Corporate report

Audit of allergen controls and relevant open audit actions - Rhondda Cynon Taf

Published 1 September 2026

Applies to Wales

Foreword

The Food Standards Agency (FSA) is the Competent Authority (CA) responsible for feed and food safety and standards legislation and for ensuring risk-based official controls are carried out at feed and food business establishments in Wales, England, and Northern Ireland.

Feed and food official controls aimed at verifying food business compliance are fundamental to safeguarding public health and contribute to the FSA’s strategic outcome that ‘food is safe and what it says it is’.

Day-to-day monitoring and enforcement of feed and food business compliance is the responsibility of local authorities (LAs).

In Wales, the power to set standards and monitor LA feed and food law enforcement services was conferred on the FSA under Section 12 of the Food Standards Act 1999 and Regulation 7 of the Official Feed and Food Controls (Wales) Regulations 2009.  The FSA is required to monitor and audit local authority feed and food law enforcement services under this legislation and the assimilated Official Controls Regulation (EU) 2017/625. In developing its audit arrangements, the FSA has taken account of the European Commission guidance on how such audits should be conducted.  

In addition to assessing the delivery of official controls against legal requirements and statutory guidance, the audit process also provides the opportunity to identify and disseminate good practice and to provide information to inform FSA policy on the execution and enforcement of feed and food law.

FSA audit programmes assess local authorities’ conformance against the requirements of the assimilated Official Controls Regulation (EU) 2017/625 and the Feed and Food Law Enforcement Standard within the Framework Agreement on Official Feed and Food Controls by Local Authorities (Framework Agreement). Assessments were also made against the Food Law Code of Practice (Wales) 2021 (FLCoP) along with related centrally issued guidance including the Food Law Practice Guidance (Wales) 2021 (FLPG).  A new Code of Practice and Practice Guidance has been published and will be applied to ongoing recommendations where applicable.

This report is available in hard copy from the FSA’s Regulatory Audit and Assurance Team, Asiantaeth Safonau Bwyd yng Nghymru / Food Standards Agency in Wales, Llawr 4 / 4th Floor, Adeilad Llywodraeth Cymru / Welsh Government Building, Parc Cathays Park, Caerdydd / Cardiff, CF10 3NQ, and electronically on the FSA’s website.

1.0 Introduction

Background

1.1 Audits of LA feed and food law enforcement services are part of the FSA arrangements to improve consumer protection and confidence in relation to feed and food. Implementing official controls in food businesses at appropriate frequencies based on risk is essential to protect public health and ensure the safety of food for consumers.

1.2 Following the Covid pandemic, from 1 April 2023, LAs should be planning to:

• Carry out due interventions for establishments that are back in the routine programme of interventions in accordance with the frequencies set out in the FLCoP.
• Work towards realigning with the provisions set out in the FLCoP from 1 April 2023, using the full range of flexibilities already offered by the FLCoP. These flexibilities including exemptions can be found in Chapter 4 of the FLCoP and Chapter 4 of the FLPG.
• Continue to exercise a risk-based approach to the requirements set out in the FLCoP based on available resource.

1.3 A key part of the FSA’s remit in its role as a CA is to provide assurance for stakeholders and the public that food authorities, such as LAs, are correctly delivering and implementing any legislation, advice and guidance issued in relation to the services they provide. This audit programme, in tandem with the bi-annual performance surveys, provides a key element of the FSA’s overall assurance framework.

1.4 In Wales, the power to set standards and monitor LA feed and food law enforcement services was conferred on the FSA under section 12 of the Food Standards Act 1999 and regulation 7 of the Official Feed and Food Controls (Wales) Regulations 2009.

1.5 The Framework Agreement on Local Authority Food Law Enforcement sets out the arrangements through which the FSA monitors and audits LA enforcement activities to help ensure that LAs are providing an effective service to protect public health.

Scope of Audit Programme

1.6 This programme consists of a series of audits across Wales to assess compliance with legislation relating to the provision of allergen information to consumers and the risk posed to hypersensitive consumers, as well as reviewing any relevant open audit actions following previous audits. The audits assess whether LAs are undertaking interventions involving allergen assessments based on a programme of interventions that is in accordance with the FLCoP.

1.7 The audit assessment considered:

• Food standards service planning, delivery and review,
• Resources available to the service and the risk-based prioritisation of activities, including the assessment of new food businesses.
• Authorisation and competence of officers
• Interventions (programmed and reactive) and Enforcement
• Sampling Policy, procedures and programme
• Internal monitoring
• Any other matters relating to allergen controls
• Open audit actions – review of any relevant open actions from previous audits and associated update of the LA audit action plan.

1.8 As part of the development of the audit programme the FSA engaged with relevant stakeholders and produced an audit plan. This is attached in Annex A.

2.0 Executive Summary

2.1 The audit examined Rhondda Cynon Taf Council’s arrangements for the delivery of allergen related official food controls, a major part of the authority’s food standards function. This included a reality check at a food establishment to assess the effectiveness of official controls and more specifically, the checks carried out by the authority’s officers, to verify food business operator (FBO) compliance with legislative requirements. The scope of the audit also included an assessment of the authority’s overall organisation and management, and the internal monitoring of food standards activities.

2.2 The Director of Public Health, Protection and Community Services had overall responsibility for the delivery of food standards services within the Public Health & Protection Department. Day to day management was the responsibility of the Trading Standards & Registrar Services Manager.

