ISO 22000 guide
ISO 22000 audit questions: what certification auditors ask, who they ask, and the evidence that answers them
Clause by clause: ISO 22000:2018 requirements: every clause explained →
Twenty-three questions ISO 22000 certification auditors ask, from the food safety policy to the CCP log, who is usually asked each one and the record that settles it, plus how to prepare line staff accurately and what a mock audit should test.
Key points
- ISO 22000 auditors test two levels: the management system around food safety, and the operation on the line where PRPs, OPRPs and CCPs are run.
- Twenty-three questions follow, across ten areas, each with the person usually asked and the record that settles it.
- Most answers are checked on the floor: a flow diagram walked, a thermometer checked, a lot traced back to its supplier.
- Prepare operators to explain their own job and its records. Never hand them a script or complete records after the event.
What do ISO 22000 auditors ask, and how do they check the answers?
An ISO 22000 certification auditor asks what your food safety management system says should happen, then goes to the production floor to see whether it does. Managers and the food safety team leader are tested on decisions and the logic of the hazard analysis; operators on whether they know their limit, their frequency and what to do when something goes wrong. Every answer is set against a record or something the auditor watches happen.
Certification bodies are accredited to ISO/IEC 17021-1, which names interviews, observation and record review as ways of gathering evidence, and apply ISO 22003-1 to food safety audits. Most come at Stage 2; our guide to Stage 1 and Stage 2 audits covers planning and sampling.
Questions on leadership, the food safety team, internal audit and management review
These test the system around the plant. Expect the auditor to pick one decision and follow it to its record.
| Question | Who is asked | Evidence that answers it |
|---|---|---|
| What does your food safety policy commit you to, and how does it reach the night shift? | Top management | A policy that names legal and customer requirements and communication, and operators who can say what it means for their task |
| Which food safety objectives are behind target, and what have you done about it? | Top management | Measurable objectives with owners and dates, current results, and actions where one is slipping |
| Who has the authority to stop a line or hold product, and has anyone used it? | Top management | Assigned responsibilities for hold, release and recall, and a hold decision on file |
| Did you consider whether climate change is relevant to your food safety system? | Food safety team leader | A context review showing the Amendment 1:2024 question was asked and answered |
| Why were these people chosen for the food safety team, and what knowledge does each bring? | Food safety team leader | Team membership covering production, hygiene, engineering and quality, with competence records |
| What made you last update the hazard analysis? | Food safety team members | Minutes of the review triggered by a new product, supplier, line, complaint or regulation |
| Did the last internal audit cover the PRPs and the hazard control plan, and who audited your own area? | Internal audit coordinator | A risk-based programme, auditors who did not audit their own work, reports and closed findings |
| What did the last management review decide, and what has changed since? | Top management | A record with the required inputs, including verification results, and decisions followed up with evidence |
Questions on PRPs, the hazard control plan, traceability, suppliers and emergencies
Clause 8 is tested where it runs: the auditor walks the process flow, chooses its own samples and follows a trail from delivery to dispatch.
| Question | Who is asked | Evidence that answers it |
|---|---|---|
| How is this area cleaned, and how do you know it worked? | Hygiene operator | Cleaning schedules followed, chemical concentrations recorded, swab or visual checks with results |
| What do you do before you come onto the line? | Any operator | Hand washing, protective clothing and jewellery rules observed at the entrance, and illness reporting the person can describe |
| Where was the last pest activity found, and what happened next? | Hygiene or QA supervisor | A bait map, contractor reports, trend review and action on sightings |
| How are allergens kept apart here, and what happens at a changeover? | Line supervisor | Segregated storage, changeover cleaning with verification, and labels checked against the recipe |
| Show me how you confirmed this flow diagram matches the process. | Food safety team leader | A dated on-site verification of the diagram, including rework and bypass steps |
| Pick one step. Why did you decide the hazard there is controlled by a PRP, an OPRP or a CCP? | Food safety team leader | A step-by-step hazard analysis with the assessment method and the reasoning for each category |
| What is the critical limit at this CCP, and what do you do if you go past it? | CCP operator | The limit on the monitoring record, entries made at the time, and a deviation with product held |
| What are the action criteria for this OPRP, and who checks your records? | Operator and supervisor | Action criteria stated, monitoring entries, and supervisory review signed and dated |
| How do you know this critical limit actually controls the hazard? | Food safety team leader | Validation evidence such as a study, published data or challenge testing, completed before the limit was relied on |
| When was this thermometer or detector last checked, and against what? | Engineer or QA technician | Calibration or verification records traceable to a reference, and action when a device was found out of tolerance |
| Take this finished lot back to its raw material suppliers. How long will it take? | QA or warehouse | Lot records that reconcile quantities in and out, produced while the auditor waits |
| When did you last run a mock recall, and what did it show? | Food safety team leader | A timed mock recall report, the quantity accounted for, and improvements made |
| How was this supplier approved, and what happens if a delivery fails your checks? | Purchasing and goods-in | Supplier criteria, approval and monitoring records, and a rejection or hold on file |
| What would you do after a power cut, water contamination or flood, and has it been tested? | Site manager | Emergency procedures, a test or review of a real incident, and the lessons applied |
| What happens to product that may be unsafe, and who can release it? | QA manager | Hold-and-release records with the evaluation behind each decision |
How to prepare line staff without scripting them
Operators are interviewed at their station, often mid-shift. Preparation should make them comfortable showing their work, not memorising sentences.
