ISO 22000 clause 10.1: correct FSMS failures and prevent recurrence elsewhere

What clause 10.1 requires in practice

Clause 10.1 sets out how the organisation responds when a nonconformity occurs in the FSMS. It must react by taking action to control and correct the nonconformity where applicable, and by dealing with its consequences. It must then evaluate whether action is needed to eliminate the causes, so the issue does not recur or occur elsewhere. That evaluation includes reviewing the nonconformity, finding its causes, and determining whether similar nonconformities exist or could occur.

Any action that is needed is implemented, its effectiveness is reviewed, and the FSMS is changed if necessary. Each corrective action should be in proportion to the impact the nonconformity has had. Under 10.1.2, the organisation retains documented information about the nature of the nonconformities and later actions, and about corrective action results. This clause applies across the whole system, for example to audit findings or missed objectives. Operational failures at CCPs and OPRPs are handled with the specific product rules of 8.9 as well, and both routes can share one investigation.

Why asking whether it happens elsewhere matters

The distinctive demand of this clause is to look beyond the single example. An audit finds one outdated instruction; the real question is whether others are outdated on another shift or at another site. Organisations that stop at the sampled item pay repeatedly, because the same weakness keeps producing findings in different places. Asking the wider question usually exposes a shared cause, such as a document control gap, and fixes it once. It also protects against the embarrassment of an assessor or customer discovering the same defect in a second location soon after a corrective action was reported as complete. For leaders, this approach converts each finding into an opportunity to strengthen the whole system at low incremental cost.

Describe the failure and contain its consequences

Investigate causes and similar situations

Review the nonconformity and determine its causes. Ask whether the same weakness exists or could occur elsewhere, such as another shift, product, site or related process. This wider check is explicit in the requirement and helps avoid fixing only the sampled instance.

Use a suitable investigation method. Process review, interviews and relevant records may be enough for a straightforward issue; complex or recurring failures may require deeper analysis. The standard does not prescribe a universal root-cause tool.

Match action to the cause and the effects of the nonconformity. A new form is useful only if the problem concerns missing or unclear information. Training is appropriate where competence contributes, but it cannot repair every resource or process-design weakness.

Implement and evaluate the action

Carry out the necessary action and review whether it is effective. Define a meaningful way to check the intended result. Completion of the task and effectiveness of the remedy are different questions.

Make changes to the FSMS where necessary. This can include responsibilities, instructions, resources or other arrangements. Use appropriate change control so the remedy does not introduce an unexamined problem elsewhere.

Retain evidence of the nature of the nonconformity, subsequent actions and corrective-action results. The record should explain the reasoning sufficiently for future review.

Illustrative food-manufacturing example

Illustrative catering example

A catering group finds that a new contract was accepted without the required food safety review. It evaluates the contract's implications, investigates the commercial handover and checks other recent contracts for the same gap.

The action changes the approval route and verifies that it works on subsequent proposals. A reminder email alone would not establish that the cause had been addressed.

Evidence and common mistakes