Prerequisite programmes and ISO 22002-1: what a food plant needs, and what auditors check

What ISO 22000 requires, and where it stops

No critical control point can make food safe in a plant where the roof leaks, drains back up and nobody washes their hands. Prerequisite programmes set the hygienic baseline, and the hazard analysis assumes that baseline is in place.

Clause 8.2 of ISO 22000:2018 requires the organisation to establish, implement, maintain and update PRPs suited to its size, operations and products, applied across the production system. In selecting them it must take account of the applicable part of the ISO 22002 series, legal and regulatory requirements, and food safety requirements agreed with customers. The clause lists the kinds of topic to consider, from construction and utilities to cleaning, personal hygiene and product information, but sets no detailed rules.

That is deliberate: ISO 22000 covers the whole food chain, from feed mills to caterers, so the detail sits in sector documents. For a plant, the real question is which ISO 22002 part applies and how far its own programmes meet it. How PRPs connect to OPRPs and CCPs belongs to our guide to the hazard control plan.

The ISO 22002 series in 2025: what changed

Food manufacturers long worked to ISO/TS 22002-1:2009, a technical specification. In July 2025 ISO published ISO 22002-1:2025, Prerequisite programmes on food safety, Part 1: Food manufacturing, as a full International Standard and withdrew the 2009 document. Alongside it came a new part, ISO 22002-100:2025, holding the PRP requirements common to the food, feed and packaging supply chain.

The series now has two layers. Part 100 is the shared base; each sector part adds what is specific to that sector. A manufacturer therefore reads Part 100 and Part 1 together. The same pattern applies to the 2025 parts for catering, food packaging, transport and storage, feed and animal food, and the new part for retail and wholesale.

Three changes show on the floor. Waste now reads as waste, food loss and waste management and recycling, so reducing loss is in scope. Food defence and food fraud form one PRP area in the common requirements. Allergen management is more explicit, covering changeover, sequencing, cleaning, tools, rework, training and labelling. Recall is no longer a standalone PRP heading in Part 1, but withdrawal and recall remain required by ISO 22000 itself.

The PRP areas a manufacturing plant covers

The table follows the headings used across ISO 22002-100 and ISO 22002-1. The auditor's focus reflects common audit practice, not the wording of the standards.

A worked example: one PRP from paper to proof

A bakery runs plain and nut biscuits on a shared line. Its allergen programme starts with a matrix of every raw material and its allergens. Nut products run last before a full clean; the changeover has a written method and a signed line clearance; nut rework is labelled, stored apart and reused only in nut products; labels are checked at every start-up.

What makes that auditable is the evidence it produces: signed changeovers for each run, allergen swabs after cleaning, rework logs that reconcile with batch records, and a monthly trend review. When the auditor picks a random production date, the changeover record appears in minutes. When one failed swab led to a changed cleaning method, the auditor sees a programme that learns.

Verifying that PRPs work

ISO 22000 requires PRPs to be verified as well as the hazard control plan, and this is where many systems are thin. Verification asks whether each programme is done as planned and whether it achieves its purpose.

• Implementation. Scheduled hygiene inspections, checks that records are complete, and observation of practice.
• Effectiveness. Outcome data: swab and environmental results, water tests, pest trends, foreign body complaints.
• Analysis. A regular review by the food safety team, with conclusions and actions feeding the management review.
• Updating. PRPs reviewed before a new product, line, supplier or building change goes live.

Verification should be done by someone other than the person performing the activity; the internal audit then tests the whole arrangement, as our guide to ISO 22000 internal audit explains.

ISO 22000 alone or FSSC 22000: what each requires

Under ISO 22000 alone, the ISO 22002 series is a reference you must take into account; PRPs may also draw on national hygiene rules, customer codes or Codex general principles, provided they suit the operation and are justified. Many plants use ISO 22002-1 anyway, as the most complete checklist available.

FSSC 22000 is built on ISO 22000, the sector PRP part and its own additional requirements. Version 7, published in May 2026, adopts the 2025 series: ISO 22002-100 plus the part for the food chain category, ISO 22002-1 for most manufacturers. Plants moving from Version 6 should map their PRPs to the 2025 structure well before the upgrade audit. Choosing the route is covered in HACCP vs ISO 22000 vs FSSC 22000.

Where PRPs go wrong

• Writing for a building that does not exist. A PRP that assumes sealed floors fails the first site walk; fund the works or record a dated plan.
• Restating the standard. Auditors want your drains, your bait map and your allergens, not ISO 22002 headings.
• Recording without reviewing. Completed checklists with no analysis show activity, not control.
• Leaving contractors outside. Pest, cleaning and maintenance contractors follow the same rules and need verifying.

Prerequisite programmes: questions buyers ask