ISO 22000: The Times…They Are A-Changing*

Changes to several International Organization for Standardization (ISO) standards were initiated at the Fifth Plenary Meeting of ISO Subcommittee 17 in Copenhagen, Denmark, during the week of September 14, 2014. Subcommittee 17 is part of Technical Committee 34 – Food products.

A working group started the development of a standard to describe the prerequisite programs for animal foods and feeds. This working group is using PAS 222 – Prerequisite programs on food safety for manufacturing food and feed for animals. This new standard will be used with ISO 22000 for certification of those sites that manufacture animal foods and feed.

In addition, a working group began the revision of ISO 22000. Table 1 presents an outline of PAS 222, which can be downloaded for free from shop.bsigroup.com/en/forms/PASs/PAS-222/.

Annex SL and Its Impact on ISO 22000
What is the ISO standard known as Annex SL?[1] Or a more important question: How will Annex SL affect my FSSC 22000 certification? Back in 2012, ISO issued a new standard, ISO/IEC Directives, Part 1, Consolidated ISO Supplement – Procedures specific to ISO. One small part (20 out of 178 pages) is known as Annex SL – Proposals for management system standards. The small part of the standard may have some big implications for sites using ISO standards.

Changes to FSSC 22000 Certification

The Foundation for Food Safety Certification manages the Global Food Safety Initiative audit scheme (FSSC 22000) that is based on ISO 22000. This year, the Foundation announced major changes to the FSSC 22000 certification scheme.

The Foundation announced two expansions in the scope of FSSC 22000.

The first change expands the certification scope to include animal feed. Animal feed manufacturing sites that desire FSSC 22000 certification will use the requirements of PAS 222 to define the prerequisite programs for their food safety management system.

In October 2014, the Foundation added an optional module that would allow a site to have a joint certification of both the food safety management system and the quality management system. The quality module is based on ISO 9001 – Quality management system requirements.

The focus of ISO 22000 is food safety, whereas the focus of ISO 9001 is customer requirements. Thus, ISO 9001 provides a management system to ensure that customers and consumers get consistent, quality products that meet their requirements. In addition, ISO 9001 has requirements that address product design and development.

In Annex SL, ISO has mandated that all ISO management standards have the same basic structure. In this way, Annex SL provides a consistent, high-level structure for all management systems. The International Register of Certified Auditors states: “All ISO management standards should have the same look and feel.”[2] The goal is to have better development and integration of all management systems (see “Changes to FSSC 22000 Certification”).

Some food processing sites have integrated several management systems into a single management system. For example, the site may be using ISO 9001 to define the quality management system, ISO 14001 to define the environmental management system requirements and FSSC 22000 or ISO 22000 to define the food safety management system requirements.

Thus, the goal of Annex SL is to minimize conflicts, duplication, confusion and misunderstanding when a site uses several ISO management system standards to develop an integrated management system. This will be accomplished by having all the ISO management system standards use identical requirements whenever possible. This will be accomplished by revising current ISO standards to include the following:

•   Emphasis on risk

•   Greater alignment of policies with business needs

•   Assurance of greater value for the customer

•   More applicability to service organizations

•   Definition of boundaries of the management system

•   Increases in leadership (management) requirements

•   Assurance that internal audits consider risks in the audit scope

ISO 22000 was originally developed as a risk management standard based on Hazard Analysis and Critical Control Points (HACCP). Many of the proposed changes in Annex SL have already been previously addressed in the standard. A previous article by Surak and Gonzalez[3] addressed some of the issues of risk in a food safety management system.

Table 2 provides the core requirements or high-level requirements for a food safety management system.

ISO Subcommittee 17, Working Group 8, which is responsible for the revision of ISO 22000, is using Annex SL to define the high-level structure for ISO 22000. It is expected that the working group will add the additional sector-specific requirements to ensure that the standard properly describes the requirements for a food safety management system.

Changes that are in Annex SL include:

•   Documented information. This is a name change. As part of this change, documented information will include both procedures and records.

•   A description of the context of the organization. This contains several new requirements.

•   Training. While not mandated, there are added requirements for competencies and awareness.

•   No mandated procedures. It is not known what mandated procedures will be included in the revised ISO 22000 standard.

•   Integration of strategic planning with the business. This has been part of the ISO 22000:2005 requirements. Element 5.1a states that food safety is supported by business objectives of the organization.

•   Risk-based management system. This is part of ISO 22000:2005. ISO 22000 is based on using HACCP, which is a risk management system.

•   Top management is accountable for the effectiveness of the management system. This has been partially addressed in Element 5.1 of ISO 22000. The standard states, “Top management shall provide evidence of its commitment to the development and implementation of the food safety management system and to continually improving its effectiveness.”

•   The standard will use the term leadership rather than management responsibilities. This is a name change.