2.3 The authority had service planning arrangements in place together with systems for reviewing performance. Service planning documents contained most, but not all of the information set out in the Service Planning Guidance, including the commitment to deliver the Council’s full obligations, a detailed analysis of resources required against those available, the requirement to review all elements of the previous year’s work and to address all variances in the plan.

2.4 Arrangements were in place to ensure effective service delivery by a sufficient number of appropriately authorised, competent officers who had been authorised in accordance with their qualifications, training and experience. This was identified as an area of good practice.

2.5 Database checks confirmed that whilst high and low risk interventions were being undertaken as required, a small number of medium risk establishments were overdue a food standards intervention and a small number of unrated premises had yet to receive an intervention. There was a plan in place to address the outstanding interventions and the authority were on track to fully re-align its intervention frequencies with the FLCoP by April 2026.

2.6 Intervention records showed that assessments of business allergen control compliance during food standards interventions were commonly of poor quality. Insufficient information was available in most cases to demonstrate that a thorough assessment had been undertaken by officers. Risk rating was generally correct but occasionally, there was a need to more accurately reflect compliance on allergen matters. Follow up action was mostly poor with revisits to check compliance having not been undertaken as required.

2.7 Food standards intervention reports were comprehensive, with all required information having been provided.

2.8 Whilst food standards sampling had generally been undertaken as required, there was evidence that appropriate follow up action was not undertaken to remove unsafe food from the market nor enforcement action taken to prevent a recurrence.

2.9 Complaints about food had been responded to within target times but had, generally, not been investigated as required. There was evidence that appropriate follow up action had not been undertaken to prevent a recurrence of contraventions.

2.10 The authority had not used an appropriate range of enforcement tools to secure improved business compliance with allergen control legislation. Low-level verbal advice was predominantly used, sometimes, where major contraventions had occurred.

2.11 There was limited evidence of internal monitoring of food standards matters, including allergen controls. The internal monitoring activity would benefit from improvement to ensure coverage of all official control activities, use of bulk database checks and better recording.

3.0 Audit Methodology

3.1 The LA received a pre-audit letter including a pre-visit questionnaire along with details of documents required to assess completion of previously outstanding recommendations.

3.2 The LA was also provided with a copy of any relevant audit reports /action plans and asked to provide evidence of their progress on outstanding actions.

3.3 This was followed by a structured on-site audit involving a reality visit to a local business and meetings with the Head of Service, LA lead officer and other relevant staff about current and future service delivery arrangements as well as an examination of a selection of food official controls records.

3.4 The audit took place from the 9th – 11th February 2026. The on-site element of the audit took 2½ working days.

3.5 The LA received this written audit report and an updated audit action plan, which will be published on the FSA website.

4.0 Audit Findings

4.1 Organisation and Management

4.1.1 Food law enforcement was overseen by the Director of Public Health, Protection and Community Services. The authority’s Constitution set out its decision-making arrangements. Under the Constitution, decisions on food-related operational matters had been delegated to the Director.

4.1.2 A ‘Food and Feed Service Plan 2025-2026’ (‘the Service Plan’) had been developed by the authority. Evidence of the approval of the Service Plan by the head of service had been provided. Whilst the head of service had been sub-delegated with the power to approve the Plan, this was conditional and evidence of meeting the condition had not been provided.

4.1.3 The Service Plan contained most of the information set out in the Service Planning Guidance, including a profile of the authority, the scope of the service and organisational structure chart for the Public Protection department. The times of operation, service delivery points and aims and objectives of the service were clearly set out.

4.1.4 The service plan indicated that there were 2069 food establishments in Rhondda Cynon Taf. The profile of businesses was provided by establishment type. The number of planned interventions due, by risk rating, had also been provided including those that were overdue.

4.1.5 The targets and priorities for food standards included a commitment to deliver all inspections / interventions due at high-risk and unrated establishments as required by the FLCoP but the commitment for the delivery of medium and low risk establishments fell short of that laid out in law and the FLCoP.

4.1.6 The expected number of revisits during the year, forms a required part of the intervention programme and an estimate of a small number of revisits was included in the service plan. However, there was no clear commitment to revisit establishments for food standards in accordance with the requirements of the law and the FLCoP.

4.1.7 The authority’s priorities and intervention-targets as set out in the Service Plan, based primarily on delivering interventions in high-risk and unrated establishments was not fully risk based in accordance with the Code.

4.1.8 The plan included an estimate of the likely demand for the food interventions programme, including the likely demand, based on previous years, for the reactive work required to be undertaken.

4.1.9 Information was provided on the food standards sampling programme which included participation in regional surveys. However, the plan was not fully risk-based as it did not include sampling during interventions, based on premises risk.

4.1.10 The resources available to deliver food law enforcement services were not detailed in the Service Plan although there was a statement that the available resources were sufficient. The plan needs to include a breakdown of the resources needed for each official control activity compared to those available in order to demonstrate the accuracy of the statement.

4.1.11 The Service Plan included information on the authority’s Enforcement Policy and its approach to staff development.

4.1.12 Arrangements for internal monitoring or ‘quality assessment’ of the food standards service through quantitative reporting arrangements was referenced within the plan along with a brief description of the qualitative internal monitoring arrangements for the service.

4.1.13 The Service Plan contained information following a review of delivering food official controls against the previous year’s plan. However, it was noted that whilst the review covered most areas of work, it did not cover all targets. The review should include the number of samples taken against the food standards sampling programme and the amount of reactive cases responded to within target times.

