Those of us working at companies in the food manufacturing and distribution supply chain know that the negative publicity of product recalls, or worse, litigation, brand damage and the impact on consumers’ health suffered as a result of a foodborne illness outbreak associated with a product, can have a significantly adverse affect on the business. Since the supply chain is now highly globalized, the ramifications of food safety problems are more far-reaching than ever before. As a result, food companies all along the supply chain continuum have recognized the need to streamline food safety activities by implementing food safety management systems (FSMSs) to ensure effective food safety practices, comply with the necessary regulatory requirements, meet the specifications of food chain customers downstream, and provide consumers with a high level of confidence in the products they purchase.

One of the challenges for the food industry in recent years has centered on the array of FSMSs from which to choose, given the introduction of several different standards, requirements and certification schemes by internationally recognized standard-setting bodies, regulatory and legislative authorities and other industry-driven organizations. It isn’t difficult to understand how a plethora of differing standards and rules on a global level is problematic for a food company’s decision-making process.

With the publication in September 2005 of the International Organization for Standardization’s (ISO) 22000:2005, industry will have a practical FSMS framework for harmonizing these various requirements and standards in a single global standard. The much-anticipated international standard incorporates three requisite components: 1) requirements for prerequisite programs, including good manufacturing and handling practices; 2) requirements for Hazard Analysis and Critical Control Points (HACCP); and 3) requirements for implementation of a management system. It is this second element of the standard that is viewed by many as one of the most significant potential benefits to industry. ISO’s harmonized standard incorporates Codex Alimentarius HACCP to make the system easier to implement by companies worldwide, irregardless of variances in individual nations’ legislation or the food products produced. However, this concept requires further explanation in order that companies looking to adopt ISO 22000 and certify their operations to the standard understand fully how HACCP, a FSMS in its own right, can be effectively integrated within this harmonized food safety management system.

Defining A New Approach
HACCP is the internationally recognized system to ensure the production of safe food. Over the last 50 years, HACCP evolved from three principles, to five preliminary steps, to seven principles that are supported by prerequisite programs (Table 1). During this evolution, the basic concept of HACCP has remained unchanged. Food safety cannot be inspected into the product. In addition, end product testing is costly, time-consuming and unreliable. Instead, food safety must be built into the processes employed to manufacture food products. This is done by identifying the hazards, taking action to prevent the hazards from occurring, and monitoring the process to ensure that conditions do not exist to allow the incorporation of a hazard into the food.

In 1989, the National Advisory Committee on Microbiological Criteria for Foods (NACMCF) published HACCP guidelines in the U.S. These guidelines became the U.S. de facto HACCP standard. In the world, the Codex Alimentarius Commission (Codex) HACCP guidelines is the de facto international HACCP standard. Codex is the internationally recoginzed food standard-setting body jointly established by the United Nations’ Food and Agriculture Organization (FAO) and World Health Organization (WHO). Both of these documents are equivalent and written in guidance format. They are intended to assist food processors in implementing a HACCP program. HACCP, in fact, is one of the first food safety management systems to be widely adopted by food processing operations.

As customers around the world demanded safer food, HACCP requirements were incorporated into both the regulations that govern food processing and into customer purchasing requirements. As a result, numerous countries have promulgated individual national standards for food safety and hygiene that include requirements for HACCP implementation. Various trade groups, particularly those on the retail side, have developed expanded customer sanitation auditing programs to address HACCP requirements. However, audits are expensive and time-consuming for both the customer and the supplier. There has been a slow movement to require suppliers to obtain third-party certification of their quality and food safety management systems. Examples of third party audits and certifications include the Food Marketing Institute’s SQF program; the Food Products Association’s FPA-Safe Food Audit; the British Retail Consortium’s BRC Global Standard; and CIES—The Food Business Forum’s Global Food Safety Initiative (GFSI).

Ultimately, the glut of these various national and industry standards present serious challenges to companies throughout the supply chain. Challenges include confusion about actual requirements that must be met to achieve uniform levels of food safety and the increased cost and operational complexities experienced by producers, processors and other suppliers that find themselves obligated to conform to multiple programs. In light of these challenges, harmonized international food standards are critical to facilitate global trade. The standards provide a common definition for products or processes and reduce misinterpretation of customer requirements across national and language borders.

International consensus standards for food products are developed by two standards organizations: Codex Alimentarius and ISO. Codex publishes international standards that can be used to develop national laws and regulations. These standards typically have a long time frame between reviews. ISO develops standards that are driven by marketplace needs. As a result, the ISO standards describe the state of the art for products, services, process, materials and systems, and conformity assessment. The standards are developed in a relatively short time frame. They are required to be reviewed every five years. As part of the review process, a recommendation must be made to renew, revise or withdraw the standard. This process ensures the standard does not become a technical barrier to trade.

