Audit record and checklist for ISO 22000:2005 Audits
Client Name: Client Reference CI/
Audit Team: Date of Audit:
Instruction to Lead Auditor
1. Use this audit record and checklist to determine the emphasis for the ISO 22000 audit.
2. Refer to ISO 22000:2005 for the full description of requirements.
3. ISO 22000 follows the standard CI assessment process.
4. The stage 1 emphasis is for the collection of evidence of preparedness and appropriate FSMS development. If evidence is available place a tick in the stage 1 column against the requirement or make reference to specific observations or NCs raised.
The stage 2 emphasis is for collection of evidence of implementation and use of the developed FSMS. If evidence is available place a tick in the stage 2 column against the requirement or make reference to specific observations or NCs raised.
The surveillance record may be considered as a sample of the stage 2 requirements. Show coverage of all stage 2 implementation requirements at least once within a 3 year cycle by using form F044 FSMS
5. Include the completed audit record and checklist with the audit report, which should include:
¨ Audit report summary sheet, RP1
¨ Audit evidence notes structured against the audit plan, RP3
¨ Audit Plan
¨ Non conformity sheets, RP2
¨ Surveillance planning form, FO73
¨ Audit Brief, FO52
¨ Disclaimer of interest form, FO38
¨ The audit record and checklist completed to show coverage of the audit
¨ A copy of the organisation’s HACCP plan.
¨ A copy of the auditors planning notes indicating anticipated hazards and critical control requirements.
F252 FSMS Rev 1 (Introduced 19 June 2006) Page 1 of 9
Audit record and checklist for ISO 22000:2005 Audits
ISO 22000Clause / ISO 22000 emphasis / Completion in ISO 22000 audit in Stage 1 and/or Stage 2 (ü when completed) /
Stage 1 / Stage 2/Surveillance /
4.1 General / Continual improvement not stressed but required to update FSMS when necessary. However see .8.5.1/8.5.2.
Scope to be defined and products, categories, processes and sites but not required as part of a “Manual”.
Must identify, evaluate and control FS hazards.
Must communicate information regarding product safety issues related to its products.
Must communicate within the organisation concerning the development, implementation and updating FSMS requirements.
Must periodically review the FSMS to ensure the system reflects the organisations activities and incorporates food safety hazards and latest information.
Process flow diagrams are required for the purpose of identifying FS hazards, process steps and control measures required.
4.2.1
Documentation
General
(HACCP Principle 7, step 12) / Does not require an FSMS “Manual”.
4.2.2
Control of
Documents
(HACCP Principle 7, step 12) / Control of documents includes checking the impact of changes on the FSMS.
4.2.3
Control of
Records
(HACCP Principle 7, step 12) / Records are to provide evidence of conformity of the FSMS.
5.1
Management
Commitment / Commitment to food safety must be shown and be supported by business objectives.
5.2
FS Policy / Must address statutory and regulatory requirements.
Must be implemented and maintained at all levels.
Must address detailed communication requirements in 5.6.1, 5.6.2.
5.3 FSMS Planning / Measurable objectives to be included within FS Policy 5.2.
5.4 Responsibility and Authority / All personnel have responsibility to report any problems with FSMS to identified persons. Designated personnel must have defined responsibility and authority to initiate and record action.
5.5 FS Team Leader / Food safety team leader must be appointed to manage FS team and ensure relevant training and education of FS team members.
5.6.1
External Communication / External communication required to provide information on food safety throughout the food chain. Arrangements required to communicate with suppliers and contractors, customers, consumers, statutory and regulatory authorities and organisations that impact, or will be affected by, the effectiveness or updating of the FSMS.
Information must be provided on FS aspects of products, particularly if there are known FS hazards that need to be controlled within the food chain.
Records must be maintained.
Designated personnel must be identified with defined responsibility for external communication on FS.
External communication is input to system updating (8.5.2) and MR (5.8.2)
5.6.2
Internal
Communication / Internal communication systems are required for communicating FS requirements and changes in a timely manner, including detailed requirements a)-m)
Information a)-m) must be included in input to system updating (8.5.2) and MR (5.8.2)
5.7
Emergency preparedness and response / Procedures are required for emergency preparedness and response to manage potential emergency situations and accidents that can impact on FS
5.8.1
Management Review General / Review of measurable objectives is a stated output of MR
5.8.2
Review input / Specific requirements a)-g) are specified. The data must be in a form to permit management to relate the information to stated objectives.
5.8.3
Review Output / Specific requirements a)-d) are specified including assurance of food safety, improvements to the FSMS, resource needs, policy and related objectives.
