Clause 4

4.1 Understanding the Organization and its Context

Has the organization determined external and internal issues that are relevant to its purpose and affect its ability to achieve the intended result(s) of its FSMS?

Has the organization identified, reviewed and updated information related to these external and internal issues?

4.2 Understanding the Needs and Expectations of Interested Parties

Has the organization determined the interested parties that are relevant to the FSMS?

Has the organization determined the relevant requirements of the interested parties of the FSMS?

Has the organization identified, reviewed and updated information related to the interested parties and their requirements?

4.3 Determining the Scope of the Food Safety Management System

Has the organization determined the boundaries and applicability of the FSMS to establish its scope?

Does the scope specify the products and services, processes and production site(s) that are included in the FSMS?

Does the scope include the activities, processes, products or services that can have an influence on the food safety of its end products?

When determining this scope, did organization consider the external and internal issues referred to in 4.1?

Is the scope available and maintained as documented information?

4.4 Food Safety Management System

Has the organization established, implemented, maintained, updated and continually improved an FSMS in accordance with the requirements of ISO 22000? — This should include the processes needed and their interactions.

Clause 5

5.1 Leadership and Commitment

Does top management demonstrate leadership and commitment by ensuring that the food safety policy and the objectives of the FSMS are established and are compatible with the strategic direction of the organization?

Does top management demonstrate leadership and commitment by ensuring the integration of the FSMS requirements into the organization’s business processes?

Does top management demonstrate leadership and commitment by ensuring that the resources needed for the FSMS are available?

Does top management demonstrate leadership and commitment by communicating the importance of effective food safety management and conforming to the FSMS requirements related to food safety? — Including applicable statutory and regulatory requirements and mutually agreed on customer requirements.

Does top management demonstrate leadership and commitment by ensuring that the FSMS is evaluated and maintained to achieve its intended result(s)? — See 4.1

Does top management demonstrate leadership and commitment by directing and supporting persons to contribute to the effectiveness of the FSMS?

Does top management demonstrate leadership and commitment by promoting continual improvement?

Does top management demonstrate leadership and commitment by supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility?

5.2.1 Establishing the Food Safety Policy

Has top management established, implemented and maintained a food safety policy that is appropriate to the purpose and context of the organization?

Has top management established, implemented and maintained a food safety policy that provides a framework for setting and reviewing the objectives of the FSMS?

Has top management established, implemented and maintained a food safety policy that includes a commitment to satisfy applicable food safety requirements? — This should include statutory and regulatory requirements and mutually agreed customer requirements related to food safety.

Has top management established, implemented and maintained a food safety policy that addresses internal and external communication?

Has top management established, implemented and maintained a food safety policy that includes a commitment to continual improvement of the FSMS?

Has top management established, implemented and maintained a food safety policy that addresses the need to ensure competencies related to food safety?

5.2.2 Communicating the Food Safety Policy

Is the food safety policy available and maintained as documented information?

Is the food safety policy communicated, understood and applied at all levels within the organization?

Is the food safety policy available to relevant interested parties, as appropriate?

5.3 Organizational roles, responsibilities and authorities

Has top management ensured that the responsibilities and authorities for relevant roles are assigned, communicated and understood within the organization?

Has top management assigned the responsibility and authority for ensuring that the FSMS conforms to the requirements of ISO 22000?

5.3 Organizational roles, responsibilities and authorities

Has top management assigned the responsibility and authority for reporting on the performance of the FSMS to top management?

Has top management assigned the responsibility and authority for appointing the food safety team and the food safety team leader?

Has top management assigned the responsibility and authority for designating persons with defined responsibility and authority to initiate and document action(s)?

Is the food safety team leader responsible for ensuring the FSMS is established, implemented, maintained and updated?

Is the food safety team leader responsible for managing and organizing the work of the food safety team?

Is the food safety team leader responsible for ensuring relevant training and competencies for the food safety team? — See 7.2

Is the food safety team leader responsible for reporting to top management on the effectiveness and suitability of the FSMS?

Do all persons have the responsibility to report problem(s) with regards to the FSMS to identified person(s)?

Clause 6

6.1 Actions to Address Risks and Opportunities

When planning for the FSMS, has the organization considered the issues referred to in 4.1 and the requirements referred to in 4.2 and 4.3?

Has the organization determined the risks and opportunities that need to be addressed to give assurance that the FSMS can achieve its intended result(s)?

Has the organization determined the risks and opportunities that need to be addressed to enhance desirable effects?

Has the organization determined the risks and opportunities that need to be addressed to prevent, or reduce, undesired effects?

Has the organization determined the risks and opportunities that need to be addressed to achieve continual improvement?

Has the organization planned actions to address these risks and opportunities?

Has the organization planned how to integrate and implement the actions into its FSMS processes?

Has the organization planned how to evaluate the effectiveness of these actions?

Are the actions taken by the organization to address risks and opportunities proportionate to the impact on food safety requirements?

Are the actions taken by the organization to address risks and opportunities proportionate to the conformity of food products and services to customers?

Are the actions taken by the organization to address risks and opportunities proportionate to requirements of interested parties in the food chain?

6.2 Objectives of the Food Safety Management System and Planning to Achieve them

Has the organization established objectives for the FSMS at relevant functions and levels?

Are the objectives of the FSMS consistent with the food safety policy?

Are the objectives of the FSMS measurable (if practicable)?

Do the objectives of the FSMS take into account applicable food safety requirements? — Including statutory, regulatory and customer requirements.

