Halal Internal Audit Template: A Complete MHMS 2020 Checklist

A Kedah food manufacturer had conducted halal internal audits every six months for three years without interruption. Their schedule was documented. Their reports were filed. Their JKHD minutes recorded audit completion each cycle. By any procedural measure, their internal audit programme appeared exemplary.

Their JAKIM renewal audit produced four NCRs — all in areas that had been recorded as "compliant" in every internal audit for the previous 18 months.

The investigation revealed the problem. The internal audits had been conducted by the company's Halal Executive. She was auditing her own team. The checklists had been completed from memory rather than through verification. Certificates that had not been physically checked in months were marked "valid." Training records that had not been updated were marked "complete." The internal audits had been confirming compliance rather than testing it.

The four NCRs JAKIM found were not new problems. They had existed — undiscovered — through six consecutive internal audit cycles. The cost of the renewal delay and the remediation programme exceeded RM 55,000.

This guide provides a complete internal audit template aligned to MHMS 2020, structured to find genuine non-conformities — not to confirm what you want to believe.

---

Before You Audit: Planning Essentials

Who Should Audit?

Independence is not optional — it is the foundational requirement for a credible internal audit. MHMS 2020 requires that internal auditors be independent of the area they are auditing. The practical standard is clear: if you are responsible for a process, you cannot audit it.

Internal auditors must be:

• Independent from the area they audit — a production line supervisor cannot audit their own line; a Halal Executive cannot audit her own team's compliance
• Trained in internal audit techniques and MHMS 2020 requirements — audit skill is not automatic; it requires specific training
• Authorised by the JKHD (Jawatankuasa Halal Dalaman) to conduct audits

For smaller organisations, true independence can be achieved by having staff audit departments other than their own — the Halal Executive audits production, a production supervisor audits documentation, and so on. Where internal independence is structurally impossible, bringing in an external audit resource is not just acceptable under MHMS 2020 — it is often the only credible option.

What Happens When You Find a Non-Conformity

Every non-conformity found during an internal audit follows the same lifecycle as an external NCR. The finding does not end when it is recorded — it opens a process that must run to documented closure.

NCR Management Workflow — MHMS 2020

1

Identify & Document

Record the non-conformity using exact wording. Log it in the NCR register immediately — never leave it in an email thread.

2

Root Cause Analysis

Identify the system failure behind the finding — not just the surface symptom. Assign to a named owner with a deadline.

3

Define Corrective & Preventive Action

Document both the corrective action (fix the finding) and the preventive action (prevent recurrence). Assign responsibility.

4

Implement & Gather Evidence

Execute the action. Collect proof: updated SOPs, re-training records, process photos, management sign-offs.

5

Verify Effectiveness

An independent reviewer confirms the root cause is resolved — not just the observable symptom. This step is mandatory before closure.

6

Close NCR

NCR formally closed with documented confirmation. Submit through MYeHALAL if externally raised by JAKIM.

Internal auditors who raise findings but do not track them through root cause analysis, corrective action, implementation, and verification are producing reports, not outcomes. The NCR lifecycle above applies to every finding, regardless of whether it originated from a JAKIM audit or your own internal programme.

How Often Should You Audit?

MHMS 2020 does not prescribe a fixed audit frequency, but best practice for most manufacturers is:

• Comprehensive audit (full scope, all pillars): at least once per year
• Focused audits (high-risk areas — supplier certificates, HCPs, training records): every six months
• Ad-hoc audits: triggered by incidents, NCRs, process changes, new product launches, or new supplier onboarding

The Kedah manufacturer's six-monthly schedule was procedurally correct. The problem was not frequency — it was independence and rigour.

Audit Scope

Each audit must define its scope — which MHMS pillars, which departments, which processes are being examined. A comprehensive annual audit covers all pillars. Focused audits target specific risk areas identified from previous findings, supplier changes, or process modifications. Document the scope in your audit plan before you start, and record any scope limitations in the final report.

---

The Audit Checklist: Organised by MHMS 2020 Pillar

For each item below, record: Compliant / Non-Compliant / Observation / Not Applicable, supported by specific evidence notes. Do not mark "Compliant" unless you have seen or verified the evidence. "I believe it is" is not evidence.

Pillar 1: JKHD (Internal Halal Committee)

Pillar 2: HAS Documentation

Pillar 3: Halal Control Points (HCP)

Pillar 4: Supplier and Raw Material Management

Pillar 5: Training

Pillar 6: Facility and Physical Controls

Pillar 7: Previous NCR Closure

Pillar 8: MYeHALAL Portal Readiness

This pillar does not appear verbatim in the MHMS 2020 document structure, but it reflects the operational reality of 2026: JAKIM conducts audits with access to your MYeHALAL portal records before arriving on site. Auditors can see your submission history, your certificate uploads, your NCR response records, and your documentation version history. A manufacturer whose portal is incomplete or whose paper records do not match portal submissions is presenting an inconsistency before the audit begins.

