ISO 22000 LI cheat sheet

FSMS definition (ISO 22000:2018, 3.x): a management system that directs and controls an organization with regard to food safety; it is built on the Plan-Do-Check-Act cycle and on risk-based thinking at two levels: organizational risk and operational (hazard) risk.

HACCP logic: seven principles are hazard analysis, determination of CCPs, establishment of critical limits, monitoring of CCPs, corrective actions, verification procedures, and record-keeping; ISO 22000 embeds these within a management system rather than replacing them.

Two-level risk thinking: the organizational level addresses risks that threaten the viability and performance of the FSMS (context, interested parties, planning); the operational level addresses hazards to food safety through the hazard analysis and OPRP/HACCP plans.

Key terms: hazard = potential source of harm; risk = function of likelihood and severity of harm; contamination = introduction of a hazard; food safety hazard categories are biological, chemical, and physical (allergens are usually treated as a chemical hazard).

CCP = a step where a control measure is essential to prevent or reduce a significant hazard to an acceptable level, with defined critical limits; OPRP = a control measure applied to prevent or reduce a significant hazard where critical limits are not used and the criterion is measurable/observable.

PRPs (prerequisite programmes) are basic hygiene conditions needed to maintain a hygienic environment across the food chain; ISO/TS 22002 series provides sector-specific PRP requirements (e.g., Part 1 for food manufacturing).

Interactive communication is mandatory: internal and external communication on food safety hazards must occur between the organization and suppliers, customers, regulators and other interested parties across the food chain; the food safety team must have access to the information.

Acceptable level and food safety hazard: the acceptable level is the level of a hazard that must not be exceeded in the end product; the hazard analysis determines whether it is controlled by the HACCP plan (critical limits) or OPRPs.

Management system elements: top management commitment, food safety policy, objectives, competence, documented information, and continual improvement are all required; a food safety management system is not a stand-alone HACCP study.

Clause 4 (Context): determine external and internal issues relevant to purpose, interested parties and their relevant requirements, and define the scope of the FSMS; the scope must state products/processes covered and any justified exclusions.

Clause 5 (Leadership): top management must establish a food safety policy, ensure integration into business processes, assign roles and responsibilities, and appoint a food safety team leader; the food safety team is a cross-functional group with competence in hazard analysis.

Clause 6 (Planning): actions to address risks and opportunities, food safety objectives with measurable criteria, and planning of changes; changes to the FSMS must be carried out in a planned manner with consideration of their impact on food safety.

Clause 7 (Support): resources, competence, awareness, communication (external and internal, including emergency situations), and documented information; competence records must demonstrate that the food safety team and personnel are qualified.

Clause 8 (Operation): PRPs, traceability system, hazard analysis, validation of control measure combinations, HACCP plan and OPRP plans, monitoring, corrective actions, verification, and product recall/withdrawal procedures.

Hazard analysis must identify hazards, determine acceptable levels, assess severity and likelihood, select control measures, and classify each significant hazard to a CCP or OPRP; the rationale must be documented.

Verification vs validation: validation confirms that the selected control measures can achieve the intended acceptable level (before implementation); verification confirms that the FSMS as implemented is effective and meets requirements.

Clause 9 (Performance evaluation): monitoring and measurement, internal audit, management review; management review inputs/outputs must include food safety performance, audit results, and decisions on improvement.

Clause 10 (Improvement): nonconformity and corrective action, handling of potentially unsafe products, and continual improvement; records of nonconformities, causes, actions and their effectiveness must be retained.

Implementation sequence: secure top management commitment, define scope and context, map processes and products, establish PRPs, perform hazard analysis, build HACCP/OPRP plans, then build supporting management-system processes (documented information, competence, audit, review).

Gap analysis against ISO 22000:2018 clauses 4-10 identifies existing documented information, PRP coverage and HACCP elements already in place, and gives the project baseline; it should be repeated before certification.

Project planning: define milestones, responsibilities, resources, training needs and a timeline; a typical small/medium manufacturer needs several months to a year depending on existing HACCP maturity and facility condition.

Scope statement must be precise: product categories, process steps, sites and any outsourced processes; exclusions must be justified and cannot exclude requirements affecting the ability to ensure food safety.

Product and process description: raw materials, ingredients, contact materials, end products, intended use, target consumers (including vulnerable groups), storage and distribution conditions, and process flow with on-site verification of the flow diagram.

PRP planning precedes hazard analysis: facility layout, utilities (water, air, steam), waste, pest control, cleaning and sanitation, personal hygiene, maintenance, allergen control, and supplier approval.

Risk-based prioritization: focus first on significant hazards and on regulatory/legal requirements; decide which hazards need CCPs versus OPRPs versus PRPs based on the hazard analysis rationale.

Documented information plan: identify mandatory documents and records, define retention times, approval and version control; avoid excessive documentation that does not add value or is not maintained.

Readiness criteria before the certification audit: internal audit completed and nonconformities closed, management review held, at least one full cycle of records, and a food safety team with documented competence.

PRP implementation: operational control of hygiene, maintenance, pest control, cleaning, personnel hygiene and supplier management must be evidenced by records; PRPs are verified and their effectiveness reviewed.

Hazard analysis implementation: verify the flow diagram on site, confirm hazard identification for each step, and ensure the classification of hazards into CCP/OPRP is documented with justification.

