ISO 22000 management review: the inputs, the outputs and the record auditors ask for

What an ISO 22000 management review is for

ISO 22000 places the management review in clause 9, beside monitoring, analysis and internal audit. Its purpose is narrow and demanding: the people who control money, staffing and priorities look at the evidence the food safety system has produced and decide whether it still does its job. The team prepares the evidence; top management weighs it and commits.

In food the distinction matters: a new metal detector, a revalidated cooking step or a supplier dropped after allergen deviations are calls only management can make, and the standard expects to see that it made them.

The inputs: what management must see

ISO 22000 adds food-specific inputs to the usual management system set. Group them into four blocks so the meeting does not become a reading of numbers.

System status and change

Start with the status of actions from the previous review, then the changes in external and internal issues since the last meeting: new products, new lines, new customers, new legislation, a change of ownership or site. The results of the food safety team's system updating activities sit here too, because they show what has already been changed in the hazard analysis, the PRPs and the hazard control plan, and why.

Performance of controls

This is the core of a food safety review. Management should see trends, not single results, in monitoring and measurement, in the analysis of verification activities for the PRPs and the hazard control plan, in nonconformities and corrective actions, and in the results of internal and external audits and inspections, including customer and regulatory visits. Add the performance of external providers, the progress against FSMS objectives, and the review of risks and opportunities with a judgement on whether the actions taken on them worked.

Events and communication

Any emergency situation, incident, withdrawal or recall since the last review belongs on the agenda, with what happened, how quickly it was contained and what the investigation found. So does the relevant information from external and internal communication: customer complaints and requests, feedback from authorities, alerts from suppliers or the sector, and the changes the food safety team was told about by production, engineering and purchasing.

Resources and improvement

Close with the adequacy of resources, meaning people, competence, infrastructure, laboratory capacity and time, and with the opportunities for continual improvement the evidence has revealed.

The outputs: what the review must decide

The output of an ISO 22000 review is a set of decisions and actions. They fall into two groups. The first is continual improvement: which opportunities will be pursued, by whom and by when. The second is change to the system itself: updates to the FSMS, the resources needed to carry them out, and any revision of the food safety policy and the FSMS objectives. Documented information on the results must be retained.

Good outputs are specific: "improve allergen control" is a wish; "revalidate the line 3 changeover clean with protein swabs, production manager, by month end, budget approved" is a decision. Each output should have an owner, a date and, where money or people are involved, an explicit approval.

How often, and who attends

The standard requires planned intervals and leaves the frequency to you. Once a year is the minimum an auditor will accept for a stable operation; most plants find a quarterly review works better, because verification trends, complaints and supplier performance change faster than an annual cycle can follow. Add an extra review after a recall, a serious incident or a major change to products or premises.

Top management must attend, and must be the people who can commit resources: the general manager or plant director, not a delegate without budget authority. The food safety team leader presents the evidence. Production, engineering or maintenance, quality or laboratory, purchasing and, where relevant, sales or customer service should be present for the items they own.

A sample agenda for a quarterly review

A ninety-minute meeting for a single-site plant. Adjust the times, not the order.

How the review links to the food safety team's system updating

ISO 22000 expects the food safety management system to be updated as knowledge and circumstances change, and it gives the food safety team a central role in that work under clause 10. The team takes in what it learns through internal communication, verification analysis, audits, corrective actions and the review's own outputs, and updates the hazard analysis, the PRPs and the hazard control plan accordingly.

The loop runs in both directions. The results of the team's updating activities are an input to the review, so management sees what has changed and why. The review's decisions are then an input to the next round of updating, so the team knows what it must change and with what resources. When auditors test this loop, they pick one review decision and follow it into a revised document, a new validation record or a changed monitoring frequency. If the trail stops at the minutes, the loop is broken. The hazard control plan guide and the internal audit guide cover those activities in depth.

The record auditors ask for

A certification body's auditor will normally ask for the last one or two reviews and read them against the rest of the system. Expect them to look for the following: the date and the attendees, showing that top management was present; the input data itself, or a reference to where it is held, not only a summary; evidence that every required input was considered, including events and communication; the decisions, with owners and dates; and proof that the decisions were carried out, found in later documents and records.

Auditors also compare the review with the floor: a review calling CCP performance satisfactory beside repeated deviations in the monitoring records puts the review itself in question.

What a weak management review looks like

• Held by the wrong people. The food safety team reviews itself and sends minutes to the general manager afterwards.
• Numbers without trends. Monitoring results are listed month by month with no target, no direction and no interpretation.
• Events left out. A customer complaint about a foreign body or a withdrawal is missing because it was "handled at the time".
• No decisions. The outputs say "noted" or "continue to monitor" against every item.

ISO 22000 management review: questions buyers ask