Food safety management system (FSMS) requirements
What the domain tests
Domain 2 assesses clause-by-clause requirements of ISO 22000:2018: context, leadership, planning, support, operation, performance evaluation and improvement. You need to know which documented information is mandatory and how the food safety team turns inputs into control measures.
Core rules
- Context (clause 4) includes interested parties, external and internal issues, scope, and the FSMS processes and their sequence and interaction.
- Leadership (5) requires a food safety policy, objectives, and assigned responsibility and authority. Top management must ensure the FSMS achieves intended outcomes.
- Planning (6) covers risks and opportunities, food safety objectives, and planned changes.
- Support (7) covers resources, competence, awareness, communication and documented information.
- Operation (8) is the technical core: product characteristics, intended use, flow diagrams verified on site, hazard identification and assessment, selection and categorisation of control measures, OPRPs, HACCP plan, validation, traceability, recall, emergency preparedness, monitoring and measuring, and verification.
- Performance evaluation (9) covers monitoring and measurement, internal audit, and management review.
- Improvement (10) covers nonconformity, corrective action and continual improvement.
Worked example
An auditor reviews a chilled ready-to-eat salad. The flow diagram omits the post-wash handling step; the team had verified the diagram two years earlier but the line changed. Washing is used to control pathogens but no action criteria are defined. The auditor traces from hazard analysis to control measure to monitoring record. The missing step and undefined criteria are nonconformities because the hazard analysis cannot be shown to be based on the current process, and the control measure is not operational.
Traps
Treating documented information as any document; missing the requirement to verify flow diagrams on site; confusing verification with validation; assuming recall and traceability are the same; failing to check management review inputs and outputs; and missing that internal audit is a requirement of the FSMS, not just a certification activity.