ISO 22000:2018: documentation and compliance requirements

This is what ISO 22000:2018 requires you to have, clause by clause, and what an auditor will ask to see for each of it. It covers 76 requirements across 7 areas.

It is deliberately not a checklist. A checklist asks whether you have something; this says what is required and what counts as evidence, which is the question that matters when you are building a system rather than testing one. If you would rather find out where you stand first, the same ground is covered by our free ISO 22000:2018 readiness assessment, which scores you out of 100.

4 Your organisation and food safety

Clauses 4.1, 4.2, 4.3, 4.4.

You must have written down the outside things that affect food safety here — laws, customers, suppliers, new hazards, recalls in your sector.

Evidence: A short list of these issues, with a note of when you last looked at it.

You must have written down the inside things — buildings, equipment, staff turnover, skills, capacity.

Evidence: The same list, covering internal issues.

You must have listed everyone with an interest — customers, consumers, the regulator, suppliers, staff, your certification body.

Evidence: A list of these groups and what each needs from you.

You must know which food safety laws and customer standards apply to you, in every market you sell into.

Evidence: A register of legal and customer requirements by market, with review dates.

You must have written down what the food safety system covers — which products, processes, sites and steps in the food chain.

Evidence: A scope statement naming products, processes and sites, and where you sit in the food chain.

You must know what your main processes are and how they fit together.

Evidence: A process map or a list with owners.

5 Leadership and the food safety team

Clauses 5.1, 5.2, 5.3.

Senior management must be able to point to food safety decisions they made in the last year.

Evidence: Management review notes. Money approved. Ask them directly.

Senior management must back the food safety team, rather than overruling it when production is under pressure.

Evidence: Evidence of a decision that cost money or time and was taken anyway. Ask the team.

You must have a written food safety policy.

Evidence: The policy, signed and dated.

It must promise to meet legal, regulatory and customer food safety requirements, to communicate, and to keep improving.

Evidence: All the promises visible in the text.

It must be shared with everyone, at every level.

Evidence: Where it is displayed. Ask staff on the line.

You must have appointed a food safety team leader, with the authority to act.

Evidence: The appointment with defined responsibility, including reporting on how the system is working to senior management.

The must be food safety team made up of people from different areas, not just quality.

Evidence: Team membership covering production, engineering, hygiene, technical and buying. Competence records for each. Meeting notes showing the team actually meets.

It must be clear who is responsible for what elsewhere in the business.

Evidence: Organisation chart. Responsibility list.

6 Planning

Clauses 6.1, 6.2, 6.3.

You must have worked out what could go wrong with the system itself, and what opportunities there are.

Evidence: A business-level risk and opportunity list, kept separate from the hazard analysis. The standard treats these as different things and confusing them is a common finding.

You must have set food safety objectives, and they must be able to be measured.

Evidence: Objectives with targets and numbers, and how each is monitored.

For each objective, it must be clear what will be done, by whom, by when, with what, and how you will judge it.

Evidence: An action plan covering all five points.

It must be defined when something changes — a new product, process, machine, supplier, building or law — you must plan the change before you make it.

Evidence: Change records with the food safety effects considered beforehand.

7 Support — people, communication and documents

Clauses 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.2, 7.3, 7.4.2, 7.4.3, 7.5.

You must provide the people, money, equipment and buildings the food safety system needs.

Evidence: Budget. Staffing. Equipment and facilities provided.

You must have enough competent people, including at busy times and on night shifts.

Evidence: Staffing levels. Cover arrangements.

You must be able to answer: Are your buildings and layout suitable for making safe food?

Evidence: Building condition. Layout preventing cross-contamination. Maintenance records.

The must be working environment suitable — temperature, humidity, air, lighting, cleanliness.

Evidence: Environmental conditions monitored where they matter.

If you use an outside expert to help build or check your system, that arrangement must be written down.

Evidence: The agreement with the consultant or expert, and what they were responsible for.

You must control what you buy in and who you buy it from, where it affects food safety.

Evidence: A supplier approval procedure with criteria matched to risk. Approved supplier list. Raw material and packaging specifications. Certificates of analysis and how you verify them. Supplier audits or questionnaires. Control of pest control, cleaning, laundry, calibration and laboratory providers.

