ISO 22000 nonconforming products: control, evaluate and decide safely
ISO 22000 clause 8.9 establishes how the organisation responds to product and process nonconformities. Competent authorised people evaluate monitoring information, identify and control affected products, make corrections, investigate causes and determine the appropriate next step. Restoring a process does not automatically demonstrate that product made during the failure is acceptable.
What clause 8.9 requires in practice
Clause 8.9 deals with what happens when monitoring shows that control has been lost. It has five parts. Competent, authorised people evaluate monitoring data (8.9.1). Corrections identify and control affected product and are recorded (8.9.2). Corrective actions find and remove causes and bring the process back under control (8.9.3). Potentially unsafe product is held, evaluated and given a justified disposition, with different rules for failures at CCPs and at OPRPs (8.9.4). Withdrawal and recall are arranged in advance, with authority, notification and effectiveness checks (8.9.5). The clause is built around separating three decisions that are often blurred: what happens to the product, how the process is restored, and how recurrence is prevented. Sterling's teams usually help organisations map these five parts onto one clear route that staff can follow in a real event.
8.9.1 and 8.9.2: act on results and identify affected product
Designate competent people with authority to evaluate monitoring data from OPRPs and CCPs and initiate corrections and corrective actions. When critical limits or action criteria are not met, identify affected products and control their use and release. Document the method for identification, assessment, correction and review.
A CCP critical-limit failure leads to affected products being handled as potentially unsafe. For an OPRP action-criterion failure, determine the food safety consequences and causes, identify affected products and handle them through the relevant evaluation arrangements. Retain evidence of the evaluation and corrections, including the problem, cause and consequences.
8.9.3: address causes and restore lasting control
Evaluate the need for corrective action after failed critical limits or action criteria. The documented arrangements address causes, prevention of recurrence and return of the process to control. Review relevant complaints, inspection information and monitoring trends that may indicate loss of control.
Determine and implement suitable actions, document results and verify effectiveness. Adjusting equipment can be an immediate correction, while investigation may reveal maintenance, specification or competence weaknesses requiring wider action. Keep the product-control decision distinct from the investigation record.
8.9.4: control potentially unsafe product and respect release boundaries
Keep identified potentially unsafe product under control until evaluation and disposition are determined. The organisation must prevent entry into the food chain unless the relevant safety conditions can be demonstrated. If product already outside its control is subsequently determined unsafe, notify relevant parties and initiate withdrawal or recall.
Each affected lot requires evaluation. The standard distinguishes release routes: products affected by failure to remain within CCP critical limits are not released through the route specified for OPRP failures; they are handled through the disposition arrangements in 8.9.4.3. A later favourable sample must not be used casually to override this distinction.
For OPRP failures, release as safe requires the specified supporting evidence, such as evidence that the control was effective, that combined controls achieved the intended performance, or that appropriate evaluation demonstrates acceptable hazard levels. Competent assessment is essential; the article does not provide a release checklist.
Product not acceptable for release may require suitable reprocessing or further processing, redirection to another use that does not affect food-chain safety, or destruction or disposal. The selected route must be appropriate and authorised. Retain evidence of evaluation, disposition and the approving authority.
8.9.5: make withdrawal and recall arrangements workable
Appoint competent people with authority to initiate and carry out timely withdrawal or recall of potentially unsafe end-product lots. Document notification, handling of affected and remaining stock, and the action sequence. Secure products under the organisation's control until appropriate disposition.
Retain the cause, extent and result, and report to management review. Verify implementation and effectiveness through suitable techniques, including practice exercises where appropriate. An exercise should test the actual interfaces, not merely show that a contact list exists.
Why clause 8.9 matters to the business
This is the clause that decides how costly a bad day will be. Organisations with clear authority, quick product identification and a rehearsed recall route usually contain a problem to a single lot or interval. Those without them may face large write-offs, regulator attention and lost customers. The clause also protects the people who work in the system, because it makes responsibilities explicit so that nobody is left to decide alone under pressure. Customers increasingly ask for proof that these arrangements exist and have been tested, which makes this a commercial as well as a safety matter.
How to implement clause 8.9
Prepare the arrangements before an event, and rehearse them with the people who would use them. Start with the highest-consequence processes, since arrangements proven there can be extended to the rest, and involve operations, quality and commercial staff in the rehearsal.
