ISO 22000 clause 8: connect food safety hazards with effective controls
Clause 8 of ISO 22000 is the operational centre of the FSMS. It connects prerequisite programmes, traceability and emergency arrangements with hazard analysis, validated controls, monitoring, verification and the handling of failures. The parts work together: a detailed hazard control plan cannot compensate for inaccurate product information or a traceability system that loses the link between materials and output.
What clause 8 requires in practice
Clause 8 is where the food safety management system meets production. It is built from nine linked parts. Operational planning and control sets criteria for processes and keeps changes under control. Prerequisite programmes establish the basic conditions that limit contamination. Traceability links incoming materials to what is dispatched. Emergency preparedness prepares for events that threaten food safety.
Hazard control is the technical core: preliminary information, hazard analysis, selection and categorisation of control measures, validation, and a hazard control plan covering critical control points and operational prerequisite programmes. Around it sit updating of that information, control of monitoring and measuring equipment, verification, and control of product and process nonconformities, including potentially unsafe product and withdrawal or recall.
The standard expects these parts to work as one chain. A product description feeds the hazard analysis, which drives the controls, which drive monitoring, which triggers corrections. A break anywhere weakens everything downstream. Outputs include documented information at many points, but the real output is controlled operations.
8.1: plan and control operational processes
Establish process criteria and operate accordingly, retaining enough documented information to demonstrate that work occurred as planned. Maintain and update the processes needed to realise safe products and implement planning actions. Control planned changes, review unintended changes and address adverse consequences. Outsourced processes also need appropriate control.
Practical implementation starts with how work actually moves through the organisation, including handovers and exceptions. A workflow that exists only in a manual gives little confidence when staff use a different route during peak production.
8.2: establish appropriate prerequisite programmes
PRPs support prevention or reduction of contamination in products, processing and the work environment. They need to fit the organisation, its operation and products, apply across the relevant production system and be approved by the food safety team. Applicable legal and agreed customer requirements inform selection.
Consider relevant sector standards and guidance. Programme topics can include layout, utilities, equipment, cleaning, personal hygiene, pest control, material handling and cross-contamination prevention. Document selection, establishment, applicable monitoring and verification. The PRP guide explains why a copied hygiene checklist is not enough.
8.3: establish traceable material and product relationships
The system needs to identify incoming materials from suppliers and the first stage of end-product distribution. Consider links between received lots, intermediate materials, rework and end products. Identify applicable requirements, keep records for a defined period that includes at least product shelf life, and verify and test effectiveness.
Traceability supports targeted investigation and product control, but it does not itself demonstrate product safety. Read the traceability guide for practical tests of record relationships and software-supported processes.
8.4: prepare for emergencies and incidents
Management needs arrangements for events that can affect food safety and are relevant to the organisation's role. Document the response, identify applicable requirements and establish internal and external communication. Actions should reflect the event's magnitude and potential food safety consequences.
Test procedures periodically where practical and review information after events or exercises. A disruption to refrigeration, water or transport may require decisions about affected product as well as recovery of service. Restarting operations does not automatically settle the safety of product exposed during the disruption.
8.5.1: establish a reliable basis for hazard analysis
The food safety team collects and maintains information about applicable requirements, materials, product-contact materials, finished products, processes and equipment. Intended use, reasonably expected handling or misuse and relevant vulnerable consumers need consideration. These details affect which hazards and consequences require attention.
Prepare sufficiently detailed flow diagrams, confirm them on site and describe the process environment. Include relevant outsourced steps, inputs, rework and outputs. A diagram that omits an intermittent operation can conceal a real route by which a hazard is introduced or persists.
8.5.2 and 8.5.3: assess hazards and validate controls
Identify reasonably expected food safety hazards and the stages where they can occur, increase, persist or be introduced. Determine acceptable end-product levels wherever possible, using applicable requirements, intended use and relevant information. Assess likelihood before control and severity of adverse health effects, then identify significant hazards.
Select suitable control measures or combinations and categorise them systematically as OPRPs or controls at CCPs. Consider failure likelihood and consequences, the measure's role and position, and whether criteria, monitoring and timely corrections are feasible. Document the reasoning; a label copied from another site is not a substitute.
Validate that the selected controls can achieve the intended control before implementation and after changes to them. If evidence does not establish capability, modify and reassess. Validation is different from observing today's process or checking whether records were completed. The hazard-control guide develops these distinctions.