6.1
Provision of resources / Includes resources to establish and update the FSMS
6.2.1
Human resources General / Introduces the concept of a food safety team and that the responsibilities and authorities of external experts must be defined in contracts.
6.2.2
Competence, awareness and training / Personnel responsible for monitoring and correction to the FSMS must be trained.
Requirements for effective communication, (5.6), must be understood with appropriate records of training including training in competency requirements and monitoring and correction requirements.
6.3
Infrastructure / There is no limitation on the infrastructure needed should ensure the FSMS requirements can be met.
6.4
Work environment / Resources need to be provided to establish, manage and maintain the work environment needed to implement ISO 22000.
7.1
Planning and realisation of safe products.
General / Must implement, operate and ensure effectiveness of planned activities and any changes including PRP(s), operational PRP (s) and/or HACCP plan.
7.2
Prerequisite
Programmes
(PRPs)
7.2.1
7.2.2 / Must establish, implement and maintain PRP(s) to control the likelihood of the introduction of food safety hazards, biological, chemical and physical contamination, including cross contamination between products, food safety hazard levels in the product and processing environment.
The PRP(s) must be appropriate to the organisational needs, size and type of operation, nature of products manufactured and/or handled, be implemented across the entire production system and be approved by the FS team.
The organisation must identify statutory and regulatory requirements related to the PRP(s).
7.2.3 / The organisation must refer to appropriate information including statutory and regulatory requirements, customer requirements and guidelines (refer to Annex c).
The PRP(s) must consider items a)-k) as well as the above.
Verification requirements for the establishment of PRP(s) must be planned and records of verifications maintained.
Activities specified in the PRP(s) must be documented.
7.3.1
Preliminary steps to enable hazard analysis.
General / Relevant information for hazard analysis must be collected, maintained and updated.
Records of hazard analysis must be maintained.
7.3.2
Food Safety Team (HACCP Step 1) / Food safety team must be appointed with knowledge to develop the FSMS, including products, processes, equipment, FS hazards for the scope of the FSMS.
7.3.3.1
Raw materials, ingredients and product contact materials / These must be described sufficient for hazard analysis including characteristics a)-h) and associated statutory and regulatory FS requirements. Descriptions must be regularly updated.
7.3.4
Intended use
(HACCP Step 3) / Intended use, expected handling of the end product, or potential mishandling or misuse must be described sufficient for hazard analysis.
User groups and vulnerable consumer groups to specific hazards must be identified.
Descriptions must be regularly updated.
7.3.5.1
Flow diagrams
(HACCP Step 4 and Step 5) / These must be prepared for product or process categories as a basis for evaluating FS hazards. These must include the sequence and interaction of process steps, any outsourced processes and subcontracted work, the entrance for raw materials, ingredients or intermediates products, reworking, the release of end products, intermediates, by-products and waste.
The FS team must verify the accuracy of flow diagrams and provide records.
7.3.5.2
Description of process steps (HACCP Step 2) / Control measures and process parameters must be described and updated including requirements from external requirements.
7.4.1
Hazard analysis general (HACCP Principle Step 6) / The FS team must conduct a hazard analysis to determine which hazards need to be controlled, the degree of control required and appropriate control measures.
7.4.2.1
Hazard identification and determination of acceptable levels (HACCP Principal Step 6) / Potential food safety hazards must be identified and recorded including preliminary information collated under 7.3, experience, external or historical data, and information from the food chain. How a food safety hazard may be introduced must be indicated.
7.4.2.2
(HACCP Principal Step 6) / Potential food safety hazards must be considered from the preceding and following steps in the operation, process equipment, utilities/services, surroundings and links to the food chain.
7.4.2.3
(HACCP Principal Step 6) / The acceptable level in the end product must be determined for each food safety hazard.
A justification must be recorded taking account of statutory and regulatory requirements, customer food safety requirements, intended use and any relevant data.
An evaluation of each FS hazard must be carried out and recorded with methodology documented.
7.4.3
Hazard assessment
(HACCP Principle Step 6) / Each FS hazard must be assessed to determine whether its elimination or reduction is essential and whether its control is needed. Each FS hazard must be evaluated according to possible severity of ill health effects and likelihood of their occurrence. The methods and results must be recorded.
7.4.4
Selection and assessment of control measures (HACCP Principle Step 6) / An appropriate selection of control measures must be determined based on their effectiveness against identified FS hazards.
Management of control measures through either operational PRP(s) or by the HACCP plan must be categorised and identified.
Items a)-g) refer to the selection process.
Management of control measures is by reference to 7.5 or 7.6 according to categorisation.