Are the objectives of the FSMS monitored and verified?

Are the objectives of the FSMS communicated?

Are the objectives of the FSMS maintained and updated as appropriate?

Does the organization retain documented information on the objectives for the FSMS?

When planning how to achieve its objectives for the FSMS, does the organization determine what will be done?

When planning how to achieve its objectives for the FSMS, does the organization determine what resources will be required?

When planning how to achieve its objectives for the FSMS, does the organization determine who will be responsible?

When planning how to achieve its objectives for the FSMS, does the organization determine when it will be completed?

When planning how to achieve its objectives for the FSMS, does the organization determine how the results will be evaluated?

6.3 Planning of Changes

When the organization determines the need for changes to the FSMS, are they carried out and communicated in a planned manner? — This includes personnel changes.

Does the organization consider the purpose of the changes and their potential consequences?

Does the organization consider the continued integrity of the FSMS?

Does the organization consider the availability of resources to effectively implement the changes?

Does the organization consider the allocation or re-allocation of responsibilities and authorities?

Clause 7

7.1.1 Resources (General)

Has the organization determined and provided the resources needed for the establishment, implementation, maintenance, update and continual improvement of the FSMS?

Has the organization considered he capability of, and any constraints on, existing internal resources?

Has the organization considered the need for external resources?

7.1.2 Resources (People)

Has the organization ensured that persons necessary to operate and maintain effective FSMS are competent? — See 7.2

Where the assistance of external experts is used, is evidence of agreement or contracts defining the competency, responsibility and authority of external experts retained as documented information?

7.1.3 Resources (Infrastructure)

Has the organization provided the resources for the determination, establishment and maintenance of the infrastructure necessary to achieve conformity with the requirements of the FSMS?

7.1.4 Resources (Work Environment)

Has the organization determined, provided and maintained the resources for the establishment, management and maintenance of the work environment necessary to achieve conformity?

7.1.5 Externally Developed Elements of the Food Safety Management System

When an organization establishes, maintains, updates and improves the externally developed elements of an FSMS, do they ensure that provided elements are developed in conformance with requirements of ISO 22000? — This includes PRPs, the hazard analysis, and the hazard control plan (see 8.5.4).

When an organization establishes, maintains, updates and improves the externally developed elements of a FSMS, do they ensure that provided elements are applicable to the sites, processes and products of the organization? — This includes PRPs, the hazard analysis and the hazard control plan (see 8.5.4).

When an organization establishes, maintains, updates and improves the externally developed elements of an FSMS, do they ensure that provided elements are specifically adapted to the processes and products of the organization by the food safety team? — This includes PRPs, the hazard analysis, and the hazard control plan (see 8.5.4).

When an organization establishes, maintains, updates and improves the externally developed elements of a FSMS, do they ensure that provided elements are implemented, maintained and updated as required by this document? — This includes PRPs, the hazard analysis and the hazard control plan (see 8.5.4).

When an organization establishes, maintains, updates and improves the externally developed elements of a FSMS, do they ensure that provided elements are retained as documented information? — This includes PRPs, the hazard analysis and the hazard control plan (see 8.5.4).

7.1.6 Control of Externally Provided Processes, Products or Services

Has the organization established and applied criteria for the evaluation, selection, monitoring of performance and re- evaluation of external providers of processes, products and/or services?

Has the organization ensured adequate communication of requirements to the external provider(s)?

Has the organization ensured that externally provided processes, products or services do not adversely affect the organization's ability to consistently meet the requirements of the FSMS?

Has the organization retained documented information of these activities and any necessary actions as a result of the evaluations and re-evaluations?

7.2 Competence

Has the organization determined the necessary competence of person(s), including external providers, doing work under its control that affects its food safety performance and effectiveness of the FSMS?

Has the organization ensured that these persons, including the food safety team and those responsible for the operation of the hazard control plan, are competent? — On the basis of appropriate education, training and/or experience.

Has the organization ensured that the food safety team has a combination of multi-disciplinary knowledge and experience in developing and implementing the FSMS? — This includes, but is not limited to, the organization’s products, processes, equipment and food safety hazards within the scope of the FSMS.

Has the organization where applicable, taken actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken?

Has the organization retained appropriate documented information as evidence of competence?

7.3 Awareness

Has the organization ensured that all relevant persons doing work under their control are aware of the food safety policy?

Has the organization ensured that all relevant persons doing work under their control are aware of the objectives of the FSMS relevant to their task(s)?

Has the organization ensured that all relevant persons doing work under their control are aware of their individual contribution to the effectiveness of the FSMS? — This includes the benefits of improved food safety performance.

Has the organization ensured that all relevant persons doing work under their control are aware of the implications of not conforming with the FSMS requirements?

7.4.1 Communication (General)

Has the organization determined the internal and external communications relevant to the FSMS, including on what it will communicate?

Has the organization determined the internal and external communications relevant to the FSMS, including when to communicate?

Has the organization determined the internal and external communications relevant to the FSMS, including with whom to communicate?

Has the organization determined the internal and external communications relevant to the FSMS, including how to communicate?

Has the organization determined the internal and external communications relevant to the FSMS, including who communicates?

Has the organization ensured that the requirement for effective communication is understood by all persons whose activities have an impact on food safety?

7.4.2 Communication (External)

Has the organization ensured that sufficient information is communicated externally and is available for interested parties of the food chain?

Has the organization established, implemented and maintained effective communications with external providers and contractors?

