ISO 22000 hazard control: build a justified HACCP and OPRP plan
ISO 22000 clause 8.5 connects food safety knowledge with a justified hazard control plan. The food safety team establishes reliable preliminary information, analyses hazards, selects and categorises controls, validates their capability and defines how they will operate. The result must fit the actual products, processes and intended use, rather than reproduce another site's plan.
What clause 8.5 requires in practice
Clause 8.5 sets out how an organisation moves from knowing its products and processes to controlling the hazards that matter. It has four main stages. The first is preliminary steps: collecting the information the food safety team needs, including requirements, material and product characteristics, intended use, flow diagrams and process descriptions. The second is hazard analysis: identifying hazards, deciding acceptable levels, assessing likelihood and severity, and selecting and categorising control measures as operational prerequisite programmes or controls at critical control points.
The third stage is validation, which confirms before implementation and after changes that the chosen measures can achieve the intended control. The fourth is the hazard control plan, which records for each control the hazards addressed, criteria, monitoring, corrections, responsibilities and monitoring records.
Critical limits at critical control points are measurable, while action criteria for operational prerequisite programmes may be measurable or observable. The standard's term for the plan is hazard control plan, covering both HACCP and OPRP elements.
8.5.1: establish the information on which analysis depends
Collect, maintain and update relevant requirements and information about products, processes, equipment and hazards. Material information includes the characteristics of raw materials, ingredients and product-contact materials needed for analysis. Depending on the item, composition, origin, handling, storage and acceptance criteria may affect the assessment.
End-product information needs the relevant characteristics, intended shelf life, storage, packaging, food safety labelling or instructions and distribution arrangements. Intended use includes reasonably expected handling and relevant foreseeable misuse. Identify consumer groups where appropriate, including those particularly vulnerable to relevant hazards.
Prepare clear flow diagrams for the products or categories and processes covered. Include relevant inputs, outsourced processes, rework and outputs, then confirm accuracy on site. Describe the process environment and conditions sufficiently for hazard analysis, including relevant seasonal or shift variation. A diagram approved in an office can still omit what happens during a real changeover.
8.5.2: identify hazards and determine significance
Identify reasonably expected hazards in enough detail to assess them and choose controls. Consider product and process information, experience, relevant scientific or historical information, food-chain information and applicable requirements. Identify the stages where a hazard may be present, introduced, increase or persist, including preceding and subsequent food-chain stages.
Determine acceptable levels in the end product wherever possible, taking applicable requirements, intended use and relevant information into account. Keep the basis and justification. A generic label such as “microbiological hazard” may be too broad to support a meaningful assessment of occurrence and consequence.
Assess each identified hazard by considering its likelihood in the end product before controls and the severity of adverse health effects in relation to intended use. Identify significant hazards and document the methodology and results. A numerical score may help organise a method, but the conclusion still needs defensible reasoning and suitable knowledge.
Select and categorise controls systematically
For significant hazards, select measures or combinations capable of preventing or reducing the hazards to defined acceptable levels. Categorise the selected controls as OPRPs or controls at CCPs through a systematic approach. The decision needs to consider both the likelihood that a measure fails and the consequences of failure.
Relevant considerations include the control's effect on the significant hazard, its position relative to other controls and whether it acts alone or as part of a combination. Also assess whether measurable limits or measurable or observable criteria can be established, whether monitoring can detect failure and whether corrections can be applied in time.
Retain the decision process and results, including external requirements that affect the choice or strictness of controls. A decision tree can support analysis but should not be applied mechanically to override the evidence. Neither an equipment name nor a familiar industry example automatically determines the correct category for every operation.
8.5.3: validate capability before relying on the control
Validation establishes that selected measures or combinations can achieve the intended control of significant hazards. Perform it before implementation in the hazard control plan and after changes to those controls. Maintain the methodology and evidence of capability.
If the evidence does not establish capability, modify and reassess the measures or combination. The evidence must be relevant to the actual operating conditions and intended result. Published knowledge may contribute, but the team needs to justify its applicability rather than assume that a parameter effective in a different product or process transfers unchanged.
Keep validation distinct from monitoring and verification. Validation concerns capability; monitoring produces information during operation for timely action; verification checks whether specified arrangements are fulfilled and effective. The three activities support one another, but one cannot simply be renamed to replace another.
8.5.4: translate decisions into an operating plan
The documented HACCP/OPRP plan identifies the hazards addressed, relevant controls, criteria, monitoring, corrections, responsibilities and monitoring records. At CCPs, critical limits are measurable. OPRP action criteria may be measurable or observable. The rationale for determining them needs documented support.
At a CCP, monitoring needs to detect departures from critical limits in time to isolate and evaluate affected product. For OPRPs, the method and frequency need to reflect failure likelihood and consequences. Where observations are subjective, instructions or specifications should support consistent judgement.
Define who monitors, who evaluates results and who can act. Specify the response when limits or criteria are not met, including preventing release of potentially unsafe product, identifying causes, restoring control and preventing recurrence. Implement the plan and retain evidence. A technically sound plan fails operationally if the person recording a result has no route to initiate action.