4.1.14 Following the review, variances in achieving the targets set out in the previous Service Plan had not identified in relation to a small backlog of medium and low risk (category B & C) interventions but the small number of unrated businesses had not been highlighted as a variance. Whilst an explanation was given for the category B & C variance, there was no explanation were given for the unrated premises.

4.1.15 The authority had committed to addressing the category B & C variance in its Service Plan in order to ensure re-alignment with the requirements of the law and the FLCoP, it was not clearly incorporated as an area for improvement.

Recommendations

4.1.16 The authority should:

• Ensure future Service Plans for food standards are developed in accordance with the Service Planning Guidance. In particular, a commitment and plan to deliver all due and overdue interventions, based on the requirements of the FLCoP, should all be provided. Also, an analysis of resources required against those available should be provided.

• Ensure the annual performance review includes all information on the previous year’s performance against the food service plan and any specified performance targets, standards and outcomes.

• Ensure all variances in meeting the food service plan are explained and addressed in its subsequent plan.

[Articles 5(1)(a) & (e) of assimilated Regulation (EU) 2017/625; FLCoP 2.3.3, FLPG 2.3.18.2, 2.3.18.3 & Annex 1]

4.2 Authorised Officers

4.2.1 The authority’s Scheme of Delegation of Powers to Officers, contained within its written Constitution, provided the Director of Public Health, Protection and Community Services with delegated powers to execute all duties relating to food services. This includes the delegated authority to authorise other officers and the power to instigate prosecutions.

4.2.2 A documented procedure had been developed for the authorisation of food standards officers based on their qualifications and experience and this was in accordance with relevant requirements.

4.2.3 The authority had appointed a suitably qualified and competent lead officer for food standards in accordance with the requirements of the FLCoP.

4.2.4 The authority had identified, within its Service Plan, that the available resources were sufficient to deliver the food standards function.

4.2.5 Provision of officer training was dependent on a formal training needs assessment. The authority was providing a combination of in-house and externally provided training. All officers were required to achieve 10 hours of continual professional development (CPD) on core food matters in accordance with the FLCoP.

4.2.6 An examination of the qualification and training records of five officers involved in the delivery of official food standards controls was undertaken. Records were being maintained by the authority for officers in the Council’s computer file & folder system.

4.2.7 All five officers had been authorised in accordance with evidence of their qualifications, training and experience. Authorisations had been signed by an officer with the delegated authority and included all the key legislation required for the delivery of the range of official controls required for allergens.

4.2.8 Academic and other relevant qualifications were available for all officers, and all but one had received the minimum 10 hours of CPD on core food matters required by the FLCoP and the authority’s own policies, in keeping with their duties. It was noted that the remaining officer had almost achieved this target and was expected to do so by the end of the year.

Good Practice

The authority had appointed a sufficient number of officers to undertake allergen control functions and had ensured that training needs had been assessed and were being met. Officers had been authorised correctly in line with their qualifications, training and experience.

4.3 Food Premises Inspections, Records and Reports

4.3.1 The authority provided information in its service plan which confirmed there were 2069 rated food businesses on the authority’s food standards establishment database at the start of the year. Immediately prior to the audit, the number of premises overdue an inspection were 18 medium risk (category B), with no high risk (cat A) or low risk (cat C) establishments. There were also 23 unrated establishments. Whilst some of the medium high-risk premises have since been inspected, the remaining backlog are expected to be fully addressed during next year’s work programme using existing resources.

4.3.2 Food standards intervention procedures were covered by the Service Plan and procedure OP402. Food standards interventions were being undertaken as part of a stand-alone inspection programme rather than combined. Whilst the procedures provided an overarching framework for undertaking interventions, they did not provide sufficient detail to cover the operational process. Auditors were unable to evidence that there was an instruction to undertake all interventions unannounced and lacked clarity on when revisits should be undertaken and what detail reports should contain and timescales for producing these.

4.3.3 Five food standards interventions carried out in the two years prior to the audit were examined. It was noted that only two out of five files contained relevant food registration details. The correct aide memoire had been used in all cases and observations were legible and retrievable. Four out of five cases had received an intervention at the correct frequency.

4.3.4 Auditors were able to establish that, in all cases, the visits had been unannounced, the nature and extent of food activities and details relating to available food management systems had been documented.

4.3.5 Record of discussions with any staff having key allergen management / control responsibilities was only available in two out of five cases. Auditors were able to establish that assessment of incoming traceability requirements was evidenced accurately in three out of five cases.

4.3.6 Compliance with composition requirements had been thoroughly assessed in all cases. Compliance with presentation and allergen labelling requirements had been assessed in four out of five files.

4.3.7 Auditors were able to determine that, as part of outgoing traceability, assessment of customer information product recall / withdrawal arrangements and whether to take samples had been examined in all cases.

4.3.8 Auditors were able to determine that allergen issues / contraventions from previous inspection were adequately assessed in one out of five cases. Inspection forms were fully completed in relation to allergens in two out of five cases.

4.3.9 Auditors were able to determine that risk ratings were consistent in all but one case. In the one case, the completed inspection form had not accurately captured the allergen risks at the premises.

4.3.10 Auditors were able to determine that reports were sent to the correct business address in a prompt manner to Food Business Operator / left on site in all cases.

