ISO 22000:2018 Checklist

Audit Checklist: Requirements of ISO 22000 version 2018 - Food Safety Management System

Clau Status:
OK | CRITICAL NC |
se Requirements of the Standard MAJOR NC | MINOR Comments
N.º NC
4 Context of the Organization
4.1 Understanding the organization and its context
The organization shall determine external and internal issues that are relevant to its purpose and affect its ability
to achieve the desired results of its FSMS.

The organization shall identify, review and update information related to these external and internal issues

4.2 Understanding the needs and expectations of interested parties

To ensure that the organization has the ability to constantly provide products and services that meet statutory,
regulatory and customer requirements applicable to food safety, the organization shall determine:

a interested parties relevant to FSMS;

b relevant requirements of FSMS interested parties;

The organization shall identify, review and update information related to interested parties and their requirements.

The organization shall establish, implement and maintain a procedure to:

a identify the statutory, regulatory and customer requirements applicable to food safety;
b determine how these requirements apply to food safety.
The organization shall document how these requirements are addressed.
4.3 Determining the scope of the food safety management system

The organization must define the limits and applicability of FSMS to establish its scope. The scope should
specify the following: products and services, processes, and production locations that are covered by FSMS.

The scope should include the following: activities, processes, products or services that may influence the food
safety of your final products.
When determining this scope, the organization should consider:

a External and Internal issues referred in clause 4.1

b requirements from clause 4.2.

The scope must be available and maintained as documented information.

4.4 Food safety management system

The organization must establish, implement, maintain, update and continuously improve FSMS, including the
necessary processes and their interactions, according to the requirements of this document.

5 Leadership
5.1 Leadership and commitment
The Top Management must demonstrate leadership and commitment with respect to the FSMS:
ensure that food safety policy and FSMS objectives are established and compatible with the organisation's
a
strategic direction;
b ensure the integration of FSMS requirements into the organization's business processes;
c ensure that the resources needed for the FSMS are available;
communicate the importance of effective food safety management and compliance with FSMS requirements, and
d
the requirements of mutually agreed customers on food safety;
e ensure that FSMS is evaluated and maintained to achieve the desired result(s) (4.1);
f directing and supporting persons to contribute to the FSMS
g promote continuous improvement;
support other relevant management functions to demonstrate your leadership in what applies to your areas of
h
responsibility.
5.2 Policy
5.2.1 Establishing the food safety policy

Top Management shall establish, implement and maintain a food safety policy that:

a appropriated to the purpose and context of the organization;

b provides a framework to define and review the objectives of FSMS
include a commitment to meet applicable food safety requirements, including mutually agreed
c
customer requirements for food safety;
d address internal and external communication;
e include a commitment to continuous improvement of FSMS;

f address the need to ensure food safety skills.

5.2.2 Communicating the food safety policy
Food safety policy shall:
a be available and maintained as documented information
b communicated, understood, and applied at all levels of the organization;
c available to relevant interested parties as appropriated.
5.3 Organizational role, responsibilities and authorities
5.3.1
Top Management shall ensure that responsibilities and authorities to the relevant roles are designated,
communicated and understood within the organization.

Top Management shall designate responsibility and authority to:

a ensure that FSMS complies with the requirements of this document;

b report the performance of FSMS to top management;

c define the food safety team and the food safety team leader;
d designate personnel with responsibility and authority defined to initiate and document actions.
5.3.2
The food safety team leader should be responsible for:
a ensure that FSMS is established, implemented, maintained and up-to-date;
b manage and organize the work of the food safety team;

c ensure relevant training and skills of members of the food safety team;

d report to top management the effectiveness and adequacy of FSMS.

5.3.3

All persons shall have responsibility to report FSMS related problems to the designated person(s).

6 Planning
6.1 Actions to address risks and opportunities
6.1.1

When planning FSMS, the organization shall consider the questions presented in clause 4.1 and the
requirements related to clause 4.2 and 4.3 and determine the risks and opportunities that need to be
addressed in

a ensure that FSMS can achieve its intended result(s);

b improve desirable effects;
c prevent, or reduce, undesirable effects;
d achieve continuous improvement.
6.1.2
The organization must plan:

a actions to address these risks and opportunities;

b how you:
i integrate and implement actions in FSMS processes;
ii assess the effectiveness of these actions.
6.1.3

The actions taken by the organization to address risks and opportunities shall be proportionate to:

a the impact on food safety requirements

b compliance with food products and services to consumers;
c requirements of the food production chain's stakeholders.
6.2 Objectives of the food safety management system and planning to achieve them
6.2.1
The organization must set objectives for FSMS at relevant roles and levels.

FSMS objectives shall:

a be consistent with food safety policy

b be measurable (if applicable)
c take into account applicable food safety requirements, including customer requirements;
d be monitored and verified;
e be communicated;
f be maintained and updated as appropriated

The organization shall retain documented information about FSMS objectives

6.2.2
When planning how to achieve FSMS objectives, the organization shall determine:
a what will be done;
b what resources will be required;
c who will be responsible;
d when it will be completed;
e how the results will be evaluated.
6.3 Planning of changes
When the organization determines the need for changes to FSMS, including personnel changes,
changes must be made and communicated in a planned manner.
The organization shall consider:
a purpose of the amendments and their possible consequences;
b continued integrity of FSMS;
c availability of resources to effectively implement changes;
d allocation or reallocation of responsibilities and authorities.
7 Support
7.1 Resources
7.1.1 General
The organization shall determine and provide adequate resources for the establishment,
implementation, maintenance, update and continuous improvement of FSMS.
The organization shall consider:
a capability, or any restrictions, of existing internal resources
b need for external resources.
7.1.2 People
The organisation shall ensure that the persons necessary to operate and maintain an effective FSMS
must be competent .7.2).

