What You Are Actually Being Assessed Against
Before you can prepare effectively, you need to understand what ISO 22000:2018 actually requires and how a certification auditor will approach your system. ISO 22000 is a food safety management system standard that combines the structure of the High Level Structure used across modern ISO standards with two food safety specific concepts: prerequisite programmes (PRPs) and a hazard analysis and critical control point (HACCP) based system.
On this page
The auditor is not there to assess whether your food is safe. They are there to assess whether your management system is capable of consistently identifying and controlling food safety hazards. That distinction matters. A well run kitchen or production line is not the same as a well designed food safety management system. You need both, and the auditor will be looking for evidence of the system, not just the practice.
If you are new to ISO 22000, take the time to read our article on what ISO 22000 is and who needs it before diving into audit preparation. It will give you the conceptual foundation you need before working through the clause requirements.
The Two Stage Audit Process: What Happens and When
Stage 1: The Document Review
Your certification audit will run across two stages. Stage 1 is primarily a document review, though most certification bodies will conduct it on site. The auditor is checking whether your documented food safety management system is sufficiently developed to proceed to Stage 2. They are not yet verifying implementation in depth, but they are reading your food safety policy, your HACCP plan, your PRP documentation, your scope, and your key procedures.
Common Stage 1 findings include scope that does not match actual operations, a hazard analysis that has not been completed or reviewed, PRPs that have been listed but not documented in any meaningful way, and a food safety team that exists on paper but has not actually met. If you receive a Stage 1 finding, treat it seriously. It is a signal that something foundational is missing, and the Stage 2 auditor will go looking for it.
Stage 2: The Implementation Audit
Stage 2 is where the auditor verifies that what your documents say is actually happening. They will interview your food safety team leader, your production supervisors, your cleaning staff, your goods receiving personnel. They will walk your facility. They will pull records. They will trace a product from raw material receipt through to finished goods release. They will check your monitoring records against your critical limits. They will look at your corrective action records to see how you handled deviations.
For a more detailed breakdown of what happens across both stages, see our guide on what happens at Stage 1 and Stage 2 of a certification audit. The mechanics are the same across standards, even though the content differs.
Exemplar Global Certified Training ProviderRTP No. 310970
Getting Your HACCP Documentation Right
The hazard analysis is the technical heart of ISO 22000. It is also the area where most first time certification candidates are caught underprepared. The standard requires you to identify all food safety hazards that are reasonably expected to occur in relation to the type of product, the type of process, and the process flow. That means biological, chemical, physical, and radiological hazards need to be considered systematically.
Your hazard analysis needs to show how each hazard was evaluated, what the severity and likelihood of occurrence are, and what control measures are in place. Auditors will look for a clear, documented rationale. Vague statements like “hazard controlled by GMP” without any reference to a specific PRP or operational PRP will attract questions at best and nonconformities at worst.
Critical Control Points and Operational PRPs
One of the things that trips up first time ISO 22000 candidates is the distinction between critical control points (CCPs) and operational PRPs (OPRPs). CCPs are process steps where a critical limit can be measured and monitored in real time, and where failure to control the hazard would result in an unacceptable product reaching the consumer. OPRPs are control measures that manage significant hazards but do not meet the specific criteria for a CCP.
Your auditor will check that you have applied a decision tool or equivalent systematic approach to determine whether each significant hazard is managed by a CCP or an OPRP. They will then check that your monitoring frequency, corrective action procedures, and verification activities are appropriate to the classification. A CCP with a monitoring frequency of “monthly” will raise immediate questions. A metal detection CCP should be monitored at every production run, and the records need to show that.
Prerequisite Programmes: More Than a Cleaning Schedule
Many organisations underestimate the depth of documentation and implementation required for PRPs under ISO 22000. The standard references ISO/TS 22002 series for sector specific PRP requirements, and an auditor familiar with food safety will know what those requirements look like in practice.
Your PRPs need to cover areas including infrastructure and equipment maintenance, cleaning and disinfection, pest control, personal hygiene, cross contamination prevention, allergen management, traceability, and supplier management. Each PRP needs to be documented, assigned to a responsible person, monitored, and reviewed. If your PRP documentation is a generic template you downloaded and never adapted to your site, the auditor will find out within the first hour of the Stage 2 audit.
Allergen Management Deserves Special Attention
Allergen management is an area where auditors spend significant time, particularly in Australian food businesses where regulatory requirements under the Food Standards Code are well established. Your allergen management PRP needs to address ingredient assessment, production scheduling to minimise cross contact, cleaning validation between allergen containing and allergen free runs, and labelling verification.
Be prepared to show the auditor your allergen matrix, your cleaning validation records, and how you handle a change to an ingredient that introduces a new allergen. If you cannot trace that process through your documented system, you have a gap.
Traceability and Product Withdrawal
ISO 22000 clause 8.3 requires a traceability system that can identify product lots and their relationship to raw materials, processing records, and delivery records. Clause 8.9 requires a documented withdrawal and recall procedure.
Auditors routinely conduct a traceability exercise during Stage 2. They will give you a finished product lot number and ask you to trace it back to the raw material lot, or they will give you a raw material lot and ask you to trace it forward to the finished product and its distribution records. You need to be able to complete this exercise within a reasonable time frame, and the records need to be retrievable without significant difficulty.