4.3.11 Inspection details on computer database and file were up to date, accurate & consistent.

4.3.12 In four out of five cases, appropriate follow up action had not been undertaken. Three of these visits scored a 40 for compliance which should have triggered a revisit. Only one case out of five had flagged significant issues for future interventions.

Recommendations

4.3.13 The authority should:

1. Ensure that food standards interventions/inspections are carried out at the minimum frequency specified by the FLCoP and that revisits are undertaken as required. [Articles 9(1) & (2) of assimilated Regulation (EU) 2017/625; FLCoP 4.2, 4.2.2, 4.2.4, 4.2.5 & 6.4.1]

2. Ensure that the food standards intervention procedures are amended to include an instruction to undertake interventions unannounced, details of when to undertake revisits and the detail reports should contain including timescales for producing these. [Articles 12(1) of assimilated Regulation (EU) 2017/625; FLCoP 2.3.1]

3. Ensure that registration forms are retained and retrievable on the database. [Articles 5(1)(a) of assimilated Regulation (EU) 2017/625; FLCoP 2.6.3]

4. Ensure premises are rated correctly in relation to allergen matters. [Articles 5(1)(a) & (b), 9(1) & (2), of assimilated Regulation (EU) 2017/625; FLCoP 4.2.2, Annex 1]

5. Ensure that observations made and/or data obtained in the course of a food standards intervention/inspection is captured fully and accurately on the correct aide memoire and that it includes complete information on:

• assessments of food standards management systems, including all control measures in place for allergens,
• record of discussions with any staff having key allergen management / control responsibilities
• assessments of labelling, composition and presentation
• incoming traceability requirements in relation to allergens including details of suppliers, other businesses that produce or import for the business and ingredient specifications
• contraventions from previous inspection adequately assessed
• details of follow up actions in light of previous inspection findings including recurrent contraventions
• details of red flagging items for following interventions [Articles 5(1)(a) & (b), 13 & 14 of assimilated Regulation (EU) 2017/625; FLCoP, 4.4, 4.6,; FLPG 4.3.4.2, 4.3.4.3, 4.6]

Verification Visit to Food Establishment

4.3.14 A verification visit was undertaken at a food establishment with the authorised officer of the authority who had carried out the most recent food standards inspection. The main objective of the visit was to consider the effectiveness of the authority’s assessment of the systems within the business for ensuring that food meets the requirements of food standards law in relation to allergen controls.

4.3.15 The officer was unable to demonstrate their knowledge of the business nor provide auditors with an assurance that assessments of allergen controls had taken place as part of the inspection. The officer had not identified that there was insufficient training for staff in allergen control measures and that the system for ensuring staff had up-to-date information on the allergen content of food they were selling was inadequate. Neither these matters, nor the existence of allergen risks had been documented by the officer and the premises had not been sufficiently rated to reflect the risks to consumers. Furthermore, the opportunity to identify allergen-based contraventions and ensure preventative action had been put in place were missed, leaving an uncontrolled risk of harm to hypersensitive consumers.

4.4 Food Inspection and Sampling

4.4.1 The authority’s Service Plan contained information on the food standards sampling plan indicating participation in projects or surveys and included allergens. However, auditors were unable to determine that a risk-based approach was used by the Authority

4.4.2 The policy did not contain information relation to the originating authority notification, or the use of informal/ formal sampling. It stated that process monitoring was not a priority for the authority.

4.4.3 The food standards sampling procedure was contained in OP406 and covered many areas, such as equipment, sample size, out of hours sampling arrangements etc. However, it would benefit from the inclusion of information relating to method of sampling and sealing, labelling, bagging.

4.4.4 The authority had appointed a Public Analyst for carrying out analyses of food. The laboratory was on the recognised list of UK designated Official Laboratories.

4.4.5 Five food standards samples carried out in the two years prior to the audit were examined. All cases were assessed by an appropriate authorised laboratory and the results were made available to the food business in four out of five cases.

4.4.6 All details contained on the database stated that samples were unsatisfactory, but in two cases the original results from the Public Analyst were not available.

4.4.7 In all cases, no enforcement action had been taken following the unsatisfactory results. In three cases the analyst clearly stated that in each case the level was three times the limit to cause an anaphylactic reaction and that the food was unsafe. The determination by the Public Analyst that this food was unsafe for consumption should have been treated as a major non-compliance. However, the officers did not follow the enforcement policy and procedure and gave low level verbal allergen signposting advice. No investigation into the root cause of the failed samples was documented.

4.4.8 In another case, despite being asked for an allergen free product, the food business operator served an unsafe product. In turn, despite determining that sufficient information was available to the business, the officer did not take any further action to address this major non-compliance.

4.4.9 One file contained no information on the database or file about the actual follow up actions taken by the officer.

Recommendations

4.4.10 The authority should:

• Include in the sampling plan a programme of risk-based food standards sampling. Ensure the sampling policy and procedures include, as appropriate, details on originating authority notification, the use of informal/formal sampling, method of sampling (protection from cross contamination) and sealing, labelling, bagging. [Articles 9(1), 12(1) & 14, of assimilated Regulation (EU) 2017/625; FLCoP 2.3.1, 2.3.2, 2.3.3, 4.3, 4.3.3.1 & 4.4]

• Ensure that all results of samples taken are retained and retrievable for six years. This must include the notification of food business operators of the results of samples taken. [Articles 13(1) & (2), of assimilated Regulation (EU) 2017/625; FLCoP 2.3.1, 2.6.3, 4.4 & 4.6]

• Ensure that appropriate action is taken in relation to non-compliance following sampling. [Articles 5, 12, 137 & 138 of assimilated Regulation (EU) 2017/625; FLCoP 2.5, 4.3, 5.2, 6.3, 6.4; FLPG 6.3, 6.4]

4.5 Food and Food Premises Complaints

4.5.1 The authority had developed a procedure for undertaking food related complaints which outlined the criteria for investigations which was in accordance with the requirements. However, the procedures did not cover complaints about food premises. Furthermore, the procedure should include details on how and when to notify the FSA, including in relation to Single Liaison Body referral.

