1. © ISO Management Systems, www.iso.org/ims
SPECIAL REPORT
ISO 22000
From intent to implementation
How close is the intent of ISO 22000:2005 and its implementation by users ?
An expert who took part in its design and development has reviewed
feedback from early users and gives some pointers to tackling the issues they
raise.
ISO 22000:2005, Food safety in any of the quality or food These innovations mainly
management systems – Require- safety management systems relate to the interpretation,
ments for any organization in standards used so far by com- consistency and thorough-
the food chain is the first man- panies in the food chain (e.g. ness of the HACCP method
agement system standard on ISO 9001, BRC, IFS, DS 3027 of controlling food safety haz-
food safety to go beyond the or others). Table 1 (overleaf) ards. Indeed, ISO 22000 is the
by Didier Blanc recommendations put forward lists and interprets the key new first standard that not only
in 1993 by the Codex Alimen- elements. endorses the Codex Alimen-
Author Didier Blanc is founder tarius Commission. Inevita- tarius recommendations, but
and director of ProCert, a provider bly, the arrival of this brand also attempts to fill the gaps
of training and certification in ISO new standard with its updat- and inconsistencies brought to
9001, ISO 14001 and ISO 22000 ed approach is accompanied light by 13 years of accumulat-
management system standards. by issues of interpretation ed experience with HACCP.
and how to meet its require-
He is a veterinary surgeon
ments.
specialized in food hygiene, and a
member of Working Groups WG 8
and WG 11 of ISO Technical Com-
mittee ISO/TC 34, Food products,
ISO 22000 goes beyond
responsible for developing ISO the food safety
22000:2005, Food safety manage- recommendations
ment systems – Requirements for put forward in 1993
any organization in the food chain, by the Codex Alimentarius
and ISO/TS 22003, Food safety Commission
management systems – Require-
ments for bodies providing audit
and certification of food safety
The main interpretation and
management systems.
implementation challenges
Dr. Didier Blanc, Director, ProCert, revolve around requirements
CH-1015 Lausanne 15, Switzerland. that did not appear in the 12
Tel. + 41 79 337 51 39. Hazard Analysis and Critical
Fax + 41 21 693 87 20. Control Point (HACCP system)
E-mail procert@epfl.ch application steps described in
Web www.procert.ch the Codex Alimentarius, nor
ISO Management Systems – May-June 2006 7

2. © ISO Management Systems, www.iso.org/ims
SPECIAL REPORT
What’s new? Clause in New element Investing in skills
the standard
Figure 1 illustrates the links In a nutshell, while the require-
between ISO 22000 and the 12 ments for means often involve
HACCP steps and highlights 5.5 Responsibility and authority for : organizing the team’s investment in infrastructure,
the stages that have been add- Food safety team training and work ; ensuring the implementation and the obligation to achieve
ed (broken outline), or signifi- leader updating of the system ; reporting to management ; results leads rather to invest-
communicating.
cantly altered and consolidat- ing in manpower, in the skills
ed (yellow background). 5.6 External communication relating to food safety haz- of the HACCP team and its
Communication ards throughout the food chain (upstream and down- leader, and in the staff that
These innovations apply as
stream) ; impact on the control of food
much upstream – the require-
Internal communication to ensure that the HACCP team product safety.
ment for the selection and
implementation of appropri- is informed in real-time of all changes (e.g. raw mate-
ate prerequisite programmes rials, facilities and installations, recipes, requirements,
etc.) likely to affect the system.
(PRP’s) 1), before proceeding to ISO 22000 states
hazard analysis – as to the core 6.2 The requirements of (demonstrated) competence of requirements in terms of
of the HACCP system itself : Human resources the HACCP team members and the staff having an
results rather than means
hazard analysis, selection, vali- impact on food safety.
dation and monitoring of ade- 7.2 The company should itself select and implement appro-
quate control measures. Prerequisite priate good hygiene practices (instead of merely apply-
programmes (PRP’s) ing those imposed upon it). However, corporate culture
A generic requirements-based
limitations often arise as soon
standard designed for certifi- 7.4.2 Taking into account the various stages in the food
as the qualification and empow-
cation purposes cannot pro- Hazard identification chain (primary production, processing, distribution)
erment of staff are involved,
vide examples or recommen- and determination where hazards can occur ;
of acceptable levels while many companies do not
dations, so I will provide some Determination of acceptable levels in the finished have the resources to employ
here. In addition, the systems product.
highly trained HACCP man-
approach of ISO 22000 states
7.4.4 Selection of (combinations of) control measures associ- agement.
requirements in terms of results
Selection and ated with hazards assessed as requiring control ;
rather than means. In addition to the financial
assessment of
Assessment of the effectiveness of control measures ; resources needed to fund a
Although this approach, suc- control measures
Method for assigning these (combinations of) control team of competent managers
cessfully applied in ISO 9001
measures either to the HACCP plan (“conventional ” and specialists, it may prove
and ISO 14001, has been wide-
CCP), or to operational PRP’s (new concept). difficult to find appropriate
ly supported by representa-
training and recruit experts,
tives of the food industry, it 7.5 Establishment of a monitoring system (procedures,
and develop the necessary
can prompt questions such as Establishing responsibilities, corrective actions) for the (combi-
the operational nations of) control measures assigned to the opera-
experience and skills on the
the following:
prerequisite tional PRP’s. job. Nevertheless, an organiza-
• What do I have to do ? tion can find a solution suited
programmes (PRP’s)
• What are the baselines ? to its size and circumstances
8.2 Prior validation of the effectiveness of the (combina-
by measures such as the fol-
• Can I have examples ? Validation of tions of) control measures to ensure observance of the
lowing :
control measure predefined acceptable level for the relevant hazard.
• How will I validate my combinations
choices ?
8.4.2 Systematic review of individual results of the plan and
• How can I be sure not to go Evaluation of verification (e.g. implementation of operational PRP’s 1) Prerequisite programme
(PRP) : basic conditions and
too far, or not far enough ? individual verification and CCP’s, compliance with acceptable levels, and anal- activities that are necessary to
results ysis of products and services, etc.). maintain a hygienic environment
throughout the food chain suitable
8.4.3 Analysis and overall review of the implementation, oper- for the production, handling and
Analysis of results of ation and efficiency of the system and of the trends in provision of safe end products and
Table 1 – Key innovations verification activities terms of hazard control, with management reporting. safe food for human consumption.
of ISO 22000 (ISO 22000).
8 ISO Management Systems – May-June 2006