Where assistance from external experts is required for the development, implementation, operation or
evaluation of FSMS, records of agreements or contracts defining the responsibility and authority of
these experts shall be retained as documented information.

7.1.3 Infrastructure
The organization shall provide the resources for the determination, establishment, and maintenance of
the infrastructure required to achieve compliance with FSMS requirements.
7.1.4 Work environment

The organization must determine, provide and maintain resources for the establishment, management
and maintenance of the work environment necessary to achieve compliance with FSMS requirements.

7.1.5 Externally developed elements of the FSMS

When an organization establishes, maintains, updates, and continuously improves its FSMS using
elements developed externally, including PRPs, hazard analysis, and hazard control plan, the
organization shall ensure that the elements provided are:

a developed in accordance with the requirements of this document;

b applicable to the organization's locations, processes and products;

c adapted specifically to the processes and products of the organization by the food safety team;

d implemented, maintained and updated as required by this document;

e retained as documented information.
7.1.6 Control of externally supplied processes, products or services
The organization shall:

establish and apply criteria for evaluation, selection, performance monitoring, and evaluation of
a
processes, products and/or services of external suppliers;
b ensure adequate communication of requirements to external supplier(s);
ensure that externally supplied processes, products or services do not adversely affect the
c
organization's ability to consistently meet FSMS requirements;
retained documented information from these activities and any necessary actions, such as the result of
d
evaluations and re-evaluations.
7.2 Competence
The organization shall:

determine the necessary competence of persons, including external suppliers, performing work under
a
their control that affects their performance in food safety and FSMS effectiveness

ensure that these persons, including the food safety team and those responsible for the operation of
b
the hazard control plan, are competent based on education, training and/or experience;

ensure that the food safety team has a combination of multidisciplinary knowledge and experience in
c the development and implementation of FSMS. This includes, but is not limited to the organization
products, processes, equipment, and food safety hazards in the scope of FSMS;

where applicable, take measures to acquire the necessary competence, and assess the effectiveness
d
of the measures taken;

e retain appropriated documented information such as evidence of competence.

7.3 Awareness
The organization shall ensure that all relevant personnel working under the control of the organization
should be aware:
a food safety policy;
b FSMS objectives relevant to your activity(s);
individual contributions to the effectiveness of FSMS, including the benefits of improved food safety
c
performance;

d implications of non-compliance with FSMS requirements.

7.4 Communication
7.4.1 General

The organization shall determine the internal and external communications relevant to FSMS,
including:

a what communicate;
b when communicating;
c with whom to communicate;
d how to communicate;
e who communicates.

The organisation shall ensure that the requirement for effective communication is understood by all
personnel whose activities have an impact on food safety.
7.4.2 External communication
The organisation shall ensure that adequate information is communicated externally and is available to
the interested parties of the food production chain.
 The organization must establish, implement and maintain effective communications with:

a external suppliers and contractors;

b customers and/or consumers, in relation to:

product information related to food safety, to enable the handling, exposure, storage, preparation,
i
distribution, and use of the product in the food production chain or by the consumer;

identified food safety hazards that need to be controlled by other organisations in the food
ii
production chain and/or consumers;

iii contractual arrangements, investigations, and orders, including their amendments;

iv feedback from customers and/or consumers, including complaints.
c statutory and regulatory authorities;

d other organizations that have an impact, or are affected by the effectiveness or updating of FSMS.

Designated persons shall have responsibility and authority defined for external communication of any
information related to food safety. When relevant, the information obtained through external
communication should be included as input data for management review and FSMS update.

External communication records must be retained as documented information.

7.4.3 Internal communication

The organization shall establish, implement and maintain effective methods for communicating with
staff on issues that impact food safety.

To maintain the effectiveness of FSMS, the organization must ensure that the food safety team is
informed at an appropriated time of the following changes:

a products or new products;

b raw materials, ingredients and services;
c production systems and equipment;
d production facilities, location of equipment and surrounding environment;
e cleaning and sanitization programs;
f packaging, storage and distribution systems;
g competences and/or designation of responsibilities and authority;
h knowledge related to the dangers of food safety and control measures;
i customer, sector and other requirements that the organization observes;
j relevant enquires and communications from external interested parties;
k complaints indicating food safety hazards associated with the end product;
l other conditions that have an impact on food safety.

The food safety team shall ensure that this information is included in the FSMS update.

Top management shall ensure that relevant information is included as inputs for management review.

7.5 Documented information

7.5.1 General
The organization's FSMS should include:

a documented information required by this document

documented information determined by the organisation that is necessary for the effectiveness of
b
FSMS;

c documented information and applicable food safety requirements.

7.5.2 Creating and update
When creating and updating documented information the organization must ensure an appropriated:

a identification and description (e.g. title, date, author, or reference number);

b format (e.g., language, software version, graphics) and media (e.g., paper, electronic);
c review and approval for suitability and adequacy.
7.5.3 Control of documented information
7.5.3.1
The documented information required by FSMS and this document shall be controlled to ensure that it
is:
a available and suitable for use, where and when necessary;

b protected (e.g. loss of confidentiality, inappropriate use, or loss of integrity).

7.5.3.2
For documented information control, the organization must address the following activities, if
applicable:
a distribution, access, retrieval and use;
b storage and preservation, including preservation of readability;
c control of changes (e.g., version control);
d retention and disposition.

The documented information of external origin, determined by the organization as necessary for the
planning and operation of FSMS, must be identified, if appropriated, and controlled.

Documented information retained as evidence of conformity shall be protected from unintended

changes.
8 Operation
8.1 Operational planning and control

The organization must plan, implement, control, maintain and update the processes needed to meet
the requirements for performing safe products, and implement the actions determined in clause 6.1:

a establish criteria for the processes;

b implement control of process according to criteria;

maintain documented information to the extent necessary to have confidence to demonstrate that the
c
process was executed as planned.
The organization should monitor planned changes and review the consequences of unintentional
changes by taking steps to mitigate any adverse effect if necessary.

The organization must ensure that outsourced processes are controlled (7.1.6)
 8.2 
8.2.1 Translations of programs

The organization shall establish, implement, maintain and update PRPs to facilitate the prevention
and/or reduction of contaminants (including food safety hazards) in products, processed products and
the work environment.
8.2.2

PRPs shall be:

a appropriate to organizational needs and its context with regard to food safety,
suitable for the size and type of operation and nature of the products that are manufactured and/or
b
handled;
implemented throughout the production system, either as applicable generic programs or as programs
c
applicable to a particular product or process
d approved by the food safety team.
8.2.3
When selecting and/or establishing PRP(s), and in addition to statutory/regulatory, the organization
should consider

a Technical Specification applicable in the ISO / TS 22002 series;

b applicable standards, codes of conduct and guidelines;
c customer requirements.
8.2.4

When establishing PRP(s), the organization shall consider:

a construction and layout of buildings and associated utilities;

b lay-out of premises, including zoning, workplace and employee facilities
c supply of air, water, energy and other utilities;
d pest control, waste and sewage disposal, and support services;
e the suitability of equipment and its accessibility for cleaning, and maintenance;
supplier approval and assurance processes (e.g. raw materials, ingredients, chemicals and
f
packaging);
g reception of materials, storage, dispatch, transportation, and handling of products
h measures for the prevention of cross-contamination;
i cleaning and sanitization;
j personal hygiene;
k product information/consumer awareness;
l other aspects, as appropriate
Documented information shall specify the applicable selection, establishment, monitoring and
verification of PRP(s).
8.3 Traceability system

The traceability system should be able to identify the incoming material from suppliers and the first
stage of the distribution route of the final product . When establishing and implementing the traceability
system, the following should be considered as a minimum:

a relation of lots of received materials, ingredients and intermediate products to the end products;

b reworking of materials/products;
c distribution of end product;
d compliance with statutory, regulatory, and customer requirements.

The documented information as evidence of the traceability system should be retained for a period
defined to include at least the shelf life of the product. The organization should verify and test the
effectiveness of the traceability system.
8.4 Emergency preparedness and response
8.4.1 General

Top Management shall ensure that procedures are implemented to respond to potential emergency
situations and incidents that may impact food safety and that are relevant to the organization's role in
the foo chain.

Documented information should be established and maintained to manage these situations and
incidents.

8.4.2 Handling of emergencies and incidents

The organization shall:

a respond to real emergency situations and incidents by:

i communicating internally;

ii communicating externally (e.g. suppliers, customers, competent authorities, media)

take measures to reduce the consequences of an emergency situation, in accordance with the
b
magnitude of the emergency or incident and the potential impact on food safety;

c test procedures periodically, where feasible;

review and, where necessary, update documented information, especially after any incident,
d
emergency situation or testing.
8.5 Hazard control
8.5.1 Preliminary steps to enable hazard analysis
8.5.1.1 General

To perform hazard analysis, preliminary documented information must be collected, maintained, and
updated by the food safety team. This includes, but is not limited to:

to the organization's products, processes, equipment and applicable requirements (statutory,

a
regulatory and customers);

b food safety hazards relevant to FSMS

8.5.1.2 Characteristics of raw materials, ingredients and product contact materials

The organization shall ensure that all applicable food safety requirements are identified for all raw
materials, ingredients and product contact materials.

The organization shall keep documented information on all raw materials, ingredients and product
contact materials to the extent necessary to perform hazard analysis (8.5.2), including the following,
where appropriate:

a biological, chemical and physical characteristics;

b composition of formulated ingredients, including additives and processing aids;
c source (e.g. animal, mineral or vegetable);
d place of origin (provenance)
e method of production
f methods of packaging and delivery
 g storage conditions and shelf life;
h preparation and/or handling before use or processing;
acceptance criteria related to food safety or specifications of purchased materials and ingredients ,
i
appropriate to their intended use.
8.5.1.3 Characteristics of the end products
The organisation shall ensure that all applicable food safety requirements are identified for all end
products intended for produced.
The organisation shall keep documented information on the characteristics of the end products to the
extent necessary to carry out hazard analysis (8.5.2), including information on the following, where
appropriate:
a product name or similar identification;
b composition;
c biological, physical and chemical characteristics important for food safety;
d intended shelf life and storage conditions;
e packaging;

f labelling relating to food safety and/or instructions for handling, preparation and intended use;

g method(s) of distribution and delivery .