4.5.2 The procedure would also benefit from identifying the need to inform the complainant of the outcome of their complaint and to detail / hyperlinks on how to notify primary, home and originating authorities.

4.5.3 An examination of records relating to five complaints or service requests received by the authority were undertaken. Auditors were able to confirm that, where appropriate, liaison had taken place with suppliers. manufacturers, Primary Authorities and the FSA.

4.5.4 On three out of five cases the auditor was able to determine that an accurate investigation had been undertaken. However, in three cases there was insufficient information to determine that appropriate action had been taken following the complaint.

4.5.5 Auditors were particularly concerned by a case where a child had been exposed to a declared allergen on two separate occasions at a local authority school. There was insufficient detail provided within the file to demonstrate that the root cause of the incidents had been determined, or that the Director of Education, as the food business operator, had been informed of the outcome. The food standards service informed the complainant that no further action would be taken, other than monitoring compliance during future inspections. The decision not to take further action was not supported by evidence. In addition, the next inspection frequency for the school was subsequently reduced to 5 years, rather than maintaining the 2 year interval dictated by its risk rating category. The evidence in this case demonstrated a serious failure to fully investigate a case where harm had been caused to a child, twice, whilst in the care of the local authority, or to take appropriate follow up action in order to prevent a recurrence.

Recommendations

4.5.6 The authority should:

• Ensure that the complaints procedure includes details on handling complaints about food premises, details on how and when to notify the FSA (including in relation to Single Liaison Body referral), information on notifying the complainant of the outcome of their complaint and details on how to notify primary, home and originating authorities. [Articles 12(1) of assimilated Regulation (EU) 2017/625; FLCoP 2.3.1,]

• Ensure that records of food complaints or service requests are retained and are retrievable. Ensure such cases are thoroughly investigated and appropriate action is taken in relation to non-compliance. [Articles 5, 12, 13(1), 137 & 138 of assimilated Regulation (EU) 2017/625; FLCoP 2.3, 2.6, 4.4, 4.6, 6.3 & 6.4 FLPG 2.3.2.4, 4.6]

4.6 Enforcement

4.6.1 The authority had developed a Corporate Enforcement Policy which had been approved by the Cabinet. The Policy advocated a graduated approach to enforcement and was generally in accordance with Food Law Code of Practice and other official guidance. The Policy provided criteria for the taking of all enforcement actions, referred to the Primary Authority scheme but did not include information to direct action in establishments where the Council itself has an interest, such as schools, care homes, and leisure centres.

4.6.2 The food standards service did not have documented procedures for the full range of enforcement notices including Food Information Regulation Improvement Notices (FIRINs), detention, seizure and voluntary surrender available to them. The procedures should ensure that enforcement is undertaken to align with the Code.

4.6.3 No enforcement action in terms of the service of FIRINs, detention, seizure, certification or voluntary surrenders relating to allergens had been undertaken within the scope of the audit and were therefore not assessed.

4.6.4 The authority had provided documented procedures for the commencement of prosecutions and undertaking simple cautions. A separate procedure was available for compliance with Police and Criminal Evidence Act 1984 considerations which was also satisfactory. These procedures considered most aspects of this work but would benefit from further development to fully capture the Disclosure Officer role and to document the process for issuing Simple Cautions.

4.6.5 No case files relating to allergen controls had been escalated for a decision by the Prosecuting Officer within the scope of this audit.

Recommendations

The authority should:

• Review and amend its enforcement policy and procedures in order to include information to direct action in establishments where the Council itself has an interest, to fully capture the Disclosure Officer role and to document the process for issuing Simple Cautions. [Articles 5(1 (a) & (b), 12 of assimilated Regulation (EU) 2017/625, FLCoP 2.3, 2.3.1, 2.3.2 & FLPG 2.3.10]

• Review and amend its enforcement procedures for food standards to ensure that enforcement action relating to FIRINs, Detention, Seizures and Voluntary Surrenders are fully documented. [Articles 5(1 (a) & (b)& 12of assimilated Regulation (EU) 2017/625 FLCoP 2.3, 2.3.1]

• Ensure appropriate enforcement action is undertaken to ensure non-compliance identified during interventions, sampling and complaint investigations are remedied. [Articles 5(1 (a) & (b), 12 & 138 of assimilated Regulation (EU) 2017/625, FLCoP 6.3 & 6.4, FLPG 6.4, 6.6]

4.7 Internal Monitoring

4.7.1 Internal monitoring is important to ensure performance targets are met, services are being delivered in accordance with legislative requirements, centrally issued guidance and the authority’s procedures. It also ensures consistency in service delivery.

4.7.2 Key performance targets have been identified in line with the FLCoP and the authority has arrangements in place for both quarterly and annual quantitative internal monitoring across the food services. Performance was reported through the corporate performance monitoring system and at departmental level.

