orders and change approvals |
| Receiving | Whether incoming goods match what procurement and halal records approved | Delivery documents, labels, receiving records and material identification |
| Storage | Whether materials remain correctly identified and controlled after receipt | Warehouse locations, labels, system records and physical stock |
| Production | Whether actual materials and processes match documented arrangements | Batch records, recipes, work instructions and production observations |
| People | Whether responsible employees understand the control they perform | Training records, interviews and observed practice |
| Change control | Whether commercial changes receive halal review before implementation | Supplier, ingredient, product, packaging and process change records |
| Traceability | Whether the business can connect inputs, production and finished products | Receiving, batch, warehouse and distribution records |
The value of this approach is that inconsistencies become visible. A certificate may be valid, for example, but the physical material may come from a different manufacturer. A purchasing system may block unapproved suppliers, but employees may circumvent the control through emergency purchases.
An audit should identify both situations.
Use sampling instead of trying to inspect everything
Large businesses may handle hundreds or thousands of materials, transactions and production batches. Checking every record during every internal audit is rarely practical.
A better approach is risk-based sampling.
Select samples that are likely to reveal whether controls remain effective. These may include:
- a newly approved supplier;
- a recently changed ingredient;
- an imported material;
- a high-risk or complex ingredient;
- a product introduced since the previous audit;
- an urgent purchase;
- a product produced through an outsourced process;
- a batch that moved through several warehouses; or
- an area that produced a previous non-conformity.
The audit should then follow each sample through the relevant process rather than reviewing it in isolation.
This also helps businesses avoid a predictable weakness: repeatedly auditing the easiest records while higher-risk changes receive less attention.
Interview the employee who actually performs the control
A procedure can be beautifully written and still be ineffective if the employee responsible for it does not understand it.
During receiving, for example, ask the employee what they would do if:
- the supplier name is correct but the manufacturer shown on the packaging is different;
- a product arrives with a different material code;
- the supporting documentation has expired;
- the label differs from the usual version; or
- production urgently needs the material before the discrepancy is resolved.
The purpose is not to trap employees. It is to test whether the control survives real operating pressure.
If the answer is “I would ask my supervisor”, the auditor can continue following that escalation until the person with decision-making authority is identified.
A strong system should make it clear who can approve, reject, quarantine or escalate an exception.
Audit recent changes particularly carefully
Halal-management gaps often appear when the business changes faster than its controlled information.
A growing company may introduce new suppliers, products, employees, packaging, equipment, warehouses or outlets throughout the year. Internal auditing should therefore give special attention to what has changed since the previous review.
A practical pre-audit request can ask departments to list significant changes made during the audit period. The auditor can then select several and check whether the appropriate halal-management review occurred before implementation.
This creates a useful connection between internal auditing and day-to-day change control.
Do not treat every finding as a paperwork correction
An internal audit becomes weak when every finding ends with “update the document”.
Suppose an auditor discovers that a buyer ordered from an unapproved source.
Correcting the approved-supplier spreadsheet may not address the cause. Management should establish why the purchase happened.
- Was the approved supplier out of stock?
- Could the purchasing system accept any supplier?
- Was the buyer unaware that approval was required?
- Was the material code ambiguous?
- Did management override the normal process because production was under pressure?
The corrective action should address the mechanism that allowed the problem to occur.
A simple finding-to-closure workflow
- Describe the evidence. Record what was observed without vague wording.
- Identify the requirement or internal control involved.
- Contain the immediate issue where necessary.
- Determine the cause.
- Assign corrective action to a named owner.
- Set an appropriate completion date.
- Verify that the action was implemented.
- Check whether the same issue exists elsewhere.
- Close the finding only when effectiveness has been demonstrated.
MHMS 2020 requires internal-audit non-conformities and corrective actions to be addressed and verified through the Internal Halal Committee. Audit reports and checklists should also be recorded and presented to the committee.
Use repeated findings as a management signal
A closed finding is not necessarily a solved problem.
If similar findings continue appearing, the business should ask whether its corrective action addressed only the symptom.
For example, repeated expired supplier documents may indicate more than employee oversight. The company may lack a defined document owner, automated reminders, supplier accountability or a clear re-verification process.
MHMS 2020 specifically requires the Internal Halal Committee to evaluate the effectiveness and frequency of internal halal audits so that non-conformities do not keep recurring.
This makes trend analysis useful. Management can periodically review:
- findings by department;
- repeat findings;
- overdue corrective actions;
- supplier-related issues;
- material-control issues;
- training-related findings; and
- areas where operational changes repeatedly bypass the halal review process.
How often should the business audit?
The core MHMS 2020 requirements state that internal halal audits should be carried out at least once a year for each applicable branch or premises network.
The document also provides a sample internal-audit procedure in its appendix that uses a more frequent six-month interval. That appendix is presented as a reference example rather than a universal replacement for the main requirement.
Businesses should therefore establish a documented audit programme that meets the applicable current requirements and reflects their own level of operational risk. A rapidly expanding restaurant group, frequently changing manufacturer or business with recurring findings may have good reason to audit particular areas more often than the minimum interval.
Additional supplier or targeted audits may also be appropriate where a specific compliance need arises.
Make the audit programme change with the business
An audit checklist written three years ago may no longer test today’s operation.
Companies should review their audit criteria when they introduce new technologies, facilities, outsourcing arrangements, distribution channels or material-management systems. They should also check current JAKIM, JAIN or MAIN requirements and applicable certification circulars rather than relying indefinitely on an old internal checklist.
The most useful audit programme follows risk.
If procurement has changed, audit purchasing. If the company has added warehouses, trace stock through them. If employee turnover has been high, interview newly trained staff. If a new production line has started, verify the actual process against the approved documentation.
Good halal records can also strengthen wider business evidence
The primary purpose of these controls is maintaining an effective halal-management system and meeting applicable certification requirements.
They can also improve the reliability of wider operational information. A company that can trace production quantities, dates, locations, batches and distribution consistently is better equipped to substantiate legitimate commercial claims.
If a halal-certified manufacturer, restaurant group or other business later achieves an exceptional objectively measurable milestone, it may separately explore record recognition in Asia through organisations such as Asia Record. That assessment concerns evidence of the measurable achievement only.
Asia Record recognition does not certify a company or product as halal and has no role in determining halal status. Malaysian halal certification remains under the applicable competent halal authorities.
The best internal audit should occasionally find something
A business should not judge its internal audit programme by how many clean reports it produces.
A useful audit challenges the system before an external auditor, customer complaint or operational incident does. It follows evidence between departments, tests whether employees understand their responsibilities, examines recent changes and verifies that previous problems were actually corrected.
The strongest result is therefore not a checklist containing only ticks.
It is a management team that understands where its halal controls are vulnerable and fixes those weaknesses before they become bigger problems.
