ISO 22000 LA common mistakes
ISO 22000 LA · Understand the traps and how to avoid them.
When asked about operational prerequisite programmes (OPRPs), the candidate treats them as identical to CCPs and applies critical-limit monitoring language to them, instead of distinguishing hazard-based control at CCPs from the broader environmental control OPRPs provide.
Many candidates come from HACCP training where every control point was called critical and never learn the ISO 22000 three-tier logic (PRP, OPRP, CCP) with the hazard analysis as the selection mechanism.
What to do instead
Build a one-page comparison table: PRP = basic hygiene conditions, OPRP = control measure needed to prevent or reduce a significant hazard where no CCP exists (with a measurable action criterion, not a critical limit), CCP = control at a point where a critical limit separates acceptable from unacceptable. Practise classifying 20 realistic hazards and justify each placement by the decision logic, not by habit.
The candidate answers questions about the hazard analysis by listing hazards generically ("biological, chemical, physical") without linking them to the specific process step, the severity/likelihood assessment, and the resulting control measure selection.
Candidates memorise hazard categories from textbooks and skip the ISO 22000 requirement that the analysis be step-specific and drive selection of control measures.
What to do instead
Rehearse the causal chain aloud: process step -> hazard identified -> severity and likelihood assessed -> control measure selected -> placed as PRP, OPRP or CCP -> validation evidence. Use a worked example (e.g. metal detection after packaging) and practise reconstructing the chain from the control measure backwards.
When asked about validation versus verification, the candidate uses the terms interchangeably, saying verification proves the control measure works and validation confirms it is operating.
The words sound similar in everyday English and many candidates have never had to defend the distinction in a real audit conversation.
What to do instead
Fix the definitions: validation is before-the-fact evidence that the selected control measure(s) are capable of achieving the intended hazard control (e.g. challenge testing, scientific literature, inactivation studies); verification is after-the-fact evidence that the control measures are implemented and effective (e.g. monitoring records, product testing, calibration, internal audits). Write both definitions from memory and apply them to five scenarios.
The candidate cites the audit criteria as "ISO 22000" alone and cannot explain the role of the audit scope, objectives, criteria and the audit plan as separate, explicitly defined elements.
Candidates conflate the standard with the audit's own terms and never internalise the ISO 19011 definitions, so they cannot answer objective/criteria/scope questions precisely.
What to do instead
Memorise and paraphrase the ISO 19011 definitions of audit criteria, audit scope, audit objectives and audit evidence. For each, write a one-line example from a food manufacturer and one from a catering operation. Practise writing an audit objective that is specific, measurable and achievable rather than "to check compliance".
The candidate describes the audit as an inspection of documents and records, treating record review as the primary evidence source and rarely mentioning observation, interview or sampling.
Candidates with quality-control backgrounds default to document review, and the ISO 19011 evidence-gathering methods are under-practised.
What to do instead
For each clause of ISO 22000, write down the strongest evidence type: record review for documented information, observation for operational control and hygiene, interview for competence and awareness. Practise writing an audit question that requires observation (e.g. "show me the CCP monitoring taking place now") rather than a question that can be answered by producing a file.
The candidate writes an audit plan that lists clauses only, with no allocation of time, no identification of auditees or areas, and no mention of the audit team roles and responsibilities.
Candidates reproduce the standard's clause structure as a plan instead of applying the ISO 19011 planning requirements to a real organisation.
What to do instead
Use a template with columns: clause/process, area/department, auditee, auditor, time allocation, evidence to be sampled. Practise building a two-day plan for a mid-sized manufacturer, ensuring time is weighted to high-risk processes and that sampling rationale is stated.
When asked how to handle a nonconformity found during the audit, the candidate jumps straight to recommending corrective action and closing the finding themselves, rather than recording the objective evidence and leaving corrective action to the auditee.
Candidates confuse the auditor's role with the consultant's or the auditee's, and the ISO 19011 principle of independence is under-applied.
What to do instead
State the auditor's sequence: record objective evidence, state the requirement, state the finding, agree the classification with the auditee, issue the report, and require the auditee to propose correction and corrective action with root-cause analysis. Practise writing findings in the three-part form (evidence, requirement, conclusion) and never draft the corrective action for the auditee.
The candidate classifies every finding as a major nonconformity, or classifies a systemic breakdown as a minor observation, without applying a consistent classification rule.
Candidates have not internalised that classification depends on the organisation's documented criteria and on factors such as system failure, repeat findings, and effect on food safety, and they default to the safe-sounding answer.
What to do instead
Learn a defensible rule set: major = system element absent or ineffective, or a food safety hazard left uncontrolled; minor = isolated lapse in an otherwise effective control; observation = improvement opportunity with no requirement breached. Apply the rule to ten short scenarios and justify each classification in one sentence.
The candidate describes the audit programme as a single audit and cannot distinguish programme-level management (risk-based scheduling, competence of auditors, monitoring and review of the programme) from the management of one individual audit.
The word "programme" invites confusion with "audit plan", and candidates rarely study the ISO 19011 programme management clauses in depth.
What to do instead
Draw two nested diagrams: outer = audit programme (objectives, risk-based frequency, resources, auditor competence, monitoring, review, improvement), inner = single audit (initiation, planning, conduct, reporting, follow-up). For each element, note one programme-level decision and one audit-level decision, and practise answering questions with the phrase "at programme level...".
The candidate answers questions about top management commitment by quoting the policy statement and stops there, without addressing management review inputs and outputs, provision of resources, or the food safety team's authority.
Candidates treat leadership as a documentation clause and do not connect it to the review and resource-allocation requirements that auditors actually test.
What to do instead
List the management review inputs and outputs required by ISO 22000 and, for each, write the question an auditor would ask and the evidence they would expect (minutes, action tracking, resource decisions). Practise interviewing a hypothetical plant manager in role-play to test whether the answers show commitment beyond the policy document.