This Is What Your Score Would Actually Look Like
An illustrative example, built the way we’d build yours · 30 years of frontline compliance experience · mpro5
1 · Critical Exposure: no process exists beyond memory, on any pillar. Nothing structured drives compliance at all.
5 · mpro5-Grade: every pillar fully connected and provable in real time, across every site. Nothing left to chance anywhere.
This score · 2.2: the average of the five pillar scores below. Real processes exist in places. Nothing proves they’re complete, connected, or reliably closing out.
out of 5Scored against mpro5’s Check, Fix, Prove, Prevent and Empower framework, the same five pillars every real analysis is scored against, from two illustrative discovery conversations with a Head of Food Safety & Compliance.
● Hover or tap the score above for what 1 and 5 actually mean
● Hover or tap any number above for what it actually means
A real number, before a single finding is read.
Every mpro5 Compliance Exposure Analysis opens exactly like this: one score, one band, and three real figures pulled straight from your own discovery conversation. You’d get this exact page for your own operation, for nothing.
A Real, Digital Process With a Broken Ending
This example is an operation running 64 high-street bakery-cafés and one central production kitchen that bakes and packs fresh sandwiches, cakes and bread for every site, every day. It’s a business with genuine process behind it, run by people who clearly care about getting this right. A digital checklist app runs in every store, a corrective-action spreadsheet is reviewed by regional managers, and training sign-off happens at site level. Most of the actual behaviour is genuinely there. What isn’t there is a way to prove any of it quickly, consistently, or across the whole estate at once, and that gap is exactly what an EHO visit is built to find. Every real analysis starts the same way we’ve started this one: by naming what’s genuinely working first, in your own words, before a single weakness gets raised.
Four different places currently hold four different pieces of the same compliance picture: a mobile checklist app for daily store checks, a spreadsheet for corrective actions, a paper folder per site for training sign-off, and a separate supplier and traceability log run entirely by the central kitchen. This report scores that reality against mpro5’s Check, Fix, Prove, Prevent and Empower framework, pillar by pillar.
Five Pillars, Built Around Passing Every Audit
Check, Fix, Prove, Prevent, Empower isn’t a catchy acronym. It’s five pillars designed around exactly what an inspector or auditor actually checks for: is the work genuinely happening, does a failure get properly fixed, can you prove it happened, are you catching problems before they become findings, and do your people actually understand why any of this matters. This is what mpro5 scores in every single analysis, including this one. Hover each card below, or tap it on your phone, to see what a 1 and a 5 actually look like for that pillar.
Check
Are the right checks running, on the right schedule, at every site, whether anyone remembers or not?
Hover to see why it matters ↓
Why it matters: this is the baseline everything else stands on. If checks don’t happen consistently, every pillar below is built on a guess.
In this example, scores a 3: the checklist is real and followed daily. Two statutory risk categories were never built into it.
Fix
When a check fails, does the right person get assigned, with a due date, and does it actually close, or escalate if it doesn’t?
Hover to see why it matters ↓
Why it matters: a problem that’s caught but never closed is often worse than one nobody caught. It’s on record and unresolved, exactly what gets asked about next.
In this example, scores a 2: no owner, no due date, no backup if the one person who checks the spreadsheet is away.
Prove
Does a retrievable, timestamped, evidenced record exist for what actually happened?
Hover to see why it matters ↓
Why it matters: having the data isn’t the same as producing it fast, under pressure, the moment someone official asks for it.
In this example, scores a 2: the record exists. It just lives in three different places at once.
Prevent
Is anyone looking for the pattern, the site, team or check that’s drifting, before it becomes a finding?
Hover to see why it matters ↓
Why it matters: most operations already collect data that would catch a problem early. Almost none of them use it that way.
In this example, scores a 2: a league table already exists. It’s used for coaching today, well before anyone treats it as an early warning.
Empower
Were the people doing the work actually trained and brought into the process, with proof of it on file?
Hover to see why it matters ↓
Why it matters: every pillar above depends on people who genuinely understand why it matters, beyond having simply signed something.
In this example, scores a 2: training happens. Confirming who’s trained, fast, across every site, doesn’t.