4.7.3 A documented internal monitoring procedure had been developed for the food standards service including officer responsibilities, accompanied visits and a sample of file checks relating to interventions. The procedures would benefit from improvement to specify for the use of bulk database checks and to include standard record forms for monitoring of file checks.

4.7.4 Line managers were responsible for internal monitoring of the food enforcement services at an operational level.

4.7.5 Auditors were able to verify that some qualitative internal monitoring had been undertaken across the service including record checks of interventions.

4.7.6 Where internal monitoring had taken place, evidence in the form of records, for the nature and extent of that monitoring, was not available; except for the matters that required feedback to officers. The system would benefit from ensuring records are maintained for all official control activities, including sample follow ups, incidents and service request investigations.

4.7.7 The records relating to internal monitoring that were available, were being maintained by managers for at least two years.

Recommendations

4.7.8 The authority should:

• Revise its documented internal monitoring procedures to ensure all relevant activities are subject to proportionate monitoring. This should include bulk database checks.

• The internal monitoring taking place in practice should include sample follow ups, incident responses and service request investigations and records for what was checked on each case file.

[Articles 5(1)(a), 5(1)(b) & 12 of assimilated Regulation (EU) 2017/625, FLCoP 2.3.1 & FLPG 2.3.2]

4.8 Relevant open audit actions

4.8.1 Relevant open audit actions from previous audit programmes were followed up.  This includes those from the full audit programme of 2013 - 2017 and the Food Hygiene Rating Scheme focussed audit of 2017. 

4.8.2 An updated action plan has been published on the FSA website.

Auditors: Craig Sewell, Angela Phillips

Division: Regulatory Audit and Assurance Team, Asiantaeth Safonau Bwyd yng Nghymru / Food Standards Agency in Wales, Llawr 4 / 4th Floor, Adeilad Llywodraeth Cymru / Welsh Government Building, Parc Cathays Park, Caerdydd / Cardiff, CF10 3NQ

Annex A: Audit Plan

Food Standards Agency in Wales

Local authority audit plan – Wales

April 2025 – March 2026

Programme Brief

Sarah Maddox, Head of Regulatory Audit and Assurance, FSA in Wales Sarah.Maddox@food.gov.uk

Craig Sewell, Senior Audit Manager, FSA in Wales – Lead Auditor wales.audit@food.gov.uk

Background

In Wales, the power to set standards and monitor local authority (LA) feed and food law enforcement services was conferred on the Food Standards Agency (FSA) under section 12 of the Food Standards Act 1999 (the Act) and regulation 7 of the Official Feed and Food Controls (Wales) Regulations 2009 (OFFC).

The Act provides the FSA with statutory powers to strengthen its influence over enforcement activity and to ensure national priorities and objectives will be delivered at a local level. It gives the FSA powers to carry out the following duties:

• set standards of performance in relation to enforcement of feed and food law
• monitor the performance of feed and food law enforcement authorities
• require information from LAs relating to food law enforcement and to inspect any records
• enter LA premises, to inspect records and take samples
• publish information on the performance of LAs
• make reports to individual LAs, including guidance on improving performance

Assimilated Regulation (EU) 2017/625 on official controls and other official activities performed to ensure the verification of compliance with feed or food law includes a requirement, under Article 6, for competent authorities to carry out internal audits or to have external audits carried out.

To fulfil this requirement the FSA provides assurance for stakeholders and the public that competent authorities (CAs) such as LAs, are correctly delivering and implementing any legislation, advice and guidance issued in relation to the services they provide. This audit programme, in tandem with the bi-annual performance surveys, provides a key element of the FSA’s overall assurance framework.

The audits in this audit programme will be a systematic and independent examination of the delivery of official controls by LAs in relation to food law in Wales.

Programme Objectives

The audit programme will look at official controls and official activities carried out from 01 April 2023. Management activities relating to the implementation of the legislation in the criteria before this date will also be included in the audit programme.

The audits will demonstrate whether the implementation of official food controls relating to allergens in Wales has been effective. Failure to secure compliance with food law which could detrimentally affect the health and welfare of people in Wales could result in reputational damage to LAs and the FSA, as well as loss of confidence in the food industry.

The focused audit programme will include an examination of the official controls, official activities and related results that are used by LAs to achieve the objectives of the Legislation below:

• The Food Safety Act 1990
• Assimilated Regulation (EU) No 1169/2011 on the provision of Food Information to Consumers
• The Food Information (Wales) Regulations 2014

The specific aims of this audit programme are to:

• provide assurance that the delivery of allergen labelling legislation that has been in operation since 2014 in Wales, has been effectively implemented by LAs; in that official controls are being delivered in accordance with the Food Law Code of Practice (Wales) (the Code), Food Law Practice Guidance (Wales), Framework Agreement and other centrally issued, official guidance and legislation.
• evaluate LA activities in relation to food businesses providing products Pre-Packed for Direct Sale (PPDS) to consumers which came into force in October 2021.
• identify and disseminate any areas of good practice and innovation to other LAs to improve the effectiveness and efficiency of controls being delivered
• provide a means to identify under performance in the LAs food law enforcement systems
• provide information to aid the development of FSA policy.
• review LA progress in implementing any relevant outstanding recommendations from previous audits

Scope of the Audit Programme

This programme will consist of a series of audits across Wales to assess the compliance with legislation relating to the provision of allergen information to consumers and the risk posed to hypersensitive consumers, as well as reviewing any relevant open audit actions following previous audits. The audits will assess whether LAs are undertaking interventions involving allergen assessments based on a programme of interventions that is in accordance with the Code.

