ISO 22000 LA cheat sheet

ISO 22000 uses the Process Approach with the Plan-Do-Check-Act cycle and Risk-Based Thinking embedded in both organizational risk and hazard risk.

The four core elements of ISO 22000:2005/2018 are interactive communication, system management, prerequisite programmes (PRPs), and HACCP principles.

Hazard analysis covers biological, chemical, and physical hazards; the 2018 revision adds allergen risk as an explicit consideration in hazard analysis.

Critical control point (CCP) determination follows the Codex decision tree: control measure availability, position in the process, and whether monitoring can detect failure before loss of control.

Operational prerequisite programmes (OPRPs) are control measures for hazards where a CCP is not practical; they require documented monitoring and correction like CCPs.

The three food safety hazard categories are distinguished by severity and likelihood; risk is the combination of the probability of occurrence and the severity of harm.

Interactive communication requires external communication with suppliers, customers, and regulators, and internal communication across functions and shifts.

Validation confirms that control measures are capable of achieving the intended hazard control; verification confirms that the FSMS is implemented and effective.

ISO 22000 is applicable to all organizations in the food chain regardless of size and complexity; it does not prescribe specific food safety performance criteria.

Clause 4 requires determining external and internal issues, interested parties relevant to food safety, and the scope of the FSMS, which must be documented and available.

Clause 5 requires top management to establish a food safety policy, assign roles and responsibilities, and ensure the food safety team has the necessary competence and authority.

Clause 6 requires food safety objectives, planning of changes, and identification of legal, regulatory, customer, and statutory requirements applicable to the product.

Clause 7 covers support: resources, competence, awareness, communication, and documented information control including creation, updating, and retention.

Clause 8 requires PRPs, hazard analysis, validation of control measures, HACCP plan, OPRPs, and an emergency preparedness and response procedure.

The HACCP plan must include critical limits, monitoring system, corrective actions, responsibilities, and records for each CCP; critical limits must be measurable or observable.

Clause 9 requires monitoring, measurement, analysis, internal audit, and management review with defined inputs and outputs including decisions on improvement.

Clause 10 requires handling of nonconformity, corrective action, and continual improvement, with documented information retained as evidence of the nature of nonconformities.

The food safety team leader is responsible for managing the food safety team, organizing its work, and ensuring relevant training and competence of team members.

ISO 19011 defines seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Objective evidence is verifiable data or records; audit findings are classified as conformities or nonconformities against the audit criteria.

Audit types include internal (first party), external supplier (second party), and certification or regulatory (third party) audits; each has different objectives and independence requirements.

Audit scope defines the boundaries such as sites, processes, products, and time period; audit criteria are the policies, procedures, standards, and requirements used for comparison.

Competence of auditors includes education, training, skills, and experience; ISO 19011 requires evaluation of auditor performance and continual professional development.

Sampling risk and audit risk mean an auditor cannot examine all evidence; conclusions are based on samples and must be reported as such in the audit report.

Independence means auditors do not audit their own work; for internal audits, auditors must not audit activities for which they are responsible.

An audit programme is a set of one or more audits planned for a specific timeframe and directed toward a specific purpose, managed by an audit programme manager.

Audit planning begins with defining audit objectives, scope, criteria, and boundaries, then reviewing documented information such as the FSMS manual, HACCP plan, and PRP records.

A document review precedes the on-site audit to determine readiness and to identify areas requiring further investigation during the audit.

The audit plan includes audit dates, duration, locations, processes to be audited, audit team assignments, and the schedule of opening and closing meetings.

Audit checklists are derived from the audit criteria (ISO 22000 clauses and the organization's own procedures) and should focus on processes and risks, not just clause coverage.

The audit team should be selected based on competence relevant to the scope, such as food technology, HACCP, and the specific product or process category.

Audit duration depends on the size, complexity, and risk of the organization, the scope of the audit, and the number of personnel and shifts.

The opening meeting confirms the audit plan, introduces the audit team, explains the audit method and sampling approach, and confirms communication and safety arrangements.

Preparing for an audit includes requesting access to records, arranging interviews with process owners, and planning sampling of shifts, lines, and sites.

Audit criteria for an ISO 22000 certification audit include ISO 22000:2018, applicable legal requirements, and the organization's own FSMS documentation.

Audit evidence is collected through interviews, observation of activities and conditions, and review of documents and records; evidence must be recorded and traceable.

The auditor should follow the process approach: trace a process from inputs to outputs and verify interfaces with other processes.

For each CCP, verify the critical limits, monitoring records, corrective actions taken, and verification activities, and confirm that the HACCP plan is implemented as written.

Verify PRPs through observation of hygiene, pest control, maintenance, cleaning, personnel hygiene, and water/air quality controls.

Nonconformity findings must state the requirement, the objective evidence, and the nature of the nonconformity; they are graded as major or minor depending on impact on the FSMS.

A major nonconformity indicates a systemic failure or a failure that affects the capability of the FSMS to ensure food safety; a minor is an isolated lapse not affecting overall capability.

Auditors should interview personnel at multiple levels to verify awareness of the food safety policy, their role, and the significance of their contribution to food safety.

Observations and opportunities for improvement are recorded separately from nonconformities and do not require corrective action under the standard.

Traceability testing verifies that the organization can trace product from raw material to finished product and vice versa within the required timeframe.

The closing meeting presents audit findings, conclusions, and recommendations, and clarifies any disagreement; it is not a decision-making meeting on certification.

The audit report must include audit objectives, scope, criteria, dates, locations, findings, conclusions, and the audit team and auditee representatives.

The audit report is the property of the client; distribution and retention must be agreed and controlled.

Corrective action requests require the auditee to perform root cause analysis, plan corrective action, and set a completion date; the auditor verifies effectiveness.

Follow-up activities verify that corrective actions have been implemented and are effective; verification may be by document review or on-site visit.

For certification audits, the certification body reviews the audit report and makes the certification decision independent of the audit team.

The audit is closed when the audit report is issued and follow-up actions are agreed; outstanding nonconformities may delay certification.

Records of the audit, including reports, nonconformities, and corrective action evidence, must be retained per the audit programme requirements.

The audit conclusion states whether the FSMS conforms to the audit criteria and is effectively implemented and maintained.

The audit programme manager establishes the programme objectives, identifies risks and opportunities, and defines the programme scope, resources, and schedule.

Audit programme planning considers the size, complexity, and risk of the organization, the results of previous audits, and the certification cycle requirements.

The certification cycle is typically three years, with an initial certification audit (Stage 1 and Stage 2), surveillance audits in years 1 and 2, and a recertification audit in year 3.

Stage 1 audit evaluates readiness for Stage 2 by reviewing documented information, the organization's understanding of the standard, and the scope of the FSMS.

Stage 2 audit evaluates implementation and effectiveness of the FSMS against all applicable requirements of ISO 22000.

Surveillance audits cover a representative sample of the FSMS and must include internal audits, management review, complaints, and use of marks.

Audit programme monitoring includes evaluating auditor performance, audit duration, and the effectiveness of the programme against its objectives.

The audit programme must be reviewed and adjusted as needed, and records of the programme and each audit must be retained.

Impartiality of the audit programme requires identifying threats to impartiality and managing them, such as conflicts of interest of auditors and technical experts.