Key Components of FSMS

Two factories produce the same soup. Both have a hazard analysis on file. One keeps finding metal fragments at packing and relies on rework. The other rarely finds them because supplier controls, preventive maintenance, and a well-placed magnet are all working together. Difference lies in how the components of the food safety management system fit together, not in whether a single document exists.

A food safety management system under ISO 22000:2018 is a set of interrelated elements that establish policy and objectives and achieve those objectives. Auditing component by component misses that interrelation. You need to see each component clearly, then test connections between them.

Policy, Objectives, and Organisational Context

Clause 4 requires the organisation to determine external and internal issues and the needs of interested parties such as regulators, customers, and consumers. Clause 5 requires top management to establish a food safety policy appropriate to the organisation’s role in the food chain. Clause 6 turns policy into measurable food safety objectives and plans to achieve them.

As an auditor, test alignment. If the context review identifies imported spices as a high-risk input, objectives, supplier evaluation criteria, and incoming inspection should reflect that. Misalignment is evidence: a policy promising continual improvement with no objectives, no resources, and no review is not an effective system, even if the policy document itself is well written.

Support Elements That Make Control Possible

Clause 7 covers resources, competence, awareness, communication, and documented information. Support is not background administration. It determines whether operational controls can work at all.

People and Competence

Organisations must determine necessary competence for people affecting food safety, provide training or other actions, and retain evidence. That includes the food safety team, which needs multidisciplinary knowledge covering products, processes, equipment, and hazards. Check competence where risk is highest: allergen changeovers, CCP monitoring, sanitation verification, and laboratory methods. A training matrix alone is not proof. Ask staff to explain and show what they do, and compare that with procedures.

Communication and Documented Information

External communication keeps hazard information moving along the food chain and to authorities and customers when needed. Internal communication ensures changes, deviations, and complaints reach the food safety team in time. Documented information must be controlled so current versions are available at points of use and obsolete versions do not cause errors. Finding an out-of-date cleaning instruction at a workstation is a Clause 7 failure with direct Clause 8 consequences.

Operational Controls in Clause 8

Clause 8 is the largest and most technical part of the standard. Its components work in sequence.

• Prerequisite programmes (PRPs): basic conditions and activities needed to maintain a hygienic environment, such as cleaning, pest control, personal hygiene, maintenance, and supplier management. PRPs are selected based on the organisation’s sector and operations.
• Traceability system: ability to trace lots of raw materials, ingredients, and product-contact materials forward to immediate customers and back to immediate suppliers, with records retained for a defined period.
• Emergency preparedness and response: procedures for incidents that can affect food safety, such as power loss, water contamination, fire, or flooding.
• Hazard analysis and hazard control plan: identification of hazards, assessment of acceptable levels, selection and categorisation of control measures as OPRPs or CCPs, setting of critical limits for CCPs and action criteria for OPRPs, and monitoring and correction procedures.
• Verification planning and verification: planned activities to confirm that PRPs are implemented, hazard analysis inputs are current, hazard levels are within acceptable levels, and controls are effective.
• Control of product and process nonconformities: corrections, handling of potentially unsafe products, evaluation for release, disposition, and withdrawal or recall when needed.

A common audit error is to judge each item in isolation. A CCP limit may be scientifically valid, but if monitoring equipment is not calibrated under Clause 9.1 arrangements, or monitoring staff are not competent, the control is not effective. Follow dependencies.

Checking and Improving the System

Clause 9 requires monitoring, measurement, analysis, and evaluation of FSMS performance. Internal audit under Clause 9.2 checks whether the system conforms to the organisation’s own requirements and to ISO 22000, and whether it is effectively implemented and maintained. Management review under Clause 9.3 requires top management to review inputs such as audit results, verification outcomes, complaints, supplier performance, and changes in context, and to produce decisions on improvement and resource needs.

Clause 10 closes the loop. When a nonconformity occurs, the organisation must react, evaluate the need for corrective action to eliminate root causes, implement action, and review effectiveness. Continual improvement and updating of the FSMS are separate expectations: the system must be kept current when teams, products, processes, or hazard knowledge change.

For audit planning, use these components as a map for sampling. Do not sample only Clause 8 records. Sample a complaint through communication, verification, management review, and corrective action. Sample a new product from context and planning through hazard analysis to monitoring. Cross-clause trails reveal whether the system functions as a system.

Documentation habits reveal integration quality quickly. Sample a single deviation and ask for its full record set: monitoring entry, correction note, product evaluation, verification entry, and corrective action. In a connected system those records reference each other and tell one consistent story with matching times, lots, and decisions. In a fragmented system each record exists alone, times drift, and product disposition is missing. That single test, repeated with a complaint and a supplier change, gives you a reliable judgement on whether components cooperate or merely coexist on the same site.

Key points

• FSMS components span Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation, and improvement.
• Clause 7 support, including competence and controlled documented information, determines whether Clause 8 controls can succeed.
• Clause 8 links PRPs, traceability, emergency preparedness, hazard control, verification, and control of nonconformities in sequence.
• Internal audit is Clause 9.2 and management review is Clause 9.3; both feed improvement under Clause 10.
• Audit connections between components, not just the presence of each document or record.