The audit programme will focus on the risks associated with the following areas of official control:

• Food standards service planning, delivery and review,
• Resources available to the service and the risk-based prioritisation of activities, including the assessment of new food businesses.
• Authorisation and competence of officers
• Interventions (programmed and reactive) and Enforcement
• Sampling Policy, procedures and programme
• Internal monitoring
• Any other matters relating to allergen controls

Open audit actions – review of any relevant open actions from previous audits and associated update of the LA audit action plan.

Assessment Approach

The audits will involve:

• a pre-audit questionnaire requesting copies of the LA service plans, planned/completed interventions and associated documentation
• the LA will also be provided with a copy of previous audit action plans and will be asked to provide evidence of their progress on any outstanding actions
• this will be followed by a structured on-site audit involving meetings with the Head of Service, LA lead officers and other relevant staff about current and future service delivery arrangements, a reality check visit and case file reviews.

Notification

Prior notification of 4 weeks for the submission of pre-audit material and at least 6 weeks of an audit visit, will be given for each audit carried out under this audit plan. This will aid transparency and facilitate the effectiveness of the audit process by allowing plenty of time for each LA to collate documents and ensure appropriate staff and facilities are available.

Timing

The audits will take place between May 2025 and February 2026. The on-site element of the audit, for each LA, should take 2 working days for assessment work followed by a closing meeting on a third day.

Assessment Report and Follow Up

All LAs in the programme will receive an individual report and an updated audit action plan, both of which will be published on the FSA website. An assessment of overall assurance for allergen controls will also be sent to each local authority but will not be published.

At the end of the programme an anonymised summary report will be produced which will contain findings from the audit programme. The summary report will include recommendations for LAs and the FSA to improve the delivery of official controls. The summary report will also highlight any common themes and emerging issues as well as any areas of good practice identified during the programme.

Planned Outcomes

Immediate Outcomes:

• Provide assurance regarding the arrangements in place for the delivery of LA official controls in managing the food safety risk relating to hypersensitive individuals posed by exposure to Allergens
• Improvements and actions taken by LAs contribute to more effective local food law enforcement
• Wider dissemination of identified good practice will contribute to improvements in quality and effectiveness of LA delivery of official food controls
• Findings and recommendations will be fed back to relevant FSA teams to inform policy making
• The audits will ensure that the FSA is fulfilling its’ statutory function.

Strategic Outcomes:

• The audits will raise the profile of the food service within LAs and help them maintain/enhance their resource allocation
• Robust assurance on the LA implementation of Official Feed and Food Control (OFFC) requirements
• Improved business compliance with food hygiene and standards contributes to improved public health and reduces the likelihood of foodborne illness, food incidents and food fraud
• Contribute towards FSA strategic risk management and compliance with UK obligations under OFFC requirements & the Food Standards Act 1999

