ISO 22000 guide
ISO 22000 checklist: every requirement in the order your food safety project meets it, with the evidence auditors sample
Clause by clause: ISO 22000:2018 requirements: every clause explained →
A 61-item working checklist for ISO 22000:2018, from scope and policy through PRPs, hazard analysis, validation, monitoring and recall to internal audit and improvement, with the evidence auditors sample and double weight where audits most often fail.
Key points
- Sixty-one checks take a food business through ISO 22000:2018, with Amendment 1:2024, in the order a project usually reaches them, each paired with the evidence an auditor is likely to sample.
- Clause 8 carries most of the weight. Prerequisite programmes, traceability, hazard analysis, validation, monitoring and recall are where a food safety system is proved or found wanting on the floor.
- Eleven items count double: hazard analysis justification, validation of control measures, OPRP and CCP monitoring records, PRP verification and the tested recall. In Sterling's experience these are where certification audits most often raise nonconformities.
- A tick means the evidence exists and reflects production as it runs. This is a working tool, not a gap analysis; an independent, accredited certification body decides on certification, and Sterling does not certify.
How to use this checklist
Work from the top. The first sections settle the boundary, the leadership and the plan; the long operational block follows the path a food safety team actually takes, from prerequisite programmes through the hazard study to the records that prove control; performance evaluation and improvement close the loop. Within a section, items follow the sequence of the work rather than strict sub-clause numbering.
Three things start early whatever their clause. Document control is needed from the first PRP procedure. The route for handling deviations and potentially unsafe product must be live before the operating period, because what happens during that period is what the auditor samples. And the food safety team should exist before anyone draws a flow diagram.
Tick an item only when its evidence exists and matches what happens on the line, on every shift in scope. The evidence notes show what auditors commonly request; they may choose other records, and they will talk to operators, not only managers. Double-weighted items are flagged; the progress score measures preparation, not the audit outcome. Ticks stay in this browser on this device, so print or save a PDF to share progress, and reset the page to begin again.
What this checklist is not
- Not the readiness check. Sterling's free online readiness check is a short self-assessment taken before a project starts. This list is the inventory you work through during the project.
- Not a gap analysis. Sterling's gap analysis, the first stage of an engagement, walks the plant, reads the HACCP study and samples records, then returns a prioritised action plan. A tick cannot tell whether a critical limit was validated or copied; a trained reviewer can.
- Not the Stage 1 readiness review. That is the certification body's own check, under its accreditation rules, that you are ready for the certification audit.
- Not the standard. Each item paraphrases a requirement in plain language. The text of ISO 22000, available from ISO and national standards bodies, remains the reference, and schemes such as FSSC 22000 add their own requirements on top.
Context and scope (clause 4)
Fix the boundary before anything else: every later item is judged against it.
Leadership and food safety policy (clause 5)
The auditor will test whether top management owns food safety or has delegated it entirely to the quality office.
Planning (clause 6)
Planning here concerns risks to the management system itself; product hazards are handled later in the hazard analysis.
Support, including PRP infrastructure (clause 7)
This is where PRPs start to need works rather than paperwork: the building, utilities and equipment have to support hygienic production.
Operation: PRPs, traceability and emergencies (clauses 8.1 to 8.4)
Prerequisite programmes are the hygiene foundation the hazard control plan depends on; the guide to prerequisite programmes and ISO 22002-1 covers them in depth.
Operation: hazard analysis, validation and the hazard control plan (clause 8.5)
The core of the standard, and the section auditors spend longest on. Method and worked examples sit in the guide to hazard analysis, OPRPs and CCPs.
Operation: monitoring, verification, nonconformities and recall (clauses 8.6 to 8.9)
This block turns the plan into proof. Most double-weighted items live here, because the records either exist from real production or they do not.
Performance evaluation (clause 9)
The auditor expects at least one full internal audit cycle and one management review before the certification audit.
Improvement (clause 10)
The last section proves the system learns from what it finds.
