ISO 22000:Food safety management systems — Requirements for organizations throughout the food chain: Contents Page Foreword Introduction 1 Scope 2 Normative reference 3 Terms and definitions 4 Food safety management system 4.1 General requirements 4.2 Documentation requirements 5 Management responsibility 5.1 Management commitment 5.2 Food safety policy

5.3 Food safety management system planning 5.4 Responsibility and authority 5.5 Food safety team leader 5.6 Communication 5.7 Contingency preparedness and response 5.8 Management review 6 Resource management 6.1 Provision of resources 6.2 Human resources 6.3 Infrastructure 6.4 Work environment

7 Planning and realization of safe products 7.1 General 7.2 Prerequisite programe(s) 7.3 Preliminary steps to enable hazard analysis 7.4 Hazard analysis 7.5 Design and redesign of the operational PRPs 7.6 Design and redesign of the HACCP plan 7.7 Updating of preliminary information and documents specifying the PRP(s) and the HACC Plan 7.8 Verification planning 7.9 Operation of the food safety management system

8 Verification, validation and improvement of the food safety management system 8.1 General 8.2 Monitoring and measuring 8.3 Food safety management system verification 8.4 Validation of control measure combinations 8.5 Improvement Annex A (informative) Guidance on the use of the standard Annex B (informative) Correspondence between ISO 22000:200X and ISO 9001:2000 Annex C (informative) Codex References providing Examples of Control Measures, including Prerequisite Programs and guidance for Their Selection and Use Bibliography

Introduction The requirement for food safety for all organizations, which produce, manufacture, handle or supply food, is paramount. Furthermore, all these organizations recognize the increasing need to demonstrate and provide adequate evidence of their ability to identify and control food safety hazards and the many conditions impacting food safety. This requirement may apply to all types of organizations within the food chain ranging from feed producers, primary producers through food manufacturers, transport and storage operators and subcontractors to retail and food service outlets - together with inter-related organizations such as producers of equipment, packaging material, cleaning agents, additives and ingredients.

Food safety is related to the presence of and levels of food borne hazards in food at the point of consumption (intake by the consumer). As food safety hazards may be introduced at any stage of the food chain, adequate control throughout the food chain is essential. Thus, food safety is a joint responsibility that is principally assured through the combined efforts of all the parties participating in the food chain.

This International Standard specifies the requirements for a food safety management system that combines the following generally recognized key elements to ensure food safety along the food chain, up to the point of final consumption; these elements are:  interactive communication;  system management;  process control (ISO 9001);  HACCP principles;  prerequisite programs.

Communication along the food chain is essential to ensure that all relevant food safety hazards are identified and adequately controlled at each step within the food chain. This implies communication of the needs of the organization to both organizations upstream in the food chain and organizations downstream in the food chain.

and impact on the end product. Communication with customers and suppliers, based on the information generated through systematic hazard analysis, will also assist in substantiating customer and supplier requirements with regard to their feasibility, need and impact on the end product. Recognition of the organization's role and position within the food chain is essential to ensure effective interactive communication throughout the chain in order to deliver safe food products to the final consumer. The possible scope of the communication channels among typical interested parties of the food chain is schematically exemplified in Figure 1.

Figure 1 – Example for communication along the food chain

This International Standard integrates the principles of the Hazard Analysis and Critical Control Point (HACCP) system and application steps developed by the Codex Alimentarius Commission and dynamically combines it with prerequisite programs (PRP(s)) necessary to control and reduce any food safety hazards identified for the end products delivered to the next step in the food chain to acceptable levels. Hazard analysis is the key to an effective food safety management system, as it organizes the knowledge required to design an effective combination of control measures.

This International Standard requires that all hazards that may be reasonably expected to occur in the food chain, including hazards that may be associated with the type of process and facilities used, are identified and assessed, resulting in a clear determination of those to be controlled within the organization and those that are to be controlled (or are already controlled) by other organizations within the food chain and/or by the final consumer. Thus, this standard provides the means to document and justify both inclusions and omissions in setting control measures.

This International Standard further clarifies the concept of prerequisite programs. The prerequisite programs (PRP(s)) are separated into two subcategories: infrastructure and maintenance programs and operational prerequisite programs. This separation takes into account differences in the nature of control measures that may be applied and their feasibility for monitoring, verification, or validation. The effective production of safe products requires the balanced integration of both types of prerequisite programs and a detailed HACCP plan.

Infrastructure and maintenance programs are used to address basic requirements of food hygiene and accepted good (manufacturing, agricultural, hygienic, etc.) practices of a more permanent nature; whereas operational PRP(s) are used to control or reduce the impact of identified food safety hazards in the product or the processing environment. The HACCP plan is used to manage the CCP(s) identified to eliminate, prevent or reduce specified food safety hazards from the product, as determined during hazard analysis. During hazard analysis the organization determines the strategy to be used to ensure hazard control by combining the PRP(s) and the HACCP plan.

