Key Requirements of ISO 22000: Clause-by-Clause Breakdown

An audit finding that simply says “Clause 8 not met” helps no one. Plant staff cannot correct it, managers cannot resource it, and a certification reviewer cannot judge it. Precise work requires knowing what each clause actually demands, sub-clause by sub-clause, and what evidence would prove it.

ISO 22000:2018 contains auditable requirements in Clauses 4 to 10. Reading them as a connected story, rather than a checklist of isolated lines, gives you the structure for planning samples, writing findings, and judging severity.

Clauses 4 to 6: Context, Leadership, and Planning

Clause 4, Context of the organisation. Determine internal and external issues (4.1) and interested parties and their requirements (4.2). Determine the scope of the FSMS (4.3). Establish, implement, maintain, and continually improve the FSMS itself (4.4). Audit test: can the organisation show how a relevant issue, such as a new allergen regulation or a new raw material origin, entered planning and operational control?

Clause 5, Leadership. Leadership and commitment (5.1), food safety policy (5.2), and organisational roles, responsibilities, and authorities (5.3), including the food safety team and team leader. Audit test: interview leaders and staff at different levels and compare accounts with resources and review decisions.

Clause 6, Planning. Actions to address risks and opportunities (6.1), food safety objectives and planning to achieve them (6.2), and planning of changes (6.3). Note that risks here are organisational risks to FSMS results, distinct from food safety hazards handled in Clause 8. Audit test: trace one objective to actions, owners, timelines, and evaluation results.

Clause 7: Support

Clause 7 makes operation possible. Resources (7.1) covers people, infrastructure, work environment, externally developed FSMS elements, control of externally provided processes, products, and services, and external expertise. Competence (7.2) and awareness (7.3) require that people affecting food safety can do their work and understand policy, objectives, and consequences of nonconformity. Communication (7.4) covers external and internal communication, including what, when, with whom, and how. Documented information (7.5) covers creating, updating, and control, so correct versions are available and protected.

Audit Clause 7 where work happens. Check the version in use at the line, the competence of the person performing a safety-critical task tonight, and whether a supplier change was communicated to the food safety team before delivery, not after.

Clause 8: Operation in Detail

Clause 8 requires operational planning and control (8.1), then the technical core:

  1. 8.2 PRPs: establish, implement, maintain, and update prerequisite programmes appropriate to the organisation, considering applicable information such as ISO/TS 22002 series where relevant.
  2. 8.3 Traceability: trace materials and products, retain records, and test the system.
  3. 8.4 Emergency preparedness and response: procedures to manage emergencies and incidents, with testing where practicable and review after incidents or tests.
  4. 8.5 Hazard control: preliminary information and flow diagrams, hazard analysis, selection and categorisation of control measures into OPRPs and CCPs, validation of control measures and combinations, and the hazard control plan specifying critical limits, action criteria, monitoring, corrections, and responsibilities.
  5. 8.6 Updating: keep preliminary information and hazard control plan current when changes occur.
  6. 8.7 Control of monitoring and measuring: provide valid, calibrated equipment and safeguard results when equipment is found unfit.
  7. 8.8 Verification: carry out verification related to PRPs and the hazard control plan and analyse results of verification activities.
  8. 8.9 Control of nonconformities: corrections, handling potentially unsafe products, evaluation for release, disposition of nonconforming products, and withdrawal or recall.

Distinguish critical limits from action criteria. Critical limits separate acceptability from unacceptability at CCPs and must be measurable. Action criteria for OPRPs must be measurable or observable and support timely action before a limit situation develops. Confusing the two weakens both monitoring and findings.

Clauses 9 and 10: Evaluation and Improvement

Clause 9, Performance evaluation. Monitoring, measurement, analysis, and evaluation (9.1) asks what needs monitoring, with valid methods, timing, and analysis. Internal audit (9.2) requires an audit programme, criteria and scope for each audit, objective and impartial auditors who do not audit their own work, reporting of results, and retention of evidence. Management review (9.3) requires top management review at planned intervals with defined inputs, including verification activity results, audit outcomes, and supplier performance, and outputs covering decisions on improvement opportunities, FSMS updates, and resource needs.

Clause 10, Improvement. Nonconformity and corrective action (10.1) requires reacting to nonconformities, evaluating root causes, implementing action, reviewing effectiveness, and updating risks and the FSMS as needed. Continual improvement (10.2) requires the organisation to continually improve suitability, adequacy, and effectiveness. Update of the FSMS (10.3) requires the food safety team to evaluate and update the system at planned intervals and after relevant changes.

When you write findings, cite to the most specific sub-clause that the evidence supports. Precision protects the auditee from vague correction work and protects you on review.

Reading the standard in full before an audit remains non-negotiable preparation. Summaries and checklists compress wording, and compression loses obligations: a shall statement reduced to a heading can hide duties on timing, responsibility, or retained evidence. During the audit, keep the actual text available and return to it when grading is disputed. Quote the requirement in findings in shortened form if scheme rules allow, but judge against the complete sentence, including its conditions. Precision at this level separates professional auditing from checklist completion and protects both consumer safety and auditee fairness.

Key points

  • Clauses 4 to 6 set context, leadership accountability, and planning, including organisational risks distinct from food safety hazards.
  • Clause 7 support covers resources, competence, awareness, communication, and control of documented information.
  • Clause 8 runs from PRPs and traceability through hazard control with OPRPs and CCPs to verification and control of nonconformities.
  • Internal audit is Clause 9.2 and management review is Clause 9.3, each with defined inputs, process, and outputs.
  • Clause 10 requires corrective action on root causes, continual improvement, and timely updating of the FSMS.
  • Cite findings at sub-clause level supported by specific objective evidence.
PreviousNext