Halal Internal Audit Template: A Complete MHMS 2020 Checklist

An internal halal audit programme that produces no findings is not thereby a good one — and MHMS 2020 makes that judgement someone's job. Under Article 5(5)(h), the JKHD is required to evaluate the effectiveness and the frequency of the internal halal audit, not merely to receive its reports.

The rest of Article 5(5) closes the loop around that duty. The internal auditor is formally appointed by the JKHD (5(5)(d)) and must hold an Internal Halal Auditing or Eksekutif Halal certificate from a training provider registered under HPB (5(5)(c)). The findings report and the checklist itself are recorded and presented back to the JKHD (5(5)(g)). Appointment, evidence and evaluation all run through the same committee — which is why an audit programme that never finds anything is a governance result, not an accident.

The checklist is not a form you design from scratch either. Lampiran E — the Senarai Semak Audit Halal Dalaman the standard points to — separates JURUAUDIT from AUDITEE in its header fields, and sets out ten scopes: documentation, personnel, buildings and facilities, raw materials and processing aids and R&D materials, processing, equipment, packaging and labelling, storage, transport, and — the tenth — dan lain-lain skop berkaitan: any other related scope. The list is deliberately left open at the end.

This guide provides a complete internal audit template aligned to MHMS 2020, structured to find genuine non-conformities — not to confirm what you want to believe.

---

Before You Audit: Planning Essentials

Who Should Audit?

Independence is not optional — it is the foundational requirement for a credible internal audit. MHMS 2020 requires that internal auditors be independent of the area they are auditing. The practical standard is clear: if you are responsible for a process, you cannot audit it.

Internal auditors must be:

• Independent from the area they audit — a production line supervisor cannot audit their own line; a Halal Executive cannot audit her own team's compliance
• Trained in internal audit techniques and MHMS 2020 requirements — audit skill is not automatic; it requires specific training
• Authorised by the JKHD (Jawatankuasa Halal Dalaman) to conduct audits

For smaller organisations, true independence can be achieved by having staff audit departments other than their own — the Halal Executive audits production, a production supervisor audits documentation, and so on. Where internal independence is structurally impossible, bringing in an external audit resource is not just acceptable under MHMS 2020 — it is the only route left that satisfies the independence requirement.

What Happens When You Find a Non-Conformity

Every non-conformity found during an internal audit follows the same lifecycle as an external NCR. The finding does not end when it is recorded — it opens a process that must run to documented closure.

Recommended NCR Management Workflow

1

Identify & Document

Record the non-conformity using exact wording. Log it in the NCR register immediately — never leave it in an email thread.

2

Root Cause Analysis

Identify the system failure behind the finding — not just the surface symptom. Assign to a named owner with a deadline.

3

Define Corrective & Preventive Action

Document both the corrective action (fix the finding) and the preventive action (prevent recurrence). Assign responsibility.

4

Implement & Gather Evidence

Execute the action. Collect proof: updated SOPs, re-training records, process photos, management sign-offs.

5

Verify Effectiveness

An independent reviewer confirms the root cause is resolved — not just the observable symptom. This step is mandatory before closure.

6

Close NCR

NCR formally closed with documented confirmation. Submit through MYeHALAL if externally raised by JAKIM.

Internal auditors who raise findings but do not track them through root cause analysis, corrective action, implementation, and verification are producing reports, not outcomes. The NCR lifecycle above applies to every finding, regardless of whether it originated from a JAKIM audit or your own internal programme.

How Often Should You Audit?

MHMS 2020 prescribes the frequency, and it does so twice. Lampiran D — the SOP the standard itself points to for internal halal audit — sets the floor under Kekerapan: at least once every six months. Article 5(5)(b) adds a second condition: the audit must reach each branch or premises in the network at least once a year.

These are not competing rules. Article 5(5)(a) explicitly refers the reader to Lampiran D; together they mean audit at least twice a year, and make sure every site is covered within the year.

