ISO 22000 LI common mistakes
ISO 22000 LI · Understand the traps and how to avoid them.
Treating ISO 22000 as a stand-alone HACCP document set: answering questions about hazard analysis by listing critical control points only, and omitting the prerequisite programme (PRP) and operational prerequisite programme (OPRP) layers that the standard requires before CCPs are considered.
Candidates often come from a Codex/HACCP background where the CCP decision tree is the centre of the method, so they map every question onto that familiar model and forget that ISO 22000 requires a hazard analysis that first selects control measures and classifies them into PRPs, OPRPs and CCPs by the likelihood-of-failure and severity logic.
What to do instead
Before the exam, draw the ISO 22000 control-measure hierarchy from memory: PRPs (basic hygiene and environmental conditions), OPRPs (control measures for significant hazards where CCP monitoring is not appropriate or feasible), and CCPs (where a critical limit and validated measurement are applied). For every hazard-analysis question, state which layer is being selected and why, and explicitly mention that PRPs are established first and verified as a foundation before OPRP/CCP determination.
Confusing verification and validation: describing validation activities (e.g. challenge testing, literature review of a kill step) as verification, or describing verification (calibration, product testing, record review) as validation, and using the two terms interchangeably in written answers.
Both involve checking that controls work, and in everyday plant language people say 'verify' for almost anything. The standard gives them distinct definitions and places them at different points in the control-measure lifecycle, so candidates who have not memorised the definitions default to colloquial usage.
What to do instead
Memorise the distinction as a one-line rule: validation answers 'will this control measure achieve the intended outcome?' and happens before or when the control is established or changed; verification answers 'is the system, and are the control measures, working as planned?' and happens routinely afterwards. Practise rewriting five plant activities (e.g. heat-process challenge study, swab results, calibration, finished-product micro testing, supplier audit) into the correct category until it is automatic.
Quoting clause numbers and structure from the wrong edition, for example describing 'operational PRPs' as a separate clause 7.5 heading or using the pre-2018 clause layout for hazard analysis (7.4) and the update of the system (7.4.3), and answering 'what does clause X require' from memory of an older text.
Many candidates study from older training notes, legacy HACCP manuals or second-hand summaries, and the 2018 revision renumbered and restructured the operational clauses (hazard analysis, validation of control measures, product/process description, layout, and the update of the hazard analysis). Mixed sources produce confidently wrong clause references.
What to do instead
Work from the current edition's table of contents and build a one-page clause map in your own words: context and leadership, planning, support, operation (PRPs, traceability, hazard analysis, validation, HACCP/OPRP plan, monitoring, corrective actions, verification, product release, nonconformity), performance evaluation, and improvement. When a question asks 'which clause', answer with the requirement's substance first and the clause number second, so a numbering slip does not lose the mark.
Writing a food safety policy or objectives that are generic ('we will produce safe food and satisfy customers') instead of objectives that are measurable, monitored and linked to the FSMS's food safety hazards and legal requirements.
Candidates treat policy and objectives as boilerplate leadership statements rather than as auditable requirements, and they underestimate the expectation that objectives be measurable, monitored, communicated and updated, and that they be consistent with the food safety policy and relevant to conformity of products and services.
What to do instead
For any objective question, use the template: 'what will improve, by how much, by when, measured how, by whom'. Draft two example objectives yourself (e.g. reduce foreign-body complaints per million units by a stated percentage within a stated period, measured monthly from the complaint log) and check each against the measurable/monitored/communicated/updated test. For policy questions, include the commitment to satisfy applicable food safety requirements and to continual improvement in a way that is specific to the organisation's products and hazards.
Designing a hazard analysis that lists hazards but never records the justification for the hazard level, the control measure selected, or the reasoning that placed a control measure in the OPRP or CCP category.
Candidates focus on producing the 'right' answer (the hazard list) and treat the reasoning columns as paperwork, so they cannot explain, when asked, why a hazard is significant or why a particular control measure was classified as it was. The standard expects documented justification, not just an output table.
What to do instead
Practise writing hazard-analysis rows with four explicit fields: hazard and source, likelihood and severity with a stated basis (historical data, literature, regulatory limits), the control measure(s), and the justification for classification (why PRP, OPRP or CCP). Take one process step and write the row out in full, then answer the question 'why is this an OPRP and not a CCP?' in two sentences. Repeat until the justification habit is automatic.
