ISO 22000 clause 8.9.2.2: respond correctly to a CCP critical-limit failure
ISO 22000 clause 8.9.2.2 requires product affected by a CCP critical-limit failure to be identified and handled as potentially unsafe. This is a specific starting point for the response. The organisation must then apply the connected product-control and disposition requirements; it cannot treat the event as only an equipment adjustment or a documentation error.
What clause 8.9.2.2 requires in practice
Clause 8.9.2.2 is short and firm. When a critical limit at a CCP is not met, the affected products must be identified and handled as potentially unsafe, which sends them into the handling rules of 8.9.4. There is no preliminary question of whether the failure was small or whether the product probably looks fine; the status follows the event.
The practical consequences are these. Affected product needs an evidence-based boundary, so the organisation must be able to say which lots or time period were exposed. It stays under control while evaluated. It cannot take the OPRP release routes, because 8.9.4.2 reserves those for OPRP failures only. Its end point is a disposition: further processing, redirection to a harmless use, or destruction. Alongside this, the process itself has to be brought back within limits and the cause addressed through 8.9.3 and 10.1. The clause does not stop corrective work, it ensures product decisions are made separately and safely.
Establish the affected product boundary
Use the monitoring system and process information to identify which product may have been affected. The relevant boundary can depend on the timing of checks, process conditions and traceability information. Determine it from evidence rather than choosing the smallest convenient quantity.
Keep the product under appropriate control while its disposition is determined. The arrangement must prevent unintended use or release across relevant locations. A hold recorded in one system is ineffective if another route still allows dispatch.
Involve designated competent personnel with the necessary authority. Operators need a clear escalation route and enough instruction to initiate the appropriate immediate control.
Preserve the CCP release distinction
Clause 8.9.4.2 states that product affected by failure to remain within CCP critical limits must not be released and must be handled under the disposition requirements. Do not apply the alternative OPRP release conditions to a CCP failure.
A satisfactory end-product sample therefore does not cancel the CCP failure and create an ordinary release route. Sampling may provide information for an appropriate technical evaluation, but it does not rewrite this requirement.
Disposition may involve suitable reprocessing or further processing, redirection to another use that does not affect food safety in the chain, or destruction or disposal. The selected route needs a valid basis, authority and retained evidence.
Restore the process and address recurrence
Return the process to control through appropriate technical action and address the cause using the relevant correction and corrective-action requirements. Keep these activities distinct from the affected-product decision.
A later acceptable monitoring result can show the current condition, but it does not establish the condition experienced by earlier product. The event record should make that difference clear.
If affected product has moved outside the organisation's control, evaluate the relevant communication and withdrawal or recall obligations through the applicable requirements. Do not limit the response to stock still on site.
Why a CCP failure needs a fixed response
CCPs exist because a hazard is serious enough that one step is relied on to control it. A missed limit therefore means the organisation cannot show that control was in place for that product. Customers, retailers and regulators expect that a failed critical point does not end in a shrug and a re-test. A fixed first response removes argument under pressure: supervisors know the product is held, managers know a technical evaluation is needed, and commercial teams know that a satisfactory later reading is not an escape route. That clarity reduces the chance of an unsafe release and gives a defensible account if the event is ever examined by an assessor or authority.
How to implement clause 8.9.2.2
Make the CCP response automatic, so that nobody has to interpret it in the middle of a shift.
- For each CCP, list the critical limit and what monitoring result counts as a failure, using the hazard control plan as the single source.
- Write the immediate actions for the operator: stop or divert, tag the product, and call the named decision-maker.
- Define how the affected period is worked out from the last conforming check, and who confirms it with traceability data.
- State plainly in the response instruction that the OPRP release evidence routes do not apply to CCP failures.
- Set up the disposition request so that a technical evaluator and an approver both appear in the record.
- Link the event to corrective action and, where product left site, to the recall arrangements.
- Rehearse with a heat-treatment scenario and a physical-hazard scenario, and compare how quickly the hold took effect in each, adjusting the instruction where it did not.
Illustrative thermal-processing example
A food processor detects failure of a validated treatment criterion managed at a CCP. The team identifies the affected production interval and controls the product. It restores the process and determines an appropriate disposition using competent technical input.
The team does not release the affected lot because a later sample is satisfactory. It preserves the CCP failure route and documents the authorised disposition and the evidence supporting it.
Illustrative packaged-food example
A manufacturer has justified a particular physical-hazard control as a CCP. A failure against its established critical limit triggers product identification and control. The team examines the relevant period and records to establish which lots are affected.
The chosen control category is specific to this illustrative operation; it is not a universal classification for every similar device. The response follows the site's justified CCP arrangement and the standard's product requirements.
Evidence and common mistakes
Retain the relevant failure information, affected-product identification, evaluation, control and authorised disposition evidence under the connected requirements. Record the process correction and subsequent corrective action separately enough to make each decision understandable.
Common mistakes include narrowing the affected interval without evidence, treating restart as release approval and using OPRP release logic after a CCP failure. Another is recording that product was rejected without showing what ultimately happened to it.
Frequently asked questions
Can a negative test result authorise normal release after CCP failure?
No. Product affected by a CCP critical-limit failure follows the disposition route specified in clause 8.9.4.3.
Must every affected lot be destroyed?
Not necessarily. Other permitted disposition routes can be considered where technically appropriate and properly authorised.
Does the next acceptable reading prove earlier product was safe?
No. It describes the later monitored condition. Earlier product needs its own appropriate control and disposition.
Check your CCP-failure decision path
Discuss a CCP failure scenario with Sterling to examine identification, authority and disposition evidence. Learning and suitable Effivity ISO & GRC automation software support can accompany the agreed process. Review HACCP Awareness, the correction guide and the hub.