Five pillars, one score each, averaged honestly. That’s the whole mechanism behind every number in this report, including the 2.2 at the top.
We Dig Into Exactly What You Have to Comply With
Before anything gets scored, we find out precisely what your business is actually judged against, because it’s rarely the same thing twice. A food business answers to food hygiene law and an EHO. A cleaning or FM contractor answers to their client’s own SLA. A school answers to ISI. A manufacturer answers to a certification scheme like BRCGS or SQF. Whatever it is, we research the real standard live, every single time a report gets built, rather than reuse a generic checklist from the last account we scored. Here’s what that research looks like for an example food business, audited under UK food hygiene law and the Food Hygiene Rating Scheme:
UK food hygiene law requires every food business to run a food safety management system based on HACCP principles. That system has to exist on paper. It also has to be genuinely followed, day to day, by the people actually doing the work. A written policy and an implemented one are two different things. An Environmental Health Officer is trained to tell them apart on the day, rather than take the folder’s word for it.
Ratings under the Food Hygiene Rating Scheme run from 0 to 5 and are set by the local authority, published on the Food Standards Agency’s public website and displayed at the premises. Inspection frequency is risk-based: a high-risk food business can be visited as often as every six months, a lower-risk one as rarely as every two years, which means the businesses with the least mature process are, on average, the ones most likely to be checked soonest.
Sources: Food Standards Agency, Food Hygiene Rating Scheme guidance; Regulation (EC) 852/2004, Article 5.
This is never copied from a previous engagement.
Not even in the same sector. It’s what makes the scoring below credible instead of self-serving: the bar belongs to your own regulator or certification body, researched fresh and cited by name every time.
64 Stores, One Kitchen, Two Estates That Don’t Talk
Every finding below is mapped to the real shape of this operation, site type by site type.
High-Street Bakery-Cafés
58 sites. Full bake, hot-hold and seating. The highest-risk, highest-inspection-frequency category on the estate.
Transport Hub Kiosks
6 sites. Grab-and-go only, no on-site baking, but still running the full store checklist built for the bakery-cafés.
Central Production Kitchen
1 site, Midlands. Bakes and packs for all 64 stores daily. Runs its own supplier and traceability system, entirely separate from the retail side.
Regional Management
4 regional managers, each covering roughly 16 sites, currently the only reviewers of the corrective-action spreadsheet.
“We don’t buy software to try it. We buy it because we’ve already worked out exactly what it needs to fix.” A recommendation matched to a real cost or a real risk below, never a feature list.
Where an Operation Like Yours Might Sit Today, Pillar by Pillar
One score per pillar, and one honest headline number.
Check
1 · Critical Exposure: no structured check process exists. Whether anything gets checked depends entirely on memory.
5 · mpro5-Grade: every check, at every site, on schedule, verified in real time, with nothing left to memory.
In this example · 3: a real, followed checklist. Two statutory risk categories were never built into it.
out of 5
A real, followed checklist, missing two whole risk categories.
Hover this card for what 1 & 5 look like
Fix
1 · Critical Exposure: a failed check goes nowhere. Nobody is responsible for what happens next.
5 · mpro5-Grade: every failure assigns itself instantly, with a due date, and escalates on its own if it’s missed.
In this example · 2: no owner, no due date, no backup reviewer. A single point of failure.
out of 5
No owner, no due date, no route to escalate.
Hover this card for what 1 & 5 look like
Prove
1 · Critical Exposure: nothing is written down. If it was never checked, there’s no way to prove otherwise.
5 · mpro5-Grade: a timestamped, evidenced record for every check, at every site, produced instantly on request.
In this example · 2: the record exists. Producing it fast, under pressure, is the actual problem.
out of 5
The record exists. Assembling it under pressure is the problem.
Hover this card for what 1 & 5 look like
Prevent
1 · Critical Exposure: problems are only found by accident, if they’re found at all.
5 · mpro5-Grade: drift at any site gets flagged automatically, before it ever becomes a finding.
In this example · 2: the data to catch drift early already exists. Nobody is using it that way yet.
out of 5
Nobody looks until an audit or a visit forces it.
