Food Safety Management System Requirements
This domain tests your knowledge of what ISO 22000:2018 actually requires - clause by clause - and your ability to separate mandatory requirements from conventional practice.
Clause map
Clause 4 Context (internal/external issues, interested parties, scope, the FSMS itself); 5 Leadership (commitment, food safety policy, roles and authorities); 6 Planning (risks and opportunities, objectives, planning of changes); 7 Support (resources, competence, awareness, communication, documented information); 8 Operation; 9 Performance evaluation; 10 Improvement.
What is genuinely mandatory
- A defined scope stating products, processes and sites covered.
- A food safety policy communicated and available as documented information.
- A food safety team with combined knowledge of the product, process and hazards, led by an appointed team leader.
- Documented information required by the standard plus whatever the organisation judges necessary for effectiveness.
- Control of externally provided processes, products and services - outsourced storage, transport, laboratory testing and pest control fall inside the FSMS.
Worked example
A spice blender outsources milling and laboratory testing. The auditor asks how the FSMS covers these. The correct answer is not "they have ISO 9001": the organisation must specify the controls, hazard information and communication for the outsourced process, include the external provider in supplier approval and PRP expectations, and retain records of monitoring and verification.
Traps
Inventing a required "food safety manual" - the standard does not demand one; assuming every clause needs a written procedure; forgetting that 7.4 communication covers both internal (food safety team, shift handover) and external (suppliers, customers, authorities, contractors); treating "shall" and "should" as interchangeable; ignoring planning of changes (6.3) when a line or supplier changes.