Fundamental Principles and Concepts of an FSMS
This domain tests whether you understand why an FSMS exists and the principles behind ISO 22000:2018, not just its clause list. Expect questions on HACCP, PRPs, risk-based thinking, the two PDCA cycles and food-chain communication.
HACCP inside a management system
HACCP contributes seven principles: hazard analysis; determine CCPs; set critical limits; monitor; take corrective action; verify; keep records. ISO 22000 embeds HACCP but adds management-system elements: policy, objectives, competence, communication, traceability, emergency preparedness, internal audit, management review and improvement. Codex Alimentarius is the international HACCP reference.
PRPs, risk and PDCA
PRPs are hygiene and environmental controls that create the conditions for HACCP: cleaning, pest control, maintenance, personal hygiene and supplier approval. They are not CCPs. Risk-based thinking means prioritizing hazards by likelihood and severity and choosing controls proportionate to risk. ISO 22000 uses two PDCA cycles: the management-system cycle across clauses 4–10 and the operational cycle from hazard analysis to control plan, monitoring, verification and update.
Communication and traceability
Interactive communication runs upstream and downstream with suppliers, customers and regulators, and internally with the food safety team and operators. Traceability must link batches to raw materials and distribution so withdrawal or recall is possible.
Worked example: A chilled ready-meal producer identifies Listeria monocytogenes after cooking. Cooking is a CCP with a critical limit of 75 °C core for 2 minutes and continuous monitoring. Post-cook chilling is an OPRP with an action criterion of ≤5 °C within 4 hours and hourly checks. Cleaning is a PRP. Reasoning: cooking kills the hazard and has a measurable critical limit, so it is a CCP; chilling limits growth but is not a kill step and uses an action criterion, so it is an OPRP; cleaning is foundational, so it is a PRP.
Traps: treating HACCP as the whole FSMS; calling a PRP a CCP; confusing validation with verification; assuming every hazard needs a CCP; forgetting that OPRPs need monitoring and action criteria.