ISO 22000

ISO 22000 is a certification standard for food safety management systems which is appropriate regardless of the step in the food chain or the size of an organization. When developing an ISO 22000 manual it is necessary to ensure the fundamentals of the standard are covered and the documentation specified in the standard is included. ISO 22000 states that an organization requires the documents necessary to ensure the effective development, implementation and updating of the food safety management system. There are specific references in the standard where it prescribes that the food safety management system will need to have documents and these should be included in an ISO 22000 Manual. The documents required are described in this article.


The starting point of any food safety management system and a demonstration of senior management commitment is the documentation, authorization and communication of a Food Safety Policy. The policy should be supported by realistic and measureable Food Safety Objectives. It is also fundamental that procedures are put in place to ensure documents and records related to food safety are controlled.


One of the basics in developing a food safety managements system is implementing prerequisite programmes or fundamental conditions which are conducive to food safety. ISO 22000 requires there to be documents that specify how prerequisite program activities are managed. Prerequisite programmes specified in the standard include:


  • construction and lay-out of buildings and associated utilities
  • lay-out of premises, including workspace and employee facilities
  • supplies of air, water, energy and other utilities
  • supporting services, including waste and sewage disposal
  • the suitability of equipment and its accessibility
  • management of purchased materials, supplies, disposals and handling of products
  • measures for the prevention of cross contamination
  • cleaning and sanitizing
  • pest control
  • personnel hygiene

This list is not finite as the standard requires ‘other aspects as appropriate’ so an ISO 22000 Manual should include all relevant prerequisites, these will be dependent on the position in the food chain for example ‘Good Agricultural Practices’ in the case of primary producers. Where appropriate procedures should also be in place to control of outsourced processes although in many organizations there is no outsourcing and this is not applicable.


The ISO 22000 standard requires a HACCP System to be in place, these documents can be part of the ISO 22000 Manual or in a separate HACCP Manual. Prior to carrying out a hazard analysis there is a requirement for relevant information required to conduct the hazard analysis including:


  • Descriptions of raw materials to the extent needed to conduct the hazard analysis
  • Descriptions of Ingredients to the extent needed to conduct the hazard analysis
  • Descriptions of product-contact materials to the extent needed to conduct the hazard analysis
  • The characteristics of end products
  • Descriptions of the intended use to the extent needed to conduct the hazard analysis
  • Descriptions of the reasonably expected handling of the end product to the extent needed to conduct the hazard analysis
  • Descriptions of any possible unintended but reasonably expected mishandling and misuse of the end product to the extent needed to conduct the hazard analysis


External documents relevant to the organization’s food safety activities including statutory, regulatory and customer requirements should be available on site and certainly used by the food safety team when conducting a hazard analysis.


A HACCP plan and Operational Prerequisite Programme plan will need to be developed by a food safety team for each product category. Descriptions of the methodology and parameters used for the categorization of control measures as belonging to the HACCP plan or Operational prerequisite programmes. The requirement for an Operational Prerequisite Programme plan is unique to ISO 22000 and is the source of some confusion. Clause 7.4.4 Selection and assessment of control measures, prescribes areas to consider when assessing control measures, because of the level of confusion we developed the ‘ISO 22000 HACCP Calculator’ which simplifies this process.


For each operational prerequisite programme the food safety hazard or hazards to be controlled, the control measures used, the monitoring procedures used, the corrections and corrective actions and the responsibilities and authorities need to be documented. Records demonstrating control at each operational prerequisite programme should be in place.


Documented HACCP plans which prescribe and identify critical control points (CCPs), the food safety hazards to be controlled at each critical control point, the control measures used, the monitoring procedures used, the critical limits applied at each critical control point, the corrections and corrective action to be taken if critical limits are exceeded and responsibilities and authorities. Critical control point monitoring records should be in place in order to demonstrate control.


There are number of fundamental food safety procedures that should be documented and included in the ISO 22000 manual these include procedures for the handling of potentially unsafe products, for withdrawing products, for corrections and for corrective action. The ISO 22000 standard is specific in prescribing what should be included in the procedure for corrective action such that the procedure needs to include that specifies the need to identify and eliminate the cause of detected nonconformities, to prevent recurrence, and to bring the process or system back into control after nonconformity is encountered. The corrective action procedure must include a review of non-conformances including customer complaints, a review of trends in monitoring results that may indicate development towards loss of control and a review to determine the causes of non-conformances. Procedures should define how the actions needed are determined and are implemented including the responsibility and authority levels within the organization. Again records of corrective actions should be maintained and also records of the review of corrections carried out to ensure that they are effective.


As with all management systems, documented procedures for Internal Auditing including responsibilities and requirements for planning and conducting audits should be in place. The procedure should define how results are reported and how the results of internal audits are reviewed; this is normally during management review of the food safety management system. Records of reviews and Internal Audits should be maintained.


The extent of documentation required in order to achieve ISO 22000 will differ from one organization to another depending on the size and complexity of the operation and the competence of personnel, however, the procedures and records referred to should be considered an essential part of any ISO 22000 manual.