In 2001, Working Group 8 of ISO Technical Committee 34 undertook a project to define the requirements for a food safety management system. The standard has the following characteristics:

• Focus only on a FSMS; quality management systems are addressed in ISO 9001

• Usable by all organizations in the food chain

• Combine the recognized food safety system elements as defined by Codex

• Provide an auditable standard that could be used as part of third party certification (which could also be used by a food processor to develop a food safety management system)

• Allow food safety control to be achieved through either the HACCP plan or through operational prerequisite programs

• Ensure that the process used to control food safety is validated, verified, implemented, monitored and managed

In September 2005, ISO published ISO 22000:2005, Food safety management systems—Requirements for any organization in the food chain, to provide a framework of internationally harmonized requirements for a global approach to implementing a FSMS that can be utilized by all types of companies within the supply chain. These range from feed, crop and livestock producers and food manufacturers, to transport and storage operators and subcontractors to retail outlets and foodservice establishments, as well as suppliers of ingredients and additives, processing and packaging equipment and materials, sanitation chemicals and treatments, and other processing and handling aids. ISO 22000 was developed by food industry experts from the manufacturing, foodservice and retail sectors, representatives of international trade associations and food safety organizations and others, in cooperation with the Codex Alimentarius Commission (CAC).

With input from this broad range of supply chain stakeholders, the new international standard addresses many of the challenges faced by industry as noted earlier. Among others, ISO 22000 addresses the increasing demand by downstream companies for supplier certification schemes that allow the verification of the effectiveness of the vendor’s FSMSs. This reduces confusion about FSMS requirements since it defines the elements of key standards required by leading retail segment-led organizations in a single standard, and defines the Codex HACCP system as the “standard within a standard” to be used.

The Essential Pieces of a Solution
ISO 22000 is written as a management system standard. As a result, the standard addresses policy, planning, implementation and operations, performance assessment, improvement, and management review (Table 2). ISO 22000 provides a useful model for business improvement in the food industry, based on the process approach, with the management of the food safety risk at its core.

ISO 22000 was not designed to be a rewording of Codex guidelines for HACCP. It is describes the current state-of-the-art requirements for a food safety management system. Therefore, it can be used to develop a food safety management system that exceeds the minimum regulatory requirements. Differences between ISO 22000 and the Codex HACCP include:

• Development of a quality policy with measurable objectives
• Requirements for management review of the food safety management system
• Increased responsibility for the food safety team leader
• Additional requirements for internal and external communications
• Additional validation requirements
• Clarification of prerequisite programs
• Additional documentation requirements
• A number of the Codex “shoulds” become ISO “shalls” or in standards terminology, optional requirements become mandatory requirements.

So, how do each of these differences materialize in ISO 22000?

Measurable Objectives of Quality Policy. ISO 22000 requires the documentation of a quality policy with measurable objectives. Examples of measurable objectives could include: objectives to reduce the amount of foreign matter complaints by 20% or to improve third party audit scores by 10%.

FSMS Management Review. Management review ensures the continued effectiveness of the food safety management system. The review goes beyond verification of the efficiency of the management system. Management review is conducted by top management. It is to be used as a platform for the exchange of new ideas with open discussion and evaluation of the food safety management system. The output of management review should provide the data for planning performance improvements of the food safety management system, and performance objectives for products and processes. In addition, management review generates recommendations for improvement in the structure of the food safety management system, allocation of resources, mitigation plans for identified risks, and strategic planning for future needs of the organization with respect to food safety requirements.

Food Safety Team Leader Responsibilities. The responsibilities of the food safety team leader go beyond managing the food safety team. The team leader is responsible for ensuring the relevant training and education of the food safety team members and for ensuring that the food safety management system is established, implemented, maintained and updated. This individual reports to top management on the effectiveness and suitability of the food safety management system irregardless of other assigned duties.

Enhanced Communications. ISO 22000 recognizes that food safety is the responsibility of all parts of the food chain. As a result the standard requires effective communication within the organization and to individual external to the organization. Figure 1 shows the desired intent of the communications about food safety issues.

Additional Validation. The standard recognizes that the food safety management system may or may not have a HACCP critical control point. As a result hazard identification and analysis must be conducted on all products. As part of this analysis, the food processor must determine if the hazards will be controlled through the operational prerequisite programs or through the HACCP plan. All control measures must be validated to ensure that they are capable of controlling the hazards. Validation consists of a series of steps to ensure the performance of the control measure meets or exceeds specified expected outcomes.

Prerequisite Programs. ISO 22000 clarifies the role of prerequisite programs that support the effectiveness of the HACCP plan. The committee that wrote the standard had to address several critical issues with regard to prerequisite programs. There is not a standard consensus of what constitutes prerequisite programs.
However, all of the prerequisite programs have four things in common:

• They address indirect food safety issues.
• They cover general programs related to food safety.
• They can be applied to multiple production lines.
• Momentary failure to meet a prerequisite programs seldom results in a food safety hazard.

The critical aspect is that frequent and/or sustained breakdown of a prerequisite program may result in a food safety hazard. From a management standards perspective, prerequisite programs cover a wide variety of elements of the food safety management system including: facilities, training, good manufacturing practices. As a result, the prerequisite programs must be properly designed, implemented, verified and/or monitored for continued effectiveness. However, many of the prerequisite programs do not lend themselves to the traditional form of validation, verification and monitoring.

