ISO 22000 common mistakes: the ten that fail audits, why they happen, and the fix for each

What does failing an ISO 22000 audit look like?

Usually the certification body's Stage 1 readiness review concludes the food safety management system (FSMS) is not ready and Stage 2 is pushed back. Or Stage 2 raises a major nonconformity, and no certificate is granted until the correction and corrective action are verified. Or a retailer later finds the plan does not match the line.

How findings are graded and closed belongs to the nonconformities guide; what the auditors do on each audit day is in the Stage 1 and Stage 2 guide.

Mistakes 1 to 3: the hazard analysis and the hazard control plan

1. A HACCP plan copied rather than analysed

• Why: a plan from a sister plant or a template looked complete, so the team signed it instead of building it.
• In the audit: the auditor takes the flow diagram onto the floor and walks it. A rework loop or an ingredient the plan never mentions shows nobody confirmed the diagram on site, and every hazard assessed after that step is in doubt.
• Fix: product descriptions, flows and the step-by-step analysis prepared by your own team and confirmed on the line during production, as the hazard control plan guide describes.

2. OPRPs and CCPs categorised by habit

• Why: the old HACCP plan had no OPRPs, so its CCPs were carried forward and everything else became a PRP.
• In the audit: ISO 22000 requires control measures to be categorised through a systematic approach, and the auditor asks for it. A metal detector called a CCP with no recorded reasoning is a finding waiting to be written.
• Fix: a documented assessment for each control measure, kept with the hazard analysis and revisited when the product or process changes.

3. Control measures never validated

• Why: critical limits came from habit or an equipment manual, never tested against the intended control.
• In the audit: the auditor picks a CCP and asks where the limit came from: a study, a regulation, a scientific reference, a challenge test. A limit nobody can justify undermines the plan.
• Fix: validation evidence for every control measure in the plan before it is relied on, repeated when recipes or equipment change.

Mistakes 4 to 6: PRPs, allergens and traceability

4. Prerequisite programmes that exist only on paper

• Why: writing a pest control or cleaning procedure is quicker than repairing a roof, sealing a drain or separating raw and cooked areas.
• In the audit: auditors spend much of Stage 2 on the floor, and the PRPs are what they see first. Peeling paint over an open line or a cleaning schedule signed for a shift that did not run outweighs a well-written manual.
• Fix: PRPs selected against the applicable ISO 22002 part and legal requirements, works scheduled and completed, and checks recorded by the people who carry them out. See the prerequisite programmes guide.

5. Allergen cross-contact left out

• Why: allergens are treated as a labelling matter for the marketing or regulatory team rather than a hazard to control on shared lines.
• In the audit: the auditor compares the production schedule with the allergen matrix and asks how the changeover clean was verified. An unverified changeover is a common, serious finding.
• Fix: an allergen map of ingredients, lines and storage; sensible run order; validated, verified changeover cleaning; label checks at packing.

6. Traceability never tested

• Why: lot codes are recorded at every stage, so the system is assumed to work until the day it is needed.
• In the audit: the auditor names a finished lot and asks for its raw materials, packaging and customers, then asks the reverse. Quantities that do not reconcile show the system was never tested.
• Fix: timed trace exercises in both directions with mass balance, a mock recall at planned intervals, and the results reviewed by the food safety team.

Mistakes 7 to 10: suppliers, the team, internal audit and management review

7. Suppliers approved without evidence

• Why: long-standing suppliers were listed as approved at the start, without criteria or a file.
• In the audit: the auditor picks a high-risk raw material and asks why its supplier is approved: certificate, specification, audit report, delivery monitoring. A name on a spreadsheet is not an answer.
• Fix: criteria for evaluating, selecting, monitoring and re-evaluating suppliers, applied according to the risk of what they supply, with the evidence kept.

8. A food safety team without authority

• Why: the team exists on paper, usually quality staff alone, while production decides what ships.
• In the audit: the auditor asks the team leader who can stop a line, place stock on hold or release it, and then looks for a real case. If production decided alone, leadership commitment is in question.
• Fix: a multidisciplinary team, a leader whose authority is written down and backed by top management, and hold and release decisions recorded against that authority.

9. An internal audit that never visits the floor

• Why: auditing documents is easier than auditing a night shift.
• In the audit: the certification body reads the internal audit reports. If no finding touches a PRP, a CCP record or a changeover, it will test the floor harder itself.
• Fix: a programme that covers the PRPs and the hazard control plan during production, on every shift, by trained auditors who do not audit their own area; see the internal audit guide.

10. A management review without food safety data

• Why: the review is held because it is required, and the minutes record attendance, not results.
• In the audit: the auditor looks for the inputs the standard lists, such as verification results, complaints, audit outcomes and the performance of external providers, and for the decisions that followed. A page with no trends and no actions will not pass.
• Fix: analysed verification, complaint and incident data brought to each review, with decisions, owners and dates recorded. The management review guide sets out the agenda.

Shortcuts that lead to these mistakes

Since 2003 we have seen the same shortcuts offered to food businesses, each producing several of the ten at once.

• The template manual. A ready-made FSMS with your logo delivers mistakes 1, 2 and 4 before the first workshop.
• The records filled in later. Monitoring sheets completed from memory at the end of the shift turn every CCP record into a liability.
• The certificate in days. Validation, PRP works and weeks of production records cannot be compressed, and a certificate from a body without accreditation recognised through the Global ACI arrangement fails the first customer check. Learn how to verify a certificate and choose a certification body.

We set the audit date once the gap analysis has sized the work; the timeline guide explains why.

ISO 22000 common mistakes: questions buyers ask