3. © ISO Management Systems, www.iso.org/ims
SPECIAL REPORT
– exchanging or sharing
HACCP team members,
and functions such as inter-
Figure 1 –
ISO 22000
and Codex
7.3.2 Food safety team
 1

nal auditing and data anal- Alimentarius
ysis, among several compa- – What’s 2
nies; new ?
7.3.3 Product characteristics
– integrating supplier or cli- For French

ent experts into the team,
to bring in hazard control speakers…
3
expertise from other lev-
7.3.4 Intended use
els in the food chain;
French speakers can find

– using e-learning when the further help on ISO 22000
required vocational training interpretation and imple- 4
is not available in appropri- mentation in Didier Blanc’s 7.3.5.1 Flow diagrams
ate timeframes, locations or book ISO 22000, HACCP et

quality 2).
sécurité des aliments –
Recommandations, outils,
7.2 Prerequisite programmes (PRP)
5
or Good hygiene practices (GHP)
Some examples FAQ et retours de terrain 7.3.5.2 Description of
(ISO 22000, HACCP and food process steps and control measures
One of the difficulties in com-

safety – recommendations,
plying with the requirements
tools, FAQ’s and user feed-
of a standard is to find a start- 6.a
ing point on which to build the back), on which this article 7.4.2 Hazard identification and
implementation. Examples is based. determination of acceptable levels

can help set the right course
and boost confidence in the His book illustrates the
implementation process. Two principles of the new Inter-
6.b
such examples are described
7.4.3 Hazard evaluation
national Standard with

hereafter. practical examples, and is
based on answers to the most
Selection of control frequently asked questions 6 c-7
7.4.4 Selection and evaluation
measures (FAQ’s) on food safety man- of control measures

Clause 7.4.3, Hazard assess- agement systems, and on
ment of ISO 22000 (see Figure the management tools he
8-9-10
1) serves to determine which developed in over 20 years’
7.5 Establishment 7.6 Establishment
of the potential hazards iden- food safety experience. of operational PRP’s of HACCP plan
tified require specific control
measures. To ensure such con- ISO 22000, HACCP et sécurité
trol, the standard requires the des aliments – Recomman-
selection of (or combination 8.2 Validation of combinations
dations, outils, FAQ et retours
of) control measures (clause of control measures
de terrain (ISBN 2-12-445311-

7.4.4, Selection and assess-
4) is published in French by
ment of control measures).
Association française de nor- 11
malisation (AFNOR), 7.8 Verification planning
2) See, for example, the HACCP 350 pp, price 42.65 euros,
and ISO 22000 courses on the
I-Cube Academia platform devel-
oped by Liège University,
Belgium, and Lausanne Polytechnic,
available from
www.boutique.afnor.fr
Elements added to Codex
Alimentarius  HACCP steps according to Codex
Alimentarius
Switzerland – www.i3academia.com Significantly altered and consolidated, compared to Codex Alimentarius
ISO Management Systems – May-June 2006 9