You must know what skills each food-safety-relevant job needs, and you must be able to show people have them.

Evidence: Competence criteria. Skills matrix. Training records covering hygiene, allergens, HACCP and the job itself. Evidence training worked, not just that people attended.

You must be able to answer: Do contractors and agency staff get the same hygiene and food safety training?

Evidence: Induction records for contractors and temporary staff.

Your people must know the policy, why food safety matters in their own job, and what to do if something is wrong.

Evidence: Awareness records. Ask staff on the line — this is how it is tested.

You must communicate with suppliers, contractors, customers and authorities about food safety.

Evidence: Records of what was communicated and to whom. Named people with authority to speak externally.

The food must safety team get told when anything changes — product, ingredient, process, equipment, cleaning, packaging, staff or law.

Evidence: Evidence changes reached the team. This is a specific requirement and it is where systems most often come unstuck, because production changes something and nobody tells the team.

You must have the documents and records the standard asks for.

Evidence: A list of documents and records held.

When a document is created or changed, it must be checked and approved before use.

Evidence: Approval on the document.

People must be able to find the current version at the line, and are old versions taken away.

Evidence: Current specifications and monitoring forms available at the point of work.

Records must be protected from damage in a wet or dirty environment, and kept long enough.

Evidence: A retention list covering shelf life plus a margin. Laminated or electronic forms where the environment is hostile.

8 Prerequisites, hazards and control

Clauses 8.1, 8.2, 8.3, 8.4, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.7, 8.8, 8.9.2, 8.9.3, 8.9.4, 8.9.5, 8.6.

You must have planned and put in place the processes needed to make safe food.

Evidence: Documented processes and evidence they are followed.

You must have prerequisite programmes covering the basics — building, utilities, waste, equipment, materials, cross-contamination, cleaning, pests, personal hygiene.

Evidence: Written prerequisite programmes covering each relevant area.

You must have choose those programmes deliberately, based on your sector and the standard.

Evidence: The reasoning behind which programmes you have.

You must be able to show they are actually being done — cleaning records, pest reports, hygiene inspections.

Evidence: Completed records, not just the procedures.

You must check the prerequisite programmes are working, not just being done.

Evidence: Verification records — swabs, inspections, audits of the programmes themselves.

You must be able to trace an ingredient forward to finished product, and finished product back to its ingredients.

Evidence: A traceability system. Batch and lot records. Rework traced too.

You must have tested traceability, and you must have meet your own target time.

Evidence: A traceability test or mock recall record with the date, the time taken and the percentage of product accounted for.

You must have worked out what emergencies could affect food safety, and you must have arrangements for them.

Evidence: A list of emergencies — utility failure, contamination, flood, fire, malicious contamination, supplier failure, withdrawal. Contact lists including authorities and customers.

You must have tested those arrangements.

Evidence: Test or simulation records, with what you changed afterwards.

You must have described your raw materials, ingredients and packaging, including allergens and origin.

Evidence: Written descriptions covering composition, origin, allergens, storage and how they will be used.

You must have described your finished products, including shelf life, storage and how they will be used.

Evidence: End product descriptions.

You must have written down who will eat the product, including vulnerable groups, and how it might be misused.

Evidence: Intended use, intended consumers, and reasonably foreseeable misuse.

You must have a flow diagram for each product or group.

Evidence: Flow diagrams covering every step from receipt to despatch.

You must be able to answer: Has someone from the team walked the line and confirmed the flow diagram is right, and signed it?

Evidence: On-site verification of each diagram, signed and dated. A diagram never checked against the actual line is a common finding.

You must have identified all the hazards that could reasonably be expected — biological, chemical, physical and allergenic — at each step.

Evidence: Hazard identification by step, with the sources you used: law, science, your own history, complaints, industry alerts.

You must have consider the steps before and after yours, the equipment, the utilities and the surroundings.

Evidence: Evidence these were taken into account.

You must have set the acceptable level for each hazard in the finished product, and said where that came from.

Evidence: Acceptable levels with their basis — a legal limit, a customer requirement or a scientific source.

You must have decided which hazards are significant, using a method you have written down.

Evidence: The hazard assessment with the method used, considering how likely and how serious each is.

For each significant hazard, you must have chosen a control measure and decided whether it is a critical control point or an operational prerequisite.

