ISO 22000 gap analysis: what it covers on the floor and in the files, and what you get

What an ISO 22000 gap analysis is, and why a food plant needs one first

A gap analysis answers one practical question before any money goes into implementation: how far is this site from a food safety management system that an accredited certification body would certify? Sterling's consultants review your existing controls against ISO 22000:2018 with its 2024 amendment, walk the process from goods receipt to dispatch, sample the records and talk to the people who run each step. The result is a clear picture of what already meets the standard, what exists but does not work, and what is missing altogether.

Food plants need this step more than most. Many already hold a HACCP certificate, a customer approval or a local food licence, so a great deal of the system exists. The question is whether it holds together: whether the hazard analysis still matches the lines you actually run, whether the prerequisite programmes are working in practice rather than on paper, and whether the records would survive an auditor tracing a lot back to its raw materials.

What Sterling's gap analysis examines

The review covers the whole standard, from context and leadership to improvement, but the weight falls where food safety is won or lost: the operation. The requirements guide explains the clauses themselves.

Prerequisite programmes, on the line

A floor walk comes before the document review, not after it. We look at personal hygiene and changing facilities, cleaning and sanitation, pest control, maintenance and the condition of equipment, allergen segregation and changeover, water supply, waste handling, and the separation of raw and finished areas. We check them against the ISO 22002 part that fits your food chain category and against the legal requirements that apply to the site.

The existing HACCP plan and its hazard analysis

We read the flow diagrams and then verify them on site, because lines change and diagrams rarely follow. We examine whether each hazard was analysed for your product and process or copied from a generic model, whether control measures were categorised on a stated basis, and whether critical limits and action criteria were validated or simply assumed. This is often the largest single gap for plants moving from a standalone HACCP plan.

Records, traceability and supplier approval

We sample monitoring, verification, calibration, hold-and-release and corrective action records to see whether they were completed at the time or filled in afterwards. We test traceability by following one lot forward and back, and we review how suppliers of raw materials, packaging and services are approved and monitored.

People and competence

We establish who is on the food safety team, what training and experience they have, and whether line operators understand the controls they are responsible for.

How it differs from the readiness check and the Stage 1 readiness review

Three activities look at readiness, and they are easily confused. The readiness check is Sterling's free online self-assessment: a short questionnaire that gives you an indication of where you stand, based only on your own answers. The gap analysis is the professional review described on this page, done on site with evidence. The Stage 1 readiness review belongs to the certification body and takes place near the end of the project, to confirm that you are ready for the Stage 2 certification audit; the Stage 1 and Stage 2 guide explains what happens there.

A self-assessment cannot see a cracked floor behind a filler, and a Stage 1 finding arrives when the timetable has least room for it; the gap analysis catches both while they are cheapest to fix.

What you receive

A gap report organised by requirement area

Each finding states the requirement, what we observed, the evidence we saw or did not see, and the risk it poses to food safety and to certification.

A prioritised action plan

Actions are sorted by food safety risk and by lead time, and separated into two streams. Infrastructure works, such as repairs to floors and drains, hand-wash stations, segregation of allergen storage or changes to airflow, need budgets, contractors and approvals, so they must start first. Paperwork and practice actions, such as rewriting the hazard analysis, validating control measures, building the recall procedure or retraining operators, can run in parallel. Each action carries an owner and a target date agreed with your team.

An effort estimate

We estimate the internal time each workstream needs from your food safety team, production and maintenance, the validation or laboratory work likely to be required, and a realistic window for the certification audit. This becomes the basis of the implementation plan, which the implementation plan guide covers in detail.

Who needs to be in the room, and how long it takes

A gap analysis done only with the quality manager misses half the system. Plan for time with these people:

• Plant manager or site head: scope, resources, decisions on infrastructure works and the target date.
• Quality assurance: documents, records, supplier approval, complaints and laboratory results.
• Production supervisors: how the lines actually run on each shift, changeovers and deviations.
• Maintenance: equipment condition, calibration, preventive maintenance and hygienic design.
• HACCP or food safety team leader: the hazard analysis, validation evidence and verification activities.

The duration depends on the number of sites, process lines and product groups, the number of shifts, how complete the existing HACCP documentation is, and whether production is running during the visit. As an indicative estimate, a single plant with a small number of lines is usually covered in a few days on site, with the report issued shortly afterwards; multi-site or high-complexity operations take longer, and the proposal states the days before you commit.

What happens after the gap analysis

The report is presented to management in a closing session, where priorities, owners and the audit window are agreed. Implementation then starts with the level of support you choose: Design™, where your team implements with Sterling's structure, workshops and coaching, or Drive™, where Sterling's consultants take on the agreed consulting and documentation work alongside your process owners. The two are alternatives, not consecutive steps. The findings are loaded into Effivity, included with the engagement at no additional cost and used in 50+ countries, so every action is tracked from the first week and the records the certification body will test build up in one place.

ISO 22000 gap analysis: questions buyers ask