4. © ISO Management Systems, www.iso.org/ims
SPECIAL REPORT
This is likely to prompt ques- fears by providing a list of pos-
tions such as : sible approaches. These are
presented in Table 2 in the
• Where do these control
form of a systems approach
measures come from ?
to implementation based on
• How do they differ from existing validations within a
PRP’s ? small company in a specific
• Should they be selected business sector.
from the PRP’s – in which
case I doubt the value of
this additional requirement Where to start?
since the HACCP measure
Once one is convinced that ISO
is already in place – or else-
22000 is the best approach to
where ?
controlling impacts on the safe-
ty of food products, the inevita-
ble question arises, “Just where
An organization can find do I start?”
a solution suited to its size Much will depend on the com-
and circumstances pany’s certification status in
terms of ISO 9001, BRC, IFS,
etc. Indeed, certain principles
The required control measures common to all management
can be selected either : system standards will have
already been assimilated –
– from an organization’s PRP’s
e.g. control of documents and
(e.g. the slicing sequence of
Validation of control
a cross-contamination haz-
measures Product
ard between cooked meat
preparation and air-dried Clause 8.2, Validation of con- Hazard to be controlled
meat products, or a refrig- trol measure combinations,
Control measure(s)
eration chain in the case of basically a new requirement
fresh products) ; introduced by ISO 22000 that Applicable
Validation methods Comments
relates to the control meas- yes/no
– beyond the PRP’s, by intro- ures addressing hazards hav-
ducing additional, more Third-party scientific validation
ing been assessed as needing
advanced technology (e.g. control, control measures that Historical knowledge
laminar flux, air process- must then be validated before
ing, x-ray detection) ; Simulation of production conditions
being implemented. This might
– outside the PRP’s relat- prompt prospective users to Collection of data in normal
declare, “But I have neither the production
ing to that specific busi-
ness sector, using measures human nor financial resourc- Admissible in industrial practices
which belong to another es to perform scientific val-
idations! Isn’t the standard Statistical programmes
level in the food chain (e.g.
good agricultural or animal designed mainly for large and Mathematical modelling
health practices, integrated wealthy companies alone, and
not for the small players?” Conclusion :
farming, or EurepGAP cer- internal validation needed ?
tification required by the ISO/TS 22004, Food safety If so, following which method ?
food industry of its suppli- management systems – Guid-
ers). ance on the application of ISO Table 2 – Need for and methods of, validating control measures
22000:2005 can help allay such according to ISO/TS 22004
10 ISO Management Systems – May-June 2006

5. © ISO Management Systems, www.iso.org/ims
SPECIAL REPORT
records, policy, internal audit-
ring, improvement measures,
Sources of help mmanagement review.
In addition to the official guidance provided control measures that the
by ISO in ISO/TS 22004, examples of food hazard analysis
safety management-related frequently asked identifies as necessary to
questions (FAQ’s) are available on the control identified hazards to
author’s ProCert Web site – www.procert.ch – acceptable levels, and which
which also welcomes new questions in are not otherwise managed by
English, French and German. A sample the HACCP plan;
question and answer follows.
• a HACCP plan to manage those
Question control measures that the
hazard analysis identifies as
I see no difference between PRP (or GMF/ necessary to control identified
GHP’s) and control measures. For me, PRP’s hazards to acceptable levels,
are measures to control existing hazards, and which are applied at
otherwise they have no purpose. Moreover, critical control points (CCP’s).
control measures associated with hazards will
always be selected from among the PRP’s. Answer
Recommendations of ISO/TS 22004: In view of the clarifications provided by The key is to correctly man-
ISO/TS 22004, the answer seems to be age HACCP procedures in
ISO/TS 22004 provides the following
twofold : conjunction with the addition-
clarifications in this respect : al requirements of ISO 22000
1) Yes, strictly speaking PRP’s are control
which, while introducing con-
ISO 22000 reorganizes the traditional con- measures, even though in practice it is sistency, nonetheless require
cept of dividing control measures into two recommended not to designate them as some effort to assimilate.
groups [prerequisites and measures applied such in order to avoid confusion.
at critical control points (CCP’s)] in a logical
2) No, PRP’s are not selected to control
order for the development, implementation Early feedback indicates
hazards identified through hazard
and control of the food safety management that one should start by
analysis – this will require specific
system. Control measures are grouped into investing in the HACCP
control measures assigned to operational
three groups, as follows : skills revisited by ISO 22000
PRP’s or to the HACCP plan – but to
create a suitable hygienic environment
• prerequisite programmes (PRP’s) that that is able to keep to a minimum the
manage the basic conditions and activities ; Early feedback on the use of
likelihood of contamination. the standard indicates that
the PRP’s are not selected for the
one should start by investing
purpose of controlling specific identified
For further guidance, the author recommends in the HACCP skills revisited
hazards but for the purpose of maintaining
establishing contact with an expert in by ISO 22000 in order to reap
a hygienic production, processing and/or the full benefits of the new
another company, or a consultant or auditor,
handling environment standard. Once these skills are
and visiting Internet forums, specialized
(see 7.2 of ISO 22000:2005) ; in place and operational, the
clubs and FAQ’s.
rest should follow as a matter
• operational prerequisite programmes
of course. •
(operational PRP’s) that manage those
ISO Management Systems – May-June 2006 11