Has the organization established, implemented and maintained effective communications with customers and/or consumers, in relation to the following? — - Product information related to food safety, to enable the handling, display, storage, preparation, distribution and use of the product within the food chain or by the consumer; - Identified foods safety hazards that need to be controlled by other organizations in the food chain and/or by consumers; - Contractual arrangements, enquiries and orders, including their amendments; - Customer and/or consumer feedback, including complaints.

Has the organization established, implemented and maintained effective communications with statutory and regulatory authorities?

Has the organization established, implemented and maintained effective communications with other organizations that have an impact on, or will be affected by the FSMS?

Do designated persons have defined responsibility and authority for the external communication of any information concerning food safety?

Where relevant, is information obtained through external communication included as input for management review? — See 9.3, 4.4, and 10.3.

Has evidence of external communication been retained as documented information?

7.4.3 Communication (Internal)

Has the organization established, implemented and maintained an effective system for communicating issues having an impact on food safety?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the products or new products?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the raw materials, ingredients and services?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the production systems and equipment?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the production premises, location of equipment and surrounding environment?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the cleaning and sanitation programmes?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the packaging, storage and distribution systems?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the competencies and/or allocation of responsibilities and authorizations?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the applicable statutory and regulatory requirements?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the knowledge regarding food safety hazards and control measures?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the customer, sector and other requirements that the organization observes?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the relevant enquiries and communications from external interested parties?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the complaints and alerts indicating food safety hazards associated with the end product?

Has the organization ensured that the food safety team is informed in a timely manner of changes in the other conditions that have an impact on food safety?

Has the food safety team ensured that this information is included when updating the FSMS? — See 4.4 and 10.3

Has top management ensured that relevant information is included as input to the management review? — See 9.3

7.5.1 Document Information (General)

Do the organization’s FSMS include documented information required by this document?

Do the organization’s FSMS include documented information determined by the organization as being necessary for the effectiveness of the FSMS?

Do the organization’s FSMS include documented information and food safety requirements required by statutory, regulatory authorities and customers?

7.5.2 Document Information (Creating and Updating)

When creating and updating documented information, does the organization ensure appropriate identification and description? — E.g. a title, date, author, or reference number

When creating and updating documented information, does the organization ensure appropriate format and media?

When creating and updating documented information, does the organization ensure appropriate review and approval for suitability and adequacy?

7.5.3 Document Information (Control of Documented Information)

Is documented information required by the FSMS controlled to ensure it is available and suitable for use, where and when it is needed?

Is documented information required by the FSMS controlled to ensure it is adequately protected? — E.g. from loss of confidentiality, improper use, or loss of integrity.

For the control of documented information, has the organization addressed distribution, access, retrieval and use?

For the control of documented information, has the organization addressed storage and preservation, including preservation of legibility?

For the control of documented information, has the organization addressed control of changes? — E.g. version control.

For the control of documented information, has the organization addressed retention and disposition?

Is documented information of external origin determined by the organization to be necessary for the planning and operation of the FSMS identified, as appropriate, and controlled?

Is documented information retained as evidence of conformity protected from unintended alterations?

Clause 8

8.1 Operational Planning and Control

Has the organization planned, implemented, controlled, maintained and updated the processes needed to meet requirements for the realization of safe products?

Has the organization implemented the actions determined in 6.1 by establishing criteria for the processes?

Has the organization implemented the actions determined in 6.1 by implementing control of the processes in accordance with the criteria?

Has the organization implemented the actions determined in 6.1 by keeping documented information to the extent necessary to have the confidence to demonstrate that the processes have been carried out as planned?

Does the organization control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary?

Does the organization ensure that outsourced processes are controlled? — See 7.1.6

8.2 Prerequisite Programmes (PRPs)

Has the organization established, implemented, maintained and updated PRP(s) to facilitate the prevention and reduction of contaminants in the products, product processing and work environment?

Are the PRP(s) appropriate to the organization and its context with regard to food safety?

Are the PRP(s) appropriate to the size and type of the operation and the nature of the products being manufactured and/or handled?

Are the PRP(s) implemented across the entire production system, either as programmes applicable in general or as programmes applicable to a particular product or process?

Are the PRP(s) approved by the food safety team?

When selecting and/or establishing PRP(s), does the organization ensure that applicable statutory, regulatory and mutually agreed customer requirements are identified?

Does the organization consider he applicable part of the ISO/TS 22002 series?

Does the organization consider applicable standards, codes of practice and guidelines?

When establishing PRP(s), does the organization consider construction, lay-out of buildings and associated utilities?

When establishing PRP(s), does the organization consider lay-out of premises, including zoning, workspace and employee facilities?

When establishing PRP(s), does the organization consider supplies of air, water, energy and other utilities?

When establishing PRP(s), does the organization consider pest control, waste and sewage disposal and supporting services?

When establishing PRP(s), does the organization consider the suitability of equipment and its accessibility for cleaning and maintenance?

When establishing PRP(s), does the organization consider supplier approval and assurance processes? — E.g. raw materials, ingredients, chemicals, and packaging.

When establishing PRP(s), does the organization consider reception of incoming materials, storage, dispatch, transportation and handling of products?

When establishing PRP(s), does the organization consider measures for the prevention of cross contamination?

When establishing PRP(s), does the organization consider cleaning and disinfecting?

When establishing PRP(s), does the organization consider personal hygiene?

When establishing PRP(s), does the organization consider product information/consumer awareness?