What has to exist for Stage 1, and what has to work by Stage 2
The certification body looks at the same system twice. At Stage 1 it asks whether the design is complete and the site ready; at Stage 2 it asks whether production has been running under that design long enough to prove it. How much operating history is enough, and how long each phase takes, is the subject of the ISO 22000 timeline guide.
| Area | Ready for Stage 1 (readiness review) | Working by Stage 2 (certification audit) |
|---|---|---|
| 4 to 6 Context, leadership, planning | Scope written, policy approved, team appointed, objectives set | Managers explain policy and results; objectives measured |
| 7 Support | Competence defined; documents controlled; infrastructure works planned or done | Training records for the people sampled; current documents at the line |
| 8.1 to 8.4 PRPs, traceability, emergencies | PRPs defined and running; traceability rules set | PRP records over the operating period; a trace and mass balance completed |
| 8.5 Hazard control | Hazard analysis complete; plan approved; validation evidence on file | Operators apply limits and actions exactly as the plan says |
| 8.6 to 8.9 Monitoring to recall | Verification plan approved; recall procedure in place | Monitoring and verification records analysed; mock recall run and reviewed |
| 9 and 10 Evaluation, improvement | Internal audit and management review planned and under way | A full audit cycle and review completed; corrective actions checked |
How Sterling turns the checklist into a certificate
Every item evidenced in daily production, not assembled the week before the audit.
Sterling's expert and experienced consultants start with a gap analysis on your floor, then work with your food safety team at the level of support you choose: Design™, where your team implements with Sterling's structure, workshops and coaching, or Drive™, where Sterling carries the agreed consulting and documentation work alongside your process owners. The PRPs, hazard control plan, monitoring records and mock recall live in Effivity, included with the engagement at no additional cost and used in 50+ countries, so the evidence builds as you produce. We ensure successful certification for our clients. The certificate is issued by the independent, accredited certification body you appoint; Sterling does not certify.
Book a free discovery callISO 22000 checklist: questions buyers ask
Must every item be ticked before we book the certification audit?
Every item that applies should be in place before Stage 2, and the double-weighted ones must have records from real production. Stage 1 can proceed with some operational records still accumulating, but the design, the hazard analysis and the plan should be complete.
Does the checklist work for FSSC 22000?
It covers the ISO 22000 part of the scheme. FSSC 22000 adds the sector PRP specification and its own additional requirements, which need a separate list; the guide comparing HACCP, ISO 22000 and FSSC 22000 explains where they differ.
What if an item does not apply to our operation?
Record why, in the scope or the hazard analysis, and tick it once the reasoning is written down. A packer that performs no heat treatment, for example, still has to show why no step controls that hazard. Expect the certification body to test every such decision.
We already have a HACCP plan. Can we tick the hazard control items straight away?
Only after the food safety team has checked it against the current products, flows and hazards, and confirmed that each control measure is validated and categorised. Existing plans often need their justifications rewritten before they meet the standard.
Who should own this checklist inside the business?
The food safety team leader, with each section assigned to the person who owns that work: maintenance for infrastructure, purchasing for suppliers, production for monitoring. One person ticking everything is a warning sign.
Can one checklist cover several sites?
Use one copy per site. PRPs, flow diagrams and monitoring records are site-specific, and the certification body will audit each site listed on the certificate against its own evidence.
More ISO 22000 guides
Every guide in the ISO 22000 series is written for one question and links back to the hub for the whole picture.
- ISO 22000 for hotels, catering and food service
- ISO 22000 certification cost: what moves the price
- ISO 22000 certification process, step by step
- Choosing an ISO 22000 certification body
- ISO 22000 common mistakes
- Decision guide
- Effivity for ISO 22000: the guide
- HACCP vs ISO 22000 vs FSSC 22000: which one, and when
- Hazard analysis, OPRPs and CCPs: the hazard control plan
- ISO 22000 internal audit: PRPs and the hazard control plan
- Prerequisite programmes and ISO 22002-1: what a plant needs
- ISO 22000 requirements explained, clause by clause
Keep exploring
Explore more about ISO 22000
Watch a video on how to implement ISO 22000 here.
Watch a video on ISO 22000 requirements here.
ISO 22000 resources
Services for ISO 22000
Talk to a consultant
Turn your ISO 22000 checklist into a system that passes on the floor.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice