ISO, HACCP and GDP internal audit in Montenegro
Review your ISO, HACCP or GDP system in Montenegro through process checks, evidence sampling, reported findings and planning of corrective actions.
Request an initial assessment
Review your ISO, HACCP or GDP system in Montenegro through process checks, evidence sampling, reported findings and planning of corrective actions.
Request an initial assessment
An internal audit checks whether the processes, documentation and daily practice really meet the requirements of your system. ConsultHQ conducts internal ISO audits, HACCP checks and GDP self-inspections adjusted to current standards and regulatory requirements, with clear findings and priorities for corrective actions before external checks.
The system may look good while looking only at the documentation.
The problem often appears only when the auditor follows the actual process, talks to employees, or selects a specific record and follows it from start to finish.
Then it becomes visible where procedure and practice are not harmonized.
A good internal audit detects that problem while the company still has room to control it.
The name "internal audit" is often used for different types of checks.
However, the methodology must follow the system we are checking.
With the ISO system, we use the principles and audit approach from the current one ISO 19011:2026, which provides guidelines for auditing management systems, managing audit programs and auditor competencies. ISO 19011:2026 was published on 27 May 2026 and replaced the 2018 edition.
With HACCP, the focus is on verifying that procedures based on HACCP principles and good hygiene practice really work. The new Montenegrin Law on Food Safety from 2026 expressly links HACCP to the validation and verification of certain procedures, while the Food Hygiene Regulation transfers the requirements of Regulation (EC) 852/2004 with relevant amendments.
At GDP, the current guidelines have a separate chapter for internal checks. They require a program that, at defined intervals, includes all relevant GDP areas, recorded findings and monitoring of the necessary CAPA activities.
That's why we adapt the method to the criterion.
We do not use one generic audit checklist for three different systems.
ISO 19011:2026 provides current international guidelines for auditing management systems.
The standard includes principles of auditing, management of the audit program, preparation and implementation of audits, reporting and competencies of auditors. The new edition further emphasizes a risk-based approach, digitization and auditing in modern physical and virtual environments.
ISO 19011 is not a certification standard.
It provides a methodological framework for a quality audit of ISO systems such as ISO 9001, ISO 14001 and other management system standards.
During the internal audit, we therefore do not only check the presence of procedures.
We monitor processes, sample evidence and assess whether the company is working according to its own system and the requirements of the relevant standard.
An ISO 9001 audit gives more value when the auditor follows the actual work flow.
For a manufacturing company, this may mean following customer requirements through sales, procurement, production, control and delivery.
In a service company, the process can start with a client's request and end with the realization of the service and the processing of feedback.
This is how you can see the connections between functions.
There can be a good procurement procedure and a good manufacturing procedure, yet important information is lost between the two processes.
The internal audit should find exactly such gaps before the certification audit.
For relevant operators, an ISO 14001 internal audit checks preparedness for environmental incidents and duties under the Law on Liability for Environmental Damage as amended in 114/2026. We sample evidence that responsibilities, preventive measures, notification steps and response records are understood and usable.
Where a company handles chemicals, the internal audit checks whether applicable requirements of the Law on Chemicals 114/2026 and the published Rulebooks 136/2026 and 137/2026 are reflected in its compliance obligations, operational controls and implementation records.
Dates of entry into force: Rulebook 136/2026 — 26 September 2026; Rulebook 137/2026 — 29 September 2026.
With ISO 14001, documentation is only one part of verification.
An audit may cover significant environmental aspects, relevant compliance obligations, operational controls, objectives and how the organization monitors its environmental performance.
The current ISO 14001:2026 further links the system with climate change, resources, biodiversity and the wider context of the organization.
That's why the internal audit should check whether changes in standards are visible in the real system.
If the company is switching from ISO 14001:2015, we can connect the audit with the previously conducted transition gap analysis.
In this way, it is checked whether the planned changes have actually been introduced.
Where relevant, an ISO 14001 internal audit also samples compliance with the Waste Management Law as amended by 128/2026: records, operators’ contracts and authorisations, EPR data quality and whether the waste-management plan was reviewed on time after a significant change.
