ISO 22000 clause 8.5.4.4: plan the response when a food safety control fails
ISO 22000 clause 8.5.4.4 requires specified corrections and corrective actions when CCP critical limits or OPRP action criteria are not met. The response must prevent release of potentially unsafe product, identify the cause, restore the controlled parameter and prevent recurrence. These are connected responsibilities, but completing one does not automatically complete the others.
What clause 8.5.4.4 requires in practice
When a CCP critical limit or an OPRP action criterion is not met, the organisation has to have specified, in advance, the corrections and corrective actions to take. The clause says what those responses must achieve: potentially unsafe product is not released, the cause of the nonconformity is identified, the controlled parameter is brought back within its limit or criterion, and recurrence is prevented. The detailed rules for corrections and corrective actions sit in clauses 8.9.2 and 8.9.3, and the organisation applies them. So this sub-clause is the link between the hazard control plan and the nonconformity process: the plan must say what happens, and the nonconformity clauses govern how it is carried out. The practical outcome is a response that is written down, understood and ready before any failure occurs.
Protect product while the situation is evaluated
Define how personnel identify and control potentially affected product. The plan should make the response usable when a failure is first detected, including responsibility for escalation and evaluation. Avoid leaving the operator to invent a disposition decision under production pressure.
Use the distinction between CCP failure and OPRP failure in the applicable correction requirements. They have different implications for evaluation and release. A general instruction that any failed product can be released after one satisfactory test is incorrect.
Where product has already moved beyond the immediate process, use traceability and relevant withdrawal or recall arrangements as required. The response needs to follow the affected product, not only the equipment where the failure was found.
Restore control without losing the cause
Take suitable action to return the controlled parameter within the relevant limit or criterion. Competent personnel should determine the appropriate correction. Do not interpret this guide as prescribing a technical repair or food-treatment procedure.
Identify why the nonconformity occurred. Immediate restoration can remove visible symptoms while leaving an underlying problem unresolved. Record relevant facts before they are lost, including conditions, timing and the evidence available.
Apply corrective action to address causes and prevent recurrence. The required work should be proportionate and effective, with evidence that the chosen action worked.
Why clause 8.5.4.4 matters to the business
Failure of a control is the moment of greatest food safety risk and greatest commercial pressure. If the response was not decided in advance, operators face a choice between stopping production and hoping, and the business tends to discover its weak points only during a crisis. A prepared response protects consumers, keeps decisions consistent from one shift to another, and gives investigators a clear record afterwards. It also separates the three things that are easily confused: dealing with the product, getting the process back in control, and stopping the same failure happening again.
How to implement clause 8.5.4.4
Write the response for each control so that, at the moment of failure, nobody needs to invent it. Keep the written response short enough to be used under pressure, with deeper guidance linked rather than pasted in, and make sure every instruction names who acts.
- For each CCP and OPRP, state the first actions: stop or hold, identify the product made since the last acceptable result, and tell the named person.
- Define who evaluates the situation and who may decide what happens to affected product, linking to the rules in clause 8.9.
- Describe how the process is brought back within its limit or criterion, and who may do it.
- Require a cause to be found and recorded, and a corrective action to be considered according to clause 8.9.3.
- Keep the immediate correction, the product decision and the corrective action as separate entries so none is lost.
- Rehearse a failure scenario with the people involved and adjust unclear authority or missing information.
- Review the response arrangements after any real event.
Specify responsibilities before the failure
The hazard-control plan should connect the result with action and authority. Personnel need to know who can hold product, evaluate the situation, authorise relevant disposition and decide when operation can continue.
Consider absence and shift arrangements. If the only authorised evaluator is unavailable, the plan needs a usable route that preserves appropriate control. Convenience should not silently expand an operator's technical authority.
Illustrative food-processing example
A validated process managed at a CCP fails its critical limit. The team controls the affected product, restores the process through appropriate action and investigates the cause. Product status is handled through the applicable requirements rather than being cleared merely because the next process reading is acceptable.
The event review discovers a maintenance-related cause. The corrective action addresses that cause and checks effectiveness, while the product disposition decision remains separately documented.
Illustrative catering example
A caterer records an OPRP observation outside its defined action criterion. The supervisor initiates the specified response, and competent personnel assess the food safety consequences, cause and affected product. They retain the evaluation and any resulting corrections.
The team later reviews whether the instruction and competence arrangements contributed to the event. A refresher briefing is selected only if it addresses the identified need, not as an automatic answer to every failure.
Evidence and common mistakes
Maintain the specified response in the plan and retain the relevant correction, evaluation and corrective-action evidence required by clause 8.9. The records should explain what happened to the product as well as the process.
Common mistakes include recording only equipment adjustment, treating a later acceptable reading as proof about earlier product and closing the event before cause and recurrence are addressed. Another is applying the CCP and OPRP response rules as though they were interchangeable.
Test the response through a scenario with the people who would use it. This can reveal missing authority or information before a real event.
Frequently asked questions
Does restoring the parameter close the incident?
No. Affected product, cause and recurrence still need the applicable evaluation and action.
Are corrections and corrective actions both needed in the plan?
Yes. The standard connects both with failure response, applying the detailed requirements in clauses 8.9.2 and 8.9.3.
Can an operator decide product release?
Only within clearly assigned competence and authority and the applicable release requirements. The plan must not leave this unclear.
Make the failure response clear before it is needed
Ask Sterling to walk through a CCP or OPRP failure scenario. Support can connect product controls, investigation, learning and suitable Effivity ISO & GRC automation software arrangements. Review Root Cause Analysis & CAPA, alongside the hazard-control plan guide and hub.