ISO 22000 documentation: what you need, what you do not, and how to keep it lean

Documents and records: the distinction that saves most of the work

The standard uses one term, documented information, for two different things, and most over-documented systems come from treating them alike. The first kind tells people what to do: the scope, the policy, the prerequisite programmes, the hazard control plan, a cleaning schedule, a recall procedure. These are living documents with a version, an approval and an owner, revised whenever the product, the line, a supplier or a regulation changes.

The second kind proves that something was done: a cooking temperature logged at 10:40 by a named operator, a metal detector challenge test, a calibration certificate, a training attendance sheet. Records are retained, protected from alteration and kept for a period you decide, usually linked to shelf life, customer requirements and local food law. Keep the document set small and stable; put the effort into records that are easy to complete at the point of work, because a missing or back-filled record is what becomes a finding.

What ISO 22000 requires you to document

The 2018 edition, as amended in 2024, names the documented information it expects at particular points. Read at the level of its clause titles, the required set is shorter than many plants assume.

Management system (clauses 4 to 7, 9 and 10)

• Scope of the food safety management system: products, processes and sites covered.
• Food safety policy and food safety objectives, measured.
• Competence evidence for people whose work affects food safety, including the food safety team.
• Internal audit programme and results, and management review results.
• Nonconformities and corrective actions, with their results.

Operation (clause 8)

• Prerequisite programmes: selection, implementation, monitoring and verification.
• Traceability records from supplier to customer.
• Emergency preparedness arrangements and evidence they have been tested.
• Hazard analysis inputs: raw material and product information, intended use and verified flow diagrams.
• The hazard analysis, including the justification for the decisions taken.
• Validation of control measures.
• The hazard control plan, covering critical control points and operational prerequisite programmes.
• Monitoring and verification records, including calibration of monitoring equipment.
• Handling of potentially unsafe products, and withdrawal or recall with tested effectiveness.

You are also expected to hold the regulatory and customer food safety requirements that apply to your products, and to control external documents you rely on, such as supplier specifications. The full requirement set is in the requirements guide; the method behind the plan is in the hazard control plan guide.

Common practice, not a requirement

A food safety manual, a fixed list of numbered procedures and a procedure for every clause are all optional. They can help a larger or multi-site organisation, but no auditor can raise a nonconformity because a manual does not exist. What the auditor can raise is a missing justification, an unvalidated critical limit or a gap in the monitoring record.

A minimal document set for a 30-person food plant

Picture a single-site plant of about 30 people making two or three product families on one shift. The set below combines the required documented information with the few working documents that make the system run; your own will vary with product, process and customers.

Most of the controlled content fits in a few dozen pages. The records grow every day, and that is where the system lives.

What to avoid: documentation that fails the floor test

An auditor on a food line compares what is written with what is happening. Three patterns fail that comparison repeatedly.

The hundred-page manual

A long manual that restates the standard in the first person is rarely read and drifts out of date the first time a line changes. If you want an overview, keep it to a few pages that point to where the real controls sit.

Procedures nobody follows

A cleaning procedure naming chemicals the plant stopped buying creates a nonconformity every time an operator is interviewed. Write procedures with the people who do the work, test them on the line, and prefer a one-page illustrated instruction where that suits the task.

A HACCP plan copied from another product

This is the most serious. A hazard analysis borrowed from a template, a sister site or a different recipe will not reflect your raw materials, flow or equipment, and its critical limits will not have been validated for your process. Auditors check the justification behind each decision; a copied plan cannot supply it. Records filled in at the end of the shift from memory fail the same way: they look complete and prove nothing.

Keeping documented information under control

Documented information must be identified, approved, available where needed, protected and changed in a controlled way. For a small plant that means one current version at the point of use, obsolete versions withdrawn from the line, and an owner who approves changes. A new ingredient, supplier, piece of equipment or customer complaint should lead back to the hazard analysis and the documents that depend on it. For records, set a retention period per record type and make sure they can be retrieved quickly during a complaint or recall. Competence records are covered in the training guide.

How Effivity holds the system

Effivity, used in 50+ countries, is included with the engagement, at no additional cost. It keeps controlled documents with version history, approval workflow and owners, so the current PRP or hazard control plan is the one people see. Monitoring, verification, calibration, nonconforming product and corrective action records are captured as forms with dates and users, and reminders prompt the next verification or mock recall before it falls due. At audit, the document, its approval and the matching records sit in one place. The module walk-through is in the Effivity guide.

ISO 22000 documentation: questions buyers ask