8.5.1.4 Intended use

Intended use, including reasonably expected handling of the end product, and any unintentional but
reasonably expected mishandling, shall be considered and shall be maintained as documented
information to the extent necessary to perform hazard analysis (8.5.2)

Where appropriate, consumer/user groups must be identified for each product.

Consumer/user groups known to be especially vulnerable to certain food safety hazards should be
identified.
8.5.1.5 Flow diagrams and description of process
8.5.1.5.1 Preparation of the flow diagrams

The food safety team shall establish, maintain and update flow diagrams as documented information
for products or categories of products or processes covered by FSMS.

Flow diagrams shall be used when performing hazard analyses as a basis for assessing the possible
occurrence, increase, decrease or introduction of food safety hazards.

Flow diagrams shall be clear, accurate and sufficiently detailed as necessary to perform hazard
analysis. Flow diagrams shall, as appropriate, include the following:

a the sequence and interaction of the steps in the operation;

b any outsourced processes;
where raw materials, ingredients, processing aids, packaging materials, utilities and intermediate
c
products enter the flow;
d where reworking and recycling take place
e where end products, intermediate products, by-products and waste are released or removed.
8.5.1.5.2 On-site confirmation of flow diagrams

The food safety team shall confirm the accuracy of the flow diagrams on-site, update the flow
diagrams when needed, and retain as documented information.

8.5.1.5.3 Description of process and processes environment

The food safety team shall describe, to the extend needed to conduct hazard analysis:

a layout of premises, including food and non-food handling areas;

b processing equipment and contact materials, processing aids and flow diagrams

PRPs, process parameter, control measures, whether any and/or the strictness with which they are
c
applied, or procedures that may influence food safety;

external requirements (e.g. customers) that can affect the choice and strictness of the control
d
measures.

Variations resulting from expected seasonal changes or shift patterns should be included where
appropriate.

Descriptions shall be updated as needed and maintained as documented information.

8.5.2 Hazard analysis

8.5.2.1 General

The food safety team shall conduct a hazard analysis, based on preliminary information, to determine
the hazards that need to be controlled. The degree of control should ensure food safety and, where
appropriate, a combination of control measures shall be used.

8.5.2.2 Hazard identification and determination of acceptable level

8.5.2.2.1

The organisation shall identify and document all the hazards to food safety that are reasonably
expected to occur in relation to the type of product, type of process and in the process environment.

Identification shall be based on:

a preliminary information and data collected in accordance with clause 8.5.1;

b experience;
internal and external information, including, as far as possible, epidemiological, scientific and other
c
historical data;

information from the food chain on food safety hazards related to the safety of end products,
d
intermediate products, and food at the time of consumption.

e customer requirements.
8.5.2.2.2
The organization shall identify steps(s) (e.g., receipt of raw materials, processing, distribution and
delivery) in(s) which(is) each hazards to food safety may be present, introduced, increased or
persisted.
When identifying the dangers, the organisation shall consider:
a the steps preceding and following in the food chain;
b all steps in the process flow as defined in the flow diagrams;
c process equipment, utilities/services, process environment and persons;
8.5.2.2.3
The organisation shall determine the acceptable level in the final product for each food safety hazard
identified whenever possible.
When determining acceptable levels, the organization shall consider:
a intended use of final products;
b applicable requirements and any other relevant information.
The organization shall maintain documented information about determining acceptable levels and their
justifications.
8.5.2.3 Hazard assessment
 The organisation shall conduct, for every identified food safety hazard, a hazard assessment to
determine whether its prevention or reduction to an acceptable level is essential.

The organisation shall assess each food safety hazard with respect to:
a likelihood of their occurrence in the end product before the application of control measures;
b severity of its adverse health effects in relation to intended use (8.5.1.4).
The organisation shall identify any significant hazards to food safety.
The methodology used shall be described, and the result of hazard assessment should be maintained
as documented information.
8.5.2.4 Selection and categorization of control measures
8.5.2.4.1
Based on hazard assessment, the organization should select an appropriate control measure, or
combination of control measures, which is capable of preventing or reducing the significant food safety
hazard of identified to defined acceptable levels .

The organization shall categorize the selected identified control measure(s) to be managed as
OPRP(s) (3.31) or as CCP(s) (3.11).

The categorization shall be conducted using a systematic approach. For each of the selected control
measures, there must be an assessment of the following:

a the likelihood of failure to function;

b the severity of the consequence in the event of failure to function; this assessment shall include:
i the effect on identified significant food safety hazards ;
ii position in relation to another control measure(s);
iii whether it is specifically established and applied to reduce hazards to an acceptable level;
iv whether it is a single measure or is part of the combination of control measurement(s).
8.5.2.4.2
In addition, for each control measure, the systematic approach shall include a feasibility assessment
of:
a establishing measurable critical limits and/or measurable/observable action criteria;
monitoring to detect any failure to remain within the critical limit and/or measurable/observable action
b
criterion;
c applying timely corrections in case of a failure.
The decision-making process and selection results of the selection and categorization of control
measures shall be maintained as documented information.

External requirements (e.g. customer requirements) that can affect the choice and strictness of control
measures should also be maintained as documented information.

8.5.3 Validation of the control measure(s) and combination of the control measure(s)

The food safety team shall validate that the selected control measures are capable to achieve the
desired control of the significant hazards(s) to food safety prior to their implementation inclusion in the
hazard control plan.

When the validation result shows that control measurement(s) is not (are) capable of achieving the
desired control, the food safety team must modify and re-assess the control measure(s) and/or its
combinations.

The food safety team shall maintain the validation methodology and evidence of the ability of the
control measure(s) to achieve the desired control as documented information.

8.5.4 Hazard control plan (HACCP/OPRP plan)

8.5.4.1 General
The organization must establish, implement, and maintain a hazard control plan. The hazard control
plan shall be maintained as documented information and shall include the following information for
each control measure of each CCP or OPRP:

a food safety hazard(s) to be controlled at the CCP or by the OPRP;

b critical limit(s) in the CCP or action criterion for OPRP;
c monitoring procedure(s);
d corrections to be taken if critical limits or action criteria are not met;
e responsibilities and authorities;
f monitoring records
8.5.4.2 Determination of critical limits and action criteria
Critical limits of CCPs and action criteria for OPRPs shall be specified. The reason for their
determinations shall be maintained as documented information.
The critical limits of CCPs shall be measurable. Compliance with acceptable limits shall ensure that the
acceptable level is not exceeded.
The action criteria for OPRPs should be measurable or observable. Compliance with the action
criterion should contribute to ensuring that the acceptable level is not exceeded.
8.5.4.3 Monitoring systems at CCPs and OPRPs
In each CCP, a monitoring system must be established for each control measure or its combinations to
detect any failure to remain within critical limits. The system shall include all planned measures related
to the critical limit(s).
or each OPRP, a monitoring system shall be established for control measurement or their
combinations to detect failures in compliance with the action criteria.
The monitoring system of each CCP and each OPRP shall consist of documented information,
including:
a measurements or observations that provide results within an appropriate time frame;
b monitoring methods or devices used;
calibration methods applicable or, for OPRPs, equivalent methods for checking reliable measurements
c
or observations (8.7);
d monitoring frequency
e monitoring results;
f responsibility and authority related to monitoring;
g responsibility and authority related to the evaluation of monitoring results;

At each CCP, the method and frequency of monitoring shall be able of timely detection of any failure to
remain within critical limits, to allow timely isolation and evaluation of the product (8.9.4).

For each OPRP, the method and frequency of monitoring shall be proportional to the likelihood of
failure and severity of the consequences.
When monitoring an OPRP is based on subjective data from observations (such as visual inspection),
the method should be supported by instructions or specifications.
8.5.4.4 Actions when critical limits and action criterion are not met
The organization shall specify the corrections (8.9.2) and corrective actions (8.9.3) to be taken when
critical limits or action criteria are not and shall ensure that:

a potentially unsafe products are not released (8.9.4);

b the cause of nonconformity is identified;
the parameter(s) controlled at the CCP or by the OPRP is (are) returned within critical limits or action
c
criteria;
d recurrence is prevented.
The organization shall make corrections according to clause 8.9.2 and corrective actions according to
clause 8.9.3.
8.5.4.5 Implementation of the hazard control plan
 The organization must implement and maintain the hazard control plan, and retain evidence of
implementation as documented information.

8.6 Update information specifying PRPs and hazard control plan

After establishing the hazard control plan, the organization shall update the following information if
necessary:
a characteristics of raw materials, ingredients and materials of contact with the product;
b characteristics of the end products;
c intended use;
d flow diagrams and descriptions of processes and process environment;

The organization must ensure that the hazard control plan and/or PRPs are updated.

8.7 Control of monitoring and measurement

The organization shall provide evidence that the specified monitoring and measurement methods and
equipment in use are suitable for monitoring and measurement activities related to PRP(s) and hazard
control plan.
The monitoring and measurement equipment used shall be:
a calibrated or checked at specified intervals prior to use;
b adjusted or re-adjusted as needed;
c identified to enable calibration status to be determined;
d safeguarded from adjustments that would invalidate the measurement results;
e protected from damage and deterioration.

Calibration and verification results shall be retained as documented information. The calibration of all
equipment shall be traceable to international or national measurement standards; when there are no
standards, the basis used for calibration or verification shall be retained as documented information.

The organization shall assess the validity of previous measurements results when the equipment or
process environment is found not in accordance with requirements. The organization shall take
appropriate action in relation to the equipment or process environment and any product affected by
non-conformance.

The assessment and the resulting action should be maintained as documented information.

Software used in monitoring and measuring within FSMS must be validated by the organization,
software supplier, or third parties before using it. Documented information from validation activities
shall be maintained by the organization and the software should be updated in a timely manner.

Whenever there are changes, including software settings/modifications for commercial purposes, they
must be authorized, documented, and validated prior to implementation.

8.8 Verification related to PRPs and hazard control plan

8.8.1 Verification

The organization shall establish, implement, and maintain verification activities. Verification planning
shall define the purpose, methods, frequencies, and responsibilities of verification activities.

Verification activities shall confirm that:

a the PRP(s) are implemented and effective;
b the hazard control plan is implemented and effective
c hazard levels are within levels identified as acceptable;
d inputs to hazard analysis is up-to-date;
e procedures determined by the organization are implemented and effective.
The organization shall ensure that verification activities are not carried out by the person responsible
for monitoring the same activities.

The results of the verification shall be kept as documented information and should be communicated.

If the verification system is based on analysis of samples of the end product or direct process samples,
and where such samples show nonconformity with the acceptable level of food safety hazards
(8.5.2.2), the organization shall treat the lots(s) of the affected product(s) as potentially unsafe
(8.9.4.3) and apply corrective actions in accordance with clause 8.9.3.

