Scope exclusion and a third-party cold store
A regional distributor of chilled and frozen foods has 60 employees and uses a 12,000-pallet third-party cold store 80 km away. Its FSMS scope statement reads: 'Processing, storage and distribution of chilled and frozen food products.' It excludes 'transport operations performed by subcontractors' because the distributor does not own trucks. The third-party cold store is responsible for temperature monitoring; the distributor receives only a monthly temperature summary. Last summer a compressor failure raised the frozen store to -9 °C for six hours. The third-party report recorded 'no product affected' without a lot-level assessment. The distributor's internal audit found no evidence of approval or performance monitoring of the third party beyond the contract. Top management argues that the cold store is outside the scope and that the contract is enough.
1. Is the scope exclusion acceptable under ISO 22000? Explain how the scope statement and outsourced-process control should be handled.
Read the worked answer
No, not as written. ISO 22000 requires the scope to state the products and processes covered and to justify any exclusion. A scope cannot be used to carve out a process that materially affects food safety while the organization still presents the product as covered. Storage and distribution are central to the safety of chilled and frozen product; a temperature failure in the third-party store directly affects product safety.
The transport exclusion is also weakly justified. Not owning trucks does not remove responsibility. If the distributor arranges or controls delivery, transport is an outsourced process affecting food safety and must be controlled. If the customer collects and transport is genuinely outside the organization's responsibility, the scope can say so, but it must be clear, justified and consistent with customer agreements.
The third-party cold store is an outsourced process. The organization must ensure it is controlled: approval, defined food safety requirements in the contract, communication, performance monitoring, access to records, traceability and corrective action. A contract alone is not evidence of control. The scope should identify the outsourced storage and distribution activities, and the FSMS should show how they are monitored.
2. What controls and evidence should the distributor establish over the third-party cold store? Address approval, monitoring, traceability and the -9 °C event.
Read the worked answer
Approval and contract. Approve the cold store against defined criteria: capacity, temperature capability, alarm response, pest control, hygiene, traceability and recall capability. The contract should specify temperature limits, monitoring frequency, record retention, notification of deviations, lot-level stock records and the right to audit.
Performance monitoring. The monthly summary is too weak for a 12,000-pallet store. The distributor should receive and review exception reports, alarm logs and corrective actions for deviations. Periodic on-site checks or remote data review should verify that the third party is actually monitoring and responding.
Traceability. The distributor must be able to link its lots to the third-party storage location and dates. The cold store's records must allow identification of which lots were in the affected store during the six-hour event.
The -9 °C event. Treat it as a potential nonconformity. Obtain the time-temperature profile, the quantity and lot codes exposed, and the product specification. Assess whether the product is safe or must be held, downgraded, destroyed, withdrawn or recalled. A statement of 'no product affected' without lot-level assessment is not sufficient. The investigation should cover alarm response, contingency plans and communication. Corrective action should include improved monitoring and a repeat temperature-excursion exercise.
3. The internal audit raised the third-party control gap. What should internal audit and management review do next?
Read the worked answer
Internal audit should raise a nonconformity against the control of outsourced processes and traceability, with evidence: no approval record, no performance monitoring beyond the contract, no lot-level assessment of the -9 °C event. It should assess whether the scope statement itself is misleading and whether the FSMS has identified the outsourced process as affecting food safety.
A corrective action should require: revision of the scope wording, a supplier approval and monitoring procedure, a temperature-deviation notification and assessment process, a traceability test involving the third party, and verification that the actions are effective. The audit should not close the finding merely because the contract was updated.
Management review should receive the finding as an input, together with the product risk from the temperature excursion, customer impact and any recall decision. Top management must decide whether the third-party arrangement is acceptable, whether alternative storage is needed, and whether resources are available to monitor the outsourced process. This is a leadership decision, not only a quality-department task. The review should record the decision and the follow-up date.