Clause 8 – Operation
In clause 8, we reach the core of the standard and we can find most of the content related to the Codex Hazard Analysis and Critical Control Points (HACCP) principles and steps. In fact, only Step 1 (Assemble the HACCP team) and Step 12 (Establishing documentation and record keeping) are totally addressed outside clause 8 (clauses 5.3 and 7.5, respectively). Internal audits, which are a verification procedure (Step 11), is covered in clause 9.2.

Clause 8.1 – Operational Planning and Control
This clause has several differences when compared with the equivalent 7.1 of the 2005 version. It is more precise about an organization’s responsibility regarding processes that are needed to meet requirements (plan, implement, control, maintain, and update) and provides examples on how to do it (establishing criteria, implementing control of the processes, and demonstrating that processes have been carried out as planned). It also introduces the necessity to implement actions in the risk and opportunities assessment.

Clause 8.2 – Prerequisite Programs
Prerequisite programs (PRPs) are a key aspect of any food safety system. There are some differences when compared with the 2005 version:

1. The word update was added in “establish, implement, maintain, and update PRP(s)”

2. When selecting and/or implementing PRP(s) organizations:






 

The wording is very important; the standard includes the terms “shall,” indicating a mandatory requirement and “should,” indicating a recommendation. This signifies that the ONLY prerequisites organizations must implement (mandatory) are the ones presented in the standard (clause 8.2.4) since ISO/TS 22002 series prerequisites are not compulsory.

When clause 8.2.4 of the standard is compared with ISO/TS 22002-1 (Prerequisites for Food Manufacturing), something stands out immediately: food defense, biovigilance, and bioterrorism. This is mandatory if organizations follow ISO/TS 22002-1 but not if you set your prerequisites according to ISO 22000:2018.

3. The list of prerequisites in the new ISO 22000 is closely resembles those addressed in the 2005 version. The two main differences are the addition of the terms product information/consumer awareness and supplier approval (although it is probable that most organizations have some related procedure in place to address the management of purchased materials that was present in the previous version).

Clause 8.3 – Traceability System
The new standard presents a list of topics that organization should consider when establishing traceability systems. For example, reworking of materials/products (not mentioned in the previous version) and the relation between the lots of received materials, ingredients, and intermediate products to the end products.

The mandatory verification and testing of the traceability system effectiveness is presented in the 2018 version. Although this was not specified in the 2005 version, the guide for its application (ISO 22004:2014) did include a reference to making tests.

What is totally new however, is the reference to quantities reconciliation (end products vs ingredients).

Clause 8.4 – Emergency Preparedness and Response
In comparison with clause 5.7 of ISO 22000:2005, it is apparent that the term “accident” has been substituted for the term “incident.” This new clause is more comprehensive than the 2005 version (which was just a small paragraph), but most of the new content was developed in ISO 22004:2014. Nevertheless, it should be emphasized that is now mandatory to take actions to reduce the consequences of the emergency situation, and then review and update documentation.

Some new examples of emergency situations were added, including: workplace accidents, public health emergencies, and interruptions of services like water, electricity, or refrigeration supply.

Clause 8.5 – Hazard Control

Clause 8.5.1 – Preliminary Steps to Enable the Hazard Analysis
The first step of hazard control is to identify raw materials, ingredients, product contact materials, and end products (and their intended use) and to prepare flow diagrams and describe processes.

In this new version, more detail is provided regarding the information that shall be collected to carry out hazard analysis. The previous version only mentioned “All relevant information needed to conduct hazard analysis.” Now, is clear that, at a minimum, the information that shall be collected by the food safety team should include:

1. Statutory, regulatory and customer requirements;

2. Products processes and equipment; and

3. Food safety hazards.

A new item has been added to the information that organizations shall maintain about raw materials, ingredients, product contact materials—namely the source (e.g., animal, mineral, or vegetable). This new information is also in place to clarify some misunderstandings that the term “origin” used in the last version brought. In fact, the new wording (for origin) is “place of origin (provenance),” which makes it more obvious that the organization shall identify the provenance of the products.

Regarding flow diagrams and their preparation, it has been specified that the introduction of processing aids, packaging materials, and utilities in the flow shall be included in the diagrams.

The number of issues that the food safety team must address when describing processes for the Hazard Analysis was expanded to the following:

1. Layout of premises (food and no-food areas)

2. Processing equipment and contact materials, processing aids, and flow of materials

3. Existing PRPs, process parameters, control measures, and procedures

4. Variations resulting from seasonal changes or shift patterns

5. External requirements

Clause 8.5.2 – Hazard Analysis
Where the 2005 version included the implicit understanding that the food safety team shall conduct a Hazard Analysis based on the preliminary information, in the new version, it is stated explicitly at the beginning.

There are also changes to the kind of information that shall be used to identify food safety hazards. The organization shall now use also internal information (epidemiological, scientific and historical data) as well as statutory, regulatory, and customer requirements for that purpose. When it comes to identifying the hazards, it was added that organizations shall now consider all steps in the flow diagram (instead of only the steps preceding and following the specified operation) and persons.