8.8.2 Analysis of the results of the verification activities

The food safety team shall conduct an analysis of the results of verification that shall be used as an
input in the FSMS performance evaluation (9.1.2).
8.9 Control of product and process non-conformities
8.9.1 General
The team shall ensure that data derived from the monitoring of OPRPs and CCPs are evaluated by
designated persons, who are competent and have the authority to initiate corrective corrections and
corrections.
8.9.2 Corrections
8.9.2.1
The organization shall ensure that, where the critical limits of the CCP(s) and/or action criteria of the
OPRPs are not met, the affected products are identified and controlled in relation to their use and
release.

The organization shall establish, maintain and update documented information that includes:

a method of identification, assessment and correction of the affected products to ensure their
a
appropriate handling;
b arrangements to review the corrections made.
8.9.2.2
When critical limits of CCPs are not met, the affected end products shall be identified and handled as
potentially unsafe products (8.9.4).
8.9.2.3
When the OPRP(s) action criteria are not met, the following shall be performed:
a determination of the consequences of this failure in relation to food safety.
b determination of the cause(s) of the failure;
c identification of the affected products and handling in accordance with item 8.9.4;
The organization should retain the results of the evaluation as documented information.
8.9.2.4
Documented information should be retained to describe corrections taken in nonconforming products
and processes, including:
a the nature of nonconformity;
b the cause(s) of failure;
c the consequence(s) of nonconformity.
8.9.3 Corrective actions
The need for corrective actions shall be evaluated when the critical limits of the PPC(s) and/or action
criterion of the OPRP(s) are not met.

The organization shall establish and maintain documented information that specifies appropriate
actions to identify and eliminate the cause of detected non-conformities, to prevent recurrence, and to
return the process to control after detection of the nonconformity.

These actions shall include:

critically analyse nonconformities detected by the customer and/or complaints/regulatory inspection
a
report;

b critically analyse trends in monitoring results that may indicate loss of control;

c determine the cause(s) of nonconformity(ies);

d determine and implement actions to ensure that nonconformities do nor recur;
e documenting the results of the corrective actions taken;
f verification of corrective actions taken to ensure its effectiveness.
The organization must retain documented information from all corrective actions.
8.9.4 Handling of potentially unsafe products
8.9.4.1 General
The organisation should take action to prevent the entry of these potentially unsafe products into the
food production chain unless it is possible to ensure that:

a The food safety hazards(s) considered is/are reduced(s) to the defined acceptable levels;

The food safety hazards(s) considered will be reduced to identifies acceptable levels before entering
b
the food production chain; or
the product still meets the defined acceptable level of the safety hazards considered( s), despite
c
nonconformity.
The organization shall retain products that have been identified as potentially unsafe under its control
until the products been evaluated and the disposition has been determined.

If products that have left the control of the organization are subsequently determined as unsafe, the
organization shall notify relevant stakeholders and initiate a withdrawal/recall (8.9.5).

The controls and related responses from relevant interested parties and authorization for dealing with
potentially unsafe products shall be retained as documented information.
8.9.4.2 Evaluation for release
Each lot of the product affected by nonconformity shall be evaluated.
Products affected by failure to remain within CCP critical limits, shall not be released, but shall treated
in accordance with clause 8.9.4.3.
Products affected by failure to comply with OPRPs action criteria shall only be released as safe when
applied any of the conditions below:

other evidence, in addition to the monitoring system, to demonstrate that control measures have been
a
effective;
evidence showing that the combined effect of control measures for the product in question meets the
b
intended performance (i.e., identified acceptable levels);

sampling results, analyses and/or other verification activities show that the affected product lot meets
c
the acceptable levels identified for the food safety hazard considered.

Results of evaluation for release of products shall be retained as documented information.

8.9.4.3 Disposition of nonconforming products

Products not acceptable for release shall be:
reprocessed or further processed inside or outside the organization to ensure that food safety hazard
a
is reduced to acceptable levels; Or

b redirected for other use as long food safety in the food production chain is not affected; Or

c destroyed and/or disposed of as waste.

Documented information on the dispositions of nonconforming products including the identification of
the persons with approving authority shall be retained.
8.9.5 Withdrawal/recall
The organisation shall be able to ensure the timely withdrawal/recall of lots of end products that have
been identified as potentially unsafe, appointing the competent persons having the authority to initiate
and carry out the withdrawal/recall.
The organization must establish and maintain documented information for:
a notify relevant interested parties (e.g. customers and/or consumers);
b handling of withdrawn/recall products, as well as affected products still in stock;
c the sequence of actions to be taken.

End Products still in stock and products withdrawn/recalled shall be secured or kept under the
organization's control until they are managed in accordance with clause 8.9.4.3.

The cause, extent and result of withdrawal/recall should be retained as documented information and
reported to the Top Management as input for the management review (9.3).

