ISO 22000 internal audit: how to audit PRPs and the hazard control plan

What ISO 22000 expects from an internal audit

To audit yourselves under ISO 22000, you run a planned programme of audits, carried out by people who do not audit their own work, that checks both the food safety management system and the operational controls in the plant, reports the results to the food safety team and management, and follows every finding to an effective correction. The requirement sits in clause 9, performance evaluation, beside monitoring, analysis and management review.

The method comes from ISO 19011, the guidance on auditing management systems, whose current edition was published in 2026 and replaced the 2018 edition. ISO 22000 adds what makes a food safety audit different: the auditor has to understand hazards, limits and the physical conditions of a plant well enough to see when a record says one thing and the floor says another.

The programme: frequency weighted by risk and past results

The programme is the plan for the year: which areas and requirements are audited, when and by whom. Every part of the scope is covered within the cycle, but not with equal attention. Three questions set the frequency. How severe is the hazard if this control fails? CCPs, allergen handling, ready-to-eat product and high-care zones come first. What did earlier audits, complaints, verification results and inspections find? Repeated findings bring an area back sooner. What has changed? A new line, product, supplier or shift pattern moves the area forward, because the hazard analysis and PRPs may not have kept up.

A common pattern is to audit high-risk production areas and the hazard control plan more than once a year, and purchasing, document control and training once. Night and weekend shifts, sanitation crews and contracted cleaning or pest control belong in the programme, because failures often happen when the day team is absent. Record the reasoning; a certification auditor will ask why an area with poor verification results was audited only once.

Who audits: competence and independence

Independence means nobody audits work they perform, supervise or wrote the procedure for. The supervisor who signs the metal detector checks does not audit that line; whoever built the HACCP study does not audit the hazard analysis. Small plants manage this by cross-auditing, with an external auditor for any area nobody inside can audit impartially.

Competence has two parts. Audit skill: planning, interviewing, sampling and writing a finding that states the requirement, the evidence and the gap. Food technology knowledge: microbiological, chemical, physical and allergen hazards, how cooking, chilling or metal detection controls them, what a validated limit means and what hygienic design looks like. Without the second, an auditor can confirm a form is signed but not whether the limit on it makes sense. The competence evidence is covered in ISO 22000 training: who needs what, and the competence evidence.

Auditing prerequisite programmes on the floor

PRPs are the basic hygienic conditions: cleaning and sanitation, pest control, personal hygiene, maintenance, water, waste, allergen management, zoning and the state of the building. A cleaning log can be complete while the underside of a conveyor still carries yesterday's residue, so records alone prove little.

Audit PRPs by observation, during production and during cleaning. Watch whether the handwashing and changing sequence into high care is followed without prompting. Stand at a changeover from an allergen-containing product and watch the clean-down and the check that releases the line. Attend a sanitation shift and compare chemical concentration and contact time with the procedure. Look up, behind and under equipment: condensation over open product, flaking paint, gaps under doors, bait stations blocked by pallets. Then take that shift's records and see whether they describe what you watched. Which PRPs apply is explained in Prerequisite programmes and ISO 22002-1: what a plant needs.

Auditing the hazard control plan

How the plan is built belongs to Hazard analysis, OPRPs and CCPs: the hazard control plan; the internal audit tests whether it runs. Four checks do most of the work.

Monitoring records against limits

Compare sampled monitoring values with each critical limit or action criterion. Look for entries written at the end of the shift, identical values all day, readings at a different frequency from the plan, and blank lines.

Corrections and product disposition

For every value outside a limit, follow the trail: was control restored, was affected product identified and held, and was the release or disposal decision recorded by someone authorised to make it?

Calibration of monitoring devices

A probe that reads high makes every cooking record unreliable. Check that CCP and OPRP devices are calibrated or verified at the planned interval against a traceable reference, and that product was assessed when a device was found out of tolerance.

Verification

Confirm that second-person record reviews, metal detector test pieces, environmental swabs and product testing took place, and that someone analysed the results and acted on trends.

Sampling, area by area

Choose samples that can reveal a problem: different shifts and products, days with deviations or complaints, the first batch after a changeover, the busiest period. Trace one lot forward from delivery to dispatch and one backwards from finished product to suppliers.

Reporting, follow-up and the certification audit

Write each finding so that someone who was not there understands it: the requirement, the evidence and the gap. Grade consistently, send the report to the food safety team and area managers, and agree an owner and a date for each finding. A correction fixes the instance; a corrective action removes the cause. Verify closure on the floor or in the records, and feed results into management review and, where a control is involved, into the review of the hazard analysis.

The certification body's audit is performed by an independent, accredited body to decide on certification; it samples the whole system over a few days and cannot advise. Your internal audit runs all year, goes deeper, can recommend improvements and is one of the first records the certification auditor reads. What happens then is covered in ISO 22000 Stage 1 and Stage 2 audits: what auditors check on the floor.

ISO 22000 internal audit: questions buyers ask