ISO 22000 clause 8.9.4.1: keep potentially unsafe product under effective control
ISO 22000 clause 8.9.4.1 requires action to prevent potentially unsafe product from entering the food chain unless the specified food safety basis can be demonstrated. Identified product must remain under the organisation's control until it has been evaluated and its disposition determined. The practical challenge is maintaining that control across physical stock, information and people.
What clause 8.9.4.1 requires in practice
Clause 8.9.4.1 is the general safeguard for potentially unsafe product. The organisation acts to stop such product entering the food chain, unless it can show one of three things: the hazard of concern is already at the defined acceptable level, it will be reduced to that level before the product enters the chain, or the product still meets the acceptable level in spite of the nonconformity.
Product identified as potentially unsafe is kept under the organisation's control until it has been evaluated and a disposition decided. If product that had already left the organisation's control is later found to be unsafe, relevant interested parties are told and a withdrawal or recall is started under 8.9.5. Finally, the controls applied, the responses received from interested parties and the authorisation given for dealing with the product are all retained as documented information. The clause therefore covers both product still on site and product that has moved on.
Why an effective hold is worth the effort
Most serious food incidents involve a hold that existed on paper but not in practice: a pallet moved to another warehouse, a lot pulled for rework, or a status that did not follow the stock to a third-party store. The business consequences are customer claims, product withdrawals and the loss of listings with retail buyers. Investing in a hold that works across every route costs little compared with a single recall. It also gives managers confidence to say yes to product when evidence supports it, since they know everything else is truly contained. For auditors and customers, a hold that is visible in both the physical store and the stock system is persuasive proof of operational discipline.
How to implement clause 8.9.4.1
Concentrate on making the hold survive ordinary business activity, because that is where holds usually fail. Ask the people who move stock every day to try to defeat the hold, and strengthen it wherever they succeed.
- List every place product can go: lines, warehouses, external stores, rework areas, returns and loading bays.
- Choose a combination of physical segregation and system status that covers each place, and write down who can change the status.
- Brief shift leaders, warehouse staff and customer service on what a hold means and who to ask before moving anything.
- Trace one held lot through the real process to see whether anything allows it to be used or dispatched.
- Agree the criteria for deciding that product has already left control, and who starts notifications and recall.
- Keep the decision, the responses of interested parties and the approval together in one place linked to the lot.
- Review each completed hold event for any route that was missed, and close the gap in the instruction.
Understand the general evidence conditions
The clause recognises evidence that the hazard has been reduced to the defined acceptable level, will be reduced appropriately before entry into the food chain, or that the product still meets the acceptable level despite the nonconformity.
Apply these conditions together with the more specific release rules. In particular, they do not override the requirement that product affected by a CCP critical-limit failure follows the disposition route.
Define the hazard and the evidence relevant to the actual product. A general statement that the product appears satisfactory cannot establish one of the required food safety conditions.
Make the hold effective across interfaces
Identify affected product, its location and its status. The chosen controls should prevent unintended use, transfer or dispatch while the decision is pending. A physical segregation arrangement, system restriction or combined approach may be suitable depending on the operation.
Check interfaces where status can be lost: internal transfers, external storage, repacking, rework and shift handover. Personnel need to understand what the status means and who has authority to change it.
Do not rely solely on a note in a file that operational staff do not use. Trace one held lot through the actual process to see whether the restriction survives ordinary business activity.
Act when product has already left control
If product outside the organisation's control is subsequently determined unsafe, notify relevant interested parties and initiate withdrawal or recall. Use the organisation's maintained arrangements and applicable requirements for the situation.
Keep relevant communication and responses connected with the product record. The organisation needs to understand which parties received information and what action followed, rather than assuming a sent message establishes recovery.
Retain documented information on controls, related interested-party responses and authorisation for dealing with the product. These records preserve the basis and responsibility for important decisions.
Illustrative food-manufacturing example
A manufacturer places a lot on hold after a control concern. Its warehouse system blocks dispatch, but production can still request the material for rework. The team identifies the gap and extends the control so the pending evaluation cannot be bypassed through a different route.
The product remains controlled until competent personnel determine and authorise the appropriate disposition. The hold label alone was not the complete control.
Illustrative distribution example
A distributor learns that an identified product is unsafe after part of the stock has reached customers. It controls remaining stock, notifies relevant parties and initiates the applicable withdrawal or recall sequence.
The record links affected lots, locations, notifications, responses and authority. It does not treat the stock remaining in its own warehouse as the entire event.
Evidence and common failures
Useful evidence connects identity, status, location, evaluation, authority and outcome. Maintain it through the actual completion of the chosen action. A closed administrative record should not conceal stock still awaiting a decision.
Common failures include informal release instructions, held product moved without status transfer and external warehouses not informed of restrictions. Another is assuming that planned further processing permits uncontrolled movement before the required arrangements are established.
Use traceability and withdrawal or recall as connected capabilities. They support control but do not replace the technical evaluation.
Frequently asked questions
Is a hold label sufficient?
Only if the complete arrangement effectively controls use and release. Check systems, people and transfers as well as the label.
Can these general conditions override the CCP release restriction?
No. Read them with the specific evaluation and disposition requirements in clauses 8.9.4.2 and 8.9.4.3.
What records of authority are needed?
Retain the authorisation for dealing with potentially unsafe product and the related control and response evidence required by the clause.
Check whether a product hold can be bypassed
Discuss a product-status and authority review with Sterling. Scope can include practical controls, learning and suitable Effivity ISO & GRC automation software evidence arrangements. Review HACCP Awareness, the product-control guide and the hub.