The organization should verify and retain as documented information the effectiveness of the
withdrawal/recall program through the use of appropriate techniques (e.g. mock withdrawal/recall or
practice withdrawal/recall in practice).
9 Performance evaluation
9.1 Monitoring, measurement, analysis and evaluation
9.1.1 General
The organization shall determine:
a what needs to be monitored and measured

b methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;

c when monitoring and measurement shall be carried out;

d when monitoring and measurement results shall be analysed and evaluated;
e who shall analyse and evaluate the results of monitoring and measurement.
The organization shall retain appropriate documented information as evidence of the results.
The organization should evaluate the performance and effectiveness of FSMS.
9.1.2 Analysis and evaluations

The organization shall analyse and evaluate appropriate data and information resulting from
monitoring and measurement, including the results of verification activities related to PRPs and hazard
control plan (8.8 and 8.5.4), internal audits (9.2), and external audits.

The analyses shall be carried out to:

confirm that the overall performance of the system complies with the planned arrangements and the
a
FSMS requirements established by the organization;
b identify the needs for updating or improving FSMS;

c identify trends which indicate a higher incidence of potentially unsafe products or process failures;
establish information for planning of the internal audit program related to the status and importance of
d
the areas to be audited;
e evidence that any corrective corrections and correctios are effective.
The results of the analyses and any resulting activities shall be retained as documented information
and shall be reported to top management and used as input for the management review(9.3) and
FSMS update (10.3)
9.2 Internal audit
9.2.1
The organization must conduct internal audits at planned intervals to obtain information on whether the
FSMS:
a conforms to:
i the FSMS requirements established by the organization;
ii the requirements of this document;
b is effectively implemented and maintained.
9.2.2
The organization shall:
plan, establish, implement and maintain an audit program, including frequency, methods,
responsibilities, planning requirements and reporting, which shall take into account the importance of
a
the processes concerned, changes in the FSMS, and the results of monitoring, measurement and
previous audits;
b define the audit criteria and scope for each audit;
select competent auditors and conduct audits to ensure the objectivity and impartiality of the audit
c
process;

d ensure that audit results are reported to food safety staff and relevant management;

retain documented information as evidence of the implementation of the audit program and audit
e
results;
f make the necessary corrective corrections and corrections within the agreed time frame;
determine whether FSMS meets the objective of the food safety policy (5.2), and FSMS objectives
g
(6.2).
Follow-up activities shall include verification of the actions taken and reporting the results of the
verification.
9.3 Management review
9.3.1 General
Top management shall review the FSMS, at the planned intervals, to ensure its continued suitability,
adequacy and effectiveness.
9.3.2 Management review input
Management review shall consider:
a the status of previous management reviews;
changes in internal and external issues that may be relevant to the FSMS, including changes in the
b
organisation and its context (4.1);
c information on the performance and effectiveness of FSMS, including trends in:
i result of the system update activities (4.4 and 10.3);
ii monitoring and measurement results;
analysis of the results of the verification activities related to PRPs and the hazard control plan
iii
(8.8.2);
iv nonconformities and corrective actions;
v audit results (internal and external);
vi inspections (e.g. regulatory, customers);
vii the performance of external providers;
viii review of the risks and opportunities and effectiveness of the actions taken to address them;
ix the extent to which FSMS objectives have been met;
d adequacy of resources;
e any emergency situation, accidents (8.4.2) and withdrawal/collection (8.9.5) occurred;
relevant information obtained through external (7.4.2) and internal communication (7.4.3), including
f
requests and complaints from interested parties;
g opportunities for continuous improvement.
The data shall be presented in such a way that allows top management to relate the information to the
FSMS objectives.
9.3.3 Management review output
The outputs of the management review shall include:
a decisions and actions related to opportunities for continuous improvement;
any need for updating and changing FSMS, including resources needed and review of food safety
b
policy and FSMS objectives.
The organization should retain documented information as evidence of the results of management
review.
10 Improvement
10.1 Nonconformity and corrective action
10.1.1
When a nonconformity occurs, the organization shall:

a react to non-compliance and, where applicable:

i take action to control or correct it;
ii deal with the consequences;
evaluate the need for action to eliminate the cause(s) of nonconformity so that this does not recur or
b
occur elsewhere, by:
i review of nonconformity;
ii determining the causes of nonconformity;
iii determining if similar nonconformities exist, or could potentially occur;
c implement any necessary action;
d review the effectiveness of any corrective action taken;
e make changes to FSMS, if necessary.

Corrective actions shall be appropriate for the effects of the nonconformity encountered.

10.1.2
The organization should retain documented information as evidence:
a the nature of nonconformity and any subsequent actions taken;
b results of any corrective action.
10.2 Continual improvement
The organization should continuously improve the suitability, adequacy, and effectiveness of FSMS.
 Top management shall ensure that the organization continually improves the effectiveness of FSMS
through the use of communication (7.4), management review (9.3), internal audit (9.2), analysis of the
results of verification activities (8.8.2), validation control measurement(s) and its combinations (8.5.3),
corrective actions (8.9.3) and FSMS updating (10.3).