When establishing PRP(s), does the organization consider others, as appropriate?

Does documented information specify the selection, establishment, applicable monitoring and verification of the PRP(s)?

8.3 Traceability System

Is the traceability system able to uniquely identify incoming material from the suppliers and the first stage of the distribution route of the end product?

When establishing and implementing the traceability system, does the organization consider the relation of received materials, ingredients and intermediate products to the end products?

When establishing and implementing the traceability system, does the organization consider the reworking of materials/products?

When establishing and implementing the traceability system, does the organization consider the distribution of the end product?

Does the organization ensure that applicable statutory, regulatory and customer requirements are identified?

Is documented information as evidence of the traceability system retained for a defined period to include, as a minimum, the shelf life of the product?

Has the organization verified and tested the effectiveness of the traceability system?

8.4.1 Emergency Preparedness and Response (General)

Has top management ensured that procedures are in place to respond to potential emergency situations or incidents that can have an impact on food safety?

Is documented information established and maintained to manage these situations and incidents?

8.4.2 Emergency Preparedness and Response (Handling of Emergencies and Incidents)

Does the organization respond to actual emergency situations and incidents by ensuring applicable statutory and regulatory requirements are identified?

Does the organization respond to actual emergency situations and incidents by communicating internally?

Does the organization respond to actual emergency situations and incidents by communicating externally? — E.g. suppliers, customers, appropriate authorities, media.

Does the organization take action to reduce the consequences of the emergency situation, appropriate to the magnitude of the emergency or incident and the potential food safety impact?

Does the organization periodically test procedures where practical?

Does the organization review and, where necessary, update the documented information after the occurrence of any incident, emergency situation or tests?

8.5.1.1 Preliminary Steps to Enable Hazard Analysis (General)

To carry out the hazard analysis, is preliminary documented information collected, maintained and updated by the food safety team? — This shall include, but not be limited to: - Applicable statutory, regulatory and customer requirements; - The organization’s products, processes, and equipment; - Food safety hazards relevant to the FSMS.

8.5.1.2 Preliminary Steps to Enable Hazard Analysis (Characteristics of Raw Materials, Ingredients and Product Contact Materials)

Does the organization ensure that all applicable statutory and regulatory food safety requirements are identified for all raw materials, ingredients and product contact materials?

Does the organization maintain documented information concerning all raw materials, ingredients and product contact materials to the extent needed to conduct the hazard analysis? — This should include the following, as appropriate (see 8.5.2): - Biological, chemical and physical characteristics; - Composition of formulated ingredients, including additives and processing aids; - Source (e.g. animal, mineral or vegetable); - Place of origin (provenance); - Method of production; - Method of packaging and delivery; - Storage conditions and shelf life; - Preparation and/or handling before use or processing; - Acceptance criteria related to food safety or specifications of purchased materials and ingredients appropriate to their intended use.

8.5.1.3 Preliminary Steps to Enable Hazard Analysis (Characteristics of End Products)

Does the organization ensured that all applicable statutory and regulatory food safety requirements are identified for all the end products intended to be produced?

Does the organization maintain documented information concerning the characteristics of end products to the extent needed to conduct the hazard analysis? — This should include the following, as appropriate (see 8.5.2): - Product name or similar identification; - Composition; - Biological, chemical and physical characteristics relevant for food safety; - Intended shelf life and storage conditions; - Packaging; - Labelling relating to food safety and/or instructions for handling, preparation and intended use; - Method(s) of distribution and delivery.

8.5.1.4 Preliminary Steps to Enable Hazard Analysis (Intended Use)

Is the intended use considered and maintained as documented information to the extent needed to conduct the hazard analysis? — This includes reasonably expected handling of the end product and any unintended use but reasonably expected mishandling and misuse of the end product, (see 8.5.2).

Where appropriate, are groups of consumers/users identified for each product?

Have groups of consumers/users known to be especially vulnerable to specific food safety hazards been identified?

8.5.1.5.1 Preparation of the Flow Diagrams

Has the food safety team established, maintained and updated flow diagrams for the products or product categories and the processes covered by the FSMS?

Do flow diagrams provide a graphic representation of the process?

Are flow diagrams used when conducting the hazard analysis as a basis for evaluating the possible occurrence, increase, decrease or introduction of food safety hazards?

Are flow diagrams clear, accurate and sufficiently detailed to the extent needed to conduct the hazard analysis?

Do flow diagrams include the sequence and interaction of the steps in the operation?

Do flow diagrams include any outsourced processes?

Do flow diagrams include where raw materials, ingredients, processing aids, packaging materials, utilities and intermediate products enter the flow?

Do flow diagrams include where reworking and recycling take place?

Do flow diagrams include where end products, intermediate products, by-products and waste are released or removed?

8.5.1.5.2 On-Site Confirmation of Flow Diagrams

Does the food safety team confirm on-site the accuracy of the flow diagrams, update the flow diagrams where appropriate and retain as documented information?

8.5.1.5.3 Description of Processes and Process Environment

Has the food safety team adequately described the layout of premises, including food and non-food handling areas?

Has the food safety team adequately described processing equipment and contact materials, processing aids and flow of materials?

Has the food safety team adequately described existing PRPs, process parameters, control measures and the strictness with which they are applied, or procedures that can influence food safety?

Has the food safety team adequately described external requirements that can impact the choice and the strictness of the control measures? — E.g. from statutory and regulatory authorities or customers.

Are the variations resulting from expected seasonal changes or shift patterns included as appropriate?