7.5
Establishing operational PRP(s) / Operational PRPs must be documented according to items a)-f)
7.6.1
HACCP Plan / The HACCP plan must be documented and for each CCP should include items a)-g)
7.6.2
Identification
Of CCPs
(HACCP Principle Step 7) / For each hazard controlled by the HACCP plan control measures must be identified.
7.6.3
Determination of critical limits for CCPs (HACCP Principle Step 8) / Measurable critical limits must be determined for monitoring at each CCP to ensure food safety hazard levels in the product are not exceeded. The choice of critical limits must be justified and documented. Subjective data must be supported.
7.6.4
System for monitoring of CCP
(HACCP Principle Step 9) / The monitoring system for each CCP must include items a)-f) and be capable of detecting when critical limits are exceeded in time for product isolation before use.
7.6.5
Actions when monitoring results exceed critical limits (HACCP Principle 5 Step 10) / Planned corrections must be specified when critical limits specified in the HACCP plan are exceeded.
Actions must ensure that controlled parameters are brought back under control and that prevention of recurrence is included.
Documented procedures must be established for handling potentially unsafe products as 7.10.3.
7.7
Updating of preliminary information and documents specifying PRPs and HACCP plan
(HACCP Principle 7 Step 12) / Following establishment of operational PRPs and the HACCP plan the information specified in a)-e) must be reviewed and the procedures and instructions amended if necessary.
7.8
Verification planning (HACCP Principle 6 Step 11) / The purpose, methods, frequencies and responsibilities of verification activities must be defined for items a)-e) and results recorded for analysis and action by the FS team.
7.9
Traceability system / Traceability must enable identification of product lots and associated incoming raw materials, processing and delivery records of outgoing products.
Records of traceability must be to defined requirements and according to statutory and regulatory requirements.
7.10.1
Corrections / Procedure required to identify and control products that are affected if there is a loss of control of operational PRPs. Handling of these products and evaluation of the causes of nonconformity must be according to 7.10.3. Approval of corrections must be by responsible persons.
7.10.2
Corrective actions. / Procedure(s) required that specify actions required to eliminate the cause of nonconformities and prevent recurrence in accordance with a)-g). The evaluation and initiation of corrective actions must be by a competent person with appropriate authority and be recorded.
7.10.3.1
Handling of potentially unsafe products.
General / The organisation must prevent nonconforming product entering the food chain unless or until conditions a)-c) are satisfied.
If nonconforming products that do not meet a)-c) have left the control of the organisation, a withdrawal procedure must be initiated, 7.10.4. Authorisation for dealing with unsafe products must be documented.
7.10.3.2
Evaluation for release / Release of product must only be if any of a) or b) or c) apply.
7.10.3.3
Disposition of nonconforming product / Product not meeting 7.10.3.2 must either be reprocessed or destroyed.
7.10.4
Withdrawals / Personnel having authority to withdraw product must be appointed by top management.
A procedure is required for notification to interested parties, handling of withdrawn products and actions required.
Withdrawn products must be held securely.
Withdrawals must be notified to top management and reviewed at MR.
The effectiveness of a withdrawal programme must be verified.
8.1 Validation, verification and improvement of the FSMS.
General / The FS team must plan and implement validation and verification activities of the FSMS.
8.2
Validation of control measure combinations / Prior to implementation of control measures for operational PRPs and the HACCP plan, their capability to achieve intended control either singly or in combination must be validated.
8.3
Control of monitoring and measuring / Evidence is required that monitoring and measuring methods and equipment are adequate for the performance required.
Calibration, adjustment and safe guarding of measuring equipment must meet a)-e) and records maintained.
Validity of previous results must be determined if measuring equipment does not conform to measuring requirements.
The ability of computer software and in measuring and monitoring must be confirmed prior to use.
8.4.1
FSMS Verification Internal Audit / Similar to ISO 9001:2000. The FSMS internal audit must determine whether the FSMS conforms to planned arrangements and that it is effectively implemented and updated (not just maintained)
8.4.2
Evaluation of individual verification results. / The FS team must evaluate verification results and the organisation must initiate appropriate action to achieve conformity. The review must include a)-d).
8.4.3
Analysis of results of verification activities. / The FS team must analyse and record verification results, including audits, for the purposes of a)-e) and for input to MR.
8.5.1
Continual improvement. / Top management must ensure that the effectiveness of the FSMS continually improves through communication, MR, Internal Audit verification results, validation of control measures, corrective actions and FSMS updating.
8.5.2
Updating the FSMS. / The FS team must evaluate the need to update the FSMS at planned intervals. The evaluation must include a)-d) and the updating activities recorded as an input to MR.
F252 FSMS Rev 1 (Introduced 19 June 2006) Page 1 of 9