ISO 22000 clause 5.2: connect food safety policy with everyday practice

What clause 5.2 requires in practice

Clause 5.2 has two halves. In the first, top management sets up, uses and keeps a food safety policy. The policy has to suit the purpose and setting of the organisation, offer a frame for setting and reviewing objectives, and carry commitments to meet applicable food safety requirements, to cover internal and external communication, to improve the FSMS continually and to see that food safety competence is secured.

In the second, the policy is held as documented information, communicated and understood and applied at every level, and made available to relevant interested parties as appropriate. Understanding and application are the heart of the second half, so publication alone does not satisfy it.

The outputs are an approved current policy, evidence of how it reached each part of the organisation, and evidence that it affects behaviour and objectives.

Establish direction that fits the organisation

Under clause 5.2.1, top management establishes, implements and maintains the policy. It needs to suit the organisation's purpose and context, provide a framework for setting and reviewing FSMS objectives and include commitment to applicable food safety requirements.

The content also addresses communication, continual improvement and food safety competence. These are important distinctions from a generic statement that the business values quality. A policy should help managers explain why resources, information and capable people are needed to fulfil food safety responsibilities.

Do not turn the policy into a substitute for the hazard control plan. It sets direction; specific processes define operating criteria and actions. Keeping those roles clear allows the policy to remain understandable while technical information is controlled at the appropriate level.

Make communication lead to use

Clause 5.2.2 requires documented policy information and communication, understanding and application at all organisational levels. The policy is also made available to relevant interested parties as appropriate. Posting a statement online does not establish internal understanding, and internal understanding does not require publishing every sensitive instruction.

Choose methods suitable for the workforce. A supervisor can use a realistic decision to explain the policy's meaning; a new manager may need a discussion of the responsibilities behind its commitments. The aim is consistent application, not memorisation of exact wording.

Why a working policy matters to the business

A food safety policy is a promise made to customers, regulators and employees at once. When it is generic, it adds nothing; when it is specific and lived, it helps people choose between speed and caution and gives managers a basis to refuse a shortcut. A well-judged policy also keeps tender responses accurate, because commitments are only made if the business can deliver them. In audits and customer reviews, the question is rarely whether a policy exists. It is whether staff can describe what it means for their own work. Closing that gap protects the brand and lowers the chance that an unsupported promise becomes a complaint.

How to connect the policy with daily practice

Join the two halves of the clause so that what management writes is what people can use. Treat the policy as a management tool that people consult, which means it must be short enough to remember and specific enough to settle a disagreement between speed and caution.

1. Draft the policy from your actual scope, customers and obligations, avoiding promises the business cannot support.
2. Check each commitment against the objectives, resources and competence plans that make it real.
3. Choose communication routes that reach every shift, language group and location, including temporary and contract staff.
4. Give each role a short example of how the policy changes what they do, such as the buyer facing a substitution.
5. Ask staff in a few areas what they would do in a realistic conflict between output and food safety.
6. Place the policy under document control and decide how relevant outside parties will see it.
7. Review it when the scope, services or commitments change.

Evidence an auditor expects for clause 5.2

The auditor will test the content of the policy and then test whether people use it. Both halves need support.

• The current approved policy, with a clear link between its commitments and the FSMS objectives.
• Interviews with managers, supervisors and operators about what the policy means in their work.
• Evidence of how the policy reached agency, night and remote staff.
• Examples of a decision that followed the policy, such as holding a change for review.
• Observation of where the policy is available to relevant outside parties.

Common nonconformities with clause 5.2

Most findings arise where the policy is either too generic to guide or too poorly shared to matter, and they are often raised after talking with staff on a different shift from the one management usually sees.

• Policy wording missing one of the required themes, such as competence or communication.
• Staff unable to describe how the policy relates to their own tasks.
• A promise of zero incidents that the system cannot support.
• Obsolete versions still displayed in some areas.
• Evidence limited to a signature sheet, with no check on understanding.

Illustrative manufacturing example

Illustrative food-service example

A food-service operator receives a new customer request concerning the intended consumers. The service manager explains the request to the food safety team instead of promising that existing arrangements will automatically suffice. Staff receive the resulting relevant instructions through the normal operating channels.

The policy provides the reason for that behaviour, while product information and technical assessment supply the detail. A framed poster in the dining area would not demonstrate that this communication occurred.

Test policy, objectives and behaviour together

Select one policy commitment and examine how it appears in an objective, a resource decision or an operating process. Then ask staff how they would handle a relevant conflict. Differences between the documented direction and actual incentives can be more revealing than a missing acknowledgement signature.

Keep the policy current as the operation changes. A new food-chain role may require management to reconsider its suitability and the way it is explained. Apply the documented-information controls when creating or updating it, and ensure staff can identify the current version.

Common mistakes include absolute promises of zero incidents, a statement copied before the scope is understood, and evidence limited to distribution. Another is measuring communication success only by attendance while no one checks how decisions are made afterwards.

Explore each numbered part