Are the descriptions updated as appropriate and maintained as documented information?

8.5.2.1 Hazard analysis (General)

Has the food safety team conducted a hazard analysis, based on the preliminary information, to determine the hazards that need to be controlled?

Does degree of control ensure food safety and, where appropriate, are a combination of control measures used?

8.5.2.2 Hazard analysis (Hazard Identification and Determination of Acceptable Levels)

Has the organization identified and documented all food safety hazards that are reasonably expected to occur in relation to the type of product, type of process and process environment? — The identification shall be based on: - The preliminary information and data collected in accordance with 8.5.1; - Experience; - Internal and external information including, to the extent possible, epidemiological, scientific and other historical data; - Information from the food chain on food safety hazards related to the safety of the end products, intermediate products and the food at the time of consumption; - Statutory, regulatory and customer requirements.

Have hazards been considered in sufficient detail to enable hazard assessment and the selection of appropriate control measures?

Has the organization identified step(s) at which each food safety hazard can be present, be introduced, increase or persist? — E.g. receiving raw materials, processing, distribution and delivery.

When identifying hazards, has the organization considered he stages preceding and following in the food chain?

When identifying hazards, has the organization considered he stages preceding and following in the food chain?

When identifying hazards, has the organization considered the process equipment, utilities/services, process environment and persons?

Has the organization determined the acceptable level in the end product of each food safety hazard identified, whenever possible?

When determining acceptable levels, did the organization ensure that applicable statutory, regulatory and customer requirements are identified?

When determining acceptable levels, did the organization consider the intended use of end products?

When determining acceptable levels, did the organization consider any other relevant information?

Does the organization maintain documented information concerning the determination of acceptable levels and the justification for the acceptable levels?

8.5.2.3 Hazard analysis (Hazard Assessment)

Has the organization conducted a hazard assessment for each identified food safety hazard to determine whether its prevention or reduction to an acceptable level is essential?

Has the organization evaluated each food safety hazard with regard to the likelihood of its occurrence in the end product prior to application of control measures?

Has the organization evaluated each food safety hazard with regard to the severity of its adverse health effects in relation to the intended use? — See 8.5.1.4.

Has the organization identified all significant food safety hazards that were found?

Has the methodology used been described, and the result of the hazard assessment maintained as documented information?

8.5.2.4 Hazard analysis (Selection and categorization of control measure(s))

Has the organization selected an appropriate combination of control measures that will be capable of preventing or reducing the identified significant hazards to defined acceptable levels?

Has the organization categorized the selected identified control measure(s) to be managed as OPRP(s) or at CCPs? — See 3.30 and 3.11.

Has the categorization been carried out using a systematic approach?

For each control measure, has there been an assessment of the likelihood of failure of its functioning?

For each control measure, has there been an assessment of the severity of the consequence in the case of failure of its functioning? — This assessment shall include: - The effect on identified significant food safety hazards; - The location in relation to other control measure(s); - Whether it is specifically established and applied to reduce the hazards to an acceptable level; - Whether it is a single measure or is part of combination of control measure(s).

For each control measure, does the systematic approach include an assessment of the feasibility of establishing measurable critical limits and/or measurable/observable action criteria?

For each control measure, does the systematic approach include an assessment of the feasibility of monitoring to detect any failure to remain within critical limit and/or measurable/observable action criteria?

For each control measure, does the systematic approach include an assessment of the feasibility of applying timely corrections in case of failure?

Are the decision-making process and results of the selection and categorization of the control measures maintained as documented information?

Have external requirements that can impact the choice and the strictness of the control measures been maintained as documented information? — E.g. statutory, regulatory and customer requirements.

8.5.3 Validation of Control Measure(s) and Combinations of Control Measures

Has the food safety team validated that the selected control measures are capable of achieving the intended control of the significant food safety hazard(s)?

Was this validation done prior to implementation of control measure(s) and combinations of control measures to be included in the hazard control plan,) and after any change therein? — See 8.5.4, 7.4.2, 7.4.3, 10.2, and 10.3.

When the result of validation shows that the control measures(s) are not capable of achieving the intended control, does the food safety team modify and re-assess?

Does the food safety team maintain the validation methodology and evidence of capability of the control measure(s) to achieve the intended control as documented information?

8.5.4.1 Hazard control plan (HACCP/OPRP plan) (General)

Has the organization established, implemented and maintained a hazard control plan?

Is the hazard control plan maintained as documented information for each control measure at each CCP or OPRP?

Does the control plan include the following information about food safety hazard(s) to be controlled at the CCP or by the OPRP?

Does the control plan include the following information about critical limit(s) at CCP or action criteria for OPRP?

Does the control plan include the following information about monitoring procedure(s)?

Does the control plan include the following information about correction(s) to be made if critical limits or action criteria are not met?

Does the control plan include the following information about responsibilities and authorities?

Does the control plan include the following information about records of monitoring?

8.5.4.2 Hazard control plan (HACCP/OPRP plan) (Determination of Critical Limits and Action Criteria)

Have critical limits at CCPs and action criteria for OPRPs been specified?

Has the rationale for their determination been maintained as documented information?

Are critical limits at CCPs measurable?

Does conformance with critical limits ensure that the acceptable level is not exceeded?

Are action criteria for OPRPs measurable or observable?

Does conformance with action criteria contribute to the assurance that the acceptable level is not exceeded?

