The auditor asks for the hazard analysis. The team leader hands over a Codex HACCP plan from 2016 with a new logo and the words “ISO 22000” typed into the header. Forty minutes later there are three nonconformities on the table, and every one of them sits in ISO 22000 clause 8.5.
In short
- ISO 22000:2018 clause 8.5 has four parts: preliminary steps (8.5.1), hazard analysis (8.5.2), validation of control measures (8.5.3) and the hazard control plan (8.5.4).
- Every significant hazard needs a control measure categorised as an OPRP or a CCP by a documented, repeatable method.
- CCPs carry measurable critical limits. OPRPs carry action criteria, which may be measurable or observable.
- Validation happens before a control measure goes live, monitoring while it runs, verification afterwards.
- A copied Codex plan usually fails on four points: acceptable levels, the categorisation method, validation evidence and OPRP action criteria.
If you would rather be taught this clause and tested on it, The ISO 22000 Standard course (R1 450, six hours, online) gives clause 8.5 its own 25 minute practical lesson and knowledge test.
What does ISO 22000 clause 8.5 require?
Clause 8.5 of ISO 22000:2018 is the hazard control clause. It requires the food safety team to gather preliminary information, carry out a hazard analysis, validate the control measures it selects and write a hazard control plan covering every CCP and OPRP.
Ask an FSSC 22000 auditor where findings cluster and many will point here (FSSC 22000 takes its management system requirements from ISO 22000). Good documents carry a site a long way in clauses 4 to 7. Clause 8.5 takes thinking, and the thinking has to be visible on paper.
1
8.5.1 Preliminary steps
Raw materials, end products, intended use, flow diagrams and the walk that confirms them.
2
8.5.2 Hazard analysis
Identify hazards, set acceptable levels, assess them, then select and categorise control measures.
3
8.5.3 Validation
Evidence, gathered before implementation, that the measures can achieve the intended control.
4
8.5.4 Hazard control plan
Critical limits, action criteria, monitoring, and actions when a limit or criterion is missed.
What are the preliminary steps in clause 8.5.1?
Clause 8.5.1 asks for documented information the hazard analysis will stand on: the characteristics of raw materials, ingredients and product contact materials, the characteristics of end products, the intended use and likely users, and flow diagrams with process descriptions. The food safety team must confirm the flow diagrams on site and keep them current.
For each raw and packaging material you need its biological, chemical and physical characteristics, origin, storage conditions, shelf life and food safety acceptance criteria. End products add composition, packaging, labelling and distribution.
For intended use, “general public” is rarely the honest answer. A chilled ready meal sold into a hospital kitchen reaches a vulnerable group, and reasonably expected mishandling (a meal left in a car, a microwave that under heats) belongs in the description too.
The on site confirmation
Flow diagrams drawn in the boardroom are wrong. They miss rework loops, water and ice additions, the point where trimmings leave, the outsourced slicing. Walk the line during production with the diagram in hand and keep a signed, dated record. Auditors find the missing rework loop in about ten minutes.
How do you do a hazard analysis under clause 8.5.2?
Clause 8.5.2 runs in three moves. Identify every hazard reasonably expected for the product and process, and set an acceptable level in the end product where possible. Assess each hazard for likelihood and severity to find the significant ones. Then select control measures and categorise each as an OPRP or a CCP.
Identification and acceptable levels
Name the hazard properly. “Pathogens” will not do. Salmonella in raw chicken will. Record the step where each hazard may be present, be introduced, increase or survive. Then state the acceptable level in the end product and its source: legislation, a customer specification, or scientific literature tied to the intended use. This is the first gap in a copied plan, because most older Codex based templates have no column for it.
Hazard assessment
Assess the likelihood of the hazard occurring before any control is applied, and the severity of the health effect if it does. Write down what the scores mean.
If two team members scoring the same hazard cannot land close together, the method is not yet a method.