• The prescribed cycle: at least once every six months, covering compliance across the whole premises or network of premises
• Multi-site coverage: each branch or premises reached at least annually
• Ad-hoc audits: triggered by incidents, NCRs, process changes, new product launches, or new supplier onboarding — additional to the prescribed cycle, never a substitute for it

A six-monthly schedule can be procedurally correct and still test nothing. Frequency is the floor, not the measure — independence and rigour decide whether an audit finds anything.

Audit Scope

Each audit must define its scope — which areas, which departments, which processes are being examined. A comprehensive annual audit covers all eight. Focused audits target specific risk areas identified from previous findings, supplier changes, or process modifications. Document the scope in your audit plan before you start, and record any scope limitations in the final report.

---

The Audit Checklist: Eight Areas

The eight areas below are ours, not the standard's numbering. MHMS 2020 enumerates thirteen general requirements in Article 5, and that is what an auditor works from — see our MHMS 2020 guide for the full list. This template groups them into eight areas that match how an internal audit actually runs. The mapping is direct:

Four Article 5 requirements have no area of their own here: 2 Polisi Halal, 9 Kebolehkesanan, 10 Semakan HAS, and 11 Analisis Makmal. A comprehensive annual audit covers those too — this template is a starting structure, not the full scope of the standard.

For each item below, record: Compliant / Non-Compliant (KECIL) / Non-Compliant (BESAR) / Not Applicable, supported by specific evidence notes. Do not mark "Compliant" unless you have seen or verified the evidence. "I believe it is" is not evidence.

Area 1: JKHD (Internal Halal Committee)

Area 2: HAS Documentation

Area 3: Halal Control Points (HCP)

Area 4: Supplier and Raw Material Management

Area 5: Training

Area 6: Facility and Physical Controls

Area 7: Previous NCR Closure

Area 8: MYeHALAL Portal Readiness

This area does not appear verbatim in the MHMS 2020 document structure, but it reflects the operational reality of 2026: JAKIM conducts audits with access to your MYeHALAL portal records before arriving on site. Auditors can see your submission history, your certificate uploads, your NCR response records, and your documentation version history. A manufacturer whose portal is incomplete or whose paper records do not match portal submissions is presenting an inconsistency before the audit begins.

---

How to Document Findings

For each finding, documentation must be specific enough that a different person — or JAKIM — could verify the finding independently. Vague observations ("training records not complete") are insufficient. Precise observations create accountability and enable genuine corrective action.

Worked NCR Example

NCR Grading Guide

For comprehensive guidance on managing NCRs from this point forward, see our NCR management guide.

---

Internal Audit Frequency: What Is Prescribed, and What You Schedule Around It

The six-month cycle is not a cadence you tune to suit your calendar — it is the floor Lampiran D sets. What you do decide is where in that cycle each audit falls, and what you add on top of it.

• The prescribed cycle: an internal halal audit at least every six months, covering the whole premises or network, with each branch reached at least annually. Treat it as the floor, not the target.
• Where to place them: position one audit of the cycle far enough ahead of your JAKIM renewal that NCRs found have room to be closed before the external audit. The renewal application window opens six months before expiry, so an audit landing before that point leaves genuine margin.
• Ad-hoc audits triggered by events: Any of the following should trigger an unscheduled targeted audit: a new supplier being onboarded, a new ingredient being introduced, a process change, a customer complaint with halal implications, or an NCR from a JAKIM audit.

What events should trigger ad-hoc audits:

---

How MPPHM 2020 Surveillance Audits Are Changing Internal Audit Scope

The MPPHM 2020 surveillance audit framework allows JAKIM to conduct unannounced post-certification inspections at any point during the certification period. The relevance to your internal audit programme is direct: a strong internal audit that covers supplier certificate currency and MYeHALAL record consistency is now a first line of defence against surveillance audit findings.