For covered operators, an ISO 14001 internal audit may sample the processes producing regulatory GHG data: use of the current monitoring plan, data sources, responsibilities and records. This internal review is not formal verification of an emissions report, which is conducted by an accredited verifier under a separate procedure.
Only for clients with an EIA decision or approval may an ISO 14001 internal audit check whether applicable conditions appear in procedures, assigned tasks, controls and records. The internal audit does not replace the statutory EIA process or project documentation prepared by authorised specialists.
Where applicable, an ISO 14001 internal audit checks emissions permits or another relevant regime, measurement results, stationary-source records and evidence of compliance with Law 117/2026 and Correction 120/2026. An internal audit does not replace an official inspection or accredited measurement. Read the Air Protection Law guide.
For clients handling quick-frozen food, an internal audit samples temperature records, checks suitable measuring and recording instruments, access to data and documented deviations. Findings are linked to affected goods, vehicles or stores and the subsequent disposition decision.
For food manufacturers, an internal audit checks whether the approved recipe, actual additive dosing and product label agree. A sample of production records is used to trace formulation changes and evidence that authorisation and conditions of use were checked for the relevant food category.
In food production, we check that packaging approval is supported by suitable specifications and supplier evidence, including a declaration of compliance when required. A change of material or intended use should be linked to the HACCP assessment and production records.
During an internal HACCP review under Regulation 91/2026, we look for evidence of food safety culture: clear responsibilities, communication about deviations, hygiene controls in practice, allergen management and appropriate staff training.
With HACCP, one should not simulate an ISO audit just because we use the word "audit".
The focus is on the functionality of the food safety system.
We check whether procedures, controls and records correspond to the actual process and whether employees understand their responsibilities.
For restaurants, this may include kitchen, storage, hygiene, allergens and relevant records.
For food manufacturers, an internal review connects laboratory results under applicable criteria in Regulation 84/2026 with lot identifiers, traceability and HACCP controls. We check whether a specific batch can be traced through production and, where needed, recall.
The new Montenegrin regulatory framework from 2026 is additionally aligned with the EU acquis and sets up a modern food safety control system.
That's why we base the HACCP check on the current process and requirements that correspond to the specific activity.
HACCP is not complete when the company defines control points.
The system must periodically confirm that the defined procedures really work.
The current Law on Food Safety in Montenegro requires, among other things, that relevant producers and entities that prepare food use sampling and other procedures for validation and verification of their processes where prescribed.
Internal verification can therefore link:
The goal is not to find as many errors as possible.
The goal is to determine whether the system provides reliable control.
The GDP guidelines have a very specific requirement for internal checks.
CInMED's guidelines state that internal audits are conducted to monitor implementation and compliance with GDP principles and propose necessary corrective measures. The program should cover all GDP areas and compliance with regulations, guidelines and procedures at defined intervals.
The verification should be carried out impartially and in detail, with appropriate competence.
The guidelines allow for the support of independent external experts, but emphasize that an external expert does not replace the organization's obligation to have its own internal verification system.
This is also important for the way ConsultHQ provides the service.
We can conduct an independent professional review and help the company develop its program, but GDP internal reviews must remain integrated into the quality system of the wholesaler itself.
For ISO 14001 clients with an integrated permit, an internal audit can sample whether permit conditions, assigned responsibilities, emissions monitoring and related records are reflected in operating processes. The audit does not replace regulatory inspection or the formal permit procedure. Our article on integrated permits for industrial installations explains the scope.
With wholesale, we get the most information when we follow a specific process.
We can start from the approved supplier and the receipt of the product.
Then we monitor its status, storage, possible temperature requirements, issuance and transport to the customer.
Along the way, it becomes visible whether:
Such an audit provides more value than a mere review of the SOP register.
A person should not check his own work without appropriate measures to preserve objectivity.
ISO 19011:2026 specifically mentions independence, an evidence-based approach and a risk-based approach among the auditing principles.
In smaller companies, complete internal independence is sometimes not practical.
Then an external auditor can be useful.
You get a person who is not daily involved in the process and more easily notices the discrepancy between documentation and practice.
It is especially useful when a company is preparing for an important certification audit or regulatory review.