---

How to Document Findings

For each finding, documentation must be specific enough that a different person — or JAKIM — could verify the finding independently. Vague observations ("training records not complete") are insufficient. Precise observations create accountability and enable genuine corrective action.

Worked NCR Example

NCR Grading Guide

For comprehensive guidance on managing NCRs from this point forward, see our NCR management guide.

---

Internal Audit Frequency and Scheduling Best Practices

Recommended scheduling structure:

• Full-scope annual audit: Cover all MHMS pillars, all departments, all product lines. This audit should be your most resource-intensive and should be timed approximately six months before your JAKIM renewal to allow time for NCR resolution.
• Focused biannual audit: Target your highest-risk areas — supplier certificate management, HCP monitoring records, and training compliance. These change most frequently and accumulate problems fastest.
• Ad-hoc audits triggered by events: Any of the following should trigger an unscheduled targeted audit: a new supplier being onboarded, a new ingredient being introduced, a process change, a customer complaint with halal implications, or an NCR from a JAKIM audit.

What events should trigger ad-hoc audits:

---

How MPPHM 2020 Surveillance Audits Are Changing Internal Audit Scope

The MPPHM 2020 surveillance audit framework allows JAKIM to conduct unannounced post-certification inspections at any point during the certification period. The relevance to your internal audit programme is direct: a strong internal audit that covers supplier certificate currency and MYeHALAL record consistency is now a first line of defence against surveillance audit findings.

The practical implication for internal audit scope:

• Supplier certificate currency should be reviewed at every audit cycle, not just annually — certificates expire on their own schedule, not yours
• MYeHALAL portal records should be verified for consistency with physical records at every audit — discrepancies between portal and physical records are exactly the pattern surveillance auditors look for
• Ingredient database cross-referencing — if your internal audit identifies ingredients where the certifying body has changed its status or lost JAKIM recognition, treat this as a Major NCR requiring immediate resolution

Manufacturers whose internal audit programmes actively cover these areas are less exposed to surveillance audit findings, and are better prepared to respond on the day of an unannounced visit.

---

Sample Audit Report Structure

HALAL INTERNAL AUDIT REPORT

Audit Reference: [IA-2026-001]
Date: [dd/mm/yyyy]
Scope: [Full / Focused — specify pillars and areas]
Auditor(s): [Names, roles, and confirmation of independence from audited areas]
Auditee Department(s): [Names]

EXECUTIVE SUMMARY
- Total findings: X
- Major NCRs: X
- Minor NCRs: X
- Observations: X
- Areas of good practice: [specific examples]

DETAILED FINDINGS
[One section per finding, using the NCR documentation format above]

RECOMMENDATIONS
[Prioritised list of actions, with owners and deadlines]

SIGN-OFF
Auditor signature: ___________  Date: ___________
JKHD review:      ___________  Date: ___________

---

Common Internal Audit Mistakes

Auditing to confirm, not to find. The Kedah case at the opening of this article is the canonical example. If your internal audits never produce NCRs, they are not rigorous. JAKIM will find what your internal audits should have — and the finding will be worse for having been missed internally.

Lack of independence. The most common structural flaw in small manufacturer audit programmes is the Halal Executive auditing her own team. This is not independence. It produces reports that confirm existing practice rather than test it.

No follow-up on findings. Raising NCRs without tracking them to closure is worse than not auditing at all. It demonstrates awareness of problems without willingness to address them. See our JAKIM audit checklist for what external auditors expect to see.

Auditing documentation only. Checking that documents exist is not enough. Verify that documented procedures match actual practice by observing operations and interviewing staff at their workstations.

Inconsistent schedule. Audits that are repeatedly postponed signal that the organisation treats compliance as optional. Maintain your schedule and document any legitimate delays with rescheduled dates.

Ignoring MYeHALAL portal consistency. Internal audits that do not check whether physical records match portal uploads are missing a category of risk that JAKIM can now identify before arriving on site.

---

Expert Insight: Why Internal Audits That Never Find NCRs Are a Red Flag

There is a simple heuristic that experienced JAKIM auditors apply when reviewing a manufacturer's internal audit history: if 12 months of internal audits produce zero non-conformities, the audit programme is not credible.

