PECB ISO 22000 Foundation common mistakes
PECB ISO 22000 Foundation · Understand the traps and how to avoid them.
Treating ISO 22000 as a stand-alone hazard-control standard and describing it as 'HACCP plus a few extra documents', rather than as a full management system built on the harmonized structure (context, leadership, planning, support, operation, performance evaluation, improvement).
Candidates often prepare from HACCP training or from food-safety technical experience, so they map everything they read onto CCPs and critical limits and overlook the management-system clauses that carry a large share of the exam questions.
What to do instead
Before answering any question, ask which clause family it targets. Build a one-page map of the harmonized structure and, for each clause, write one sentence on what evidence an organization would produce. Practice classifying mixed statements as 'management-system requirement' versus 'operational hazard control' until the distinction is automatic.
Confusing prerequisite programmes (PRPs) with operational prerequisite programmes (OPRPs), for example naming cleaning and pest control as OPRPs or claiming every CCP must also be an OPRP.
The terms look similar and both concern control measures, so candidates rely on the word 'programme' rather than on the logic of hazard analysis and the criteria that justify elevating a control measure to an OPRP.
What to do instead
Memorize the decision logic: PRPs are baseline hygiene conditions established through hazard analysis and applicable across the site; OPRPs are control measures identified by hazard analysis as necessary to prevent or reduce a significant hazard to acceptable levels, applied to a specific step or product, with measurable or observable criteria and monitored action criteria. Test yourself by justifying, for five example control measures, why each is a PRP, OPRP or CCP.
Describing the hazard analysis as a list of hazards only, omitting the requirement to assess the likelihood and severity of each hazard and to determine whether it is significant enough to require control measures.
Candidates learn hazard categories (biological, chemical, physical, allergen) and stop there, so they write descriptive answers that never reach the risk-evaluation step the standard actually requires.
What to do instead
Structure every answer on hazard analysis as three moves: identify hazards per step and product, evaluate them against defined likelihood and severity criteria, then select control measures for those assessed as needing control. Rehearse this with one process flow so the sequence is fixed in memory.
Confusing verification with validation, for example stating that validation is the periodic check that the FSMS is working, or that verification proves a control measure can achieve its intended effect.
Both terms appear in the same clauses and both sound like 'checking', so candidates swap them under time pressure without a functional anchor.
What to do instead
Anchor on purpose: validation answers 'would this control measure work as designed?' and happens before or on implementation; verification answers 'is it actually working and is the system conforming?' and happens routinely afterwards. Associate validation with evidence such as scientific literature, challenge tests and regulatory limits, and verification with monitoring records review, sampling, audits and calibration.
Treating the hazard analysis and the HACCP plan as interchangeable, or assuming ISO 22000 mandates a separate documented HACCP plan document with a fixed format.
Legacy HACCP vocabulary is strong in the food industry, and many candidates have seen Codex-style documentation, so they import document-format assumptions that the standard does not impose.
What to do instead
Learn what the standard actually requires to be documented: hazard analysis, the hazard control plan (which includes OPRPs and CCPs with their limits, monitoring, corrections and corrective actions), and the PRPs selected. Focus answers on required content and logical linkage rather than on document titles or templates.
Mixing up correction, corrective action and withdrawal or recall: for example saying a corrective action is the immediate handling of a nonconforming product, or that a recall is the corrective action for a CCP deviation.
The words overlap in everyday language and the standard places them in different clauses, so candidates answer from intuition instead of from the defined roles.
What to do instead
Build a three-line chain: correction deals with the immediate nonconforming product or process deviation; corrective action eliminates the cause so it does not recur, and includes reviewing the hazard analysis and updating the hazard control plan where needed; withdrawal or recall is the planned response when product already released is found unsafe. Practice with a scenario such as a metal-detector rejection and trace the same event through all three.
Answering questions on communication and external information as if they concerned only internal staff briefings, missing the requirement to communicate with suppliers, customers, regulators and other relevant external parties, and to keep the food safety team informed of relevant external developments.
Candidates read 'communication' as an HR or internal-audit topic, and the external-information element is a distinctive ISO 22000 feature that general management-system study material does not emphasize.
What to do instead
Memorize the communication axes: internal, external, and communication with suppliers and contractors, plus the flow of external information into the FSMS (new regulations, scientific findings, customer requirements, complaints). For each axis write one concrete example of what is communicated and to whom, and one place it would be recorded.
Describing top management responsibility as 'signing the food safety policy and approving the budget', without covering the requirement to demonstrate leadership and commitment by ensuring the FSMS is integrated into business processes, providing resources, and communicating the importance of conforming to food safety requirements.
Leadership clauses read like boilerplate, so candidates skim them and reproduce generic corporate-governance language rather than the standard's specific expectations.
What to do instead
Prepare a short list of observable leadership behaviours: policy aligned with strategic direction, food safety objectives set and resourced, management review used as a decision forum, roles and responsibilities assigned, and active promotion of improvement. When a question mentions top management, choose the answer that shows a behaviour, not just an approval.
Treating monitoring and measurement as purely a laboratory activity and forgetting calibration and verification of measuring equipment, or forgetting that monitoring results must be evaluated against defined criteria and that action criteria trigger action before a limit is exceeded.
Candidates picture a testing lab rather than a production line, so they miss the equipment, criteria and decision rules that operational control depends on.
What to do instead
For each example control measure, write four fields: what is measured, how and with what equipment, the criterion or limit, and the action taken if the criterion is not met. Add a fifth field for how the equipment is kept trustworthy (calibration, verification, traceability). This five-field template covers most operational-control questions.
Ignoring traceability and the requirement to identify and assess product that is affected when a nonconformity is detected, or assuming traceability means only lot numbering on finished packaging.
Traceability feels like a labelling detail, so candidates underprepare for questions about identifying affected product, tracing it through the process, and establishing the link between batches and raw materials.
What to do instead
Learn traceability as a system: identify product lots and their relationship to raw materials, packaging, processing conditions and distribution, and test the system through a mock trace or mass balance. Link it explicitly to the nonconformity clause by rehearsing how far back and forward you would trace when a deviation is found.