ISO 22000 clause 8.9.4: control, evaluate and dispose of potentially unsafe food

What clause 8.9.4 requires in practice

Clause 8.9.4 covers what happens to product that may be unsafe. Its general rule is to prevent such product from entering the food chain unless the organisation can show the hazard is already at, or will be brought to, an acceptable level, or that the product still meets the acceptable level despite the nonconformity. Until evaluation and disposition are finished, the product is retained under the organisation's control.

Three parts follow. Under 8.9.4.1, product that has already gone beyond the organisation's control and is later judged unsafe triggers notification of relevant parties and a withdrawal or recall, with controls, responses and authorisations kept as records. Under 8.9.4.2, each affected lot is evaluated; CCP-affected product is not released, while OPRP-affected product may be released as safe only on stated evidence. Under 8.9.4.3, anything not releasable gets a disposition, with the approver identified. Taken together, the clause forms one decision chain rather than separate checklists.

Maintain control while the decision is pending

The general requirements address the evidence needed to prevent unsafe entry into the food chain and the need to retain potentially unsafe product under control until evaluation and disposition. Identify the product and maintain its status across relevant locations and systems.

Competent personnel need the information and authority to decide. Commercial urgency does not change the evidence required. A product hold should remain effective even when stock is transferred or personnel change shifts.

If product that has left the organisation's control is subsequently determined unsafe, notify relevant interested parties and initiate the required withdrawal or recall. Do not treat the inability to physically hold the stock as an end to responsibility.

Apply the correct evaluation route

Evaluation for release applies to each lot affected by the nonconformity. Product affected by a CCP critical-limit failure must not be released and follows the disposition requirements.

After an OPRP failure, release as safe requires one of the specified evidence conditions: other evidence of effective control, evidence of the intended combined control outcome, or appropriate sampling, analysis or verification demonstrating conformity with the acceptable hazard levels.

These are substantive evidence conditions. They do not create a general rule that one satisfactory sample permits release after any failure.

Determine and authorise disposition

Disposition addresses products not acceptable for release. Permitted routes include suitable reprocessing or further processing, redirection to another use without affecting food safety in the chain, or destruction or disposal.

The chosen route needs an appropriate technical basis and any applicable external requirements. Record what happened and identify the approving authority. Product should remain controlled until the authorised arrangement is completed.

Why potentially unsafe product needs a decision chain

The moment a lot is questioned, three groups pull in different directions: production wants to keep moving, sales wants to deliver and quality wants to be certain. Without a defined chain the loudest voice tends to win. A clear route from hold, to evaluation, to approved disposition gives each group a role and keeps the food safety judgement with people qualified to make it. It also limits cost, because lots with proper evidence can be released with confidence, while lots without it are dealt with early, before they are shipped and need recalling. For customers and authorities, the existence of this chain, and records showing it was followed, is a strong signal of a trustworthy supplier.

How to implement clause 8.9.4

Treat the three sub-clauses as one workflow and design it end to end before an event tests it. Test each hand-off with people from production, warehouse and quality, because that is where records and reality part company.

1. Map the journey of a questioned lot from first doubt through hold, evaluation, decision and completed action, marking every hand-off.
2. Define what status labels or system blocks apply, and check that they survive transfers, rework requests and shift changes.
3. Appoint evaluators by product area and state what authority each has to release, redirect or reject.
4. Write two separate release routes into the instruction, one for CCP failures and one for OPRP failures, so nobody blends them.
5. Set out how products already outside the site are identified, and when the recall arrangements are triggered.
6. Create one record that follows the lot, showing evidence, evaluator, approver and the physical outcome.
7. Run a desk exercise on a recent event and see whether the record alone tells the full story.

Illustrative food-manufacturing example

Illustrative food-distribution example

A distributor receives information that challenges the safety of identified stock, some of which has moved to customers. It controls remaining stock, evaluates the information with competent personnel and communicates with relevant parties. Where product outside its control is determined unsafe, it initiates the appropriate withdrawal or recall.

The exercise follows product location and status rather than treating a central warehouse hold as complete control of every affected unit.

Evidence and common mistakes

Explore each numbered part