If you are working in food manufacturing, processing, catering, or distribution and you are trying to get your head around ISO 22000, the clause structure is the best place to start. Understanding ISO 22000 clause structure tells you not just what the standard requires, but how those requirements connect to the actual work happening in your facility. This article walks through each section of the standard in plain language, explains what it means in practice, and highlights where food businesses typically struggle when auditors come knocking.
On this page
Why ISO 22000 Uses the Harmonised Structure
ISO 22000:2018 follows the same Harmonised Structure used by ISO 9001, ISO 14001, ISO 45001, and most other modern ISO management system standards. That means Clauses 1 through 10 follow a familiar pattern: context, leadership, planning, support, operation, performance evaluation, and improvement.
The reason this matters for food businesses is that if you already hold ISO 9001 certification, you will recognise the framework immediately. The structure is not new. What is new is the food safety specific content sitting inside that structure, particularly the operational clauses in Clause 8, which is where ISO 22000 does its most distinctive work.
For a broader comparison of how ISO 22000 fits alongside other food safety schemes, the article on FSSC 22000 vs ISO 22000 is worth reading before you dive into the clause detail.
Exemplar Global Recognised Training ProviderRTP No. 310970
Clauses 1 to 3: Scope, References and Definitions
These opening clauses are not auditable in the traditional sense, but they set the boundaries for everything that follows.
Clause 1: Scope
ISO 22000 applies to any organisation in the food chain, regardless of size or complexity. That includes primary producers, food manufacturers, transport and storage operators, caterers, retailers, and even producers of food contact materials and packaging. The scope is deliberately broad because food safety hazards can enter the chain at any point.
Clause 2 and 3: References and Terms
Clause 2 references ISO 22000:2018 alongside ISO/TS 22004 for guidance. Clause 3 contains the terms and definitions. Pay attention to how the standard defines terms like food safety hazard, prerequisite programme, critical control point, and food safety team. These definitions shape how you interpret the requirements throughout the rest of the standard.
Clause 4: Context of the Organisation
This clause asks you to think carefully about where your organisation sits in the food chain and who has a stake in your food safety outcomes.
Clause 4.1: Understanding the Organisation and Its Context
You need to identify the internal and external factors that affect your ability to produce safe food. For a ready meal manufacturer, that might include raw material supplier reliability, cold chain infrastructure, regulatory requirements in export markets, and seasonal variation in ingredient quality. These factors should be documented and reviewed regularly, not just listed once and forgotten.
Clause 4.2: Understanding the Needs and Expectations of Interested Parties
Interested parties in a food context include customers, regulators, industry bodies, consumers, and in some cases community groups. You need to identify what each group expects and which of those expectations become requirements your food safety management system must address. Retail customers specifying allergen management requirements is a common example.
Clause 4.3: Determining the Scope of the FSMS
Your scope statement must clearly define which products, processes, and locations are covered by the food safety management system. Auditors will check that the scope is realistic and that it does not exclude processes that clearly affect food safety. A scope that says manufacturing of chilled meat products but excludes the receiving dock where cross contamination risks begin will raise questions.
Clause 4.4: The Food Safety Management System
This clause requires you to establish, implement, maintain, and continually improve the FSMS. It is a commitment clause. The system must be documented and the processes must be determined, not just described in a manual that nobody reads.
Clause 5: Leadership
Leadership requirements in ISO 22000 are consistent with other ISO standards but include food safety specific expectations that go beyond a signed policy.
Clause 5.1: Leadership and Commitment
Top management must demonstrate genuine commitment to the food safety management system. In practice, auditors will look for evidence that leaders allocate resources for food safety, that they participate in management reviews, and that they respond when the system raises concerns. A quality manager who cannot get budget approved for temperature monitoring equipment is a sign that top management commitment is more symbolic than real.
Clause 5.2: Food Safety Policy
The food safety policy must be appropriate to the organisation, must include a commitment to meeting applicable requirements, and must provide a framework for setting food safety objectives. It needs to be communicated, understood, and applied throughout the organisation, including by workers on the production floor who may never read the policy document itself.
Clause 5.3: Organisational Roles, Responsibilities and Authorities
ISO 22000 specifically requires the appointment of a food safety team leader. This person is responsible for organising, managing, and maintaining the food safety team. They must have the knowledge and authority to manage the hazard analysis and HACCP plan. This is a named role with specific responsibilities, not just a title on an org chart.
Clause 6: Planning
Planning in ISO 22000 covers how the organisation addresses risks and opportunities and sets food safety objectives.
