Certification for food businesses

A food safety management system is the set of defined responsibilities, hazard analysis, controls and records that keeps food safe. It includes the basic programmes of cleaning, pest control, personal hygiene and equipment maintenance. If you can say who is responsible, which hazards you identified and how each is controlled, and you have the records to show it, you have the beginning of one.

ISO 22000 is the international standard for it, and it applies to any organization in the food chain. The auditor walks the production line, reads monitoring, cleaning and supplier approval records, and asks staff what they do when a limit is exceeded. Certification means that this system has been audited independently.

Export customers and large retailers often name the scheme they accept, and the name matters. Some accept ISO 22000. Many ask for FSSC 22000, a scheme built on ISO 22000 with additional requirements of its own. Ask your buyer in writing which one they mean and which edition, before you apply.

Ask us about the availability of FSSC 22000 certification before you plan around it. The rules of the country you export to are a separate matter from any certificate, so check the requirements of each destination market as well.

HACCP is a method. You identify the hazards at each step, decide which steps are critical, set limits for them, monitor them, define what to do when a limit is missed, verify that the plan works and keep records. If you do this and keep the records current, you have a strong base.

ISO 22000 is a management system that includes HACCP and adds what the method alone leaves out: management commitment, communication with suppliers and customers, planning, internal audit, review and improvement. The auditor checks that the hazard analysis is current, that the monitoring records are real and that corrective action was taken when something went wrong.

Traceability means that from a finished lot you can find the ingredients, packaging and supplier lots that went into it, and find which customers received it. An auditor may pick a lot and ask you to trace it in front of them, in both directions.

The same system has to support a withdrawal or a recall: someone is responsible, customer contacts are to hand and the steps have been tried before they are needed. ISO 22000 addresses both. Practise the exercise yourself, with records, before the audit.