The practical implication for internal audit scope:

• Supplier certificate currency should be reviewed at every audit cycle, not just annually — certificates expire on their own schedule, not yours
• MYeHALAL portal records should be verified for consistency with physical records at every audit — discrepancies between portal and physical records are exactly the pattern surveillance auditors look for
• Ingredient database cross-referencing — if your internal audit identifies ingredients where the certifying body has changed its status or lost JAKIM recognition, this would likely fall under the BESAR (Major) raw-material non-conformity category — treat with urgency pending your own risk assessment

Manufacturers whose internal audit programmes actively cover these areas are less exposed to surveillance audit findings, and are better prepared to respond on the day of an unannounced visit.

---

Sample Audit Report Structure

HALAL INTERNAL AUDIT REPORT

Audit Reference: [IA-2026-001]
Date: [dd/mm/yyyy]
Scope: [Full / Focused — specify areas]
Auditor(s): [Names, roles, and confirmation of independence from audited areas]
Auditee Department(s): [Names]

EXECUTIVE SUMMARY
- Total findings: X
- BESAR (Major) NCRs: X
- KECIL (Minor) NCRs: X
- SERIUS NCRs: X
- Areas of good practice: [specific examples]

DETAILED FINDINGS
[One section per finding, using the NCR documentation format above]

RECOMMENDATIONS
[Prioritised list of actions, with owners and deadlines]

SIGN-OFF
Auditor signature: ___________  Date: ___________
JKHD review:      ___________  Date: ___________

---

Common Internal Audit Mistakes

Auditing to confirm, not to find. If your internal audits never produce NCRs, they are not rigorous — and under Article 5(5)(h) that is the JKHD's assessment to make before JAKIM makes it for them. JAKIM will find what your internal audits should have — and the finding will be worse for having been missed internally.

Lack of independence. The most common structural flaw in small manufacturer audit programmes is the Halal Executive auditing her own team. This is not independence. It produces reports that confirm existing practice rather than test it.

No follow-up on findings. Raising NCRs without tracking them to closure is worse than not auditing at all. It demonstrates awareness of problems without willingness to address them. See our JAKIM audit checklist for what external auditors expect to see.

Auditing documentation only. Checking that documents exist is not enough. Verify that documented procedures match actual practice by observing operations and interviewing staff at their workstations.

Inconsistent schedule. Audits that are repeatedly postponed signal that the organisation treats compliance as optional. Maintain your schedule and document any legitimate delays with rescheduled dates.

Ignoring MYeHALAL portal consistency. Internal audits that do not check whether physical records match portal uploads are missing a category of risk that JAKIM can now identify before arriving on site.

---

Expert Insight: Why Internal Audits That Never Find NCRs Are a Red Flag

An internal audit history that records zero non-conformities across successive cycles is not evidence of a flawless operation. It is evidence that the audit is not finding what is there.

This is not cynicism. It follows from how manufacturing works. Complex manufacturing operations handling multiple ingredients from multiple suppliers, managed by teams of people across multiple shifts, do not operate at zero defect rate for documentation compliance over extended periods. Something is always imperfect — a signature missed, a training record not updated for a new starter, a certificate that renewed but the file copy was not replaced. Zero findings means the audit is not finding them.

The damage this causes is compounded. JAKIM auditors who arrive at a manufacturer with a clean internal audit history do not interpret it as evidence of excellent compliance. They interpret it as evidence of either very shallow auditing or auditing that confirmed rather than tested. They then audit with heightened scrutiny. The manufacturer who proudly presents two years of clean internal audits may receive more NCRs from their external audit — not fewer.

The right benchmark for a credible internal audit programme is not zero NCRs. It is NCRs that are proportionate to operational complexity, consistently classified, genuinely resolved, and not recurring.

---

Conclusion

A well-executed internal audit programme is the most powerful tool available to a manufacturer for maintaining MHMS 2020 compliance between JAKIM inspections. The template above provides the structure. The value comes from rigorous, independent execution and genuine follow-through on every finding.