Clause 6.1: Actions to Address Risks and Opportunities
You need to consider the risks and opportunities arising from your context and interested party analysis. For a food business, this might mean planning for supplier failure, seasonal ingredient variability, or changes to food safety legislation. Actions taken must be proportionate to the potential impact on food safety.
Clause 6.2: Objectives of the Food Safety Management System
Food safety objectives must be measurable, monitored, and communicated. They need to be consistent with the food safety policy and reflect the actual hazards present in your operation. Objectives like zero confirmed food safety incidents from our facility in the next 12 months or 100 per cent completion of prerequisite programme verification activities each quarter are the kind of measurable targets auditors expect to see.
Clause 7: Support
This clause covers the resources, competence, awareness, communication, and documented information requirements that underpin the system.
Clause 7.1: Resources
Resources include people, infrastructure, and the work environment. For food businesses, the work environment clause has particular relevance. Temperature control, humidity, lighting, and pest management are all part of the environment needed to produce safe food. These are not just facilities issues; they are food safety management system requirements.
Clause 7.2: Competence
Everyone whose work affects food safety must be competent. Competence is demonstrated through education, training, and experience. Auditors will look for training records, but they will also test competence by asking workers questions. A worker who cannot explain why they follow a particular hygiene procedure, or who does not know what to do if a temperature excursion occurs, is evidence of a competence gap regardless of what the training register says.
Clause 7.3: Awareness
Workers must be aware of the food safety policy, the food safety objectives relevant to their role, their contribution to the effectiveness of the system, and the consequences of not following food safety requirements. Awareness is not achieved by a single induction session. It requires ongoing reinforcement.
Clause 7.4: Communication
ISO 22000 distinguishes between external and internal communication. External communication must ensure that food safety information flows between your organisation and your customers, suppliers, regulators, and other relevant parties. Internal communication must ensure that changes affecting food safety are communicated to the food safety team before they are implemented. That last point catches many organisations out. A new ingredient supplier, a process change, or a new piece of equipment should trigger a food safety team review before the change goes live.
Clause 7.5: Documented Information
You must maintain documented information required by the standard and retain records demonstrating that the system is operating effectively. In food safety terms, this includes hazard analysis records, HACCP plans, monitoring records, corrective action records, and verification results. Document control in food businesses must also account for version management of specifications, allergen declarations, and product formulations.
Clause 8: Operation
This is where ISO 22000 becomes distinctly different from other ISO management system standards. Clause 8 contains the food safety specific operational requirements including prerequisite programmes, hazard analysis, and the HACCP plan.
Clause 8.1: Operational Planning and Control
You must plan, implement, control, maintain, and update the processes needed to meet food safety requirements. This includes determining the criteria for processes and products, and implementing controls in accordance with those criteria.
Clause 8.2: Prerequisite Programmes (PRPs)
Prerequisite programmes are the basic conditions and activities necessary to maintain a hygienic environment throughout the food chain. They include cleaning and sanitation, pest control, personal hygiene, supplier management, and cross contamination prevention. PRPs are not the same as CCPs. They control general hygiene conditions rather than specific identified hazards.
For a detailed explanation of how PRPs and CCPs differ and interact, the article on PRPs and CCPs explained covers the distinction thoroughly.
Clause 8.3: Traceability System
The traceability system must be able to identify material inputs related to the product and the route of the product through processing. In practice, this means being able to trace a finished product back to its raw material batches and forward to its distribution destinations. Auditors will test this with a traceability exercise, asking you to trace a product in both directions within a defined timeframe.
Clause 8.4: Emergency Preparedness and Response
You must be prepared to respond to potential emergency situations or incidents with impact on food safety. This includes product recalls and withdrawals. Your emergency response procedures must be documented, tested, and reviewed after any actual emergency or exercise.
Clause 8.5: Hazard Analysis
This is the technical heart of ISO 22000. The hazard analysis process requires you to identify all food safety hazards reasonably expected to occur in relation to your products and processes, evaluate their significance based on severity and likelihood, and determine appropriate control measures. The food safety team must have the technical knowledge to conduct this analysis properly. A hazard analysis completed by a single person without food safety expertise is a common finding.
The article on the hazard analysis process in ISO 22000 provides a step by step walkthrough of how this analysis should be conducted.