This International Standard requires that organizations identify, monitor, control and routinely update both the PRP(s) and the HACCP plan. To facilitate the application of this International Standard, it has been developed as an auditable standard. However, individual organizations are free to choose the necessary methods and approaches to fulfill the requirements of this International Standard. To assist individual organizations with development and implementation of this International Standard an informative explanation and guide for its use are provided in Annex A.

This International Standard recognizes that there are differences amongst organizations within the food chain. It specifies a mechanism that will allow a small and/or less developed organization, such as a small farm, a small packer-distributor, a small retail or food service outlet, to implement an externally developed and designed combination of PRP(s) and HACCP plans, if a) it is demonstrated that it has been developed in compliance with the requirements of this International Standard specified for the hazard analysis, PRP(s) and HACCP plan, b) specific measures have been undertaken to adapt the externally developed system to the organization, and

c) it has been implemented and is operated in accordance with the other requirements of this International Standard. The most effective food safety systems are designed, operated and updated within the framework of a structured management system and incorporated into the overall management activities of the organization. This provides maximum benefit for the organization and interested parties. This International Standard has taken due consideration of the provisions of ISO 9001:2000 in order to enhance compatibility of the two standards.

The correspondence between ISO 9001:2000 and this International Standard is provided in Annex B. This International Standard may be applied independently from other management system standards. Its implementation can be aligned or integrated with existing related management system requirements while organizations may utilize existing management system(s) to establish a food safety management system that complies with the requirements of this International Standard.

As with other management system standards, the use of this International Standard must have the commitment of the organization's top management. The aim of this International Standard is to harmonize the requirements for food safety management for businesses within the food chain on a global level. It is particularly intended for application by organizations that seek a more focused, coherent and integrated food safety management system than is normally required by law. This International Standard is not intended for application as minimum requirements for regulatory purposes. However, it requires an organization to incorporate any applicable food safety related statutory and regulatory requirements into its food safety management system.

1 Scope This International Standard specifies requirements for a food safety management system in the food chain where an organization needs to demonstrate its ability to control food safety hazards in order to consistently provide safe end products that both meet agreed customer and applicable regulatory food safety requirements, and aims to enhance customer satisfaction through the effective control of food safety hazards, including processes for updating the system.

This International Standard specifies requirements to enable an organization to plan, design, implement, operate, maintain and update a food safety management system aimed at providing end products that according to its intended use will ensure that the food, when eaten, are safe for the consumer, evaluate and assess customer requirements and demonstrate conformity with those mutually agreed customer requirements that relate to food safety, demonstrate effective communication with customers and other interested parties along the food chain

demonstrate conformity with applicable regulatory requirements as regard to food safety, assure that it complies with its stated food safety policy, demonstrate such compliance to other interested parties, and seek certification or registration of its food safety management system by an external organization. All requirements of this International Standard are generic and intended to be applicable to all organizations wishing to design and implement an effective food safety management system, regardless of type, size and product provided, that they operate in the food chain.

This includes organizations directly involved in one or more steps of the food chain (for example, but not limited to feed producers, farmers, producers of ingredients, food producers, retailers, food services, catering services, organizations providing cleaning, transportation, storage and distribution services) and other organizations indirectly involved with the food chain (such as suppliers of equipment, cleaning agents and packaging material and other food contact material).

2 Normative reference 3 Terms and definitions 3.8 food chain sequence of the stages and operations involved in the production, processing, distribution, and handling of a food and its ingredients, from primary production to consumption NOTE Primary production includes the production of feed for food producing animals and for animals intended for food production. 3.9 food safety assurance that food will not cause harm to the consumer when it is prepared and/or eaten according to its intended use

8 Verification, validation and improvement of the food safety management system 8.1 General The food safety team shall plan and implement the processes needed to verify, validate and update the food safety management system. The outcome of these activities shall a) demonstrate the compliance with the requirements of this International Standard and the food safety related objectives of the organization (see 5.2), and b) ensure updating of the food safety management system when needed. This shall include determination of applicable methods, including statistical techniques, and the extent of their use.

8.2 Monitoring and measuring As a prerequisite for valid monitoring and verification, the organization shall determine suitable methods for the monitoring and measurement. When it has been determined that monitoring and measurement devices are needed, the organization shall provide evidence that the devices are adequate to ensure the performance of the food safety management system.

The organization shall establish the processes needed to ensure that monitoring and measurement are carried out in a manner that is consistent with the specified requirements. Where necessary to ensure valid results, the measuring equipment and methods used shall a) be calibrated or verified at specified intervals, or prior to use, against measurement standards traceable to international or national measurement standards; where no such standards exist, the basis used for calibration or verification shall be recorded,

b) be adjusted or re-adjusted as necessary, c) be identified to enable the calibration status to be determined, d) be safeguarded from adjustments that would invalidate the measurement results, and e) be protected from damage and deterioration. Records of the results of calibration and verification shall be maintained. In addition, the organization shall assess the validity of the previous measuring results when the equipment is found not to conform to requirements.

If the measurement equipment is non-conforming, the organization shall take appropriate action on the equipment and any product affected. Records of such assessment and resulting actions shall be maintained. When used in the monitoring and measurement of specified requirements, the ability of computer software to satisfy the intended application shall be confirmed. This shall be undertaken prior to initial use and reconfirmed as necessary.