- Walk the line with each monitor. Ask what the limit is, where it is written and what happens when it is missed. Correct the understanding, not the wording.
- Keep the records where the work is. A CCP log kept in the office invites entries made later.
- Practise "show me". A colleague from another department asks operators to show a record, a cleaning check or a hold label. The goal is ease, not a stock reply.
- Cover every shift. Auditors often choose the least supervised shift.
- Use the language people work in. Tell the certification body in advance if interviews need translation.
The audit is of the system, not the person. "I would ask my supervisor" is an accurate answer when the procedure says exactly that.
What not to do on audit day
- Identical answers. When three operators give the same sentence, the auditor asks each to show the last deviation they handled.
- Records written after the shift. The same pen, the same handwriting and perfectly round figures across a week tell the auditor the log was completed from memory.
- A cleaned-up plant. A deep clean the day before shows the auditor a plant that is not normal.
- A spotless deviation log. A year with no CCP deviations or holds draws questions about whether monitoring catches anything.
- Managers answering for operators. A supervisor who steps in suggests the knowledge sits with a few people.
- Arguing at the closing meeting. Challenge a finding with evidence, calmly; our guide to ISO 22000 nonconformities explains grading and closure, and the ten mistakes that fail audits are covered separately.
Mock audit before Stage 2
In an implementation engagement, a rehearsal audit is usually the last check before the certification body arrives. It follows the real sequence, from floor walk and interviews to the traceability exercise and closing meeting, led by people who did not build the system.
Findings are graded as a certification body would grade them and closed before Stage 2, and operators hear how their answers came across, so coaching replaces scripts. It does not replace the internal audit that clause 9 requires; our internal audit guide covers that.
How Sterling prepares you for the certification audit
Findings raised by us first, and closed with evidence before Stage 2.
Our expert and experienced consultants test the system through verification, a mock recall, internal audit and management review, raise the findings first and close them with your food safety team, with evidence, before the certification body walks the floor. Records sit in Effivity, included with the engagement at no additional cost. We ensure successful certification for our clients. The certification decision rests with the independent, accredited certification body; Sterling does not certify.
Book a free discovery callISO 22000 audit questions: what buyers ask
Will the auditor interview our production operators?
Yes, operators are interviewed at their stations, usually while the line is running. Expect questions on hygiene rules and what they do when a reading is out.
Does production have to be running during the ISO 22000 audit?
Yes, for the parts of the audit that test the operation, the products in scope should be in production. PRPs and monitoring can only be observed on a working line.
Will the auditor ask to see a traceability exercise live?
Very often, yes. Auditors commonly pick a finished lot and ask you to trace it back to raw materials and forward to customers while they wait, then check that the quantities reconcile.
Can our consultant answer questions during the audit?
No, a consultant may attend only as an observer agreed with the certification body in advance, and observers must not influence the audit. Your own team answers and presents records.
What if the operator who runs a CCP is off on the audit day?
A trained deputy should be able to show the monitoring and explain the corrective action. A CCP only one person can operate is itself a weakness, so name deputies and flag absences when the audit plan is agreed.
More ISO 22000 guides
Every guide in the ISO 22000 series is written for one question and links back to the hub for the whole picture.
- ISO 22000 certification in Australia
- ISO 22000 benefits
- ISO 22000 for hotels, catering and food service
- ISO 22000 certification cost: what moves the price
- ISO 22000 certification process, step by step
- HACCP vs ISO 22000 vs FSSC 22000: which one, and when
- Hazard analysis, OPRPs and CCPs: the hazard control plan
- Prerequisite programmes and ISO 22002-1: what a plant needs
- ISO 22000 requirements explained, clause by clause
- ISO 22000 training: who needs what, and the competence evidence
- ISO 22000 for logistics
- Verify a certificate
Keep exploring
Explore more about ISO 22000
Watch a video on how to implement ISO 22000 here.
Watch a video on ISO 22000 requirements here.
ISO 22000 resources
Services for ISO 22000
Talk to a consultant
Walk into your ISO 22000 audit with a floor and a food safety team ready to answer.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice