FSSC 22000 Version 7 Documented Information: What It Asks For, and Where Sites Fall Short

Home / Guides / Documented information

FSSC 22000 · ISO 22000 CLAUSE 8.5 · EVIDENCE

By Mthokozisi Nkosi, founder of ASC Food Safety Consultants. FSSC 22000 and BRCGS Lead Auditor, SAATCA registered R638:2018 Lead Implementer, HPCSA registered Environmental Health Practitioner, MSc International Public Health. Published 18 September 2026.

What FSSC 22000 Version 7 documented information does an auditor ask for first?

The hazard analysis, and the records ISO 22000:2018 clause 8.5 requires you to keep alongside it. Part 2 section 2.1 lists three sets of audit criteria, ISO 22000:2018, the sector prerequisite programme standard and the additional requirements, and clause 8.5 is where the first set produces the most records and the deepest sampling.

The gap on most sites is not knowledge. Teams in Johannesburg and Cape Town describe their CCPs accurately and walk you through the monitoring. What they cannot produce is the thinking behind the numbers, because it happened in a workshop four years ago and nobody wrote it down. ISO 22000:2018 asks for that thinking as documented information in three places, and those three come up short.

What does ISO 22000 clause 8.5 require you to keep?

Six records, named in the clause text itself. Work down the subclauses and the list is explicit.

Clause 8.5.2.2.3 requires documented information concerning the determination of acceptable levels and the justification for the acceptable levels. Clause 8.5.2.4.2 requires the decision-making process and results of the selection and categorization of the control measures, plus the external requirements that can impact the choice and the strictness of the control measures. Clause 8.5.3 requires the validation methodology and evidence of capability of the control measures to achieve the intended control. Clause 8.5.4.1 requires the hazard control plan itself, with six fields per control measure at each CCP or OPRP: the hazards controlled, the critical limit or action criterion, monitoring procedures, corrections if limits are not met, responsibilities and authorities, and records of monitoring. Clause 8.5.4.2 requires the rationale for the determination of critical limits and action criteria. Clause 8.5.4.3 requires the monitoring system as documented information: measurements or observations giving results in an adequate time frame, methods or devices, calibration methods, frequency, results, and responsibility and authority.

Notice the pattern. Three of the six are the plan and its operation, and most sites hold those. Three are the reasoning behind the plan, and most sites do not.

Where is the justification for your acceptable level?

In most systems, nowhere, or folded into a sentence in the manual that says the company complies with applicable legislation. Clause 8.5.2.2.3 does not accept that. It requires you to determine the acceptable level in the end product of each food safety hazard identified, whenever possible, and in doing so to ensure that applicable statutory, regulatory and customer requirements are identified, to consider the intended use of end products, and to consider any other relevant information. Then it requires documented information concerning both the determination and the justification.

Good evidence is a table with one row per hazard and end product pairing. Columns: the hazard, the product or product group, the acceptable level as a figure and a unit, the source of that figure named specifically rather than as legislation, the intended use, and a sentence explaining why that level is acceptable for that use. Where a customer specification is stricter than the regulation, say which one and record that you took the stricter of the two.

The case that exposes a weak record is a ready to eat chilled product and Listeria monocytogenes. The level is not a matter of opinion, and it differs by country of sale and by whether the product supports growth. A justification reading reduce to acceptable levels has determined nothing. One that names the regulation for the country of intended sale, the customer specification, which is stricter, and the intended use has done the whole of 8.5.2.2.3 in four lines.

How do you record the CCP or OPRP categorisation?

As a decision with its workings shown, not as an answer. Clause 8.5.2.4.2 says that in addition to the hazard assessment, for each control measure the systematic approach shall include an assessment of the feasibility of three things: establishing measurable critical limits or measurable or observable action criteria, monitoring to detect any failure to remain within them, and applying timely corrections in case of failure. It then requires the decision-making process and results of the selection and categorization to be maintained as documented information, and separately requires the external requirements that can impact the choice and strictness of control measures to be maintained too.

Good evidence is one row per control measure with five columns: can a measurable limit be set, can monitoring detect failure in a useful time, can a timely correction be applied, the resulting categorisation as CCP or OPRP, and the external requirement that constrained the choice where one did. Signed and dated by the food safety team.

The habit to break is the decision tree printout with no answers on it. A blank tree in the appendix is evidence that you own a decision tree. The clause asks for the decision-making process and the results, which means the reasoning for this control measure on this line, not the method in the abstract.

Why is the critical limit rationale the record most often missing?