Why a justified hazard control plan matters to the business
A hazard control plan is the organisation's reasoned answer to the question of why its food is safe. When it is built on accurate information and validated controls, the business can defend its decisions to customers, auditors and regulators. When it is copied from another operation, it may look complete but fail at the first awkward question about a specific process.
Good analysis also saves money. Controls are applied where they matter instead of everywhere, monitoring effort is focused, and unnecessary testing and rework are avoided. It supports product development, because the team can quickly see how a new recipe or pack affects hazards. And in an incident, a clear plan with defined criteria and authority makes the response faster and less contentious.
How to implement clause 8.5
Build the plan from evidence and keep each decision traceable to its source. The sequence below works for most operations.
- Assemble a competent food safety team with knowledge of the products, processes, equipment and hazards in scope.
- Collect and confirm preliminary information, including material and product descriptions, intended use, flow diagrams checked on site, and a description of the process environment.
- Identify hazards at each step, set acceptable levels where possible, and assess likelihood and severity to find the significant ones.
- Select control measures and categorise them through a systematic method, recording the reasoning rather than only the result.
- Validate that the selected measures can achieve control before relying on them, and revalidate after relevant changes.
- Write the hazard control plan with limits or criteria, monitoring methods, responses, responsibilities and records.
- Implement it on the floor, keep the supporting information up to date, and test the whole chain by tracing one hazard from source to record.
Illustrative manufacturing example: a changed product formulation
A hypothetical manufacturer changes a formulation while retaining the same production equipment. The food safety team reviews material and end-product information, intended use and the actual process. It asks whether the change affects hazards, acceptable levels, control capability or monitoring assumptions.
The team obtains suitable technical evidence before concluding that existing controls remain valid. It updates connected information and communicates any revised instructions. The example deliberately supplies no time, temperature or concentration: appropriate values depend on the specific product, process, hazard and validation evidence.
Illustrative catering example: a different consumer group
A hypothetical caterer considers supplying meals to a setting with consumers more vulnerable to a relevant food safety hazard. The team reviews intended use, consumer information and applicable requirements rather than assuming that its ordinary workplace catering assessment transfers unchanged.
The review may affect product choices, the hazard assessment or control arrangements. Competent assessment determines the actual response. The example demonstrates why intended consumers belong in the analysis; it is not dietary or medical advice and does not establish a suitable menu or process.
Evidence and common failure patterns
An auditor may trace one significant hazard from source information to assessment, categorisation, validation, criteria, monitoring and response. The documents should describe the same operation. A discrepancy between the diagram and actual rework, for example, can undermine later conclusions even when the final plan looks detailed.
Frequent weaknesses include copied limits with no applicability argument, missing intended-use information, unjustified control categorisation and validation confused with a record review. Another is monitoring that detects a failure only after product can no longer be identified or controlled. Evaluate the whole decision chain.
Explore each numbered part
8.5.1 · build a reliable basis for hazard analysis
Hazard analysis is only as dependable as the information describing the food and its process. This guide connects material characteristics, end products, intended use, flow diagrams and the process environment. Manufacturing and catering examples show how missing assumptions can distort later decisions and how the food safety team can assemble and maintain a coherent evidence base.
8.5.2 · turn hazard information into justified control decisions
Hazard analysis connects knowledge of the food and process with the controls needed to protect the consumer. This guide explains identification, acceptable levels, significance assessment and control selection as distinct decisions. Manufacturing and catering examples show why a completed scoring sheet is insufficient unless the team can explain its assumptions, technical basis and chosen control arrangement.
8.5.3 · validate that selected food safety controls can work
Validation establishes capability before the organisation relies on a control measure. This guide explains the food safety team's role, the evidence needed for individual or combined controls, and what to do when capability is not demonstrated. Manufacturing and catering examples distinguish validation from routine monitoring, verification and the assumption that a familiar process must be adequate.
8.5.4 · make the HACCP and OPRP plan usable at work
The hazard-control plan turns technical decisions into instructions and evidence that people can use. This guide connects plan content, limits and criteria, monitoring, response and implementation. Food-manufacturing and catering examples show why a plan must explain both normal control and failure handling, with clear authority and a reliable link to affected-product decisions.
Frequently asked questions
Is every important control a CCP?
No. Categorisation follows the systematic assessment of the control and its role. PRPs, OPRPs and CCP controls are distinct concepts; importance alone is not a sufficient classification method.
Can a generic HACCP plan establish conformity?
It may provide a starting point, but the food safety team must establish applicability, adaptation and evidence for the actual operation. Generic information cannot validate site-specific controls by itself.
Can a favourable finished-product test validate every control?
A test result may contribute evidence for a defined purpose. It does not automatically establish the capability of every control across the intended operating conditions or replace the required analysis and monitoring.
Build a defensible control plan with the right competence
Discuss your products, processes and hazard-control needs with Sterling. A scoped programme can combine implementation support, documentation, employee development and Effivity ISO & GRC automation software for agreed management workflows. Define specialist technical and validation work explicitly. Review HACCP Awareness and ISO 22000 Food Safety Awareness as foundations, followed by the deeper competence required for your team's technical decisions.
Return to traceability, clause 8 or the hub; continue to verification.