Hover this card for what 1 & 5 look like
Empower
1 · Critical Exposure: staff were never trained on why the checks matter, and no record exists either way.
5 · mpro5-Grade: every person trained, understood, and provably signed off, at every site.
In this example · 2: training gets signed off. Whether it was understood is never actually confirmed.
out of 5
Signed off, but understanding is never actually confirmed.
Hover this card for what 1 & 5 look like
How we scored this: this measures the process behind each pillar, and paperwork alone doesn’t move the score. Check scores a 3 because the daily checklist is real and genuinely followed. It doesn’t score a 4 because two statutory risk categories were never built into the checklist in the first place, which is a coverage gap rather than a discipline problem. Fix is capped at 2 because closing an issue depends entirely on one regional manager noticing a spreadsheet row, with no defined owner, due date or backup if that person is away. That’s a structural single point of failure regardless of how much effort goes in day to day.
The regulation’s own language is “put in place, implemented and maintained.” A checklist app, a spreadsheet and a paper folder can each individually satisfy “in place.” None of them, run separately, can prove “maintained” across 65 sites at once, and that ceiling is what keeps every pillar here below a 4.
We never round a score to make it look tidier.
A clean audit history is never treated as evidence for a higher one on its own. Passing your last inspection answers whether the standard was met. It doesn’t answer how you got there, and that’s what’s actually being scored. An honest 2.2 holds up to scrutiny from the most numbers-literate person in your buying committee. A flattering 3.0 wouldn’t.
This scorecard is built on 30 years of frontline compliance experience.Yours would be built the same way, from your own discovery conversation, for nothing.
Book My Free Analysis →Four Systems, Two Estates, No Shared Picture
For context only. The findings below are about the process each of these is meant to support. The tools themselves aren’t the verdict.
| System | What It’s For | Verdict |
|---|---|---|
| Mobile checklist app | Daily opening, closing and temperature checks at every retail site | Real, but overbuilt for some sites |
| Corrective-action spreadsheet | Logging and (in theory) closing out failed checks | Manual, person-dependent |
| Paper training folders | Sign-off records for food-hygiene training, held per site | Exists, but slow to produce |
| CPU supplier & traceability log | Batch and supplier records at the central kitchen only | Isolated from the retail side |
None of this is about bad software.
Every verdict above is a process gap that would exist under any tool, or none. The same rule applies to your own stack: nothing here asks you to justify what you already bought. It only asks whether the behaviour behind it is provable.
Every Weakness, Mapped to a Path to 5/5
15 specific findings across the five pillars, each one about the process behind it. Every finding carries a free Quick Win that can start this week with what’s already in place, and a Path to 5/5, the deeper structural fix once that’s running at scale, measured against “put in place, implemented and maintained.”
90% of this, you could do for free, starting today.
Your own team could act on almost everything below this week, whether or not you ever speak to mpro5 again. That’s deliberate: a report only worth reading after you’ve bought something is just a pitch dressed up as a diagnosis. This one has to earn its place on its own first.
Check
The test for this pillar: are the right checks running, on the right schedule, at every site, whether anyone remembers or not?
“Not raised” is the single most valuable line here.
Before scoring anything, we research the actual list of checks a compliant operation in your position should be running, then confirm each one against what discovery genuinely surfaced. It’s the highest-leverage line in the whole report: an honest flag for something the sales conversation itself might never have uncovered.
| Check Category | Statutory / Best-Practice Basis | Status in This Example |
|---|---|---|
| Cleaning & hygiene | Food Hygiene (England) Regulations 2013 | Confirmed |
| Temperature control (fridge, freezer, hot-hold) | Regulation (EC) 852/2004, Annex II | Confirmed |
| Allergen & PPDS labelling | Natasha’s Law, Food Information (Amendment) (England) Regulations 2019 | Not raised, worth confirming |
| Pest control | Food Hygiene (England) Regulations 2013 | Confirmed, but unreliable |
| Supplier & batch traceability, CPU to store | General Food Law Regulation (EC) 178/2002, Article 18 | Not raised, worth confirming |
“Not raised” means exactly that. It isn’t a claimed gap. If it’s already covered, that’s a two-minute confirmation. If it isn’t, it’s the highest-leverage fix in this whole report.
