ISO 22000 clause 7.5: keep food safety information controlled and useful

What clause 7.5 requires in practice

Clause 7.5 deals with documented information, a term that covers both instructions and records. Three parts work together. The first sets what the system must contain: information the standard requires, information the organisation decides is needed for effectiveness, and information and food safety requirements demanded by authorities and customers. The second covers creation and updating, asking for suitable identification, format and media, and review and approval for suitability and adequacy.

The third part concerns control. Information must be at hand and fit for use at the place and moment it is needed, and it must be safeguarded against leaks, misuse and damage to its accuracy. The organisation addresses distribution, access, retrieval and use; storage and preservation including legibility; change control; and retention and disposition. External-origin information needed for planning and operation is identified and controlled, and records of conformity are protected from unintended alteration.

How much documentation is appropriate depends on size, complexity and people's competence.

Identify three sources of documentation need

Clause 7.5.1 includes information required by ISO 22000, information the organisation determines is necessary for FSMS effectiveness, and relevant documented information and food safety requirements required by authorities and customers. Do not limit a document register to standard clauses alone.

Consider the decisions personnel need to make and the evidence needed afterwards. A hazard-control instruction and a completed monitoring record have related but different purposes. One explains the current arrangement; the other preserves evidence of an activity or result.

The extent depends on the operation, complexity and personnel competence. A small food business may use concise information, but size does not remove explicitly required documentation or applicable external requirements.

Create information that is fit for use

Creation and updating require suitable identification, description, format and media, with review and approval for suitability and adequacy. Give information enough identity that people can distinguish the product, process or version involved.

Review the content with the people who understand the technical basis and the work. Approval should establish that the information is suitable for its intended use. A neatly formatted instruction can still be technically wrong or impractical at the point of operation.

When information changes, consider related documents, forms, system settings and personnel. Updating a specification while leaving a connected receiving instruction unchanged can create conflicting decisions.

Why document control matters to the business

In a food business, paperwork is a working tool. Operators rely on current instructions, and when something goes wrong, the organisation relies on records to reconstruct what happened and defend its decisions. Wrong or outdated information can lead people to make confident mistakes, while missing or altered records leave the business unable to show that it acted properly.

Disciplined documentation also saves effort. A smaller set of accurate, usable documents is easier to train on, easier to update after a change and less likely to contradict itself. Customers and authorities place weight on records they can trust, and a business that can retrieve evidence quickly tends to resolve complaints, audits and investigations faster.

How to implement clause 7.5

Aim for the least documentation that supports reliable work and credible evidence. A sequence like the following suits most organisations.

1. Collect the documentation requirements in the standard, in customer contracts and in applicable food law, and add what your own operation needs.
2. Separate instructions, which describe how work is done, from records, which show what happened, because they need different controls: instructions are kept current, records are kept unaltered.
3. Agree how documents are identified, who reviews them for technical content and practicality, and who approves them for use, so every controlled item has a clear owner.
4. Decide where current versions live, who can read them and who can change them, and how superseded copies are withdrawn from the workplace.
5. Set retention and disposal rules by considering legal, customer and investigation needs, rather than a single period for everything.
6. Protect records from unintended change, and define how legitimate corrections are made and shown.
7. Check control by following one instruction from approval to its point of use, then retrieving one older record and confirming it can still be read, interpreted and trusted by someone who was not involved when it was created.

Keep documents and evidence dependable

Common nonconformities with clause 7.5

Findings usually show control that works on paper but not at the point of use. Typical examples include:

• Obsolete instructions still available at a workstation alongside current ones, so operators cannot tell which version applies.
• Required documented information that was never created, or exists only in the memory of an experienced employee.
• Records that anyone can edit without a trace of who changed what.
• External specifications used in operation with no identification or update route.
• Retention periods applied without reference to legal or customer needs, or records destroyed by routine clean-up.

Illustrative food-manufacturing example

Illustrative food-distribution example

A distributor keeps traceability records in a shared application. A review finds that users can overwrite a key lot relationship without a dependable history. The organisation assesses suitable access and change arrangements, then checks that the records remain retrievable and trustworthy during a traceability exercise.

The example concerns the evidence function of a food-chain system. Software ownership alone does not establish document control or traceability effectiveness.

Use evidence to test the system

Select a current instruction and follow it from approval to the point of use. Then retrieve a completed record from an earlier period and establish whether it can still be read and interpreted. Include external specifications and archived versions where they influence decisions.

Common problems include treating a document list as proof of control, applying one retention period without examining relevant requirements, and making records editable by everyone for convenience. Another is keeping obsolete information accessible without a clear distinction from the current operating version.

Explore each numbered part