Your withdrawal procedure also needs to be tested. A procedure that has never been trialled is a risk. Run a mock recall before your certification audit. Document it. Show the auditor the records from the exercise, including what you found, how long it took, and any improvements you made as a result.
Management Commitment: What the Auditor Is Looking For
ISO 22000 clause 5.1 requires top management to demonstrate leadership and commitment to the food safety management system. This is not a box ticking exercise, and experienced auditors will push past the documented food safety policy to test whether management is genuinely engaged.
Expect the auditor to ask your General Manager or Operations Manager direct questions about the food safety policy, the objectives, the results of recent internal audits, and what actions have been taken in response to management review outputs. If the senior person in the room cannot answer those questions without being prompted by the food safety team leader, the auditor will note it.
Make sure your management review records are current and complete. The review inputs required by clause 9.3 include the results of internal audits, customer feedback, process performance, nonconformities and corrective actions, and the results of verification activities. A management review that consists of a five minute discussion with no documented outputs will not satisfy the standard.
Internal Audit: You Need to Have Done One
Before your Stage 2 certification audit, you must have completed at least one full internal audit of your food safety management system. This is not optional. The auditor will ask to see your internal audit programme, your completed audit checklists or reports, and the corrective actions raised as a result.
The internal audit needs to have been conducted by someone who is competent to audit against ISO 22000 and who did not audit their own work. If you do not have an internal auditor with food safety management system knowledge, you need to either train someone or engage an external resource to conduct the audit on your behalf.
Running effective food safety internal audits requires a specific approach. Our guide on running effective food safety internal audits walks through the process in practical terms.
Common Nonconformities in First Time ISO 22000 Audits
Based on experience across multiple food safety certification audits, the following are the areas where first time candidates most commonly receive nonconformities.
- Hazard analysis not covering all process steps: The flow diagram is incomplete or the hazard analysis does not address all steps shown on the diagram.
- Critical limits not scientifically validated: Temperature limits or time limits are stated without reference to a validation source such as a scientific study, regulatory guideline, or challenge testing result.
- Monitoring records incomplete or inconsistent: CCP monitoring records have gaps, unsigned entries, or corrections that have not been initialled and explained.
- Corrective action records for deviations are missing: When a critical limit was exceeded, there is no documented corrective action showing what happened to the affected product and what was done to restore control.
- PRPs not verified: There is no evidence that PRPs have been assessed for effectiveness, such as environmental swabbing results, pest activity records, or equipment inspection records.
- Food safety objectives not measurable: Objectives such as “maintain food safety” do not meet the requirement for measurable targets with defined timeframes.
- Competence records incomplete: Staff who perform CCP monitoring tasks cannot demonstrate that their competence has been assessed and documented.
Practical Steps to Take in the Month Before Your Audit
With four weeks to go, here is where to focus your energy.
- Complete your internal audit and close out findings. The certification auditor will check whether corrective actions from your internal audit have been implemented effectively. Unresolved findings from your own audit are a red flag.
- Run a mock traceability exercise. Pick a finished product lot and trace it back. Time yourself. Identify any gaps in your records.
- Review your CCP monitoring records for the past three months. Look for gaps, unexplained corrections, and deviations that were not followed up with a corrective action record.
- Check that your hazard analysis has been reviewed and signed off. It should be dated, approved by the food safety team, and reflect your current processes. If you have made any process changes since the last review, update it now.
- Brief your team. Every person the auditor might speak to should know what the food safety policy says, what their role is in the FSMS, and where to find the documents relevant to their work. They do not need to memorise clauses. They need to understand their job in the context of food safety.
- Prepare your management review records. If your last management review was more than twelve months ago, schedule one before the audit. Make sure the outputs are documented and that actions have been assigned and followed up.
- Check your documented information is controlled. Obsolete versions of procedures and forms should not be in use on the production floor. Version numbers, approval signatures, and review dates need to be current.
For a broader look at how to prepare your team for the audit day itself, see our article on how to prepare for a certification audit as the quality manager. Much of that advice applies directly to food safety certification as well.
Exemplar Global Certified Training ProviderRTP No. 310970On the Day: How to Conduct Yourself
The opening meeting sets the tone. Have a senior manager present. Be ready to confirm the scope, the audit agenda, and the logistics. Do not over explain your system in the opening meeting. Let the auditor work.
During the audit, answer questions directly and honestly. If you do not know the answer, say so and offer to find out. Do not guess, and do not volunteer information that might open areas the auditor has not planned to visit. If you disagree with an auditor's interpretation of a clause, you have the right to discuss it professionally. Ask them to point you to the specific clause requirement and explain their reasoning.
Keep a note of any findings raised during the audit so you can prepare your corrective action responses promptly after the closing meeting. Major nonconformities will need to be closed before certification is granted. Minor nonconformities and observations will need to be addressed within the timeframe agreed with the certification body.
Building Your Food Safety Auditing Capability
If you are the food safety manager or quality manager responsible for this certification, the experience of going through your first ISO 22000 audit will teach you a great deal. But you will get more out of it if you understand the auditor's perspective before you walk into the room.
Audit Workshop delivers training for ISO 22000 internal auditors and lead auditors, covering the hazard analysis process, HACCP principles, PRP requirements, and how to audit a food safety management system effectively. Whether you are preparing your organisation for certification or building your own auditing credentials in the food safety space, structured training will sharpen your preparation and give you a clearer picture of what the auditor is actually looking for.