Critical limits must be measurable and validated; monitoring of CCPs must specify method, frequency, responsibility and recording, and results must be evaluated against the limits.

OPRP criteria are measurable or observable (e.g., time, temperature, concentration, visual cleanliness); OPRP monitoring results must be evaluated before product release.

Corrective action for CCP/OPRP deviations: control the affected product (hold, segregate), determine and correct the cause, evaluate whether the product is safe for release, and record the action and its effectiveness.

Traceability: the system must identify product batches and link raw material lots to finished product lots and vice versa; a traceability test should be performed and timed, with results recorded.

Allergen management: identify allergens in raw materials, control cross-contact through changeover, cleaning, storage segregation and labelling; verify allergen labelling against the product recipe.

Supplier and outsourcing control: approval, monitoring of performance, and communication of food safety requirements; outsourced processes must be controlled and their food safety impact assessed.

Emergency preparedness: procedures for recall/withdrawal, incidents, and emergencies (fire, flood, utility failure, contamination); recall procedures must be tested and their effectiveness verified.

Communication: internal communication of hazards and changes, and external communication with suppliers, customers, and authorities, must be planned and recorded.

Monitoring is measurement or observation over time to assess whether control measures are working; measurement is a single determination of a value; both feed verification and performance evaluation.

Verification activities: review of monitoring records, calibration of measuring equipment, product testing, environmental monitoring, review of PRP effectiveness, and internal audits; results must be analyzed and reported.

Calibration and verification of measuring equipment: equipment used for CCP/OPRP monitoring must be calibrated or verified at defined intervals against traceable standards, with records and action on out-of-tolerance results.

Internal audit: planned intervals, defined criteria and scope, auditor objectivity (auditors must not audit their own work), reporting of results to management, and follow-up of findings.

Management review inputs include status of actions from previous reviews, changes in context, food safety performance (including monitoring results and nonconformities), audit results, and resource adequacy; outputs include improvement decisions.

Key performance indicators: number of CCP/OPRP deviations, complaint rates, recall/withdrawal events, supplier nonconformities, audit findings, and on-time completion of corrective actions.

Data analysis: trends in monitoring data, complaints, and verification results must be analyzed to identify emerging hazards or deterioration of control before failures occur.

Records must be legible, identifiable, retrievable and retained for the defined period; electronic records need controls for integrity and access.

Verification of the hazard analysis: confirm that the hazard analysis and control plans remain valid when products, processes, equipment, or suppliers change.

Continual improvement (Clause 10.3) is a recurring activity to enhance performance; it can be driven by objectives, audit findings, deviations, complaints, new technology, or changes in regulations and standards.

Nonconformity and corrective action (10.1): react to the nonconformity, evaluate the need to eliminate the cause, implement action, review effectiveness, and update risks identified in planning if necessary.

Handling potentially unsafe products (8.9.5): identify and control products that do not conform, evaluate the reason for nonconformity, decide on disposition (release, rework, reprocessing, destruction), and retain records.

Root cause analysis: use structured methods (5 Whys, fishbone, FMEA) to distinguish the cause from the symptom; corrective action must address the cause, not just the affected batch.

Improvement loop: measure performance, compare with objectives, identify gaps, plan actions, implement, verify effectiveness, and standardize the change in documented information.

Food safety culture is an important enabler of improvement: management commitment, communication, training, and employee involvement influence the effectiveness of the FSMS.

Update triggers: changes to the product, process, layout, suppliers, legislation, or scientific knowledge require re-evaluation of the hazard analysis and control measures before implementation.

Effectiveness verification: after a corrective action, verify that the nonconformity does not recur, and record the verification; close the action only when effectiveness is demonstrated.

Improvement should be documented as evidence for certification: trend analysis, completed improvement projects, and updated objectives show a functioning improvement cycle.

Certification process: application and contract, Stage 1 audit (documentation and readiness), Stage 2 audit (implementation effectiveness), certification decision, surveillance audits (typically annually), and recertification before the certificate expires.

Stage 1 audit purpose: evaluate documented information, the organization's understanding of requirements, scope, and readiness for Stage 2; findings are reported and must be addressed before Stage 2.

Stage 2 audit purpose: evaluate implementation and effectiveness of the FSMS, including PRPs, hazard analysis, CCP/OPRP monitoring, verification, internal audit and management review.

Audit evidence: records must exist for a representative period (commonly at least one full cycle of internal audit, management review and monitoring), and the food safety team must be able to explain the hazard analysis rationale.

Nonconformity grading: major nonconformity (system failure or significant food safety risk) usually requires correction and verification before certification or within a defined short period; minor nonconformities are closed within an agreed timeframe.

Auditor competence: the certification body must assign auditors with food-chain category competence (e.g., ISO/TS 22003 categories) and no conflict of interest; the organization may comment on auditor suitability.

Preparation checklist: current documented information, scope statement, process flow and layout, hazard analysis, HACCP/OPRP plans, calibration records, traceability test, recall test, internal audit and management review records, and corrective action log.

Audit conduct: opening meeting, document and record sampling, site walkthrough, interviews with operators, and closing meeting; the organization should provide a guide and access to all areas and records in scope.

Certification is not the end: surveillance audits check continued compliance and improvement; certificates can be suspended or withdrawn for serious or repeated nonconformities.