Planning of an FSMS Implementation Based on ISO 22000
This domain tests whether you can sequence an implementation project realistically - what must exist before what - rather than describing documentation alone.
The sequence that works
- Decision and mandate: top management commits, appoints a project lead and reserves resources.
- Gap analysis: compare current HACCP, hygiene and management practices against ISO 22000:2018 clauses; capture existing certificates (ISO 9001, customer codes) to reuse.
- Context and scope: define products, process categories, sites and boundaries (4.1–4.3).
- Food safety team: form it early - competence takes time to build.
- PRP baseline: assess and upgrade prerequisites before hazard analysis, because hazard analysis assumes the PRPs in place.
- Process flow and layout: draw them, then verify on site by walking the line, including rework, by-products and returns.
- Hazard analysis and hazard control plan (8.5), including validation of control measures.
- Implementation, verification, internal audit, management review, then certification.
Worked example
A sauce producer with two sites plans five months. Month 1: gap analysis and scope. Month 2: team training plus PRP upgrade (drainage, allergen segregation). Month 3: flow diagram verification and hazard analysis, freezing the hazard control plan. Month 4: records accumulate, verification sampling, internal audit in week 3. Month 5: management review, then stage 1. The reasoning: hazard analysis cannot be finalised before PRPs and flow diagrams are settled, and internal audit needs enough implemented records to be meaningful.
Traps
Writing documents before the flow diagram is verified; scheduling internal audit before implementation is complete; letting a consultant own the FSMS so the team cannot defend the hazard analysis; assuming a short "record history" is acceptable to a certification body.