ISO 22000 scope: sites, products and processes, and the mistakes that cost you

What the scope of a food safety management system must name

ISO 22000:2018 deals with the boundary of the system in the clause titled "Determining the scope of the food safety management system", within clause 4 on the context of the organisation. The scope is expected to state which products and services, which processes and which production sites the system covers, and to include every activity that can affect the safety of the end products. It is kept as documented information, so it is written down, approved and version-controlled like any other controlled document.

The scope follows from the work done earlier in clause 4: the issues that shape food safety for your business, the interested parties with requirements and your position in the food chain. A dairy whose retailer demands certification of its whole output cannot certify one yoghurt line. Whether to certify at all is covered in the decision guide for food businesses.

Writing the scope: products, processes, sites and the food chain category

A good scope statement tells a customer who has never visited the plant exactly what is covered. It is built from four elements.

Certification bodies are accredited to ISO/IEC 17021-1, by accreditation bodies recognised through the Global ACI arrangement, and for food safety they also apply ISO 22003-1:2022. That standard divides the food chain into clusters, categories and subcategories, such as primary production, food and feed processing, catering, retail, transport and storage, and packaging. The certification body assigns your activities to one or more of these and may only send auditors qualified for them. A bakery that runs its own delivery fleet may sit in two categories, which changes who audits and for how long. Ask which category is proposed before you sign; the guide to choosing a certification body covers that conversation.

What you can leave out, and what you cannot

You may certify part of what you do, provided the part left out cannot affect the safety of what is certified. Most scope disputes start there.

Legitimate boundaries

A separate site with its own staff, utilities and product flow can be added later. A product group made in a segregated building, with no shared equipment, materials or people, can be excluded if the reasoning is recorded. Trading in product you never handle can sit outside a manufacturing scope.

Boundaries that do not hold

A product made on a shared line cannot be excluded silently. If an uncertified product shares a filler, a cleaning cycle, a chiller or a team with a certified one, its allergens, foreign bodies and microbial load are hazards to the certified product, and the auditor will treat them as such. Shared services work the same way: a common goods-in area, a shared laboratory or water supply reach into the certified scope whether the statement mentions them or not. The realistic options are to include the product or to show, with records, how the controls protect the certified one.

Outsourced processes and the control you keep

Food businesses outsource contract packing, cold storage, transport, pest control, testing and cleaning. ISO 22000 deals with this under the clause titled "Control of externally provided processes, products or services". Outsourcing a step changes who performs it, not who is responsible for it.

So the scope names the outsourced process, and the system shows its control: how the provider is selected and evaluated, the food safety requirements given to them in writing, the monitoring you do (audits, test results, temperature logs) and what happens when they fail. Hazards at an outsourced step still belong in your hazard analysis, as the hazard control plan guide explains.

Multi-site sampling and how scope moves the audit days

Audit time for food safety management systems is not negotiated freely. Under ISO 22003-1 the certification body calculates it from the food chain category, a basic audit time for the site, the number of HACCP studies (broadly, the distinct hazard analyses your product and process flows require) and the effective number of personnel. Each extra product flow, site or category adds time, and a vague scope is sized for its widest reading.

Multi-site sampling is narrower in food than elsewhere. ISO 22003-1 permits it only for certain categories, with a documented rationale, internal audits of every site and one system run centrally; a major finding at one sampled site then affects the certification of all of them. A group with several factories should expect each to be audited. Confirm the rule for your categories before budgeting; the cost guide sets out the drivers.

How the scope reads on the certificate

The certification body transcribes the agreed scope, often tightening the wording, beside the legal entity, the site addresses and the standard and edition. An illustrative example, not taken from any real certificate:

"Manufacture of chilled ready meals and fresh sauces in plastic trays and pouches, including receipt of raw materials, cooking, cooling, packing, cold storage and dispatch, at the site listed."

It names recognisable product groups, shows that cooking and cooling are covered and ties the statement to a site. "Food production" tells a customer nothing. Retailers read scope statements closely, as the guide to verifying a certificate explains. The certificate covers the management system, not a product; "ISO 22000 certified" on a pack is a misuse.

Five scope mistakes that cost you

• Scoping to the tender, not the plant. Scoping for the one customer who asked, then finding the next wants a product not covered, means a scope extension with its own audit.
• The silent exclusion. Leaving out the product with the difficult allergen while it shares equipment with certified products. Auditors see it on the floor.
• Forgetting the warehouse and the trucks. Off-site storage you operate and transport you control are processes; if they are missing from the scope the traceability chain has a gap.
• A scope wider than the evidence. Naming seasonal lines not produced before Stage 2 leaves nothing to sample and questions the hazard analysis.
• Agreeing the category late. Finding at application that you fall in two categories, with more audit time and fewer auditors, can push dates back.

ISO 22000 scope: questions buyers ask