In the hazard assessment, two very interesting remarks were added (in bold): the likelihood of occurrence shall be determined prior to the application if control measures and the severity evaluated in relation to the intended use.

After hazard identification, determination of acceptable levels, and the hazard assessment, the next step is to select and categorize control measures. For this, the new version presents several aspects to take in consideration (most of them similar to the last version). But three things are worthy of special consideration:

1. Assessing the feasibility of establishing measurable critical limits and/or measurable/ observable action criteria; this is not entirely new since something was already mentioned in Table 1 of ISO 22004:2014

2. Assessing the feasibility of applying timely corrections in case of failure

3. The use of external requirements to choose control measures or impact their strictness

Clause 8.5.4 – Hazard Control Plan [HACCP/Operational PRP (OPRP) plan]
This clause combines information that was previously divided into two separate clauses: Establishing the OPRPs and Establishing the HACCP plan. This assists in recognizing that the hazard control plan includes not only critical limit(s) at CCP but also action criteria for OPRPs.

Regarding monitoring systems, the new version introduces the need to document the monitoring methods used and it adds the possibility of using equivalent methods (to calibration) for verification of reliable measurements or observations in the case of OPRPs.

Clause 8.6 – Updating the Information Specifying the PRPs and the Hazard Control Plan
This clause remains very similar to the equivalent in the 2005 version (clause 7.7). Besides using a hazard control plan to substitute what was previously considered as OPRPs and HACCP plan, it introduces the requirement to update raw materials, ingredients, and product-contact materials characteristics after establishing the hazard control plan.

Clause 8.7 – Control of Monitoring and Measuring
There are no major differences in this clause but some adjustments that make it clearer and more specific.

The generic statement in the previous version, “The organization shall provide evidence that the specified monitoring and measuring methods and equipment are adequate to ensure the performance of the monitoring and measuring procedures” has now been declared as mandatory for “monitoring and measuring activities related with the PRP(s) and hazard control plan.”

The clause is more demanding when it comes to the use of software for monitoring and measuring; demanding validation of its adequacy prior to use, and whenever it is changed/updated.

Clause 8.8 – Verification Related to PRPs and the Hazard Control Plan
There are three differences in this clause that are worth exploring:

1. The list of what verification activities shall consist of, is equivalent to clause 7.8 of the 2005 version with one exception—more than just the implementation of PRPs shall be confirmed, but also its effectiveness (rewording of operational OPRPs and HACCP plan to hazard control plan is also to be noted)

2. It is now mandatory for the organization to ensure the independence of the person that does verification activities

3. The new version indicates the need to take corrective actions whenever nonconformity in found on testing end product or direct process samples

Clause 8.9 – Control of Product and Process Nonconformities
Right from the title it is strikingly clear that process nonconformities shall be controlled. Processes nonconformities are addressed in clause 8.9.2.4, which details the information that shall be retained to describe corrections made.

A general clause is added right at the beginning to define that only designated persons (with competence and authority) may evaluate nonconformities, and initiate corrections and corrective actions. In the 2005 version, this information was dispersed throughout the clause.

Organizations are now clearly required to take actions to review nonconformities identified by consumers or in regulatory inspections reports (in the last version, only customer complaints were given as example).

It is now also unambiguous that any product that fails to remain within critical limits at CCPs shall not be released, and treated according to clause 8.9.4.3 – Dispositions of nonconforming products.

Clause 9 – Performance Evaluation
In clause 9, the evaluation of the system performance is addressed. It is divided into three subclauses:

1. Monitoring, measurement, analysis, and evaluation is new and forces the organization to define what and when monitoring and measurement should take place, and how, when, and who shall analyze and evaluate their results

2. Within internal audits, the importance of taking in consideration changes in the food safety management system and the results of monitoring and measurement when defining the audits program has been introduced; it also states that there is a duty to report the audit results to the food safety team and relevant management, and that internal audit should check compliance of the FSMS against food safety objectives and policy

3. Management review has undergone several changes, especially in the inputs; nonconformities and corrective actions, performance of external providers, adequacy of resources, and opportunities for continual improvement shall also to be considered as inputs; the concept of external and internal issues is also covered in this clause as an input, whenever any change is considered relevant for the food safety management system; regarding the outputs, the mains change is the inclusion of any decisions and actions related to continual improvement opportunities

Clause 10 – Improvement
The first thing that is noticeable when comparing clause 10 – Improvement (2018 version) and clause 8.5 – Improvement (2005 version) is that there is a new subclause that addresses nonconformity and corrective action. There is now clear guidance for the steps to take when nonconformity occurs (Figure 1).

The subclause continual improvement (already present in the previous version) now includes the need for an organization to continuously improve the effectiveness of the food safety management system as well as its suitability and adequacy. No relevant changes can be found in the last clause of the system (updating the food safety management system).

Food safety systems are excellent tools to guarantee food safety. Understanding more about updates to global standards is a step toward maintaining food safety around the world.

Nuno F. Soares, Ph.D., is an author, consultant, and trainer in food safety. He has over 20 years of experience in food industry as quality and plant manager. He is the author of “ISO 22000:2018 Explained in 25 Diagrams.”