ISO 22000:2018 – What’s new (Part 3)

This is it! With part 3 is completed my presentation on the main changes of the updated ISO 22000. Next step? The ISO 22000:2018 explained in 25 diagrams e-book! It is only 15 days away. You can read more about it in this Post.

If you haven’t done yet please, read Part 1 and Part 2 now!

In this third article we review clauses 8, 9 and 10.

Clause 8 – Operation

In clause 8 we reach the core of the standard and we can find most of the content related to the Codex HACCP principles and its steps. In fact, only Step 1 (Assemble HACCP team) and Step 12 (Establishing documentation and record keeping) are totally addressed outside clause 8 (in clauses 5.3 and 7.5 respectively). Internal audit, which is a verification procedure (Step 11), is covered in clause 9.2.

Clause 8.1 – Operational planning and control

This clause has several differences when compared with the equivalent 7.1 of the 2005 version. It is more precise about an organization’s responsibility regarding processes that are needed to meet requirements (plan, implement, control, maintain, and update) and provides examples on how to do it (establishing criteria, implementing control of the processes and demonstrating that processes have been carried out as planned). It also introduces the necessity to implement actions in the risk and opportunities assessment.

Clause 8.2 – Prerequisite programmes

Prerequisite programmes are a key aspect of any food safety system. There are some differences when compared with the 2005 version:

• The word update was added in “establish, implement, maintain and update PRP(s)”
• When selecting and/or implementing PRP(s) organizations:

The wording is very important; the standard includes the terms “shall”  indicating a mandatory requirement and “should” indicating a recommendation. This signifies that the only prerequisites organisations must implement (mandatory) are the ones presented in the standard (clause 8.2.4) since ISO/TS 22002 series prerequisites are not compulsory.

• The list of prerequisites in the new ISO 22000 is closely resembles those addressed in the 2005 version. The two main differences are the addition of the terms product information/consumer awareness and supplier approval (although it is probable that most organizations have some related procedure in place to address the management of purchased materials that was present in the previous version).

Clause 8.3 – Traceability system

The new standard presents a list of topics that organization should consider when establishing traceability systems. For example, reworking of materials/products (not mentioned in the previous version) and the relation between the lots of received materials, ingredients and intermediate products to the end products.

The mandatory verification and testing of the traceability system effectiveness is presented in the 2018 version. Although this was not specified in the 2005 version, the guide for its application (ISO 22004:2014) did include a reference to making tests.

What is totally new however, is the reference to quantities reconciliation (end products vs ingredients).

Clause 8.4 – Emergency preparedness and response

In comparison with clause 5.7 of ISO 22000:2005, it is apparent that the term “accident” has been substituted for the term “incident”. This new clause is more comprehensive than the 2005 version (which was just a small paragraph) but most of the new content was developed in ISO 22004:2014. Nevertheless, it should be emphasised that is now mandatory to take actions to reduce the consequences of the emergency situation, and then review and update documentation.

Some new examples of emergency situations were added, including: workplace accidents, public health emergencies, interruptions of services like water, electricity or refrigeration supply.

Clause 8.5 – Hazard Control

Clause 8.5.1 – Preliminary steps to enable hazard analysis

The first step of hazard control is to identify raw materials, ingredients, product contact materials and end products (and their intended use) and to prepare flow diagrams and describe processes.

In this new version, more detail is provided regarding the information that shall be collected to carry out hazard analysis. The previous version only mentioned “All relevant information needed to conduct hazard analysis”. Now, is clear that, at a minimum, the information that shall be collected by the food safety team should include:

1. statutory, regulatory and customer requirements
2. products processes and equipment and
3. food safety hazards

A new item has been added to the information that organizations shall maintain about raw materials, ingredients, product contact materials – namely the source (e.g. animal, mineral or vegetable). This new information is also in place to clarify some misunderstandings that the term “origin” used in the last version brought. In fact, the new wording (for origin) is “place of origin (provenance)” which makes it more obvious that the organization shall identify the provenance of the products.

Regarding flow diagrams and their preparation, it has been specified that the introduction of processing aids, packaging materials and utilities in the flow shall be included in the diagrams.

The number of issues that the food safety team must address when describing processes for the hazards analysis was expanded to:

Clause 8.5.2 – Hazard analysis

Where the 2005 version included the implicit understanding that the food safety team shall conduct hazard analysis based on the preliminary information, in the new version it is stated explicitly at the beginning.

There are also changes to the kind of information that shall be used to identify food safety hazards. The organization shall now use also internal information (epidemiological, scientific and historical data) as well as statutory, regulatory and customer requirements for that purpose. When it comes to identifying the hazards, it was added that organizations shall now consider all steps in the flow diagram (instead of only the steps preceding and following the specified operation) and persons.

In hazard assessment, two very interesting remarks were added (in bold): the likelihood of occurrence shall be determined prior to the application if control measures and the severity evaluated in relation to the intended use.