8.5.4.3 Hazard control plan (HACCP/OPRP plan) (Monitoring Systems at CCPs and for OPRPs)

At each CCP, has a monitoring system been established for each control measure or combination of control measure(s) to detect any failure to remain within the critical limits?

Does the system include all scheduled measurements relative to the critical limit(s)?

For each OPRP, has a monitoring system been established for the control measure or combination of control measure(s) to detect failure to meet the action criterion?

Does the monitoring system, at each CCP and for each OPRP, consist of documented information?

Does this information include measurements or observations that provide results within an adequate time frame?

Does this information include monitoring methods or devices used?

Does this information include applicable calibration methods or, for OPRPs, equivalent methods for verification of reliable measurements or observations? — See 8.7.

Does this information include monitoring frequency?

Does this information include monitoring results?

Does this information include responsibility and authority related to monitoring?

Does this information include responsibility and authority related to evaluation of monitoring results?

At each CCP, are the monitoring method and frequency capable of timely detection of any failure to remain within critical limits, to allow timely isolation and evaluation of the product? — See 8.9.4.

For each OPRP, are the monitoring method and frequency proportionate to the likelihood of failure and the severity of consequences?

When monitoring an OPRP that is based on subjective data from observations, is the method supported by instructions or specifications? — E.g. visual inspection.

8.5.4.4 Hazard control plan (HACCP/OPRP plan) (Actions when Critical Limits or Action Criteria are not Met)

Has the organization specified corrections and corrective actions to be taken when critical limits or action criterion are not met? — See 8.9.2 and 8.9.3.

Do these corrections and corrective actions ensure that the potentially unsafe products are not released? — See 8.9.4.

Do these corrections and corrective actions ensure that the cause of nonconformity is identified?

Do these corrections and corrective actions ensure that the parameter(s) controlled at the CCP or by the OPRP is (are) returned within the critical limits or action criteria?

Do these corrections and corrective actions ensure that recurrence is prevented?

Does the organization make corrections in accordance with 8.9.2 and corrective actions in accordance with 8.9.3?

8.5.4.5 Hazard control plan (HACCP/OPRP plan) (Implementation of the Hazard Control Plan)

Has the organization implemented and maintained the hazard control plan, and retained evidence of the implementation as documented information?

8.6 Updating the Information Specifying the PRPs and the Hazard Control Plan

Following the establishment of the hazard control plan, has the organization updated information related to characteristics of raw materials, ingredients and product-contact materials?

Following the establishment of the hazard control plan, has the organization updated information related to characteristics of end products?

Following the establishment of the hazard control plan, has the organization updated information related to intended use?

Following the establishment of the hazard control plan, has the organization updated information related to flow diagrams and descriptions of processes and process environment?

Has the organization ensured that the hazard control plan and/or the PRP(s) are up to date?

8.7 Control of Monitoring and Measuring

Has the organization provided evidence that the monitoring and measuring methods and equipment in use are adequate for activities related to the PRP(s) and the hazard control plan?

Is the monitoring and measuring equipment calibrated or verified at specified intervals prior to use?

Is the monitoring and measuring equipment adjusted or re-adjusted as necessary?

Is the monitoring and measuring equipment identified to enable the calibration status to be determined?

Is the monitoring and measuring equipment safeguarded from adjustments that would invalidate the measurement results?

Is the monitoring and measuring equipment protected from damage and deterioration?

Are the results of calibration and verification retained as documented information?

Is the calibration of all the equipment traceable to international or national measurement standards? — Where no standards exist, the basis used for calibration or verification shall be retained as documented information.

Does the organization assess the validity of the previous measurement results when the equipment or process environment is found not to conform to requirements?

Does the organization take appropriate action in relation to the equipment or process environment and any product affected by the non- conformance?

Are the assessment and resulting action maintained as documented information?

Has software used in monitoring and measuring within the FSMS been validated by the organization, software supplier or third party prior to use?

Has documented information on validation activities been maintained by the organization and has the software been updated in a timely manner?

Are changes, including software configuration/modifications to commercial off-the- shelf software, authorized, documented and validated before implementation?

8.8.1 Verification

Has the organization established, implemented and maintained verification activities?

Does the verification planning define purpose, methods, frequencies and responsibilities for the verification activities?

Do the verification activities confirm that the PRP(s) are implemented and effective?

Do the verification activities confirm that the hazard control plan is implemented and effective?

Do the verification activities confirm that hazard levels are within identified acceptable levels?

Do the verification activities confirm that input to the hazard analysis is updated?

Do the verification activities confirm that other actions determined by the organization are implemented and effective?

Does the organization ensure that verification activities are not carried out by the person responsible for monitoring the same activities?

Are verification results retained as documented information and communicated?

Where verification of samples shows nonconformity, does the organization handle the affected lot(s) as potentially unsafe and apply corrective actions in accordance with 8.9.3? — See 8.5.2.2 and 8.9.4.3.

8.8.2 Analysis of Results of Verification Activities

Does the food safety team conduct an analysis of the results of verification that are used as an input to the performance evaluation of the FSMS? — See 9.1.2.

8.9.1 Control of Product and Process Nonconformities (General)

Does the organization ensure that data derived from the monitoring of OPRPs and at CCPs is evaluated by competent designated persons who have the authority to initiate corrections and corrective actions?

8.9.2 Control of Product and Process Nonconformities (Corrections)

Does the organization ensure that when critical limits at CCP(s) or action criteria for OPRPs are not met, the products affected are identified and controlled with regard to their use and release?