Annex B:  Allergen controls audit action plan

Action Plan for Rhondda Cynon Taf County Borough Council

Audit Date: 9th – 11th February 2026

TO ADDRESS (RECOMMENDATION INCLUDING STANDARD PARAGRAPH)	BY (DATE)	PLANNED IMPROVEMENTS	ACTION TAKEN TO DATE
4.1.16 The authority should: (i) Ensure future Service Plans for food standards are developed in accordance with the Service Planning Guidance. In particular, a commitment and plan to deliver all due and overdue interventions, based on the requirements of the FLCoP, should all be provided. Also, an analysis of resources required against those available should be provided.	July 2026	The 2026-27 plan will include revisit requirements and all frequencies in line with the FLCoP. Analysis of resource required will be estimated, although it is noted that due to the implementation of the Food Standards Delivery Model during 2026, it is unlikely that a reasonable determination of resource will be possible until the 2027-28 plan.	Early estimates of resource required are being undertaken, based on initial converted data provided by the FSA.
4.1.16 (ii) Ensure the annual performance review includes all information on the previous year’s performance against the food service plan and any specified performance targets, standards and outcomes.	July 2026	The 2026-27 plan will be amended to include all matters identified in the audit report (including revisits and sampling)	[blank]
4.1.16 (iii) Ensure all variances in meeting the food service plan are explained and addressed in its subsequent plan.	July 2026	The 2026-27 plan will be amended to include matters relating to variances	[blank]
4.3.13 (i) Ensure that food standards interventions/inspections are carried out at the minimum frequency specified by the FLCoP and that revisits are undertaken as required.	April 2026	The remaining overdue interventions will be completed by the end of the year, as identified by auditors in 4.3.1.	[blank]
4.3.13 (ii) Ensure that the food standards intervention procedures are amended to include an instruction to undertake interventions unannounced, details of when to undertake revisits and the detail reports should contain including timescales for producing these.	July 2026	OP402, para 4.5.5 will be reviewed and amended to reflect the FLCOP in that Officers should undertake unannounced visits to food and feed premises and should only consider prior notification where notice is necessary and duly justified for the control to be undertaken as per the Food and Feed Law Codes of Practice.	Reminders to staff in relation to revisits was provided in Team Meeting on 17th February 2026.
4.3.13 (iii) Ensure that registration forms are retained and retrievable on the database.	April 2026	Environmental Health colleagues will be reminded to attach registration forms to the MIS premises record. All Officers to check MIS system for registration form prior to visit advise FBO to complete if not available.	[blank]
4.3.13 (iv) Ensure premises are rated correctly in relation to allergen matters.	Complete	The allergen scheme within the new FSDM will ensure thorough assessment of allergen controls is undertaken.	Instructions to staff in relation to recording sufficient information in relation to allergens / allergen systems was provided in Team Meeting on 17th February 2026.
4.3.13 (v) Ensure that observations made and/or data obtained in the course of a food standards intervention/inspection is captured fully and accurately on the correct aide memoire and that it includes complete information on: 1) assessments of food standards management systems, including all control measures in place for allergens 2) record of discussions with any staff having key allergen management / control responsibilities 3) assessments of labelling, composition and presentation 4) incoming traceability requirements in relation to allergens including details of suppliers, other businesses that produce or import for the business and ingredient specifications 5) contraventions from previous inspection adequately assessed 6) details of follow up actions in light of previous inspection findings including recurrent contraventions 7) details of red flagging items for following interventions.	Complete	[blank]	Reminder to staff in relation to recording sufficient information of all listed point was provided in Team Meeting on 17th February 2026.
4.4.10 (i) Include in the sampling plan a programme of risk-based food standards sampling. Ensure the sampling policy and procedures include, as appropriate, details on originating authority notification, the use of informal/formal sampling, method of sampling (protection from cross contamination) and sealing, labelling, bagging.	July 2026	The 2026-27 sampling plan will be amended to include reference to risk-based sampling. A work instruction will be drafted and hyperlinked from OP406 (Sampling): this will provide detail as listed.	[blank]
4.4.10 (ii) Ensure that all results of samples taken are retained and retrievable for six years. This must include the notification of food business operators of the results of samples taken.	Complete	[blank]	Reminder to staff in relation to ensuring all records are linked and those links are working was provided in Team Meeting on 17th February 2026.
4.4.10 (iii) Ensure that appropriate action is taken in relation to non-compliance following sampling.	April 2026	The sampling procedure will be expanded to include the necessary further action required where unsatisfactory sample results are received. Formal Samples must be undertaken in a strictly controlled manner, following procedures laid down in specific regulations and Codes of Practice. Informal samples can be taken and submitted for analysis. All unsatisfactory results whether formal or informal will be discussed with the Principal Officer or Service Manager to determine and agree next steps. The rationale for decision to progress or no further action must be documented and agreed and the database updated. All sample results shall be attached to the sample record. Appropriate action may include re-sampling or conducting a visit to the premises as soon as practical. During any visit, the Officer will inform the food business operator of the result and investigate possible contributory factors and notify the relevant Home Authority/Primary Authority. If requested, a copy of the report will be provided to the food business operator. Follow up samples will also be taken where appropriate. Samples which are unsatisfactory may lead to formal action being taken in accordance with the Corporate Enforcement Policy.	[blank]
4.5.6 (i) Ensure that the complaints procedure includes details on handling complaints about food premises, details on how and when to notify the FSA (including in relation to Single Liaison Body referral), information on notifying the complainant of the outcome of their complaint and details on how to notify primary, home and originating authorities.	July 2026	OP405 (Complaints) will be updated to include listed matters, where they are not already explicit. OP107, para 4.1 states that all requirements within the Quality Manual relate to all legislative duties, including Food and Feed Safety.
4.5.6 (ii) Ensure that records of food complaints or service requests are retained and are retrievable. Ensure such cases are thoroughly investigated and appropriate action is taken in relation to non-compliance.	May 2026	The complaints procedure will be reviewed and updated where applicable. File monitoring will be implemented by Principal Officer to evaluate compliance with procedure. Staff will be informed accordingly.	Reminder to staff in relation to ensuring all records are linked and those links are working was provided in Team Meeting on 17th February 2026.
4.6.6 (i) Review and amend its enforcement policy and procedures in order to include information to direct action in establishments where the Council itself has an interest, to fully capture the Disclosure Officer role and to document the process for issuing Simple Cautions.	May 2026	Review Public Protection procedures to include details of escalation where LA premises are involved and information relating to legal process. The CEP will need to be updated to indicate what action to be taken where breaches committed by the Authority and responsible delegated roles.	Recommendation will be communicated to the Director of Legal and Democratic Services who holds responsibility for the Corporate Enforcement Policy.
4.6.6 (ii) Review and amend its enforcement procedures for food standards to ensure that enforcement action relating to FIRINs, Detention, Seizures and Voluntary Surrenders are fully documented.	September 2026	Relevant procedures will be amended in relation to matters listed.	[blank]
4.6.6 (iii) Ensure appropriate enforcement action is undertaken to ensure non-compliance identified during interventions, sampling and complaint investigations are remedied.	May 2026	A review will be undertaken of Public Protection policies and amendments made. Staff will be informed of the changes and any identified training undertaken.	[blank]
4.7.8 (i) Revise its documented internal monitoring procedures to ensure all relevant activities are subject to proportionate monitoring. This should include bulk database checks.	September 2026 and July 2027	A monitoring check form will be drafted, to capture 10 % of what has been assessed. The ability to carry out bulk database checks will be assessed after implementation of FSDM; where possible, this will be actioned.	[blank]
4.7.8 (ii) The internal monitoring taking place in practice should include sample follow ups, incident responses and service request investigations and records for what was checked on each case file.	September 2026	Implement the same monitoring check form as 4.7.8 (i) across sampling and complaints.	[blank]