GENEVA – In an era where global supply chains are increasingly complex, ensuring the safety of food from farm to fork has never been more critical. The International Organization for Standardization (ISO) 22000:2018 standard stands as the definitive framework for Food Safety Management Systems (FSMS).
By integrating strategic business management with rigorous hazard control, this document provides a robust roadmap for any organization in the food chain to guarantee safe products.
This extensive review analyzes the core components of the 2018 second edition, highlighting its adoption of the High-Level Structure (HLS), its unique two-level Plan-Do-Check-Act (PDCA) cycle, and its stringent operational requirements.
A Strategic Approach to Food Safety
The ISO 22000:2018 standard represents a significant evolution from its predecessor. It is not merely a checklist for hygiene; it is a strategic decision for an organization to improve its overall performance in food safety. The standard is applicable to any organization, regardless of size or complexity, directly or indirectly involved in the food chain—from feed producers and farmers to retailers and catering services.
The primary objective is clear: to enable organizations to plan, implement, operate, maintain, and update an FSMS that provides products and services that are safe for their intended use. This involves demonstrating compliance with statutory and regulatory requirements while effectively communicating food safety issues to interested parties throughout the food chain.
The Two-Level PDCA Cycle
A defining feature of the 2018 edition is its sophisticated use of the Process Approach, incorporating the Plan-Do-Check-Act (PDCA) cycle at two distinct levels.
Organizational PDCA: This covers the overall frame of the FSMS (Clauses 4 through 7 and Clauses 9 through 10). It ensures the business side of the system—leadership, planning, and support—is functioning correctly.
Operational PDCA: This covers the operational processes within the food safety system, specifically described in Clause 8. This is where the principles of HACCP (Hazard Analysis and Critical Control Point) are applied.
By linking these two levels, the standard ensures that the technical control of food hazards is supported by adequate resources and management commitment.
Leadership and Context: The Foundation (Clauses 4 & 5)
Implementation begins with understanding the Context of the Organization. The standard mandates that organizations determine external and internal issues relevant to their purpose—ranging from legal and technological environments to food fraud and defense concerns. Furthermore, organizations must identify interested parties (stakeholders) and their relevant requirements to ensure the FSMS can achieve its intended results.
Leadership is no longer a passive role. Top management must demonstrate active leadership and commitment. This includes:
Ensuring the food safety policy and objectives are compatible with the strategic direction of the company.
Integrating FSMS requirements into the organization's core business processes.
Ensuring resources are available.
Top management is also responsible for assigning clear roles, specifically appointing a Food Safety Team and a Team Leader responsible for the system’s establishment and effectiveness.
Planning and Support: Risk-Based Thinking (Clauses 6 & 7)
A major shift in the 2018 standard is the explicit emphasis on Risk-Based Thinking. This operates on two levels: organizational risk (business uncertainty) and food safety risk (hazards).
Organizational Risk Management
Under Clause 6, organizations must plan actions to address risks and opportunities. This might involve avoiding risk, taking risk to pursue an opportunity, or eliminating a risk source. The goal is to prevent undesired effects and achieve continual improvement.
Resource and Support Management
To execute these plans, Clause 7 dictates strict requirements for support. This includes providing necessary infrastructure (buildings, utilities, equipment) and a suitable work environment (controlling hygiene, temperature, and even psychological factors).
Competence and Awareness are pivotal. The organization must ensure that all persons affecting food safety performance are competent through education, training, or experience. Crucially, the standard requires that all employees are aware of the food safety policy and the implications of not conforming to the FSMS requirements.
Communication is mandated as a two-way stream.
External Communication: Organizations must effectively communicate with suppliers, customers, and statutory authorities regarding product safety information and hazards.
Internal Communication: The food safety team must be kept informed of changes in products, raw materials, equipment, or production systems to update the FSMS continually.
Operation: The Core of Food Safety (Clause 8)
Clause 8 is the operational engine of ISO 22000, integrating the Codex Alimentarius HACCP principles into the management system.
Prerequisite Programmes (PRPs)
Before addressing specific hazards, organizations must establish Prerequisite Programmes (PRPs). These are the basic conditions necessary to maintain a hygienic environment. Depending on the industry segment, this includes pest control, cleaning and sanitizing, personal hygiene, and supplier approval processes.
Traceability and Emergency Response
The standard enforces a robust Traceability System. Organizations must be able to uniquely identify incoming material from suppliers and the first stage of the distribution route of the end product. This system must be verified and tested. Similarly, Emergency Preparedness procedures must be in place to handle incidents like natural disasters or bioterrorism that could impact food safety.
Hazard Control: The HACCP Plan
The heart of Clause 8 is the systematic control of hazards.
Hazard Analysis: The food safety team must identify and document all reasonably expected food safety hazards (biological, chemical, or physical). This involves analyzing flow diagrams, process steps, and the characteristics of raw materials and end products.
Hazard Assessment: Each hazard is assessed based on the likelihood of occurrence and the severity of adverse health effects to determine if it is a "significant food safety hazard".
Selection of Control Measures: Organizations must select measures to prevent or reduce these hazards to acceptable levels.
The Critical Distinction: CCPs vs. OPRPs ISO 22000:2018 distinguishes between two types of control measures based on a systematic categorization:
Critical Control Points (CCPs): Steps where control is applied to prevent or reduce a significant hazard to an acceptable level, and where defined critical limits (measurable values) allow for immediate correction.
Operational Prerequisite Programmes (OPRPs): Control measures essential to prevent or reduce hazards, where action criteria (measurable or observable) enable effective control.
For both CCPs and OPRPs, the organization must establish a Hazard Control Plan comprising monitoring systems, responsibilities, and specific corrections to be taken if limits are breached.
When critical limits at a CCP are not met, the product must be handled as potentially unsafe and not released until evaluated. The standard outlines strict protocols for corrections, corrective actions, and the withdrawal or recall of unsafe products from the market.
An FSMS is not a "set and forget" system. Clause 9 mandates rigorous evaluation.
Monitoring and Measurement: The organization must determine what needs to be monitored, the methods used, and when results are analyzed.
Internal Audit: Audits must be conducted at planned intervals to determine if the FSMS conforms to requirements and is effectively implemented.
Management Review: Top management must review the FSMS performance, considering inputs like audit results, customer complaints, and the effectiveness of risk actions. This review must result in decisions related to continual improvement and resource needs.
Improvement (Clause 10)
The final clause emphasizes the cycle of Improvement. When nonconformities occur, the organization must not only correct them but also analyze the root causes to prevent recurrence.
Furthermore, the standard requires the Update of the FSMS. The food safety team must evaluate the system at planned intervals, reviewing the hazard analysis and established control plans to ensuring the system evolves alongside changes in the organization.
Dowload File: ISO 22000:2018
Key Terminology Guide
For readers less familiar with ISO technical language, the following definitions from the standard are essential for understanding the article above:
Food Safety Hazard: A biological, chemical, or physical agent in food with the potential to cause an adverse health effect.
Validation: Obtaining evidence prior to an activity that a control measure is capable of effective control.
Verification: Confirmation after an activity, through objective evidence, that requirements have been fulfilled.
Monitoring: Conducting a planned sequence of observations or measurements during an activity to assess if a process is operating as intended.
Corrective Action: Action to eliminate the cause of a nonconformity and prevent recurrence.