Has the organization established, maintained and updated documented information that includes a method of identification, assessment and correction for affected products to ensure proper handling?

Has the organization established, maintained and updated documented information that includes arrangements for review of the corrections carried out?

When critical limits at CCPs are not met, are affected products identified and handled as potentially unsafe products? — See 8.9.4.

Where action criteria for an OPRP are not met, does the organization determine the consequences of that failure with respect to food safety?

Where action criteria for an OPRP are not met, does the organization determine the cause(s) of failure?

Where action criteria for an OPRP are not met, does the organization identify the affected products and handling in accordance with 8.9.4?

Does he organization retain results of the evaluation as documented information?

Is documented information retained to describe corrections made on nonconforming products and processes?

Does this information include the nature of the nonconformity?

Does this information include the cause(s) of the failure?

Does this information include the consequences as a result of the nonconformity?

8.9.3 Corrective Actions

Is the need for corrective actions evaluated when critical limits at CCP(s) and/or action criteria for OPRPs are not met.?

Has the organization established and maintained documentation that specifies appropriate actions to identify and eliminate the cause of nonconformities, to prevent recurrence, and to return the process to control?

Do these actions include reviewing nonconformities identified by customer and/or consumer complaints and/or regulatory inspection reports?

Do these actions include reviewing trends in monitoring results that can indicate loss of control?

Do these actions include determining the cause(s) of nonconformities?

Do these actions include determining and implementing actions to ensure that nonconformities do not recur?

Do these actions include documenting the results of corrective actions taken?

Do these actions include verifying corrective actions taken to ensure that they are effective?

Does the organization retain documented information on all corrective actions?

8.9.4.1 Handling of Potentially Unsafe Products (General)

Does the organization prevent potentially unsafe products from entering the food chain, unless it can demonstrate that the hazard is reduced to the defined acceptable levels?

Does the organization prevent potentially unsafe products from entering the food chain, unless it can demonstrate that the hazard will be reduced to acceptable levels prior to entering?

Does the organization prevent potentially unsafe products from entering the food chain, unless it can demonstrate that the product still meets the defined acceptable level despite the nonconformity?

Does The organization retain products that have been identified as potentially unsafe under its control until the products have been evaluated and the disposition has been determined?

If products that have left the control of the organization are subsequently determined to be unsafe, does the organization notify relevant interested parties and initiate a withdrawal/recall? — See 8.9.5.

Are the controls and related responses from relevant interested parties and authorization for dealing with potentially unsafe products retained as documented information?

8.9.4.2 Handling of Potentially Unsafe Products (Evaluation for Release)

Is aach lot of products affected by the nonconformity evaluated?

Are products affected by failure to remain within critical limits at CCPs handled in accordance with 8.9.4.3 rather than being released?

Are products affected by failure to meet action criteria for OPRPs only released as safe when any of the following conditions apply? — - Evidence other than the monitoring system demonstrates that the control measures have been effective; - Evidence shows that the combined effect of the control measures for that particular product conforms to the performance intended (i.e. identified acceptable levels); - The results of sampling, analysis and/or other verification activities demonstrate that the affected products conform to the identified acceptable levels for the food safety hazard(s) concerned.

Are results of evaluation for release of products retained as documented information?

8.9.4.3 Handling of Potentially Unsafe Products (Disposition of Nonconforming Products)

Are products that are not acceptable for release reprocessed or further processed within or outside the organization to ensure that the food safety hazard is reduced to acceptable levels?

Are products that are not acceptable for release redirected for other use as long as food safety in the food chain is not affected?

Are products that are not acceptable for release destroyed and/or disposed as waste?

Is documented information on the disposition of nonconforming products, including the identification of the person(s) with approving authority retained?

8.9.5 Withdrawal/Recall

Is the organization able to ensure the timely withdrawal/recall of products that have been identified as potentially unsafe, by appointing competent person(s) with the required authority?

Has the organization established and maintained documented information for notifying relevant interested parties? — E.g. statutory and regulatory authorities, customers and/or consumers.

Has the organization established and maintained documented information for handling withdrawn/recalled products as well as products still in stock?

Has the organization established and maintained documented information for performing the sequence of actions to be taken?

Are withdrawn/recalled products and end products still in stock secured or held under the control of the organization until they are managed in accordance with 8.9.4.3?

Are the cause, extent and result of a withdrawal/recall retained as documented information and reported to the top management as input for the management review? — See 9.3.

Does the organization verify the implementation and effectiveness of withdrawals/recalls through the use of appropriate techniques and retain documented information? — E.g. mock withdrawal/recall or practice withdrawal/recall.

Clause 9

9.1.1 Monitoring, Measurement, Analysis and Evaluation (General)

Has the organization determined what needs to be monitored and measured?

Has the organization determined the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results?

Has the organization determined when the monitoring and measuring shall be performed?

Has the organization determined when the results from monitoring and measurement shall be analysed and evaluated?

Has the organization determined who shall analyse and evaluate the results from monitoring and measurement?

Does the organization retain appropriate documented information as evidence of the results?

Does the organization evaluate the performance and the effectiveness of the FSMS?

9.1.2 Monitoring, Measurement, Analysis and Evaluation (Analysis and Evaluation)

Does the organization analyse and evaluate appropriate data and information arising from monitoring and measurement? — Including the results of verification activities related to PRPs and the hazard control plan (see 8.8 and 8.5.4), the internal audits (see 9.2) and external audits.