8.5.4: operate the HACCP/OPRP plan
The documented plan connects each relevant hazard and control with its criteria, monitoring, corrections, responsibilities and records. CCP critical limits are measurable; OPRP action criteria may be measurable or observable. Their rationale needs evidence appropriate to the control.
Monitoring must detect failure in a timeframe that supports the necessary response. For CCPs, it must enable timely isolation and evaluation of affected product. OPRP monitoring reflects failure likelihood and consequences; subjective observations need supporting instructions or specifications. Define actions for failed criteria, keep potentially unsafe product from release and retain evidence of implementation.
8.6 and 8.7: keep information and measurements dependable
After establishing the plan, update relevant material and product characteristics, intended use, diagrams and process descriptions as needed. Keep the PRPs and hazard control plan current. This avoids a system in which the approved plan and its underlying information describe different operations.
Methods and equipment used for PRP and hazard-control monitoring need to be adequate. Manage calibration or verification, status, protection and records. If equipment or the process environment is unsuitable, assess earlier results and affected product and document action. Software used for monitoring and measuring also needs appropriate validation before use, with relevant changes authorised, documented and validated.
8.8: verify implementation and effectiveness
Plan verification with a defined purpose, method, frequency and responsibility. It checks matters including PRP and plan implementation and effectiveness, acceptable hazard levels and current hazard-analysis inputs. The person responsible for monitoring an activity must not verify that same activity.
Retain and communicate results, and have the food safety team analyse them for performance evaluation. Where specified sample testing shows an unacceptable hazard level, handle affected lots as potentially unsafe and take corrective action. Read the verification guide for examples.
Why clause 8 matters to the business
Clause 8 is where customers, regulators and consumers actually experience your food safety management system. Complaints, rejected loads, recalls and withdrawn certificates almost always trace back to a weakness in this clause: a hazard not identified, a control that could not work, a monitoring result nobody acted on or a lot that could not be traced.
A coherent clause 8 gives management something unusually valuable: predictability. Decisions about new products, suppliers or equipment can be assessed against known hazards and validated controls, and incidents can be contained quickly because affected product is identifiable. It also lowers the cost of quality in the long run, since problems are prevented or caught at the step where they are cheapest to fix, and it gives a clear story to tell when a customer asks how you manage food safety.
How to implement clause 8
Build the chain in the order the product flows, and test each link against real operations. A practical sequence follows.
- Describe your products, materials and processes accurately, including rework, outsourced steps and the intended use of what you make.
- Establish the prerequisite programmes that suit the premises, people and products, and approve them through the food safety team.
- Put a traceability system in place that preserves lot relationships through mixing, splitting and rework, and test it with real examples.
- Carry out the hazard analysis, categorise the control measures, validate them, and write the hazard control plan with limits, monitoring and responses.
- Make sure monitoring and measuring equipment is adequate, identified and calibrated or verified, and that the people who monitor can act on a failure.
- Plan verification by people independent of the monitoring, and analyse the results for management review.
- Define how failures are handled, covering affected product, corrections, corrective action, withdrawal and recall, then practise them.
- Prepare emergency procedures and update the information whenever the operation changes.
Evidence an auditor expects for clause 8
Clause 8 is usually audited by following the product through the process and asking each step to justify itself. Expect an auditor to look for and observe the following:
- the process on the floor matching the flow diagrams and descriptions
- prerequisite programme conditions observed in the premises and their monitoring and verification records
- a traceability test with linked records from material to dispatch
- a hazard analysis traced to control measures, validation evidence and the plan
- monitoring records, calibration status and evidence that deviations were acted on
- records of corrections, corrective actions and product disposition decisions
8.9: control failures and affected product
Competent authorised people evaluate monitoring results and initiate action. Identify and control product affected by failed CCP critical limits or OPRP action criteria. Make corrections, examine causes and evaluate corrective-action needs, retaining evidence of actions and effectiveness.
The release routes differ. Product affected by a CCP critical-limit failure is not released through the OPRP evidence-based release route; it proceeds through the specified disposition arrangements. OPRP failures require evaluation against the standard's conditions. Potentially unsafe products remain controlled until evaluation and disposition, and unsafe product already outside control requires relevant notification and withdrawal or recall.
Withdrawal and recall arrangements need competent authority, communication, product control and evidence of implementation and effectiveness, including suitable testing. The product and process nonconformity guide explains the sequence and boundaries.
