ISO 22000 clause 7.5.3: protect current instructions and reliable records

What clause 7.5.3 requires in practice

Clause 7.5.3 asks the organisation to keep controlled the documented information required by the system and by the standard. The outcome has two parts: it must be available and suitable for use when and where it is needed, and it must be properly safeguarded, for example against leaks, misuse and damage to its accuracy.

To achieve this the organisation addresses, as applicable, distribution, access, retrieval and use; storage and preservation, including keeping information legible; control of changes such as version control; and how long information is kept and what becomes of it afterwards. Documented information that comes from outside the organisation and is needed for planning and operating the system is identified and controlled as appropriate. Records kept as evidence of conformity are protected from unintended alteration.

A note explains that access may mean permission only to view, or permission to view and change. The standard sets no particular software or retention period. It expects reasoned arrangements that make current information easy to use and evidence reliable.

Make current information available at the point of use

Determine who needs the information, where the activity occurs and when access is required. A current instruction stored centrally is of limited value if the relevant shift cannot obtain it. Distribution and retrieval arrangements should reflect actual work.

Distinguish current operating information from superseded versions retained for reference or investigation. Older information may need preservation, but it should not be easily mistaken for an authorised instruction. Consider printed copies, local downloads and information embedded in other systems.

Access can involve different permissions. Someone may need to read a document without authority to change it. Decide these arrangements according to the information and the consequences of improper use.

Protect information and its meaning

Protection includes relevant confidentiality, integrity and prevention of improper use. Storage and preservation should maintain legibility and interpretability, whether the information is electronic or on paper. A file that survives but cannot be opened or understood is not adequately useful evidence.

Address change control, retention and disposition as applicable. Identify relevant standard, authority, customer and organisational needs when deciding how long information remains necessary. Do not assume a single convenient retention period is suitable for every record.

For evidence of conformity, protect against unintended alteration. If a legitimate correction is needed, use an arrangement that preserves trust in the record and the circumstances of the correction. Silently replacing an inconvenient result undermines the evidence.

Control necessary external information

External specifications, instructions or other information necessary for FSMS planning and operation need suitable identification and control. Define who determines relevance, how updates are received and how the approved information reaches users.

The organisation may not control the external author's revision process, but it controls how the information is used locally. An old supplier document in a shared folder should not automatically remain the operating reference after a relevant change.

Why protecting instructions and records matters to the business

Food safety decisions are made from documents and defended with records. If a line operator follows a superseded instruction, the process may drift out of control without anyone knowing. If a record can be overwritten or cannot be read a year later, the business loses its ability to show what it did when a customer, regulator or court asks.

Controls also protect commercial information, such as customer specifications and formulations. Good control shortens the time to find evidence in an incident, which can limit the scale of a withdrawal or recall. It also lowers the cost of audits, because retrieval is routine. Finally, it signals to customers that records are dependable, which supports trust in test results, monitoring logs and traceability data.

How to implement clause 7.5.3

Treat control as part of how work flows, not as an archive project. One practical order of work is as follows.

1. Identify where each controlled item is used, and make sure the current version is available at that location in the form the user needs.
2. Define who can read, who can edit and who can approve changes, and match these permissions to the consequence of misuse.
3. Withdraw superseded copies from the workplace, and mark any retained for reference so they cannot be mistaken for current instructions.
4. Choose storage that preserves legibility and meaning, including data context such as codes and units, for as long as the record is needed.
5. Set retention and disposal by looking at legal, customer and investigation needs, and record the reasoning.
6. Agree how corrections to records are made so the original entry and the reason remain visible.
7. Identify external documents that influence operation, and define how updates reach users.

Illustrative food-manufacturing example

Illustrative food-logistics example

A logistics operation retains movement records used to identify affected product. During a test, it finds that an archived export omits the meaning of a status code. The data exists, but a reviewer cannot reliably interpret whether the product was held or available for dispatch.

The organisation preserves the necessary context and checks retrieval again. Evidence protection includes maintaining usable meaning, not just keeping a large volume of files.

Test whether important evidence can be trusted

Common nonconformities with clause 7.5.3

Findings in this area usually come from sampling real documents at the place of use. Typical examples include:

• Uncontrolled printed copies or local downloads still in use after a revision has been issued.
• Records editable by many users with no change history.
• Archives that cannot be opened or interpreted when requested, for example data exports without the meaning of codes.
• Records disposed of before the retention need was met, or kept indefinitely with no reasoning.
• External specifications or customer documents used operationally without identification.