Seven-month certification deadline with one competent resource
A 90-employee sauce and condiment manufacturer holds a GFSI-benchmarked HACCP certificate and wants ISO 22000 certification to satisfy a new retail customer. The customer's deadline is seven months away. The consultant who performed the gap analysis has left; the report lists 38 gaps, including no food safety team beyond the HACCP team, no context analysis, no risk-based PRP verification, no internal audit programme covering the standard, and management review that discusses only sales and quality. Production runs five days a week, with a planned shutdown in month 4 for equipment installation. The quality manager is the only person with ISO 22000 knowledge and is also covering two vacancies. Top management has approved a €40,000 budget but expects 'no disruption'.
1. Build a realistic implementation sequence and critical path for the seven months. Identify what cannot be compressed.
Read the worked answer
Sequence. Months 1-2: appoint a food safety team leader and cross-functional team, define competence needs, complete context analysis, confirm scope, issue policy and objectives, and prioritise the 38 gaps. Months 2-3: update PRPs, hazard analysis and the hazard control plan; define risk-based PRP verification; train operators and supervisors. Month 4 shutdown: validate equipment changes before restart and update the hazard analysis. Months 4-5: document control, traceability test, emergency/recall test, supplier and outsourced-process controls. Month 5-6: full internal audit against ISO 22000 and management review. Month 6-7: close corrective actions, verify effectiveness, stage 1 audit, then stage 2.
Critical path. The food safety team and competent resource must be in place first. Hazard analysis and validation must precede operation of new equipment. Internal audit and management review cannot be compressed into a paper exercise; they need a full cycle of records and evidence. Corrective-action effectiveness also needs time.
What cannot be compressed. At least one complete internal audit covering the standard, a management review with the required inputs and outputs, validation before implementation, and verification that PRP and CCP monitoring are working. Stage 2 cannot be pulled forward to compensate for a late start.
2. What should be escalated to top management, and how should a go/no-go decision be made?
Read the worked answer
Escalate the single point of failure: one quality manager with ISO 22000 knowledge, covering two vacancies and also leading implementation. That is a delivery risk, not a personnel detail. Escalate the mismatch between 'no disruption' and the month-4 shutdown, which is the only realistic window for validation and training. Escalate the 38 gaps and the fact that management review currently covers only sales and quality, not food safety performance and improvement.
A go/no-go gate should be set at the end of month 4. Criteria: food safety team appointed and competent; context, scope and hazard analysis updated; PRP verification and traceability/recall tests completed; internal audit scheduled with sufficient coverage; management review planned with top management attendance; major gaps closed or with credible plans. If the gate is not met, do not book stage 2. Top management must decide whether to add temporary resource, reduce other projects, or move the customer deadline. The decision and rationale should be recorded.
3. If the date slips, what options are defensible and what should not be done?
Read the worked answer
Defensible options: hold stage 1 only and defer stage 2; use a pre-assessment to test readiness; extend the deadline with the customer and explain the food safety rationale; bring in temporary technical resource to protect the critical path; reduce the scope only if a genuine product/process boundary exists, such as a separate site or line, and with justification.
What should not be done: book stage 2 before internal audit and management review have been completed; treat the HACCP certificate as equivalent to ISO 22000; exclude inconvenient processes to fit the date; or let the quality manager sign management review on top management's behalf. A certification body will test whether the FSMS is implemented and effective, not whether the documents exist. If stage 2 is attempted too early, a major nonconformity is likely and certification will be delayed further. The customer should be told the truth about the date, with a realistic plan.