After hazard identification, determination of acceptable levels and hazard assessment, the next step is to select and categorize control measures. For this, the new version presents several aspects to take in consideration (most of them similar to the last version). But three things are worthy of special consideration:

1. Assessing the feasibility of establishing measurable critical limits and/or measurable/ observable action criteria. This is not entirely new since something was already mentioned in table 1 of ISO 22004:2014
2. Assessing the feasibility of applying timely corrections in case of failure
3. The use of external requirements to choose control measures or impact their strictness

Clause 8.5.4 – Hazard control plan (HACCP/OPRP plan)

This clause combines information that was previously divided into two separate clauses: Establishing the operational prerequisite programmes and Establishing the HACCP plan. This assists in recognising that the Hazard Control Plan includes not only critical limit(s) at CCP but also action criteria for OPRP.

Regarding monitoring systems, the new version introduces the need to document the monitoring methods used and it adds the possibility of using equivalent methods (to calibration) for verification of reliable measurements or observations in the case of OPRPs.

Clause 8.6 – Updating the information specifying the PRPs and the hazard control plan.

This clause remains very similar to the equivalent in the 2005 version (clause 7.7). Besides using a hazard control plan to substitute what was previously considered as operational PRP(s) and HACCP plan, it introduces the requirement to update raw materials, ingredients and product-contact materials characteristics after establishing the hazard control plan.

Clause 8.7 – Control of monitoring and measuring.

There are no major differences in this clause but some adjustments that make it clearer and more specific.

The generic statement in the previous version, “The organization shall provide evidence that the specified monitoring and measuring methods and equipment are adequate to ensure the performance of the monitoring and measuring procedures” has now been declared as mandatory for “monitoring and measuring activities related with the PRP(s) and hazard control plan”.

The clause is more demanding when it comes to the use of software for monitoring and measuring; demanding validation of its adequacy prior to use, and whenever it is changed/updated.

Clause 8.8 – Verification related to PRPs and the hazard control plan

There are 3 differences in this clause that are worth exploring:

1. The list of what verification activities shall consist of, is equivalent to clause 7.8 of the 2005 version with one exception – more than just the implementation of PRP(s) shall be confirmed, but also its effectiveness. (Rewording of operational OPRP(s) and HACCP plan to hazard control plan is also to be noted.)
2. It is now mandatory for the organization to ensure the independence of the person that does verification activities
3. The new version indicates the need to take corrective actions whenever nonconformity in found on testing end product or direct process samples.

Clause 8.9 – Control of product and process nonconformities

Right from the title it is strikingly clear that process nonconformities shall be controlled. Processes nonconformities are addressed in clause 8.9.2.4 which details the information that shall be retained to describe corrections made.

A general clause is added right at the beginning to define that only designated persons (with competence and authority) may evaluate nonconformities, and initiate corrections and corrective actions. In the 2005 version this information was dispersed throughout the clause.

Organizations are now clearly required to take actions to review nonconformities identified by consumers or in regulatory inspections reports (in the last version only customer complaints were given as example).

It is now also unambiguous that any product that fails to remain within critical limits at CCPs shall not be released, and treated according to clause 8.9.4.3 – Dispositions of nonconforming products.

Clause 9 – Performance evaluation

In clause 9 evaluation of the system performance is addressed. It is divided in 3 sub-clauses:

1. Monitoring, measurement, analysis and evaluation is new and forces the organization to define what and when monitoring and measurement should take place and how, when and who shall analyze and evaluate their results
2. Within Internal audits the importance of taking in consideration changes in the FSMS and the results of monitoring and measurement when defining the audits program has been introduced. It also states that there is a duty to report the audit results to the food safety team and relevant management, and that internal audit should check compliance of the FSMS against food safety objectives and policy
3. Management review has undergone several changes, especially in the inputs. Nonconformities and corrective actions, performance of external providers, adequacy of resources and opportunities for continual improvement shall also to be considered as inputs. The concept of external and internal issues is also covered in this clause as an input, whenever any change is considered relevant for the FSMS. Regarding the outputs the mains change is the inclusion of any decisions and actions related to continual improvement opportunities.

Clause 10 – Improvement

The first thing that is noticeable when comparing clause 10 – Improvement (2018 version) and clause 8.5 – Improvement (2005 version) is that there is a new sub-clause which addresses nonconformity and corrective action. There is now clear guidance for the steps to take when nonconformity occurs:

The sub-clause continual improvement (already present in the previous version) now includes the need for an organization to continuously improve the effectiveness of the FSMS as well as its suitability and adequacy. No relevant changes can be found in the last clause of the system (updating the FSMS).

I would like to endorse Patrícia Moyano and Carla Sofia Gomes for the outstanding collaboration in preparing this article.

Disclaimer: The information contained on this article is based on research done in the last months and the authors personal experience and opinion. It is not intended to represent the view of any organization they work for or collaborate with. The authors will not be held liable for the use or misuse of the information provided in the article.