Conducting an ISO 22000 audit
What the domain tests
Domain 5 tests evidence gathering and audit conduct: opening meeting, communication, interview and observation, sampling, audit trails, team meetings, and writing nonconformities.
Core rules
- Hold an opening meeting to confirm objectives, scope, criteria, schedule, methods, confidentiality and safety rules.
- Gather evidence by interview, observation and document review; corroborate one source with another. Follow audit trails from hazard analysis to control measure to monitoring record to corrective action.
- Sample with purpose; record what was sampled and why. Do not generalise from one record to the whole system without testing the control.
- Verify implementation and effectiveness: a HACCP plan can be documented, implemented and ineffective. Check monitoring frequencies, critical limit breaches, corrective actions and verification results.
- Write nonconformities with three elements: the requirement, the objective evidence, and a clear statement of the gap. Avoid proposing the solution.
- Hold team meetings to share findings, adjust the plan and manage time.
Worked example
At a dairy, the CCP cooking record for one batch has no temperature reading. The auditor traces the batch to finished product and finds no deviation record or disposition. The nonconformity states the requirement for monitoring and corrective action, the evidence (batch number, missing reading, no disposition), and the gap (the control was not demonstrated for that batch). The auditor does not write operator careless; that is not objective evidence.
Traps
Leading questions; accepting undocumented verbal claims; writing a nonconformity for a missing record when another record proves the control; auditing only the food safety team; ignoring allergen changeovers; and failing to follow a positive finding through to effectiveness.