Two illustrative operational examples
A hypothetical manufacturer discovers that a rework route is missing from its process diagram. The team reviews the diagram and hazard analysis, checks traceability relationships and determines whether the existing controls remain suitable. The finding is not resolved merely by drawing another arrow; the operational implications require assessment.
A hypothetical caterer serving construction sites experiences a transport disruption. It activates its arrangements, identifies affected product and obtains an authorised food safety decision before service resumes. Restoring the vehicle does not retrospectively demonstrate that the food remained acceptable. Neither example supplies technical limits or a release decision for another operation.
Explore each numbered part
8.1 · turn food safety plans into controlled operations
Operational planning connects food safety intentions with repeatable work. This guide explains process criteria, implementation, maintenance, updating and the evidence needed to show that processes followed the plan. Food-manufacturing and outsourced-storage examples show how to control changes and external processes while connecting organisational risk actions with the technical controls used for safe products.
8.2 · make the food safety foundation dependable
Prerequisite programmes provide the operating conditions that support food safety before and alongside specific hazard controls. This guide explains programme selection, relevant sector guidance, responsibility and verification across premises, people and supporting services. Manufacturing and catering examples show why a written cleaning schedule or generic checklist does not by itself establish an effective programme.
8.3 · prove the links between materials and products
Traceability preserves the relationships between incoming materials, processing and distribution so that affected products can be identified reliably. This guide examines records, rework, lot relationships and effectiveness testing. Manufacturing and food-distribution examples show how gaps in a manual transaction or software configuration can defeat an otherwise plausible traceability system.
8.4 · prepare for disruptions that affect food safety
A disruption becomes a food safety concern when normal controls or essential information can no longer be relied on. This guide connects emergency preparation with response, communication, consequence reduction and learning. Manufacturing and catering examples show how to choose relevant scenarios, test practical arrangements and keep product decisions separate from the pressure to resume service.
8.5 · build a justified HACCP and OPRP plan
Hazard control needs a defensible chain from product and process information to assessed hazards, selected controls, validation and an operating HACCP/OPRP plan. This guide explains those connections without prescribing universal limits or categorisations. Manufacturing and catering examples show why changed ingredients, processes or consumers can require a fresh technical evaluation.
8.6 · keep PRPs and hazard-control information aligned
Hazard-control decisions can change the information on which the analysis began. This guide explains how to update material and product characteristics, intended use, flow diagrams and process descriptions when necessary. Manufacturing and catering examples show how to close the loop between technical decisions and operating documents so PRPs and the hazard-control plan remain consistent.
8.7 · trust the measurements used for food safety decisions
A food safety decision is only as dependable as its measurement or observation method. This guide explains equipment suitability, calibration or verification, protection, software validation and the review of earlier results after a problem. Processing and food-logistics examples show why replacing an instrument or correcting software does not automatically resolve product decisions already made.
8.8 · check that PRPs and hazard controls work
Verification checks whether prerequisite programmes and the hazard control plan operate as intended, while analysis of results identifies wider weaknesses and updating needs. This guide distinguishes verification from validation and monitoring, explains responsibility and records, and uses food-manufacturing and catering examples to show how findings should lead to useful decisions.
8.9 · control, evaluate and decide safely
Responding to a failed food safety control requires more than adjusting the process. This guide connects competent evaluation, identification of affected products, correction, corrective action, release boundaries and withdrawal or recall. It explains the different consequences of CCP and OPRP failures and why commercial pressure cannot replace the evidence required for a product decision.
Frequently asked questions
Are PRPs and OPRPs the same?
No. PRPs provide relevant foundational conditions and activities. OPRPs are selected through hazard analysis to control significant hazards and form part of the hazard control plan.
Can testing replace process control?
Testing can contribute evidence where appropriate, but it does not replace suitable PRPs, validated controls and effective monitoring. A sample result must be interpreted within the relevant product and process context.
Does the standard provide universal critical limits?
No. Limits and criteria require a justified basis appropriate to the hazards and operation. Generic article examples should never be treated as validated parameters for production.
Develop the operational system with competent support
Sterling can help coordinate operational review, documentation, learning and independent-audit preparation. Agreed Effivity ISO & GRC automation software can support management workflows and evidence; specialist validation and technical services should be scoped explicitly. Request a free consultation about your food-chain operations. Review ISO 22000 Food Safety Awareness and HACCP Awareness for the learning foundation.
Return to support or the hub; continue to performance evaluation.