The Daily Checklist Can’t Be Trimmed to What Actually Applies
Staff at the transport-hub kiosks still see full bakery-line checks, proving temperatures, oven logs, that don’t exist at their sites, because the app runs one version of the checklist for the whole estate.
Staff learn to skim past items that don’t apply to them, and the same habit starts to apply to items that do.
Strip the non-applicable line items from the kiosk-site version this week using the checklist app’s own site-group settings. Most platforms already support this, it just hasn’t been switched on.
A checklist built automatically per site type from one shared definition, so a change made once updates every relevant site, rather than being maintained by hand across separate versions.
Two Systems, One Supply Chain, No Shared Picture
The central kitchen’s traceability log and the retail checklist app share no common batch or supplier reference. Each was built for its own side of the business.
A batch issue starting at the kitchen has no automatic route into the checks running at the 64 stores it supplies that day.
Add a single shared batch-reference field to both systems this week, even entered manually, so a kitchen-side issue can at least be searched for on the retail side.
One system where a flag raised at the kitchen surfaces automatically on every affected store’s checklist the same day, with no manual cross-check required.
Allergen and Traceability Checks Were Never Confirmed
Neither PPDS allergen labelling checks nor supplier-traceability checks appear anywhere in the current checklist, on a business preparing and selling fresh food across 65 sites daily.
A checklist can run perfectly, every single day, and still miss an entire risk category if that category was never built into it.
A 15-minute review this week of the current checklist against the coverage table above, confirming which categories are genuinely handled elsewhere and which are real gaps.
Every statutory check category built into the same system automatically, with no category left to whoever happened to set the checklist up originally.
Fix
The test for this pillar: when a check fails, does the right person get assigned with a due date, and does it actually close, or escalate if it doesn’t?
This is usually where the real exposure hides.
Check is where most operations feel confident going in. A failed check that’s genuinely caught but never properly closed is arguably worse than one nobody caught at all. It’s on record and unresolved, which is exactly what an inspector asks about next.
A Raised Issue Has Nowhere Defined to Go
A failed check gets logged in a spreadsheet that a regional manager reviews when they get to it. No automatic assignment to a named owner, and no due date convention.
An issue with no clear owner sits exactly where it was raised, indefinitely, regardless of how serious it actually is.
Add two columns to the existing spreadsheet this week, Owner and Due By, and make it policy that nothing gets logged without both filled in.
Every failed check assigns itself to the right person with a due date the moment it’s raised, and escalates on its own if that date passes.
Nothing Prompts a Close-Out
Once logged, nothing reminds anyone to close an issue. The spreadsheet has grown to include rows open for several months at a time.
The backlog only grows, and every week without a prompt is a week closer to a visit finding it still open.
A recurring weekly 20-minute slot, already on someone’s calendar, with one job: clear the oldest five open rows.
Automatic reminders and escalation the moment a fix passes its due date, with no manual weekly sweep required to keep the backlog from rebuilding.
Fixing Depends on One Regional Manager Knowing to Look
The corrective-action spreadsheet is reviewed by whichever regional manager owns that patch, with no defined SLA and no named backup if they’re on leave.
A genuine single point of failure. It hasn’t caused a missed fix yet. That isn’t evidence it won’t.
Name a backup reviewer for each region this week, in writing, for whenever the primary manager is away.
A defined escalation path that runs on its own regardless of who’s in or out that particular week.
Prove
The test for this pillar: does a retrievable, timestamped, evidenced record exist for what actually happened?
Having the data isn’t the same as producing it fast.
That gap, between “it’s on file” and “I can show you right now,” is what Prove actually measures. It’s usually the pillar buying committees underestimate hardest going in.
The Full Picture Lives in Three Different Places
Checklist history sits in the mobile app, corrective actions sit in a spreadsheet, training sign-off sits in paper folders at each site. A visit asking for a recent history means pulling from all three, under time pressure.
Having the data somewhere isn’t the same as producing a clean, complete answer in the time an inspector actually gives you.
Build one single-page summary template this week that pulls the last 30 days from all three sources by hand, so the assembly work is at least done once in advance.
One record, built automatically, that already looks like the answer to “show me the last 90 days” before anyone has to ask.