Is analysis carried out to confirm that the overall performance of the system meets the planned arrangements and the FSMS requirements established by the organization?

Is analysis carried out to identify the need for updating or improving the FSMS?

Is analysis carried out to identify trends which indicate a higher incidence of potentially unsafe products or process failures?

Is analysis carried out to establish information for planning of the internal audit programme related to the status and importance of areas to be audited?

Is analysis carried out to provide evidence that corrections and corrective actions are effective?

Are the results of the analysis and the resulting activities retained as documented information?

Are the results reported to top management and used as input to the management review and the updating of the FSMS? — See 9.3 and 10.3.

9.2 Internal Audit

Does the organization conduct internal audits at planned intervals to provide information on whether the FSMS conforms to the organization’s own requirements for its FSMS?

Does the organization conduct internal audits at planned intervals to provide information on whether the FSMS conforms to the requirements of ISO 22000?

Does the organization conduct internal audits at planned intervals to provide information on whether the FSMS is effectively implemented and maintained?

Has the organization planed, established, implemented and maintained an audit programme which considers the the processes, FSMS changes, and results of monitoring, measurement and previous audits? — Including the frequency, methods, responsibilities, planning requirements and reporting.

Does the organization define the audit criteria and scope for each audit?

Does the organization select competent auditors and conduct audits to ensure objectivity and the impartiality of the audit process?

Does the organization ensure that the results of the audits are reported to the food safety team and relevant management?

Does the organization retain documented information as evidence of the implementation of the audit programme and the audit results?

Does the organization make the necessary corrections and take the necessary corrective actions within the agreed time frame?

Has the organization determined if the FSMS meets the intent of the food safety policy and objectives of the FSMS? — See 5.2 and 6.2.

Do follow-up activities by the organization include the verification of the actions taken and the reporting of the verification results?

9.3.1 General Management Review

Does top management review the organization’s FSMS, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness?

9.3.2 Management Review Input

Does the management review consider the status of actions from previous management reviews?

Does the management review consider changes in external and internal issues that are relevant to the FSMS, including changes in the organization and its context? — See 4.1.

Does the management review consider information on the performance and the effectiveness of the FSMS? — This includes the following: - Result(s) of system updating activities (see 4.4 and 10.3); - Monitoring and measurement results; - Analysis of the results of verification activities related to PRPs and the hazard control plan (see 8.8.2); - Nonconformities and corrective actions; - Audit results (internal and external); - Inspections (e.g. regulatory, customer); - The performance of external providers; - The review of risks and opportunities and of the effectiveness of actions taken to address them (see 6.1); - The extent to which objectives of the FSMS have been met.

Does the management review consider the adequacy of resources?

Does the management review consider any emergency situation, incident or withdrawal/recall that occurred? — See 8.9.5 and 8.4.2.

Does the management review consider relevant information obtained through external and internal communication, including requests and complaints from interested parties? — See 7.4.2 and 7.4.3.

Does the management review consider opportunities for continual improvement?

Is the data presented in a manner that enables top management to relate the information to stated objectives of the FSMS?

9.3.3 Management Review Output

Do the outputs of the management review include decisions and actions related to continual improvement opportunities?

Do the outputs of the management review include any need for updates and changes to the FSMS, including resource needs and revision of the food safety policy and objectives of the FSMS?

Does the organization retain documented information as evidence of the results of management reviews?

Clause 10

10.1 Nonconformity and Corrective Action

When a nonconformity occurs, does the organization react to the nonconformity and, as applicable take action to control and correct it?

When a nonconformity occurs, does the organization react to the nonconformity and, as applicable deal with the consequences?

When a nonconformity occurs, does the organization evaluate the need for action to eliminate the cause(s) of the nonconformity, in order that it does not recur or occur elsewhere? — This should be done by: - reviewing the nonconformity; - determining the causes of the nonconformity - determining if similar nonconformities exist, or could potentially occur

When a nonconformity occurs, does the organization implement any action needed?

When a nonconformity occurs, does the organization review the effectiveness of any corrective action taken?

When a nonconformity occurs, does the organization make any necessary changes to the FSMS?

Are corrective actions appropriate to the effects of the nonconformities encountered?

Does the organization retain documented information as evidence of the nature of the nonconformities and any subsequent actions taken?

Does the organization retain documented information as evidence of the results of any corrective action?

10.2 Continual Improvement

Does the organization continually improve the suitability, adequacy and effectiveness of the FSMS?

Does top management ensure that the organization continually improves the effectiveness of the FSMS?
— This should be done through the use of communication (see 7.4), management review (see 9.3), internal audit (see 9.2), analysis of results of verification activities (see 8.8.2), validation of control measure(s) and combination(s) of control measure(s) (see 8.5.3), corrective actions (see 8.9.3) and FSMS updating (see 10.3).

10.3 Update of the food safety management system

Does top management ensure that the FSMS is continually updated?

Does the food safety team evaluate the FSMS at planned intervals?

Does the team consider whether it is necessary to review the hazard analysis, established hazard control plan and established PRPs? — See 8.5.2, 8.5.4, and 8.2.

Are updating activities based on the following? — - Input from communication, external as well as internal (see 7.4); - Input from other information concerning the suitability, adequacy and effectiveness of the FSMS; - Output from the analysis of results of verification activities (see 9.1.2); - Output from management review (see 9.3)

Are system updating activities retained as documented information and reported as input to the management review? — See 9.3.

Completion

Recommendations

Auditor (Full Name and Signature)