This is not cynicism. It is a statistical observation. Complex manufacturing operations handling multiple ingredients from multiple suppliers, managed by teams of people across multiple shifts, do not operate at zero defect rate for documentation compliance over extended periods. Something is always imperfect — a signature missed, a training record not updated for a new starter, a certificate that renewed but the file copy was not replaced. Zero findings means the audit is not finding them.

The damage this causes is compounded. JAKIM auditors who arrive at a manufacturer with a clean internal audit history do not interpret it as evidence of excellent compliance. They interpret it as evidence of either very shallow auditing or, in the Kedah case, auditing that confirmed rather than tested. They then audit with heightened scrutiny. The manufacturer who proudly presents two years of clean internal audits may receive more NCRs from their external audit — not fewer.

The right benchmark for a credible internal audit programme is not zero NCRs. It is NCRs that are proportionate to operational complexity, consistently classified, genuinely resolved, and not recurring.

---

Conclusion

A well-executed internal audit programme is the most powerful tool available to a manufacturer for maintaining MHMS 2020 compliance between JAKIM inspections. The template above provides the structure. The value comes from rigorous, independent execution and genuine follow-through on every finding.

Key takeaways:

• Internal auditors must be independent of the area they are auditing — the Halal Executive cannot audit her own team
• MYeHALAL portal readiness is now a distinct audit scope area; portal records must match physical records before JAKIM arrives
• MPPHM 2020 surveillance audits can examine supplier certificate currency at any time — internal audits that cover this area actively reduce unannounced inspection risk
• Every internal NCR follows the same six-stage lifecycle as an external NCR — raise, root cause, corrective action, implement, verify, close
• Zero NCRs in an internal audit is a warning sign, not a success metric
• Ad-hoc audits should be triggered by supplier changes, ingredient changes, process changes, and received NCRs — not just the annual schedule

TAQYID's audit management module provides structured MHMS-aligned checklists, automated scheduling, integrated NCR workflows, MYeHALAL-ready record export, and audit reporting — making internal audits a sustainable practice rather than a periodic scramble.

Explore TAQYID's audit management →

---

Frequently Asked Questions

Can the Halal Executive conduct their own internal audit?

No. MHMS 2020 requires that internal auditors be independent of the area they are auditing. The Halal Executive is responsible for the halal compliance function — auditing her own team's compliance is a structural conflict of interest, not genuine independent review. In small organisations where a fully independent internal team is not feasible, the Halal Executive can audit departments other than her own, or the organisation should bring in external audit support. JAKIM auditors routinely ask who conducted internal audits and will flag a lack of independence as an NCR.

How detailed should internal audit reports be?

Internal audit reports should be detailed enough that a different person — including a JAKIM auditor — can independently verify the finding without additional explanation. Each NCR should include the pillar and checklist reference, a verbatim description of the observation, the specific evidence examined, the MHMS 2020 requirement not met, the classification, and the assigned corrective action with owner and deadline. A finding described as "training records not complete" without specifying which records, which staff, and what was missing is not actionable and will not satisfy JAKIM review.

What is the difference between an observation and a minor NCR in an internal audit?

An observation identifies an area of concern or an improvement opportunity that does not constitute a non-conformity against MHMS 2020. No corrective action is required, but the area should be monitored. A minor NCR is a documented failure to meet a specific MHMS 2020 requirement — it requires corrective action within a defined timeframe, and closure must be verified. The practical distinction: does the finding represent a failure to meet a requirement (NCR) or a risk that a requirement might be failed in future (observation)? When in doubt, classify upward — it is better to raise a minor NCR that closes quickly than to record an observation that later becomes a Major NCR in a JAKIM audit.

How long should internal audit records be retained?

MHMS 2020 requires records to be maintained for a period that covers at least one full certification cycle. In practice, most manufacturers retain internal audit reports, NCR records, and closure evidence for a minimum of three years. The MYeHALAL portal submission history creates an additional digital record trail. For manufacturers that have experienced JAKIM findings or NCRs, retaining relevant audit records for five years is advisable, as recurring patterns across audit cycles are relevant context for regulatory assessment.

What should happen if an internal audit finds a Major NCR just before a JAKIM renewal audit?

Disclose it and resolve it — do not conceal it. JAKIM auditors specifically review the relationship between internal audit findings and external audit outcomes. A manufacturer who finds a Major NCR internally, resolves it with documented corrective action, and presents the closed NCR to JAKIM demonstrates exactly the kind of functional compliance management system that MHMS 2020 is designed to produce. A manufacturer who finds a Major NCR and suppresses it — then has JAKIM find the same issue — has both the original NCR and a credibility problem. The MYeHALAL portal trail makes concealment increasingly difficult. Timely internal discovery and documented resolution is always the better outcome.