Introduction to ISO 22000 Structure

Open ISO 22000:2018 at random and you may land on a requirement about document control, then one about cooking temperatures, then one about management review. Without a map, the standard feels scattered. With a map, its logic is plain: clauses 4 to 7 plan and support the system, clause 8 controls operations, and clauses 9 and 10 check results and improve. Learning that structure is how an auditor finds the right requirement quickly and sees how failures connect.

Structure also matters because ISO 22000 shares its framework with other management system standards. Organisations running ISO 9001 for quality alongside it will recognise the same clause order and much of the same language. Food safety specific content sits mainly in clause 8, where prerequisite programmes and hazard control live. Knowing which parts are generic management and which are food safety specific helps you audit each on its own terms.

Clauses 1 to 3: the frame

Clause 1 defines scope: the standard specifies requirements for a food safety management system for organisations in the food chain that need to demonstrate their ability to consistently provide safe products and services and meet applicable legal and customer requirements. Clause 2 lists normative references, principally the ISO 22000 vocabulary standard. Clause 3 provides terms and definitions, and auditors should use them precisely. Words such as significant hazard, control measure, OPRP, CCP, critical limit, action criterion, correction, and corrective action have defined meanings that decide audit conclusions.

Definitions prevent costly confusion. A correction is action to eliminate a detected nonconformity, such as re-chilling product. Corrective action eliminates the cause so it does not recur. Validation is obtaining evidence that control measures will be capable of controlling the hazard. Verification confirms that specified requirements have been fulfilled. Teams that swap these terms loosely usually apply the concepts loosely too, and records show it.

Clauses 4 to 7: plan and support

Clause 4 asks you to understand your organisation and its context, the needs of interested parties such as regulators, customers, and owners, and to define the scope of the system. Clause 5 covers leadership: food safety policy, organisational roles, and the food safety team and its leader. Clause 6 covers planning: actions to address risks and opportunities, food safety objectives and plans to achieve them, and planning of changes so changes are carried out in a controlled way.

Clause 7, support, is longer than it first appears. It covers resources, infrastructure, and work environment. It covers externally developed elements and externally provided processes, products, and services, which is how supplier control enters the management clauses. It also covers competence and awareness, internal and external communication in clause 7.4, and documented information in clause 7.5: creating, updating, and controlling documents and records so current versions are available and obsolete ones do not creep back into use.

Where documented information appears

Requirements for documented information are spread through the standard, not gathered in one list. Some items must be documented and retained as evidence, such as hazard analysis inputs and internal audit results. Others must be documented and kept available, such as the scope, policy, and objectives. An auditor checks both kinds and should know, for each clause, what evidence the standard expects to exist.

Clause 8: operation in detail

Clause 8 is where food safety happens. Clause 8.2 sets requirements for prerequisite programmes. Clause 8.3 covers the traceability system. Clause 8.4 covers emergency preparedness and response. Clause 8.5, hazard control, is the longest sequence: preliminary steps to enable hazard analysis, including raw material and product characteristics, intended use, flow diagrams, and descriptions of process steps and existing control measures; hazard identification and assessment; selection and categorisation of control measures; validation of control measure combinations; and the hazard control plan, followed by updating, verification planning, and control of monitoring and measuring.

Later parts of clause 8 deal with what happens when control is lost: control of product and process nonconformities in clause 8.9, including corrections, corrective actions, handling of potentially unsafe products, evaluation for release, disposition, and withdrawal or recall. An audit trail often runs through clause 8 in order, from a raw material specification, through a flow diagram and hazard assessment, to a limit in the hazard control plan and the record that proves monitoring happened.

Clauses 9 and 10: check and improve

Clause 9 covers performance evaluation. Clause 9.1 covers monitoring, measurement, analysis, and evaluation, including verification activities for prerequisite programmes and the hazard control plan. Clause 9.2 requires internal audits at planned intervals. Clause 9.3 requires management review, with defined inputs such as audit results, verification results, nonconformities, and changes, and defined outputs such as decisions on improvement and resources.

Clause 10 closes the loop. It requires reaction to and control of nonconformity, corrective action proportionate to the effects, continual improvement of the system, and updating the food safety management system when changes occur. Read together, clauses 9 and 10 are why the system cannot stand still: evaluation produces information, and clause 10 obliges you to act on it.

Annexes support the main text. They include a cross-reference to Codex HACCP and a comparison of structure with ISO 9001. They help interpretation but do not add requirements. In an audit, findings cite the normative clauses, not the annexes.

Key points

• ISO 22000:2018 uses clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation, and improvement.
• Clauses 1 to 3 set scope, references, and precise definitions that govern how findings are worded.
• Clause 8 holds the food safety specific work, especially hazard control in clause 8.5.
• Documented information requirements are spread across clauses; auditors must know what evidence each clause expects.
• Clauses 9 and 10 turn monitoring, audit, and review results into corrective action and updating.