Bookmark and Share

From: Food Quality & Safety magazine, October/November 2006

Strengthening the Food Safety Management System

by John G. Surak

A foodborne disease incident can be devastating for any organization that supplies food to the U.S. market. The cost of a food safety recall is typically millions of dollars and can result in the closing of food processing plants. To minimize this risk, many companies in the supply chain require that their supplier’s implement and maintain HACCP programs.

HACCP is not a new concept. When the Pillsbury Co. (Minneapolis, Minn.) developed HACCP in the late 1950s, it consisted of three principles. In 1997, the Codex Alimentarius Commission (CODEX) published an international standard that defined HACCP as five preliminary steps, and seven principles that are supported by prerequisite programs.

HACCP continues to evolve. Advances in the quality management field allowed food processors to develop a complete food safety management system. This further reduced the risk of creating a food safety incident. During this time, a number of countries including: Australia, Denmark, Germany, Ireland, the Netherlands and the U.S. developed national food safety management standards. In addition, a number of organizations developed third party audit programs of sanitation and HACCP programs. Examples include:

  • Food Marketing Institute and SQF program;
  • Food Products Association and FPA-Safe Food Audit;
  • British Retail Consortium and the BRC Global Standard;
  • CIES - The Food Business Forum and the Global Food Safety initiative.

All of these standards and audit programs are similar but slightly different. As a result, there was an international effort to harmonize the standards into a single ISO standard. ISO 22000 was published in 2005, and defines a state-of-the-art food safety management system (Table 1). The standard has the following characteristics:

  • Utilizable by all organizations in the food chain;
  • Combines the recognized food safety system elements as defined by CODEX;
  • Provides an auditable standard that could be used as part of third party certification;
  • Ensures that the process used to control food safety is validated, verified, implemented, monitored and managed;
  • Focuses only on a food safety.

The working group that developed ISO 22000 intended that ISO 22000 would not replace ISO 9001. Instead, they intended that a food processor use both standards: ISO 22000 to address a food safety management system (FSMS) and ISO 9001 to address a quality management system. Both standards are compatible and have similar structures.

ISO has a unique format when compared to both the U.S. definition of HACCP, developed by the National Advisory Committee on the Microbiological Criteria for Foods (NACMCF), or the CODEX definition of HACCP. NACMCF and CODEX wrote their standards as guidance standards. These standards describe how a food processor can implement HACCP. ISO 22000 is written in auditable form so it can be used as a tool to develop audit plans for either internal audits or third party audits.

ISO 22000 incorporates the five preliminary steps and the seven principles of HACCP. Thus, companies that design a FSMS, which complies with ISO 22000, will have a FSMS that complies with both the Codex definition of HACCP and the NACMCF definition of HACCP.

The strength of ISO 22000 lies in its ability to link the quality management system to the business process. This is done by:

  • Establishing a food safety policy with measurable objectives;
  • Increasing the management responsibilities for the food safety team leader;
  • Implementing a management review process of the food safety management system.

In addition, the ISO 22000 food safety management system does the following:

  • Clarify the role of prerequisite programs in the FSMS;
  • Define food safety communications;
  • Allow for the development of a FSMS without a CCP;
  • Further define the process to update the FSMS;
  • Separate validation activities from verification activities;
  • Present the requirements of a FSMS in an audit format.

Management Responsibility for a FSMS

ISO 22000 defines a management approach to food safety. Therefore, food safety is more than just a function of quality assurance and operations. The production of safe food requires the active involvement of most of the business functions, including, R&D, engineering, purchasing, sales, and human resources. ISO 22000 recognized this by requiring that top management must be committed and involved in the planning and production of safe food. Top management is actively involved in food safety by establishing a corporate food safety policy and food safety objectives and then managing the company to achieve the objectives. The objectives should be specific, attainable, relevant, and time-framed. An objective could be: Make the existing food safety management system compliant to ISO 22000 by the end of the fourth quarter. The policy and the objectives must be communicated, implemented and maintained at all levels in the organization.

Top management conducts periodic management reviews of the food safety management system. The management review is a top level review that is designed to assess the overall effectiveness of the FSMS. In addition, it provides a mechanism that allows every one to commit to the food safety issues that are a priority to top management. The standard lists the following outcomes for the management review:

  • Assuring food safety;
  • Improving the effectiveness of the FSMS;
  • Providing the resources needed to maintain and improve the FSMS;
  • Revising the food safety policy and/or objectives.

The day-to-day management of food safety is the responsibility of the food safety team leader. This individual has the responsibilities to mange the food safety team, ensure that the team has relevant training, and report to top management on the effectiveness and suitability of the food safety management system.

The food safety team has responsibilities that go beyond just conducting the hazard analysis and developing the HACCP plan. The team is responsible for the development, implementation and maintenance of the FSMS. These responsibilities include reviewing and assessing all internal communications that can affect food safety. Relevant internal communications can include: the development of new products, changes in specifications, processes, or packaging materials, changes in regulatory requirements, increase in knowledge of food safety issues that impact products and processes, and relevant inquiries from customers or other external individuals. The review is provided to top management for use in the management review process.