We define the scope before the start of the check.
The audit can cover the entire system or only certain processes that carry a higher risk.
Service may include:
Not every audit has to be a multi-day project.
The scope should be appropriate to the organization and the reason for the audit.
A report without clear findings has little value.
The client should know what the auditor saw, according to which criteria he assessed the situation and where there is a deviation.
That's why we link the findings to concrete evidence.
We separate more serious non-conformities from minor weaknesses and opportunities for improvement.
We don't clutter the report with a lot of style suggestions while there is a more serious problem in the process.
Priority should follow risk.
An internal audit has value only if the findings lead to appropriate action.
For a simple deviation, the solution can be straightforward.
In the case of a recurring or more serious problem, it is necessary to determine the cause and define a corrective measure that prevents recurrence.
GDP guidelines expressly link internal checks with documented and monitored corrective and preventive measures.
Since June 2026, CInMED has been using a special CAPA model after the GDP inspection, which additionally shows the regulatory importance of a well-established CAPA system.
ConsultHQ can support the team in structuring a corrective plan.
Ownership of the measure should still remain with the responsible function within the company.
Gap analysis is used when you want to know what is missing in relation to a specific requirement.
An internal audit makes sense when a system already exists and we want to check its implementation and compliance.
In practice, the two services can be linked.
A company that is implementing ISO 9001 for the first time can start with a gap analysis, close the gaps and then conduct an internal audit before certification.
Wholesale can first do a GDP gap analysis according to the latest requirements, and later a self-inspection after the corrections are put into practice.
This gives a logical sequence of work.
An internal audit can significantly improve a company's readiness.
But it cannot guarantee that the external auditor will not find additional findings.
External audit is an independent procedure.
Our goal is to find as many relevant weaknesses as possible before it and give the company time to properly address them.
This is especially valuable in the case of a new system, a change in standards or a longer period without quality internal verification.
With food, preparation should not mean sorting out the paperwork a few days before the inspection.
The Law on Official Controls (72/2026) applies from June 5, 2026 and governs compliance checks throughout the food chain. Our internal readiness review for official controls therefore examines HACCP procedures in practice, documentation and records from routine operations.
That's why internal verification should also include practice in the facility.
We review whether what is written in the system corresponds to what the employees actually do.
Such an approach provides a more realistic preparation than checking the documentation itself.
We align the self-inspection programme with CInMED’s GDP guidelines of 22 July 2026 and the GDP inspection procedure from the EU Compilation of Union Procedures published by CInMED on 19 August. An internal finding should have an owner, deadline, CAPA and effectiveness check; CInMED alone conducts the regulatory inspection and decides on the GDP certificate.
The GDP guidelines do not require that the entire system be necessarily reviewed at once.
The program can be divided into several individual checks of a limited scope, provided that it covers all relevant GDP aspects over a defined period of time.
This is especially useful for larger wholesalers.
One check may focus on storage and temperature.
The second on suppliers, customers and contracted activities.
Third on CAPA, complaints and withdrawal.
Thus, the program remains operationally viable, and the system still receives a complete periodic check.
The result should be clear enough for management to decide what to do next.
Depending on the system and volume, the client receives:
The audit does not need to create a new administration.
It should show where the existing system really needs attention.
An audit that has no meaningful findings for years is not automatically proof of a perfect system.
It can be a sign that the check is not deep enough.
Formal verification of signatures and dates easily misses a process problem.
That is why we base the audit on sampling, evidence, interviews and real processes.
A good auditor is not there to "bring down" the system.
But it is not even there to confirm the desired result in advance.
The value of an audit comes from an objective finding.
A company preparing for an ISO 9001 certification audit needs a different program than a restaurant that wants to check HACCP before an official inspection.
GDP wholesale has a third regulatory framework.
Therefore, before the audit, we define the system, goal, locations and processes that should be covered.
Based on this, ConsultHQ can propose a full audit of the system or a targeted check of areas with a higher risk.
The goal is to find relevant deviations while the organization can still address them in a controlled manner — before an external auditor, customer or competent authority does.
An initial assessment helps us define scope and next steps based on your actual business.
Request an initial assessment