ISO 22000 clause 6.1: plan for risks and opportunities affecting the FSMS

What clause 6.1 requires in practice

Clause 6.1 asks for three linked steps. In 6.1.1, when planning the FSMS the organisation looks at the context from clause 4.1 and the requirements and scope from 4.2 and 4.3, and works out which risks and opportunities need handling. The reasons are to give assurance that the system can reach its results, to strengthen desirable effects, to prevent or lessen undesired ones and to improve. A note limits the notion to events and consequences affecting the performance and effectiveness of the system, and points out that public authorities handle public health risk while organisations manage food safety hazards through clause 8.

In 6.1.2, actions are planned, with a method of building them into FSMS processes and of evaluating their effectiveness. In 6.1.3, the actions must be proportionate to the effect on food safety requirements, on conformity of products and services for customers and on food-chain party requirements. Notes list possible responses.

6.1.1: identify what could affect the system's results

Consider the relevant issues and requirements identified under clauses 4.1, 4.2 and 4.3. Determine what needs attention so the FSMS can achieve its intended results, strengthen desirable effects, prevent or reduce unwanted effects and improve. Focus on conditions that can change the system's ability to work.

Examples can include insufficient technical cover during expansion, unreliable transfer of supplier changes or a recurring delay in updating instructions. Opportunities may involve a better way to share information or use existing competence. They should have a plausible food safety management benefit, rather than being a collection of general commercial ambitions.

Operational hazards have a separate technical assessment. The possibility that a team lacks competence to assess a new process is a system-level issue. The biological, chemical or physical hazards associated with that process need analysis under clause 8.5.2. A high-level risk register cannot substitute for that work.

6.1.2: integrate action and evaluate whether it works

Plan how to address the selected risks and opportunities, how actions enter FSMS processes and how effectiveness will be evaluated. Give the action an operational home. An entry saying “improve communication” provides little direction if no process owner knows what must change.

Identify the intended result before selecting a measure. If a supplier change routinely reaches production before technical review, a useful action should improve that handover. Checking only how many briefing sessions were held would not establish that the sequence now works.

The standard does not prescribe one risk-scoring matrix or a formal ISO 31000 implementation project. Choose an approach that supports clear decisions and proportionate evidence. A numerical score is not stronger than a reasoned explanation if its scale and assumptions are unclear.

6.1.3: keep the response proportionate

Consider the impact on food safety requirements, conformity of food products and services to customers, and relevant food-chain requirements. Proportionality means matching the response to the consequences. It is not permission to accept unsafe product or disregard an applicable obligation because treatment is inconvenient.

An action can change the process, remove a weakness, use suitable external support or pursue a beneficial new practice. Whatever the approach, assess whether it creates new dependencies or shifts the problem elsewhere.

Why system-level risk planning matters to the business

Many of the failures behind food safety incidents are management failures: a specialist with no cover, a supplier change nobody passed on, an overdue update left unchecked. Clause 6.1 asks the business to find such weaknesses before they cause harm, and to respond in proportion. This keeps effort aimed at what matters instead of spreading across a long list. It also helps leaders choose between competing investments, because each action has an intended result and a test of effect. Customers value suppliers who can show they manage the health of their own system, not just the hazards in their products.

How to plan for risks and opportunities affecting the FSMS

Keep the exercise short, tied to decisions and separate from product hazard analysis. Remember that this is organisational planning about the health of the system. Hazard analysis under clause 8.5.2 answers a different question and needs its own competent method.

1. Review the output of clauses 4.1 to 4.3 with a cross-section of managers and ask what could stop the system working as intended.
2. Write each weakness as a cause and effect, for example a single approver causing delayed reviews.
3. Add genuine opportunities, such as better information sharing, where a food safety management benefit is plausible.
4. Rank by consequence for food safety requirements and customers, using a simple, explainable method.
5. Choose actions that change a process, remove a dependency or add cover, and give each an owner and a date set by the organisation.
6. Decide in advance what evidence will show that the action worked.
7. Review progress at management review and close actions only when the intended result is visible.

Illustrative food-manufacturing example

Illustrative catering example

A caterer sees an opportunity to use a common controlled source for recipe and ingredient information across sites. It plans ownership, access and a method for local teams to recognise updates. A trial checks whether changed information reaches the service points and can be used during busy periods.

The trial also identifies any location with poor access. A more centralised system would not improve the FSMS if it made essential information unavailable where food is prepared.

Evidence and common mistakes