The food safety team is responsible for approving all prerequisite programs, or all of the programs that support the HACCP plan. In addition, the team has the responsibilities for planning and implementing the process to validate control measures, and verify and improve the FSMS. As part of this latter process, the team is provides reports to top management on the status of the FSMS and recommendations for up-dating and improving the system.

A Systems Approach to Food Safety

ISO 2200 takes a systems approach to the development of a FSMS (Figure 1). The FSMS is defined as a continuous process which includes a requirement for continual improvement. The improvement step provides direct input into the start of the process, which is the planning and realization of safe food. In addition, there is a process control loop which is shown as a dotted line in Figure 1. This check ensures that the hazard analysis address is effective in meeting the original planning step for food safety,

ISO 22000 links the prerequisite programs and the HACCP plan into a FSMS. In addition, a number of the prerequisite (PRP) programs “shoulds” become “shalls” or in standards terminology, optional requirement become mandatory requirements.

ISO 22000 separates the prerequisite programs into two major groups:

  • Prerequisite programs that address infrastructure and maintenance of the food safety management system. An example is training.
  • Operational prerequisite programs that are used to control potential food safety hazards. An operational PRP is similar to a control point or CP. An example of an operational PRP is the receiving temperature of raw meat at a poultry further processing plant.

A critical control point (CCP) is defined as a step that can be applied to prevent or eliminate a food safety hazard.

The standard recognizes that the food safety management system may or may not have a HACCP critical control point (Figure 1). As a result, hazard identification and hazard analysis is conducted on all products. As part of this process, the food safety team must determine if the hazards will be controlled through the operational prerequisite programs or through the HACCP plan. The selection of the appropriate control system is dependent on a number of factors including the severity of the adverse health effect and the likelihood of occurrence of the hazard. A number of factors can contribute to the likelihood of occurrence including frequency of the hazard associated with the specific product, effectiveness of the PRP programs, method used to prepare the product in the plant, expected conditions during storage and transportation, and additional processing steps that occur before the consumption of the food.

Separation of Validation and Verification

Traditionally, HACCP classified validation as a system under verification. Recently, food safety experts are rethinking this concept and are separating validation activities from verification activities. Currently, Codex is developing a standard that describes the guidelines for the validation of control measures.

The following definitions can be used to clarify the differences between validation, verification and monitoring:

  • Validation – Obtaining evidence that the control measures managed by the HACCP plan and the operational PRPs are capable of being effective. This is an assessment conducted prior to starting operations.
  • Verification – Confirmation through the provision of objective evidence that the specified requirements have been fulfilled. This is an assessment carried out during and after operations.
  • Monitoring – Conducting a planned sequence of observations or measurements to assess whether control measures are operating as intended. This is an activity undertaken during operations.

ISO 22000 requires that all control measures must be validated to ensure that they are capable of controlling the hazards. Validation consists of ensuring that performance of the control measure meets or exceeds specified expected outcomes.

ISO 2200 Family of Standards

ISO is developing additional standards that are related to ISO 22000. These standards will be known as the ISO 22000 family of standards. At the present time, the following standards will make up the ISO 22000 family of standards:

  • ISO 22000 – Food safety management systems – Requirements for any organization in the food chain.
  • ISO 22001 – Guidelines on the application of ISO 9001:2000 for the food and drink industry. (This will be the revision of ISO 15161:2001.)
  • ISO TS 22003 – Food safety management systems – Requirements for bodies providing audit and certification of food safety management systems. (This standard is currently under development.)
  • ISO TS 22004 – Food safety management systems – Guidance on the application of ISO 22000:2005.
  • ISO 22005 – Traceability in the feed and food chain – General principles and basic requirements for system design and implementation. (This standard is currently under development.)
  • ISO 22006 – Quality management systems – Guidance on the application of ISO 9002: 2000 for crop production. (This standard is currently under development.)
  • ISO 22000 fitness checker – A practical, easy to use check list designed to help SMEs assess their readiness for ISO 22000 certification. (This book will be published the International Trade Centre, Geneva, Switzerland latter this year.)


ISO 22000 provides a number of advantages to food processors wishing to improve their food safety management system. The standard ensures that the food safety management system uses a systems approach to the management of food safety. In addition, the standard is fully compatible with an ISO 9001-based quality management system.

The standards developed by ISO, Codex, and NACMCF have major impacts on food processing companies. These standards are not developed in a vacuum. Food processors should actively participate in the development of standards. This allows the company to benchmark the current industrial practices and develop systems to ensure the company remains competitive in the marketplace.

Food Processors can purchase a copy of ISO 22000 from either ISO ( or the American National Standards Organization (

John G. Surak, Ph.D. is a consultant in process control, statistics, and development of management systems that meet ISO 9001 and 22000 requirements. He is a professor emeritus at Clemson University. He can be reached at 1-864-506-2190 or



Current Issue

Current Issue

February/March 2015

Site Search

Site Navigation