Clause 8.6: Hazard Control Plan (HACCP Plan)
Based on the hazard analysis, you must establish a hazard control plan. This is the document that identifies your CCPs and operational PRPs, the critical limits or action criteria for each, the monitoring procedures, the corrective actions when limits are exceeded, and the verification activities. Critical limits must be measurable. A critical limit of cook to a safe temperature is not acceptable. A critical limit of internal product temperature of 75 degrees Celsius for a minimum of 15 seconds is what the standard expects.
Clause 8.7 to 8.9: Monitoring, Corrective Actions and Control of Nonconformities
These clauses cover what happens when monitoring shows that a critical limit has been exceeded or an action criterion has not been met. You must have documented procedures for handling potentially unsafe products, deciding on their disposition, and investigating the cause of the failure. Corrective actions must address root causes, not just symptoms.
Clause 9: Performance Evaluation
Performance evaluation in ISO 22000 includes monitoring, measurement, analysis, internal audits, and management review.
Clause 9.1: Monitoring, Measurement, Analysis and Evaluation
You must determine what needs to be monitored, the methods to be used, when monitoring occurs, and when results will be analysed. Verification activities, which confirm that the overall system is working, are a specific requirement under this clause. Verification is different from monitoring. Monitoring checks that a control measure is operating within its limits. Verification checks that the control measure is actually effective at controlling the hazard.
Clause 9.2: Internal Audit
Internal audits must be conducted at planned intervals to determine whether the FSMS conforms to requirements and is effectively implemented and maintained. Food safety internal audits require auditors with knowledge of food safety principles, not just ISO auditing technique. An internal auditor who does not understand HACCP will struggle to audit the hazard control plan effectively.
Clause 9.3: Management Review
Management review must cover a defined set of inputs including audit results, customer feedback, performance against food safety objectives, and the results of verification activities. Outputs must include decisions about improvement opportunities and any changes needed to the FSMS. Management review records must demonstrate that the review was substantive, not just a rubber stamp.
Clause 10: Improvement
Clause 10 covers nonconformity and corrective action, continual improvement, and the update of the food safety management system.
Clause 10.1: Nonconformity and Corrective Action
When a nonconformity occurs, you must react to it, evaluate the need for corrective action, implement corrective action where needed, and review the effectiveness of that action. The corrective action process must address root causes. Finding that a temperature log was not completed and responding by telling the worker to complete it is not a corrective action. Understanding why the log was not completed and fixing the underlying cause is.
Clause 10.2: Continual Improvement
You must continually improve the suitability, adequacy, and effectiveness of the FSMS. This includes updating the system when new hazards are identified, when processes change, or when verification results indicate that current controls are not sufficient.
Clause 10.3: Update of the Food Safety Management System
ISO 22000 includes a specific requirement to update the FSMS at defined intervals. This means the food safety team must periodically review the hazard analysis, the PRPs, and the hazard control plan to ensure they reflect current products, processes, ingredients, and knowledge. This update requirement is often missed by organisations that implement the system and then treat it as a static document.
Exemplar Global Recognised Training ProviderRTP No. 310970How Auditors Navigate the Clause Structure
When an auditor conducts an ISO 22000 certification audit, they will not necessarily follow the clauses in numerical order. They are more likely to follow the food safety system as a process, starting with how hazards are identified and controlled, then checking that the supporting elements of the system are in place.
That means an auditor might start with Clause 8.5 hazard analysis, trace the identified hazards through to the hazard control plan in Clause 8.6, check the monitoring records, then examine the corrective action records, before stepping back to verify that the food safety team has the competence required under Clause 7.2 and that management is providing the resources required under Clause 5.1.
Understanding the clause structure helps you prepare for this kind of process based audit. It also helps you conduct your own internal audits more effectively, because you can see how the clauses connect rather than treating them as a checklist of isolated requirements.
If you are preparing for an ISO 22000 certification audit, the article on preparing for your first ISO 22000 certification audit gives practical guidance on what to have ready before the auditor arrives.
Building Your Knowledge as a Food Safety Auditor
Auditing a food safety management system requires a combination of ISO auditing skills and food safety technical knowledge. The clause structure gives you the framework, but you also need to understand HACCP principles, food microbiology basics, allergen management, and the role of PRPs before you can audit effectively.
At Audit Workshop, our ISO 22000 training covers both the standard requirements and the practical auditing skills needed to assess a food safety management system with confidence. Whether you are a quality manager preparing your organisation for certification, an internal auditor building your food safety knowledge, or an experienced auditor looking to add ISO 22000 to your scope, our courses are built around real audit practice, not just theory.