Key takeaways:

• Internal auditors must be independent of the area they are auditing — the Halal Executive cannot audit her own team
• MYeHALAL portal readiness is now a distinct audit scope area; portal records must match physical records before JAKIM arrives
• MPPHM 2020 surveillance audits can examine supplier certificate currency at any time — internal audits that cover this area actively reduce unannounced inspection risk
• Every internal NCR should follow the same structured lifecycle as an external NCR — raise, root cause, corrective action, implement, verify, close — as recommended best practice
• Zero NCRs in an internal audit is a warning sign, not a success metric
• Ad-hoc audits should be triggered by supplier changes, ingredient changes, process changes, and received NCRs — not just the annual schedule

TAQYID's audit management module provides structured MHMS-aligned checklists, automated scheduling, integrated NCR workflows, MYeHALAL-ready record export, and audit reporting — making internal audits a sustainable practice rather than a periodic scramble.

Explore TAQYID's audit management

---

Frequently Asked Questions

Can the Halal Executive conduct their own internal audit?

No. MHMS 2020 requires that internal auditors be independent of the area they are auditing. The Halal Executive is responsible for the halal compliance function — auditing her own team's compliance is a structural conflict of interest, not genuine independent review. In small organisations where a fully independent internal team is not feasible, the Halal Executive can audit departments other than her own, or the organisation should bring in external audit support. Who conducted each internal audit is recorded in the audit report itself, which is part of what a JAKIM audit examines — and a lack of independence is an NCR.

How detailed should internal audit reports be?

Internal audit reports should be detailed enough that a different person — including a JAKIM auditor — can independently verify the finding without additional explanation. Each NCR should include the area and checklist reference, a verbatim description of the observation, the specific evidence examined, the MHMS 2020 requirement not met, the classification, and the assigned corrective action with owner and deadline. A finding described as "training records not complete" without specifying which records, which staff, and what was missing is not actionable and will not satisfy JAKIM review.

What is the difference between an "observation" and a KECIL (minor) NCR in an internal audit?

MPPHM 2020 recognises only three official non-conformity categories: KECIL (Minor), BESAR (Major), and SERIUS. "Observation" is not an official category — it is an internal continuous-improvement note some teams use informally to flag an emerging risk that does not yet constitute a non-conformity, such as a certificate approaching expiry. A KECIL NCR, by contrast, is a documented failure to meet a specific MHMS 2020 requirement — it requires corrective action within a defined timeframe, and closure must be verified. TAQYID's practical recommendation: when in doubt, classify upward — it is better to raise a KECIL NCR that closes quickly than to log an informal note that later becomes a BESAR (Major) NCR in a JAKIM audit.

How long should internal audit records be retained?

MHMS 2020 requires records to be maintained for a period that covers at least one full certification cycle. In practice, most manufacturers retain internal audit reports, NCR records, and closure evidence for a minimum of three years. The MYeHALAL portal submission history creates an additional digital record trail. For manufacturers that have experienced JAKIM findings or NCRs, retaining relevant audit records for five years is advisable, as recurring patterns across audit cycles are relevant context for regulatory assessment.

What should happen if an internal audit finds a BESAR (Major) NCR just before a JAKIM renewal audit?

Disclose it and resolve it — do not conceal it. JAKIM auditors specifically review the relationship between internal audit findings and external audit outcomes. A manufacturer who finds a BESAR NCR internally, resolves it with documented corrective action, and presents the closed NCR to JAKIM demonstrates exactly the kind of functional compliance management system that MHMS 2020 is designed to produce. A manufacturer who finds a BESAR NCR and suppresses it — then has JAKIM find the same issue — has both the original NCR and a credibility problem. The MYeHALAL portal trail makes concealment increasingly difficult. Timely internal discovery and documented resolution is always the better outcome.