Preparing for an ISO 22000 audit
What the domain tests
Domain 4 tests how to set up an ISO 22000 audit: initiating it, reviewing documentation, preparing a risk-based plan and work documents, and organising resources and communication.
Core rules
- Initiate the audit by defining objectives, scope and criteria, checking feasibility, and establishing contact with the auditee.
- Review the FSMS documentation to understand the HACCP plan, PRPs, product groups, site layout, previous findings and any changes since the last audit.
- Build the audit plan around risk: high-risk processes, CCPs, OPRPs, allergen control, cleaning, maintenance, and shifts with less supervision. Allocate time to top management, the food safety team, production, sanitation, storage and dispatch.
- Select the team for competence, including sector knowledge and language; avoid conflicts of interest.
- Prepare work documents: checklists, sampling plans, forms for nonconformities, and a traceability test plan. A checklist is an aide-mémoire, not a script.
- Plan sampling deliberately: which products, lots, lines, shifts and records. Sampling is not random if risk points to specific areas.
Worked example
A two-day audit of a bakery has three product groups and a night shift. The plan gives half a day to top management and the food safety team, one day to production and CCPs, and a four-hour night-shift visit to observe cleaning and start-up. The auditor schedules a traceability test from finished product to flour lot and back. The reasoning: the night shift has different supervision and cleaning controls, so risk-based planning requires observing it, not just the day shift.
Traps
Writing a plan that only follows clause order; ignoring shift patterns; reviewing the HACCP plan without checking the on-site flow; overloading the schedule; failing to agree scope and criteria; and using a checklist as a substitute for an audit trail.