•   No preventive action. ISO 22000:2005 does not have a requirement for preventive action. The working group stated the HACCP process is a preventive action system.

•   No management system manual. ISO 2200:2005 does not have a requirement for a food safety manual.

•   Management representative. ISO 22000:2005 has a requirement for a food safety team leader. It is expected that this requirement will not be eliminated.

•   No numbering requirement. A site can use any numbering system for the food safety management system.

•   Plan, do, check, act. The ISO 22000:2016 structure will be based on the plan, do, check, act cycle and the process approach to developing the food safety management system. This is not new because ISO 22000:2005 already incorporates these concepts.

Some of the new elements in Annex SL that will be addressed in a food safety management system include the following:

•   Element 4.1. Understanding the organization and its context. This element requires the site to determine both internal and external issues that are relevant and affect the ability of the organization to achieve outcomes of its food safety management system. In reality, this is not new in developing a food safety management system; however, the context needs to be formally documented.

•   Element 4.2. Understanding the needs and expectations of interested parties. This is also not a new requirement. The need to meet regulatory and customer food safety requirements is mandated throughout ISO 22000:2005, most notably in clause 5.6.2 — internal communications, which states that these requirements must be communicated to the food safety team — and in clause 7.3.4, in which the site must describe the intended use of the food.

•   Element 4.3. Determining the scope of the food safety management system. This is a formal declaration of the boundaries of the food safety management system and not a new requirement. It must be done as part of the certification process.

•   Elements 7.2 – Competence and 7.3 – Awareness. One focus of Annex SL is output of the processes. Training should be structured to lead to competence and awareness. In reality, this is not a new requirement; however, the focus of an audit will move from reviewing training records to determining if the training achieved the desired results. At this time, it is not known whether ISO 22000:2016 will have a training requirement.

•   Element 7.5. Documented information. Annex SL does not yet have any mandated procedures. However, the ISO 22000 Working Group may incorporate required procedures and documents in the revision.

ISO 22000:2005 was developed utilizing the 12 steps of Codex HACCP, or the five preliminary steps and seven principles of the National Advisory Committee on Microbiological Criteria for Foods. These requirements were placed into the standard in clause 7.0 in the proper order. The working group may or may not develop the standard where the 12 steps of Codex HACCP are presented in sequential order.

Strategizing the Implementation of Changes to ISO 22000
It is expected that there will be a 3-year transition process for sites that are already certified to either FSSC 22000 or ISO 22000. However, any changes to the standard may pose some issues for maintaining an effective food safety management system.

Changes to the standard can be categorized into one of the following groups:

•   Areas where changes may be minimal

•   Areas that potentially require a rethink of the structure of the food safety management system

•   Areas requiring updating

•   New requirements that may be already satisfied

•   New requirements that may present a challenge to the implementation process

Sites already certified to FSSC 22000 or ISO 22000 should not make immediate changes to their food safety management system. At the 2014 meetings in Copenhagen, the working group began the revision process. The first step was to see how ISO 22000:2005 fits into the management system structure of Annex SL.

The working group is adding specific sector requirements for a quality management system. These sector-specific requirements may not be included in ISO 22000:2016.

However, sites using ISO 22000 should start looking ahead to what may be changed. It is suggested that site management should download a copy of Annex SL and start reading Appendix 3: High-level structure, identical core text, common terms and core definitions. As a result, you can become familiar with the new structure and some of the high-level requirements that will be included in the revision to ISO 22000:2016.

John G. Surak, Ph.D., is the principal of Surak and Associates and provides consulting on food safety and quality management systems, auditing management systems, validating manufacturing processes, designing and implementing process control systems and implementing Six Sigma and business analytics. He leads the U.S. delegation to ISO Technical Committee 34, Subcommittee 17. This subcommittee is responsible for developing and maintaining the ISO 22000 series of standards. His website is www.stratecon-intl.com/jsurak.html. He can be reached at jgsurak@yahoo.com.

James H. Bytnar is a senior staff lead auditor, employed by SRI Quality System Registrar, and provides quality, environmental, safety and food safety management systems audits in many industry sectors. He is a voting member of the ISO Technical Advisory Groups 176 and 207 for Quality and Environmental Management Systems, respectively, the Project Committee 283 for Safety Management Systems as well as the ISO Technical Committee 34, Subcommittee 17 for Food Safety Management Systems. SRI’s website is www.SRIRegistrar.com. He can be reached at jbytnar@SRIRegistrar.com.

*Thanks to Bob Dylan.

References
1. www.unit.org.uy/misc/AnexoSL.pdf.
2. www.irca.org/Documents/press/2012/IRCA%20Annex%20SL%20brochure.pdf.
3. www.food-safety.com/magazine-archive1/octobernovember-2011/food-safety-and-risk-assessment/.