10.3 Update of the food safety management system

Top management shall ensure that FSMS is continuously updated. To achieve this, the food safety
team must evaluate FSMS at the planned intervals. The team should consider whether it is necessary
to review hazard analysis (8.5.2), the established hazard control plan (8.5.4) and the established
PRPs(s) (8.2). Upgrade activities shall be based on:

a input from external and internal communication (7.4);

b input from other information regarding the suitability, adequacy and effectiveness of FSMS;
c output from the analysis results of verification activities (9.1.2)
d output from management review (9.3).
System updating activities shall be retained as documented information and reported as input for
management review (9.3).
THIS CHECKLIST IS ONE OF THE TOOLS FROM FSSC 22000 V5 AND ISO 22000:2018 BLUE PRINT - CHECK IT NOW
FSSC 22000 V5 Checklist

Company information
Company
Address:

Plant manager:

Phone:
email:
Number of employees in production
Total number of employees:
Number of employees in quality/food safety:
Shifts

Year of construction

Number of SKUs produced:

Number of production lines
Current production capacity
Installed capacity
Audit Data

Audit Summary

Summary of nonconformities found during the audit

Audit Checklist: Requirements of ISO 22000 version 2018 - Food Safety Management System

Status:
Clause OK | CRITICAL NC |
Requirements of the Standard Comments
N.º MAJOR NC | MINOR
NC
2.5 Additional Requirements
2.5.1 Management of Services

The organisation shall ensure that in the case of external laboratory analysis services are used for the
verification and/or validation of food safety, they are carried out by a competent laboratory that has the
ability to produce accurate and reproducible test results using validated testing methods and best
practices (e.g. successful participation in proficiency testing programs, approved or approved or
approved regulatory programs using validated testing methods and best practices)

2.5.2 Product labelling

The organization shall ensure that finished products are labelled in accordance with all legal and
regulatory requirements applicable to food safety (including allergens) in the intended country of sale.

2.5.3 Food Defense

2.5.3.1 THREAT ASSESSMENT
The organization shall have a documented procedure in place to:
a) Conduct a threat assessment to identify and assess potential threats;
b) Develop and implement mitigation measures for significant threats
2.5.3.2 PLAN
The organization shall have a documented food defense plan specifying mitigation measures covering
a) the processes and products within the organization's FSMS scope
b) The food defense plan should be supported by the organization's FSMS.
c) The plan must comply with applicable legislation and be kept up to date.
2.5.4 Food Fraud Mitigation
2.5.4.1 VULNERABILITY ASSESSMENT
The organization shall have a documented procedure in place to:
a) Conduct a food fraud vulnerability assessment to identify and assess potential vulnerabilities;
b) Develop and implement mitigation measures for significant vulnerabilities
2.5.4.2 PLAN
The organization shall have a documented food fraud mitigation plan specifying mitigation measures
a) relating to processes and products within the organization's FSMS scope.
b) The food fraud mitigation plan should be supported by the organization's FSMS.
c) The plan shall comply with applicable legislation and be kept up to date.
2.5.5 Logo use
a) Certified organizations, Certification Bodies, and Training Organizations shall use the FSSC 22000
logo only for marketing activities , such as printed materials, website and another promotional material.

b) In case of using the log the organization shall comply with the following specifications (see green and
grey colors specifications)
Use of the logo in black and white is permitted when all other texts and images are in black and white.

c) The certified organization is not allowed to use the FSSC 22000 logo, any statement or make
reference to its certified status on:
i a product;
ii its labelling;
iii its packaging (primary, secondary or any other form);
iv in any other manner that implies that FSSC 22000 approves a product, process or service.
2.5.6 Management of allergens (Food chain categories C, E, FI, G, I E K)
The organization shall have a documented allergen management plan that includes:
a) Risk assessment covering all potential sources of allergens cross-contamination and;
b) Control measures to reduce or eliminate the risk of cross-contamination.
2.5.7 Environmental monitoring (Food chain categories C, I E K)
The organization must take in place:
a) Risk-based environmental monitoring program;
Documented procedure for the evaluation of the effectiveness of all controls on preventing
b) contamination from the manufacturing environment and this shall include, at a minimum, the
evaluation of the microbiological and allergen controls present;
c) Data from monitoring activities, including regular trend analysis.
2.5.8 Formulation of Products ( Food chain category D)
The organization shall have in place procedures to manage the use of ingredients containing nutrients
that may have a harmful impact on animal health.
2.5.9 Transportation and delivery (Food chain category FI)
The organisation shall ensure that product is transported and delivered under conditions which
minimize the potential for contamination.
 Clause Documented Information

2.5.1

2.5.2

2.5.3 2.5.3.1 Threat assessment procedure

2.5.3.2 Food Defense Plan

2.5.4 2.5.4.1 Vulnerability assessment procedure

2.5.4.2 Food Fraud mitigation plan

2.5.5

2.5.6 Allergen management plan

Procedure for the evaluation of the

2.5.7 effectiveness of environmental
monitoring control

2.5.8

2.5.9
 Mandatory requirement

External laboratory analysis services (used for the

verification and/or validation of food safety) has the
capability to produce precise and repeatable test results
using validated test methods and best practices

Ensure that finished products are labelled according to

all applicable food safety (including allergens) statutory
and regulatory requirements in the country of intended
sale.
Conduct a threat assessment and develop and
implement mitigation measures for significant threats
Specify the mitigation measures, support plan by FSMS,
comply with legislation and be updated
Conduct a vulnerability assessment and develop and
implement mitigation measures for significant
vulnerabilities
Specify the mitigation measures, support plan by FSMS,
comply with legislation and be updated
Use the FSSC 22000 logo only for marketing activities
and comply with color specifications
Plan include risk assessment of allergen cross-
contamination and control measures defined
Risk-based environmental monitoring program,
(evaluation) microbiological and allergen controls, trend
analysis of data from monitoring activities
Procedures to manage the use of ingredients (adverse
animal health impact).
Minimize potential contamination during transport and
deliver
 Scope of the FSMS

Product categories Processes Activities Production Sites Outsourced Activies

sauces and condiments Manufacturing