ISO 22000 clause 2: distinguish references from additional requirements

What clause 2 requires in practice

Clause 2 tells the reader that the edition has no normative references. In other words, no other publication has to be read as part of its requirements. That is a statement about the standard text only. It does not remove duties that arise elsewhere: food law, customer specifications and any scheme the organisation wishes to join all keep their own force.

The practical requirement is therefore one of discipline. The organisation needs to know which source creates which obligation. The management-system requirements come from this standard. Legal duties come from the regulators that apply to the site and product. Agreed customer terms come from the contract. Sector programme guidance supports choices about prerequisite programmes, and clause 8.2 asks the organisation to identify applicable requirements and to consider relevant guidance when it selects them. A certification scheme can add its own demands for those who choose it.

Nothing in clause 2 asks for a reference library, a special procedure or a particular register.

Identify why a source matters

A source can have several different roles. ISO 22000 supplies the management-system requirements. An applicable customer specification can create a contractual food safety commitment. A sector publication can support PRP selection. A certification scheme can impose additional requirements on organisations seeking that scheme's certification. Record the correct basis rather than labelling everything an ISO 22000 clause 2 obligation.

For example, clause 8.2 requires the organisation to identify applicable requirements and consider relevant PRP guidance. This is a substantive provision elsewhere in the standard. It should not be rewritten as a claim that clause 2 makes every food safety publication mandatory.

Why knowing the source of each requirement matters

When every food safety document is labelled as an obligation of the standard, projects swell and teams argue about what is truly mandatory. When the opposite mistake is made, a binding customer condition or legal duty is treated as optional guidance. Both errors are expensive. Separating the sources lets a business scope its programme accurately, answer a buyer who asks what a certificate does and does not cover, and prepare for an assessment with confidence. It also helps a purchasing or sales manager explain to a customer which commitments come from the contract and which from the standard. Clear provenance protects credibility during audits and complaints.

How to keep sources and requirements distinct

Clause 2 needs no new system. It calls for a habit of recording where an obligation comes from. A simple route is below.

1. Collect the documents already driving food safety work: contracts, customer specifications, regulator notices and sector guidance.
2. For each, note in a sentence whether it is law, an agreed customer term, supporting guidance or a scheme rule.
3. Ask the person who owns the process to confirm that the right team receives the item that affects them.
4. Check that you hold the current published version rather than a draft or an outdated copy.
5. Where an external document is needed to run the system, place it under the control that clause 7.5.3 asks for.
6. Revisit the list when a customer, scheme or legal position changes, and tell the affected owners.
7. If a table helps your team, keep it as an optional aid and avoid describing it as a clause 2 duty.

Evidence an auditor expects for clause 2

Because the clause is short, an auditor tests the habit behind it. The questions are usually practical: where does this customer requirement come from, who knows about it, and how did it reach the operation? Useful evidence is whatever shows that sources are recognised and used correctly.

• Interview with the quality or technical lead explaining how the programme separates law, contract, guidance and scheme rules.
• Control of external documents that operations rely on, with current versions in use at the point of work.
• Contract review notes showing a customer food safety term reaching the people who prepare or handle the product.
• Observation that staff use the guidance the PRP choices claim to rely on.

Common nonconformities with clause 2

Findings seldom cite clause 2 itself. They appear where source confusion causes a gap elsewhere.

• A customer specification that the site treats as optional, so its terms never reach the line.
• Outdated sector guidance still used to justify PRP choices after a newer edition was published.
• An external document used in daily work without any version control.
• A project plan that lists a scheme rule as if it came from the standard, so scheme-specific work is missed; the standard does not impose it. Missed scheme-specific work.
• No one able to explain which authority's food law applies to a particular product or site.

Illustrative manufacturing example

A manufacturer receives a consultant's list of documents for an FSSC project. Purchasing asks which items arise from ISO 22000, which address the relevant sector PRPs and which come from the FSSC scheme. The distinction allows the team to plan the actual requested outcome rather than assume an ISO 22000 certificate alone fulfils it.

Illustrative catering example

A caterer reviews a manufacturing-focused hygiene checklist. Some principles are useful, but the team checks its catering activity, applicable requirements and relevant guidance before adopting the details. It does not treat a publication's existence as proof that every manufacturing arrangement fits a mobile service point.

Keep necessary references usable

Use authorised, current information and identify who notices relevant changes. Necessary externally originated documented information needs suitable control under clause 7.5.3. An optional reference register can record a source's purpose and owner; clause 2 does not prescribe such a register or require a separate reference procedure.

Common mistakes include treating a bibliography as a list of additional mandatory certifications, confusing HACCP guidance with a complete FSMS, and adopting an obsolete publication without checking its status. A draft revision should be distinguished from the published requirement currently used for the programme.