Open Issues Are Visible to Anyone Who Looks, Including an Inspector
The same aging spreadsheet backlog that caps Fix at a 2 also sits there as an open record, visible to anyone reviewing it.
“You raised this, but it isn’t closed. Why?” is a question the current record can’t answer well.
Nothing new to build here. This is the same backlog already flagged under Fix, clearing it clears both findings at once.
A record where “open” and “closed” are always current, because closing an issue is what updates the record, with no separate manual step afterward.
Proving a Recalled Product Left the Shelf Relies on Someone Noticing
If a product needs pulling today, the method is a manager physically checking shelves and till records store by store, with no single confirmation that every site complied.
There’s no record confirming every store actually removed a recalled product, only a process that depends on someone checking and remembering to report back.
A same-day, reply-required message to every site manager this week, with a hard deadline for confirmation, logged in one place.
A same-day recall instruction that can’t be marked complete at a site until it’s genuinely confirmed there, visible in real time everywhere else.
Prevent
The test for this pillar: is anyone looking for the pattern, the site, team or check that’s drifting, before it becomes a finding?
The data to catch this early already exists.
Almost nobody uses it that way, because it was built for a different job, usually performance ranking rather than early warning. This is often the single highest-leverage finding in the whole report, and the fix is a change in how existing data gets used.
The Data That Could Flag a Drifting Site Is Only Used to Rank It
A monthly league table already ranks stores by number of failed checks, but it’s used by regional managers for coaching conversations rather than flagged as a compliance early-warning signal.
The same data that could show a store drifting toward a real problem is currently used only to see who’s behind this month.
This week, have whoever already builds the league table circulate the bottom three sites specifically as a compliance flag, alongside the usual performance note.
Any site trending the wrong way surfaces automatically the moment the pattern starts, well before month-end.
Nobody Looks Until an Audit or a Visit Forces It
The pattern across the estate is consistently reactive. A spot-check or an EHO visit is what surfaces a real problem. There’s no standing process built to catch it earlier.
The gap between something starting to go wrong and someone noticing stays exactly as wide as the time between checks.
This week, take one metric already being collected, failed-check rate, and set a plain threshold that triggers a phone call instead of just a note on a report.
Every site’s pattern watched continuously and flagged the moment it crosses a threshold, well before it’s ever discovered after the fact.
A Kitchen-Side Pattern Has No Route Into Retail-Side Visibility
As already flagged under Check, the central kitchen’s own supplier log is entirely separate from the retail league table and action tracking.
A pattern that starts at the kitchen, an ingredient, a batch, a supplier, has no way to show up against the stores it might already be affecting.
A monthly 15-minute cross-check this week between the kitchen log and the store league table, done by hand, until something better exists.
One shared view where a kitchen-side trend and a retail-side trend are the same picture, instead of two separate ones compared occasionally by hand.
Empower
The test for this pillar: were the people doing the work actually trained and brought into the process, with proof of it on file?
The pillar most audits check first, and most reports save for last.
Every process above depends on the people running it actually understanding why it matters, beyond simply signing something that says they were told.
Training Sign-Off Exists, But Nobody Can Produce It Fast
Training records are paper sign-off sheets kept in a folder at each site. Confirming who’s trained on what, across 64 stores, means physically checking 64 folders.
Worth confirming directly: food-handler competency is exactly what an inspection tends to test first, and a folder nobody can produce quickly reads the same as a folder that doesn’t exist.
This week, have each site manager photograph their current sign-off sheet and send it to one shared drive, so a searchable copy exists centrally.
Training and certification status visible for every person, at every site, in real time, with no folder to go and find.
New Starters Inherit a System Nobody Explained to Them
Seasonal and high-turnover retail staff are common in this sector. A new starter is generally handed the existing checklist and folder system with informal, on-the-day explanation from whoever’s on shift.
The reasoning behind why a check exists gets lost exactly when it matters most, in someone’s first week on the job.
Write a one-page “why this checklist exists” sheet this week, given to every new starter alongside the checklist itself.
Onboarding that trains every new starter on the actual checks they’ll run, hands-on, before their first shift alone, with a record that they were.