8.3 Food safety management system verification 8.3.1 Internal audit The organization shall conduct internal audits at planned intervals to determine whether the food safety management system a) conforms to the planned arrangements, to the requirements of this International Standard and to the food safety management system requirements established by the organization, and b) is effectively implemented and updated. An audit program shall be planned taking into consideration the status and importance of the processes and areas to be audited, as well as any updating actions resulting from previous audits (see 8.5.2 and 5.8.2).

The audit criteria, scope, frequency and methods shall be defined. Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work The responsibilities and requirements for planning and conducting audits, and for reporting results and maintaining records shall be defined in a documented procedure. The management responsible for the area being audited shall ensure that actions are taken without undue delay to eliminate detected nonconformities and their causes.

Follow-up activities shall include the verification of the actions taken and the reporting of the verification results. Results of audits shall in relevant form be reported to top management as part of the analysis of results of verification activities (see 8.3.3 and 5.7.2) and shall be used as an input to the food safety management system updating (see 8.5.2). 8.3.2 Evaluation of individual verification results The individual results of planned verification (7.8) shall be systematically evaluated, including internal audits (8.3.1).

If verification does not demonstrate conformity with the planned arrangements, the organization shall take action to achieve the required conformity. Such action shall include but is not limited to a) review of existing updating procedures and communication channels (see 5.5 and 7.7), b) review of the conclusions of the hazard analysis (see 7.4), the design of operational PRP’s (see 7.5) and the HACCP plan (see 7.6.1), c) evaluation of the infrastructure and maintenance programs (see 7.2.2), and

d) evaluation of the effectiveness of human resource management and of training activities (see 6.2). Verification results shall be recorded and shall be communicated to the food safety team. Verification results shall be provided to enable the analysis of the results of the verification activities (see 8.3.3). If system verification is based on testing of end product samples and where such testing samples show lack of compliance with the acceptable level of the food safety hazard (see 7.4.2), the affected lot(s) shall be handled as potentially unsafe products in accordance with 7.9.4.

8.3.3 Analysis of results of verification activities The food safety team shall analyze the results of verification activities, including the results of the internal audits. The analysis shall be carried out in order to a) confirm that the overall performance of the system meets the planned arrangements, meets the requirements of this International Standard and the food safety management system requirements established by the organization,

b) identify the need for updating or improvement of the food safety management system, c) identify trends which indicate the risk of a higher incidence of potentially unsafe products, d) establish information for the planning of the internal audit program concerning the status and importance of areas to be audited, and e) provide evidence that corrective actions and corrections that have been taken are effective. The result of the analysis and resulting activities shall be recorded and shall in relevant form be reported to top management as input to the management review (see 5.8.2). It shall also be used as an input to food safety management system updating (see 8.5.2).

* 8.4 Validation of control measure combinations For the initial design of the combination of control measures to be included in operational PRPs and the HACCP plan and after any change therein (7.4.4), the organization shall confirm that the control measure combinations are capable of achieving the intended level of control of the identified food safety hazards. Validation activities shall include actions to confirm that a) the established critical limits for CCPs are capable of achieving the intended control of the food safety hazard(s) for which they are designated (7.6.3), and

b) the control measures are effective and capable of, in combination, ensuring control of the identified food safety hazards to obtain end products that meet the defined acceptable levels (7.4.4). If validation results show that one or more of the above elements cannot be confirmed, the control measure system shall be modified and reassessed (see 7.4.1). Modifications may include changes in control measures (i.e. process parameters, stringencies, intensities and/or their combination) and/or change(s) in the raw materials, manufacturing technologies, end product characteristics, methods of distribution, and/or intended use of the end product.

8.5 Improvement 8.5.1 Continual improvement The organization shall continually improve its food safety management by meeting the requirements concerning planning and realization of safe product, as presented in 7. Top management shall ensure that the organization continually improves the effectiveness of the food safety management system through the use of communication (see 5.5), management review (see 5.8), internal audit (see 8.3.1), evaluation of individual verification results (see 8.3.2), analysis of results of verification activities (see 8.3.3), validation of control measure combinations (see 8.4) and food safety management system updating (see 8.5.2). NOTE See ISO 9001 for guidance on continual improvement of quality management system effectiveness.

8.5.2 Food safety management system updating Top management shall ensure that the food safety management system is updated in a timely manner to ensure food safety. The food safety team shall at defined intervals evaluate and assess customer feed back including complaints related to food safety, audit reports, and results of verification activity analyses (see 8.3.3). The necessity of reviewing the hazard analysis (7.4) and the design of the operational PRP(s) (7.5) and the HACCP plan (7.6) shall then be considered.

The input for the updating evaluation and assessment activities shall be a) communication, external as well as internal, as stated in 5.5, b) other information concerning the suitability, adequacy and effectiveness of the food safety management system, c) output from the analysis of results of verification activities (8.3.3), and d) output from management review. System updating activities shall be recorded and in relevant form be reported as input to the management review (see 5.7.2).