Because the limit was inherited, and nobody inherits the reasoning with it. A pasteuriser runs at the temperature and hold time it has always run at. A metal detector rejects at the sensitivity the supplier set at commissioning. A chiller pulls down within the window the previous quality manager wrote on the form. All three may be correct. None of them is evidenced.

Clause 8.5.4.2 is short and unambiguous. Critical limits at CCPs and action criteria for OPRPs shall be specified, and the rationale for their determination shall be maintained as documented information. It adds that critical limits at CCPs shall be measurable, and that conformance with critical limits shall ensure that the acceptable level is not exceeded. Action criteria for OPRPs shall be measurable or observable, and conformance with them shall contribute to the assurance that the acceptable level is not exceeded.

Read the second sentence carefully, because it is what makes the rationale hard to fake. The rationale has to close the loop back to 8.5.2.2.3. It is not enough to say where the number came from. You have to be able to show that holding the number keeps the hazard at or below the acceptable level you determined for the end product.

Good evidence for a thermal CCP names the source, whether a process authority publication, a validation study or a legislative requirement; the target organism and the log reduction the limit delivers; the safety margin applied and why; a cross reference to the acceptable level record; and the date, reviewer and review interval. Four or five lines. For a metal detector the same shape: sphere sizes achieved at commissioning and on the current product matrix, the test record, the reject verification frequency, and the link to the acceptable level.

This is the record our hazard analysis tool refuses to let you leave blank, and the design came from audit experience rather than software preference. If the rationale is optional in the tool, it is empty in the file.

What does 2.5.12 PRP verification want on file?

Routine site inspections, and the risk basis that sets their frequency and content. Requirement 2.5.12 is headed PRP Verification (Food Chain (Sub)Categories BIII, C, D, E, FI, G, I & K), it applies in addition to ISO 22000:2018 clause 8.8.1, and it carries a single bullet: the organization shall establish, implement and maintain routine, for example monthly, site inspections and PRP checks to verify that the site internally and externally, the production environment and processing equipment are maintained in a suitable condition to ensure food safety, with the frequency and content based on risk, with defined sampling criteria, and linked to the relevant technical specification.

Four phrases in that bullet are each a record. Routine means a schedule you can show, with dates kept. Based on risk means a rating that explains why the raw intake dock is walked weekly and the dry goods store monthly. Defined sampling criteria means you have written what a sample is, how many points, which areas, and how they rotate. Linked to the relevant technical specification means each check is measured against a stated requirement rather than against the inspector’s judgement on the day.

Clause 8.8.1 adds the rules 2.5.12 sits on. Verification planning shall define purpose, methods, frequencies and responsibilities, and verification shall confirm that the PRPs are implemented and effective, that the hazard control plan is implemented and effective, that hazard levels are within identified acceptable levels, and that input to the hazard analysis is updated. Results shall be retained and communicated. And the line that catches small sites: verification shall not be carried out by the person responsible for monitoring the same activities.

How will the finding be graded when the record is not there?

On its effect on the capability of the management system, which is the test Part 3 section 6.2 sets. A minor is issued where the finding does not affect that capability. A major is issued where it does, or for a legislative noncompliance linked to quality. A critical is issued where there is a significant failure in the management system, a situation with direct adverse food safety impact and no appropriate action observed, or where food safety legality or certification integrity is at stake.

So the grade turns on what the missing record leaves unproven. One critical limit on a well monitored CCP with a missing rationale, where the limit is demonstrably correct, is a different finding from a CCP whose limit is not measurable at all, and different again from a hazard analysis with no acceptable levels anywhere, which leaves the whole hazard control plan unanchored. Section 6.2 also fixes where the finding is written: nonconformities shall always be written to the most relevant Scheme requirement linked to the specific audit criteria in ISO 22000:2018, the specified PRP standard or the FSSC 22000 additional requirement.

The same reasoning applies to the management review. ISO 22000:2018 clause 9.3.2 lists the inputs, including the analysis of verification results under 8.8.2, nonconformities and corrective actions, and internal and external audit results. A review that skips an input is a finding against a named clause, and Version 7.0 adds one: requirement 2.5.9 (a)(iii) makes the evaluation of quality control parameters a management review input.

Grading is the skill the two practical exercises in our course exist to build. You audit a deliberately flawed management review with 12 planted defects and 3 decoys, cite the requirement for each and grade it, and the decoys mean you have to read the requirement before you raise anything. Then you walk a plant on video across four scenes against 36 findings.

Questions people ask