The Internal Audit Programme: Finding Your Own Findings First

The internal audit programme is the mechanism that makes the rest of this guide true: a risk-based cycle that reconciles the registers against the declarations against the physical packaging, samples the technical files against the packs they describe, walks the sites where packaging decisions happen (the pack bench, the returns desk, the artwork studio), and tests the supplier declarations the whole structure rests on. Its findings are tracked to closure with owners and dates, and its calendar is keyed to the framework's phases - the audit questions of 2027 (data and substances) differ from those of 2029 (deposit and labelling readiness) and 2030 (grades and content in production).

This guide specifies the programme's cycles and its highest-yield tests.

Three reconciliations, run at least annually, find the majority of real-world findings before authorities do. Placed-quantity reconciliation: order and shipment data against EPR declarations against scheme invoices, by state and material - breaks here are fee exposure and credibility damage in one. File-to-pack sampling: a statistical sample of live SKUs whose technical documentation is pulled and checked against the physical article (composition, marks, claims, certificate scopes) - breaks here are the surveillance file-to-pack finding in rehearsal. Identity reconciliation: the entity names and numbers across registers, marketplaces, representatives and invoices - breaks here are the suspension ladder's clerical traps. Each reconciliation is a defined procedure with tolerances, an exception report and a remediation SLA; run them as controls, reported to the compliance owner, not as projects.

The site walk audits what documents cannot: the pack bench's actual carton choices against the ratio rules, the returns desk's segregation, the artwork versions physically in production against the register, the retained samples' existence. Supplier testing audits the chain's honesty at its load-bearing points: a sample of supplier declarations verified against evidence (certificates checked at source, content shares traced to contracts and deliveries, substance declarations screened where the risk warrants). The walk and the test are scheduled on risk - new suppliers, new materials, past findings raise frequency - and their tone is set by leadership: these are the controls that keep the business out of the published decisions, and staff who experience them as such report into them early and honestly.

A finding without a closure discipline is a diary. Each finding carries: severity (safety, placing legality, financial, clerical), an owner, a remediation date proportionate to severity, and a verification step independent of the owner. Overdue findings escalate on a published ladder to the compliance board. The board's view is the programme in one page: audits completed against plan, findings by severity and age, the reconciliation exceptions' trend, and the phase-readiness status against the framework's next wave. Reported so, packaging compliance takes its place as an ordinary governed risk - which is the station's definition of success, and the precondition for the readiness audit that closes the guide.

The audit programme's spirit deserves its sentence: every finding it raises is a problem the business gets to solve at its own tempo, in its own order, at internal prices - the same problem an authority would set at theirs. Staff who understand that report findings early and completely; programmes that punish findings teach concealment and audit a fiction. Leadership sets the spirit in the first meeting and defends it at the first bad result. Everything else in this guide is mechanics.

Audit the audit programme annually against a harder standard than its findings: coverage (did the cycle reach the duties whose phase changed), yield (did it find the things the year's external events proved were there to find), and closure honesty (did findings die of old age in the tracker or get fixed). A programme failing its own audit is worse than none - it manufactures assurance. The compliance board owns this meta-audit personally; it is the one item in the station that cannot be delegated downward.