Knowledge base

ISO 22000 Documentation: What You Really Need

A reference guide for the documented information required by ISO 22000.

Neha Dvivedi · 16 August 2026

ISO 22000 requires organisations to maintain certain documents and records to show that their Food Safety Management System (FSMS) is properly planned, implemented, monitored, and improved.

Documents you must maintain

An organisation should have documented information covering:-
Scope of the FSMS – What products, processes, locations, and activities are covered.

Food Safety Policy – The organisation’s commitment to food safety.

Food Safety Objectives – Clear and measurable food safety goals.

Hazard Control Plan – Details of how significant food safety hazards are controlled, including CCPs and OPRPs.

Prerequisite Programmes (PRPs) – Basic food safety and hygiene controls.

Process Flow Diagrams – Step-by-step flow of processes for the products or product categories covered.

Process and Environment Descriptions – Information about how processes operate and the conditions in which they take place.

Raw Material, Ingredient and Food-Contact Material Information – Details that may affect food safety.

Finished Product Descriptions – Information about the final products and their food safety characteristics.

Hazard Assessment Methodology and Criteria – How hazards are identified, evaluated, and prioritised.

Other Information Needed for the FSMS – Any documented information necessary to ensure the system works effectively.

Records you NEED TO KEEP

Records provide evidence that the food safety system is actually being implemented. These include:

• Records showing employee competence and training.

• CCP and OPRP monitoring results.

• Records of corrections and corrective actions.

• Results showing that control measures have been validated.

• Results of verification activities.

• Evaluation and analysis of verification results.

• Records of updates made to the FSMS.

• Traceability records.

• Product withdrawal and recall records, including mock recall exercises.

• Results of emergency response tests.

• Internal audit plans and results.

• Management review records.

• Records of nonconformities and corrective actions.

• Evidence of required external communication.

Four Key Documents That Deserve Special Attention

Some documents are particularly important because many other parts of the food safety system depend on them.

1. Process Flow Diagrams

The process flow diagram should accurately show how the product moves through the process.

The food safety team should verify the flow diagram at the actual production site, and the verification should be recorded with a date.

The diagram should include details that are sometimes missed, such as:

• Rework loops

• Sampling points

• Waste removal

• Utilities entering the process

• Other relevant process steps

The auditor may compare the documented flow with the actual production line.

2. Product and Raw Material Descriptions

These descriptions should include information relevant to food safety, such as:

• Product characteristics

• Intended use

• Raw material characteristics

• Known allergens

• Other information that could affect food safety

3. Hazard Analysis

The hazard analysis should explain how hazards were assessed, not just provide the final results.

It should clearly show:

• How hazards were identified

• How they were evaluated

• The criteria used for assessment

• Why certain hazards require control

4. Hazard Control Plan

For every significant food safety hazard, the control plan should clearly identify:

• The control measure

• Whether it is a CCP, OPRP, or another type of control

• Critical limits or action criteria

• Monitoring methods

• Corrections

• Corrective actions

• Responsibilities

• Required records

Keep Validation and Verification Records Separate

Validation and verification are not the same thing, so keep their records clearly separated.

Validation = Can the control measure work?

Validation provides evidence that a control measure is capable of controlling the hazard.

Examples include:

• Validation of a thermal processing method

• Establishing the sensitivity of a metal detector

• Validation of allergen cleaning procedures

Verification = Is the system actually working?

Verification provides evidence that the controls are being properly implemented and remain effective.

Examples include:

• Reviewing monitoring records

• Product testing

• Environmental monitoring

• Internal audits

Practical Tips

Verify and date your process flow diagram

Do not simply create the flow diagram and file it away. Verify it against the actual production process and record the date and results of verification.

Make PRP documentation specific

Do not describe prerequisite programmes in general terms.

Clearly document:

• What needs to be done

• How it will be done

• How often it will be done

• Who is responsible

• How it will be verified

Record mock recall results properly

A mock recall should show measurable results, such as:

• How long the recall exercise took

• How much product was successfully traced

• What percentage was accounted for

• What problems were identified

• What improvements are required

Keep monitoring equipment calibrated

Equipment used for food safety monitoring should be properly calibrated, including:

• Thermometers

• Metal detectors

• Weighing scales

• pH meters

If a CCP is being monitored using equipment that is not properly calibrated, the reliability of that monitoring becomes questionable.

Common ISO 22000 Audit Findings

Auditors commonly identify issues such as:

1. The process flow diagram does not match the actual production line, or its verification has not been recorded.

2. Validation evidence is missing for one or more important control measures.

3. PRPs are described too generally without clear methods, frequencies, or responsibilities.

4. Mock recall records are incomplete, with no clear timing or mass-balance information.

5. Allergen cross-contamination controls depend on cleaning procedures that have not been validated.

6. Monitoring records are completed, but there is no evidence that anyone reviewed or evaluated them.

The Key Message

ISO 22000 documentation is not about creating paperwork for the sake of an audit. The documentation should clearly demonstrate how food safety hazards are identified, controlled, monitored, verified, and continuously improved.

Good documentation should reflect what is actually happening on the production floor, not just what is written in the procedure.

What this covers

ISO 22000

See how this looks as a working system

Reading about a requirement and seeing the documentation that satisfies it are different things. In a short demo we open the actual manual, procedures and records set for ISO 22000, show you how each clause is answered and where your existing way of working already fits. You will know what implementation involves before you commit to it.