Treating traceability as a finished-product recall list: describing lot identification and a customer contact list but omitting the requirement to trace raw materials forward and finished product backward, including quantities reconciled, and to test the system at a defined frequency.
Candidates confuse traceability with recall procedure, and many have seen traceability documented only as batch codes on labels. The requirement covers the ability to identify lots of incoming material and to link them through processing to finished product and distribution, with records kept for a defined period and the system verified by test.
What to do instead
Learn the traceability requirement as a two-direction exercise: pick a finished lot, trace back to every raw-material lot and supplier, and pick a raw-material lot, trace forward to every finished lot and customer. Add the reconciliation element (quantity in versus quantity out) and the periodic traceability test with its record. When a question mentions traceability, mention both directions, lot identification at all stages, records, and the test.
Describing monitoring as 'checking records' and omitting the elements the standard expects for each monitoring activity: what is measured, the method, the frequency, who is responsible, and the criteria or limits used to judge conformity.
In practice 'monitoring' is often performed by operators and recorded, so candidates describe it loosely as supervision or record review, conflating monitoring with verification. The exam expects the monitoring plan to be specified and the results evaluated against defined criteria.
What to do instead
Use the mnemonic 'what, how, when, who, against what': for each OPRP and CCP, state the parameter, the measurement method and equipment, the frequency, the responsible person and competence needed, and the limit or criterion. Then distinguish monitoring (ongoing, at the control point, generating results evaluated against criteria) from verification (confirming the plan is implemented and effective). Write out one CCP monitoring specification fully as practice.
Answering corrective-action questions with 'retrain the operator' or 'fix the product' only, without addressing the requirement to evaluate the cause, determine and implement action to eliminate it, review the effectiveness of the action, and handle the affected product (including its status and disposition).
Candidates collapse corrective action into correction. In everyday language 'corrective action' means fixing the immediate problem, but the standard separates correcting the nonconformity (including product disposition) from analysing cause and acting to prevent recurrence, and requires records of both.
What to do instead
Answer in a fixed sequence: contain and evaluate the affected product (is it safe? disposition and release decision), record the nonconformity, determine the cause, decide and implement action, review whether the action was effective, and update the hazard analysis or FSMS if needed. Practise with a scenario such as a metal-detector reject at the packing line, writing each of the five steps in one sentence.
Describing continual improvement as 'annual management review' or 'internal audit findings', without identifying improvement inputs, the evaluation of the FSMS's performance against objectives, and the update of the system (including the update of the hazard analysis) as a distinct activity.
Candidates equate improvement with the performance-evaluation clauses they have studied most, and they miss that the standard expects a deliberate process for updating the FSMS when inputs change (new hazards, new products, process changes, new legal requirements) and for evaluating performance against objectives.
What to do instead
Build a two-column list: 'inputs that trigger update' (new or changed product, process, layout, equipment, supplier, legislation, emerging hazard, complaint trend, audit finding) and 'evidence of improvement' (objectives met or exceeded, reduced nonconformities, improved verification results). For any improvement question, name the trigger, the update to the hazard analysis or control plan, and the verification that the change was effective.
Approaching the certification audit as a memory test about clause numbers: unable to explain, in an audit-style scenario, how the organisation demonstrates conformity for a given clause, what objective evidence an auditor would sample, and how a nonconformity would be graded and closed out.
Candidates revise definitions and clause lists but never practise answering scenario questions in the auditor's language (evidence, sampling, conformity, nonconformity, correction and corrective action, follow-up), so they freeze when asked 'what would you show the auditor' or 'how would you respond to this finding'.
What to do instead
Rehearse audit-style scenarios aloud: for each operational clause, state the requirement in one sentence, give two examples of objective evidence (records, interviews, observation), and describe what a nonconformity against it would look like and how it would be closed. Also practise the audit lifecycle: application and readiness, stage 1 (documentation and readiness), stage 2 (implementation effectiveness), findings and grading, corrective action and follow-up, and surveillance. Time yourself on three scenarios to build fluency.