Nobody Owns Whether Staff Understand the Checks, Only Whether They Signed
A signature confirms attendance at a briefing rather than comprehension, and nothing currently follows up to confirm the training actually stuck.
A checklist run by someone who signed but didn’t really absorb it is barely more reliable than no checklist at all.
This week, add one verbal spot-check question, “why do we do this check,” to a manager’s existing store walk-round.
A short comprehension check built into training itself, with the result recorded alongside the sign-off, instead of assumed from it.
5 findings unlocked. Yours comes with every single one.Free, walked through live, no obligation.
Book My Free Analysis →What a 5/5 Actually Looks Like
Every Quick Win above is worth doing on its own merits: trimming the checklist to what each site actually needs, naming a backup reviewer per region, building one summary template, photographing the training folders into a shared drive. None of it requires new software, and all of it moves the needle this month.
None of them, alone or stacked, produce a real-time, cross-site, provable record. That’s not a shortage of effort. It’s the ceiling of running four separate systems by hand, indefinitely, with nobody’s job depending on remembering every one of them at once.
mpro5’s own data shows digitising the daily check itself, moving it into one connected process rather than an app that still needs a spreadsheet and a folder alongside it, saves 30 to 60 minutes per shift, per site. Scaled to an estate this size, that’s upward of 10,000 hours a year handed back to the floor at the low end of that range, on top of everything this report has already quantified below. The checking itself doesn’t get lighter. The three separate places it currently lives do.
No vendor gets named here. That’s deliberate.
It’s the same restraint every real mpro5 analysis holds until the very last section. If a competitor’s consultant could read this box out loud and it wouldn’t sound like they were selling anything, it did its job. The reveal is next.
What This Is Actually Costing, Two Ways
One of these is a time cost. The other is what’s actually at stake if a check that isn’t happening, or a fix that isn’t closing, gets found by someone other than you first.
The Time Cost
Hover for how this number is built
Based on 65 sites, roughly 45 minutes a week per site spent assembling records across the checklist app, the spreadsheet and the training folders, at a blended hourly rate. Real per-site time data, recalculated against your own numbers in your Free Analysis.
The Exposure Cost
Prosecutions under sections 7 and 14 of the Food Safety Act 1990 carry fines of up to £20,000 per offence in a magistrates’ court, and unlimited fines plus up to two years’ imprisonment in the Crown Court. That’s before the Food Hygiene Rating itself, published by the local authority and displayed at the premises, becomes part of the public record, searchable by any customer, indefinitely.
None of the findings above are about food actually being unsafe today. They’re about whether that could be proven quickly if a supplier issue, a temperature failure or a training gap were ever challenged. The exposure isn’t what’s happening. It’s what can’t yet be shown.
Sources: Food Safety Act 1990, ss.7, 14; Sentencing Council guidance, food safety and food hygiene offences; Food Standards Agency, Food Hygiene Rating Scheme guidance.
The time cost is what manual compliance is costing today. The exposure cost is what’s actually being risked underneath it.
These Brands Follow This Framework Every Day
To meet, and exceed, the industry standards they are actually held to.
Ready to See Your Own Score?
This example is a composite, built on real patterns to show you exactly what this looks like. Your own Free Analysis is built the same way, from your own discovery conversation, scored against the actual standard you’re audited on, with the same Quick Wins and the same Path to 5/5, for nothing.
Book My Free Analysis →No cost, no obligation, and every Quick Win in it is yours to keep, whatever you decide afterward.
- ✓ A full five-pillar score, researched fresh against the exact standard your business is audited on
- ✓ Every Quick Win written in plain language, yours to act on this week whether or not you ever speak to us again
- ✓ A real, sourced exposure cost, so you know precisely what’s at stake and what closing it is genuinely worth
- ✓ Walked through live, in around 30 minutes, on a call. Nothing to prepare and nothing to send us first
We build every one of these by hand, never generated from a template, which means we can only take on so many in a given month. Book this week and yours gets scheduled within 5 working days.
This gets discussed live, never sent and forgotten.
A real analysis is normally walked through on a call, so questions get answered on the spot as they come up. The Free Analysis is exactly that first conversation.