PECB ISO 22000 Foundation cheat sheet

ISO 22000 belongs to the ISO high-level structure (HLS), so it shares clause numbering and core text with ISO 9001 and ISO 14001: clauses 1-3 are scope, normative references and terms; clauses 4-10 carry the auditable requirements.

Food safety hazard categories are biological (bacteria, viruses, parasites, prions), chemical (toxins, allergens, cleaning residues, veterinary drugs), and physical (glass, metal, bone, stones); radiological and allergen hazards are commonly grouped with chemical ones.

The Codex Alimentarius General Principles of Food Hygiene establish the two-step logic an FSMS must follow: prerequisite programmes (PRPs) first, then HACCP-based hazard analysis for significant hazards that PRPs cannot control.

The seven HACCP principles are: hazard analysis; determination of CCPs; establishment of critical limits; monitoring of CCPs; corrective actions; verification procedures; and documentation and record keeping.

A critical control point (CCP) is a step where control is essential to prevent, eliminate, or reduce a significant hazard to an acceptable level; an operational prerequisite programme (OPRP) controls a significant hazard by criteria that are not critical limits.

A critical limit is a measurable value separating acceptability from unacceptability at a CCP; an action criterion is the equivalent measurable criterion used for an OPRP, and both require defined monitoring and correction or corrective action.

Risk in ISO 22000 is a function of the likelihood of a hazard's occurrence and the severity of its adverse health effect; hazard assessment combines these two dimensions when deciding whether a hazard is significant.

The PDCA cycle structures the standard: Plan covers clauses 4-7 (context, leadership, planning, support), Do covers clause 8 (operation), Check covers clause 9 (performance evaluation), and Act covers clause 10 (improvement).

An FSMS is a set of interrelated elements an organization uses to establish food safety policy and objectives and to achieve those objectives; certification is against the standard, not against a product or a finished batch.

Clause 4 requires the organization to determine external and internal issues, identify interested parties relevant to food safety, define the FSMS scope with products, processes and sites, and establish, implement, maintain and continually improve the FSMS.

Clause 5 requires top management to demonstrate leadership, establish a food safety policy, assign roles and responsibilities, and appoint a food safety team leader who manages the food safety team and reports on FSMS performance.

Clause 6 requires risk-based planning: actions to address risks and opportunities, food safety objectives, and planning of changes; clause 7 covers resources, competence, awareness, communication and documented information.

Clause 7.4 distinguishes internal communication (between process owners and the food safety team) from external communication with suppliers, customers, regulators and other interested parties, with designated responsibility for each.

Clause 8.2 requires PRPs selected from recognized sources (such as Codex General Principles of Food Hygiene) for the relevant part of the food chain, appropriate to the organization's products and processes.

Clause 8.5 requires a hazard analysis with product and process descriptions and intended use, hazard identification, hazard assessment, and selection of control measures, including validation before implementation.

Clause 8.8 requires the HACCP plan and OPRPs to specify hazards, control measures, critical limits or action criteria, monitoring procedures and frequency, corrections and corrective actions, and verification, with records kept.

Clause 9 requires monitoring, measurement, analysis and evaluation, internal audit at planned intervals, and management review with defined inputs and outputs; clause 10 covers nonconformity, corrective action and continual improvement.

An emergency or incident (clause 8.4) requires documented procedures for response, including withdrawal and recall, with notification to interested parties and verification of the response.