Evidence: The categorisation with the logic behind it: how well the measure works, whether it can be monitored, where it sits, how likely it is to fail and how bad the consequence would be. The list of critical control points and operational prerequisites. This is where people coming from plain HACCP most often fall short, because the second category does not exist in Codex HACCP.

You must have validated the control measures — shown they can actually reduce the hazard to the acceptable level.

Evidence: Validation studies, challenge tests, thermal studies, published data, or a legally validated process. Done before use, and repeated after a change. Validation is not the same as verification.

For each control point, the plan must state the limit or criterion, the monitoring, the corrections, the corrective actions, who is responsible and what is recorded.

Evidence: The hazard control plan with all six for every critical control point and operational prerequisite. Limits at critical control points must be measurable.

The monitoring records must be actually completed at the stated frequency, and checked by someone.

Evidence: Completed monitoring records, signed off by an authorised person.

The must be equipment used at control points calibrated, and you must act when it is found wrong.

Evidence: Calibration records for the equipment at each control point. Records of what was done about product already made when equipment was found out of calibration. Validation of any software used for monitoring.

You must have a verification plan saying what you check, how, how often and who does it.

Evidence: The plan and the completed verification records — product and environmental testing, inspections, review of monitoring records.

You must analyse the verification results, and does the food safety team look at them.

Evidence: Analysis of results, with actions arising, discussed by the team.

When a limit is exceeded or a criterion is not met, you must apply the correction and record it.

Evidence: Correction records for every deviation.

You must then work out why it happened and act to stop it recurring.

Evidence: Corrective action records with root cause.

Product that might be unsafe must be held, evaluated and not released until it is shown to be acceptable.

Evidence: A hold procedure. Evaluation records. Decisions on release, reprocess, redirect or dispose, and who authorised each.

You must have a withdrawal and recall procedure, with someone named who can start it.

Evidence: The procedure. Named authority. Notification arrangements for authorities and customers.

You must have tested a recall, and it must have work.

Evidence: Recall test records with the date, time taken and result. Records of any real withdrawal, with its effectiveness checked.

When something changes that affects the hazard analysis, you must update the system before the change takes effect.

Evidence: Records of updates to descriptions, flow diagrams, hazard analysis, prerequisites and the control plan, with the trigger for each. Evidence updates happen at the time, not at the next annual review.

9 Checking how you are doing

Clauses 9.1, 9.2, 9.3.

You must have decided what you will measure, and how often.

Evidence: A monitoring plan covering verification results, monitoring trends, nonconformities, complaints, audits and supplier performance.

You must analyse the results and act on them.

Evidence: Analysis and evaluation records, with actions taken.

You must audit the system, covering the prerequisites, the control plan and the management side.

Evidence: An audit programme. Audit reports and findings.

The auditors must be independent of the work they audit, and competent in food safety and HACCP.

Evidence: Auditor training and independence records.

Senior management must review the system at planned intervals.

Evidence: Review dates and attendance.

The review must cover everything the standard asks for.

Evidence: An agenda covering: previous actions, changes, performance and effectiveness, resources, emergencies or withdrawals, updating activities, communications received and sent, audit results.

The review must produce decisions and actions, not just minutes.

Evidence: Decisions and an action list with owners and dates.

10 Putting things right and getting better

Clauses 10.1, 10.2, 10.3.

When something goes wrong, you must deal with it and work out why.

Evidence: Nonconformity and corrective action records with root cause.

You must check whether the same problem could happen elsewhere, and check later that your fix worked.

Evidence: Evidence you looked wider. A follow-up record with a date.

The food must safety team consider whether the hazard analysis or the control plan needs changing as a result.

Evidence: Team review of the analysis after a problem.

You must be able to show food safety performance is better than before.

Evidence: Trends in complaints, test results, nonconformities and audit findings across periods.

The must be system kept up to date — reviewed and updated by the food safety team at planned intervals.

Evidence: Records of system updating decisions, with dates.

Using this document

Nothing above asks for a manual, a template pack, or a filing system. It asks for decisions that have been taken deliberately and can be shown to have been taken — which is a far smaller job than most organisations expect, and a different one.

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor finds the gap between the two. The test we apply is whether the person who has to do the job recognises their own work in what is written down.