ISO 22000 separates the prerequisite programs into two major groups:
• Prerequisite programs that address infrastructure and maintenance of the food safety management system. An example is training.
• Operational prerequisite programs that are used to control potential food safety hazards. An example could be the receiving temperature of a raw meat product at a fully cooked meat processing plant.

Additional Documentation. ISO 22000 delineates the document and record requirements to maintain a food safety management system. The following procedures are required by the standard: document control; record control; corrective action; product withdrawal; internal audits; procedure to handle potentially unsafe product; and prerequisite program procedures. The following documents and records are required:

• Management of the prerequisite programs
• Characteristics and intended use of the end product
• The HACCP plan
• Product/process flow diagram
• Hazard identification
• Hazard analysis
• Selection of control measures
• Critical limits
• Corrective action records
• Internal audit records
• Calibration records
• Traceability records
• Raw material and ingredient records
• Evaluation and handling of potentially unsafe product or nonconforming product
• Internal and external communication
• Management review
• Monitoring records for operational prerequisite program and HACCP plan
• Product withdrawal records
• Verification
• Training and knowledge records
• Agreements with external food safety experts.

The standard defines the minimum amount of documentation. Some food processors may need to go beyond the minimum requirements to ensure the effective management of the FSMS. Documentation should be seen as a tool to help control the management system rather than a system to just write down data. Thus, the organization should not document for documentation’s sake. All documentation should have a purpose.

ISO is developing additional standards that are related to ISO 22000. These standards will be known as the ISO 22000 family of standards. At the present time, the following standards will make up the ISO 22000 family of standards:

• ISO 22001—Guidelines on the application of ISO 9001:2000 for the food and drink industry, will be the revision of ISO 15161:2001.

• ISO 22002, Quality management systems—Guidance on the application of ISO 9002:2000 for crop production.

• ISO/TS 22003, Food safety management systems—Requirements for bodies providing audit and certification of food safety management systems, will give harmonized guidance for the accreditation (approval) of ISO 22000 certification bodies and define the rules for auditing a food safety management system as conforming to the standard. It will be published in the first quarter of 2006.

• ISO/TS 22004, Food safety management systems—Guidance on the application of ISO 22000:2005 was published in November 2005 and provides information to assist organizations including small and medium-sized enterprises around the world.

• ISO 22005, Traceability in the feed and food chain—General principles and guidance for system design and development, will be circulated as a draft international standard.

• ISO 22000 Fitness Checker: Are you ready?, a practical, easy-to-use checklist designed to help small- to medium-sized enterprises (SMEs) assess their readiness for ISO 22000 certification, is being prepared in partnership with the International Trade Center (ITC).


Solving the Puzzle Requires Involvement
Food safety failures in both developed and developing countries have intensified interest everywhere in systematic prevention at every link in the supply chain. ISO 22000, backed by international consensus among government and industry experts, harmonizes the requirements for good food safety practice worldwide. It also provides a number of advantages to food processors that would like to improve their food safety management system. The standard ensures that the food safety management system uses a systems approach to the management of food safety. ISO 22000 provides a better understanding Codex HACCP. The auditable form allows a food processor to easily determine if there are deficiencies in an existing food safety management system.

In addition, the standard is fully compatible with an ISO 9001 based quality management system. As stated by ISO, another benefit of ISO 22000 is that it extends the successful management system approach of the ISO 9001:2000 quality management system standard, which is widely implemented in all sectors but does not itself specifically address food safety. The development of ISO 22000 was based on the assumption that the most effective food safety systems are designed, operated and continually improved within the framework of a structured management system, and incorporated into the overall management activities of the organization. While ISO 22000 can be implemented on its own, it is designed to be fully compatible with ISO 9001:2000 and companies already certified to ISO 9001 will be able to extend this to certification to ISO 22000.

The standards developed by both ISO and Codex have a major impact on food processing companies. These standards are not developed in a vacuum. Food processors should actively participate in the development of international standards. This allows the company to benchmark the current industrial practices and develop systems to ensure the company remains competitive in the marketplace. A copy of ISO 22000 is available for purchase from either ISO (www.iso.org) or the American National Standards Organization (www.ansi.org).

John G. Surak, Ph.D., is Vice President of Quality and Food Safety with Brooks Food Co. in Bedford, VA, which manufactures a range of custom-designed, frozen food including chicken, breaded vegetables such as onion rings, fruit sweet snacks, cheese products, and French toast for major foodservice chains, school lunch programs and brokerage businesses.

Previously, Dr. Surak was professor of food science and coordinator of International Programs for the College of Agriculture, Forestry, and Life Sciences at Clemson University in South Carolina. His work has emphasized the development of quality management systems for food safety and his expertise in statistical process control (SPC) methods for the food industry is widely recognized. Dr. Surak taught SPC for the HACCP Implementation Model Program to USDA FSIS inspectors and industry participants of the pilot study, and served as a consultant to the USDA’s Agricultural Marketing Service on purchasing specifications for meat and poultry for the School Lunch Program. He is a member of the American Society for Quality Control and the Institute of Food Technologists and is a fellow of both societies.