- Name the roles that evaluate monitoring results, check their competence and give them authority and cover for every shift.
- Write a method for identifying affected product, linking monitoring results to production intervals and lots through traceability.
- Set out the different handling for CCP failures and OPRP failures, and the evidence required before product is released as safe.
- Define allowed routes for product that cannot be released, and who approves each route.
- Describe the corrective action process, including cause analysis and checking that the action worked.
- Document the withdrawal and recall arrangements: who decides, who is told, and how stock is controlled.
- Practise a scenario at least once, review the outcome with the team and improve the arrangements.
Illustrative manufacturing example: a failed critical limit
A hypothetical manufacturer records a CCP critical-limit failure. Authorised personnel identify the affected interval and product, prevent its release and apply the appropriate evaluation and disposition arrangements. Separately, the team restores process control and investigates why the failure occurred.
The example deliberately gives no processing limit or disposition recommendation. Re-running the equipment successfully does not retrospectively establish the acceptability of the earlier product. The technical decision depends on the actual hazard, process and evidence.
Illustrative catering example: information arrives after distribution
A hypothetical caterer receives credible information raising a safety concern about a lot used in meals already distributed to workplace locations. Its authorised team identifies the affected products and locations, evaluates the situation and initiates the relevant communications and withdrawal or recall arrangements as required.
The organisation records decisions and responses and controls remaining stock. Later review examines both the incident and the effectiveness of the response. The example shows the importance of traceability and authority; it does not establish a legal notification timetable or a product-specific safety conclusion.
Evidence and common weaknesses
An auditor may follow a deviation through affected-product identification, corrections, evaluation, disposition and corrective-action effectiveness. Common failures include uncertain authority, product released before evaluation, incomplete identification of affected lots and closure based only on process restart.
Explore each numbered part
8.9.1 · give monitoring evaluators competence and authority
Monitoring data needs an evaluator who can recognise its meaning and initiate action. This guide explains the competence and authority required by clause 8.9.1. Food-production and catering examples show how responsibility can fail at shift handovers or external interfaces, and why a completed record does not establish that an appropriate decision followed.
8.9.2 · correct nonconformities while controlling affected food
Correction must address affected product as well as the process condition. This guide explains identification, assessment, control of use and release, review of corrections and required records. Processing and catering examples show the different starting points for CCP and OPRP failures and why restoring operation does not settle the status of food already affected.
8.9.3 · prevent food safety control failures from recurring
Corrective action addresses why a food safety nonconformity occurred and whether the chosen remedy prevents recurrence. This guide explains investigation inputs, cause determination, action and effectiveness verification. Food-manufacturing and catering examples show why retraining or equipment repair should follow evidence, and why closing an action is different from demonstrating that it worked.
8.9.4 · control, evaluate and dispose of potentially unsafe food
Potentially unsafe food needs control until a justified decision determines its fate. This guide connects general product control, evaluation for release and permitted disposition routes. Manufacturing and distribution examples explain the distinct treatment of CCP and OPRP failures, the need to evaluate each affected lot and the records that preserve responsibility and decision authority.
8.9.5 · make food withdrawal and recall work in practice
Withdrawal and recall depend on authority, product identification, communication and controlled handling working together. This guide explains documented arrangements, management reporting and effectiveness checks. Food-manufacturing and distribution examples show how a practice exercise can reveal missing recipients, incomplete stock information or an unclear decision route before the organisation faces a real event.
Frequently asked questions
Can an OPRP failure be ignored if no complaint is received?
No. The consequences and causes need evaluation, with affected product identified and handled appropriately. Absence of complaints is not evidence that the relevant hazard is acceptable.
Does restoring the process release earlier product?
No. Process restoration and affected-product evaluation are separate decisions. Apply the relevant release or disposition requirements to each affected lot.
Is a traceability test a complete recall test?
Traceability supports the response, but recall also involves authority, notifications, coordination and product control. Define and test those arrangements as well.
Prepare authorised teams before a real event
Sterling can help develop responsibilities, documentation and response exercises within an agreed FSMS programme. Effivity ISO & GRC automation software and employee learning can support management evidence and follow-up. Discuss product-control and recall preparedness. Review ISO 22000 Food Safety Awareness for the system foundation and Root Cause Analysis and CAPA for investigation skills, with technical food safety competence retained for product decisions.
Return to verification, clause 8 or the hub; continue to performance evaluation.