Selection and categorisation of control measures
For every significant hazard, select a control measure or a combination. Then categorise each through a systematic approach that considers how likely the measure is to fail and how severe the consequence would be. The standard also asks about feasibility: can you set a measurable limit, monitor in time to catch a failure, and correct in time. A Codex decision tree alone does not answer those questions, and it has no branch that ends in “OPRP”.
Categorisation is where a copied plan comes apart in front of the auditor. If your team stalls here, the clause 8.5 practical lesson in the ISO 22000 course spends 25 minutes on the practical application of this clause, with its own knowledge test straight after.
Start the ISO 22000 online course, R1 450
What is the difference between a PRP, an OPRP and a CCP?
A PRP is a basic condition or activity that keeps the environment hygienic and is not tied to one specific hazard. An OPRP controls a significant hazard and has an action criterion that can be measured or observed. A CCP controls a significant hazard with a measurable critical limit that separates acceptable product from unacceptable product.
| PRP | OPRP | CCP | |
|---|---|---|---|
| What it controls | General hygiene conditions across the site | A specific significant hazard | A specific significant hazard |
| Limit type | None required by the standard | Action criterion, measurable or observable | Critical limit, measurable |
| Validated? | Verified, not validated under 8.5.3 | Yes, before use | Yes, before use |
| When it fails | Fix the condition, check for product impact | Evaluate affected product for cause and consequence before any release | Affected product is potentially unsafe and is handled as such |
| Ready meal example | Pest control, staff hygiene, cleaning schedule | Allergen changeover clean with a signed visual inspection | Cook step with a minimum core temperature |
Critical limit versus action criterion
A critical limit is a number. If the limit is 75 °C at the core and the probe reads 73, the batch is on the wrong side of the line and nobody debates it. An action criterion may also be something a trained person observes: no visible residue on the depositor after an allergen changeover, sieve mesh intact at end of shift. Miss it and the product needs evaluating.
An OPRP is not a CCP you could not be bothered to monitor, and teams that downgrade a cook step to escape batch records get caught on the categorisation logic. PRPs themselves sit in clause 8.2. For that layer, see our guide to prerequisite programmes in food manufacturing.
What is the difference between validation, monitoring and verification?
Validation asks whether the control measure can work, and is completed before the measure is implemented and again after any change. Monitoring checks, during the process, whether the measure is working right now. Verification looks back afterwards to confirm that the plan was followed and is still effective.
Clause 8.5.3 is the one a copied plan cannot fake. “Validated by: QA Manager, signature, date” proves only that somebody signed. The auditor wants evidence that your time and temperature, in your kettle, on your largest portion, delivers the reduction you claimed against the acceptable level from 8.5.2.
Worked example
Mzansi Fresh Meals (a fictional ready meal plant, the ASC training case), cook step for chicken curry.
Validation: published thermal inactivation data for Salmonella and Listeria monocytogenes, plus a heat distribution trial in the site’s own kettle using the largest chicken piece, repeated when the kettle was replaced.
Monitoring: the cook probes every batch with a calibrated thermometer and records the core temperature against the critical limit.
Verification: daily review of batch records, a weekly probe check against a reference thermometer, and monthly trending of finished product results.
What goes into the hazard control plan in clause 8.5.4?
The hazard control plan is the documented output of clause 8.5. For each CCP and OPRP it names the hazard controlled, the critical limit or action criterion, the monitoring procedure, the corrections and corrective actions if a limit or criterion is missed, who is responsible, and which records are kept.
Specify monitoring so a relief operator could do it: method, frequency, calibrated equipment, who monitors and who evaluates the results. The frequency must let you find a failure in time to isolate the affected product. Check a metal detector once a shift and one failed check holds the whole shift.
When a limit or criterion is missed, the product is handled under control of product and process nonconformities (clause 8.9) and the cause is found and fixed. Verification of the plan sits in clause 8.8. For the full clause map, read ISO 22000 explained: clauses, prerequisite programmes and certification.
What does The ISO 22000 Standard course cover, and what does it cost?
The ISO 22000 Standard walks through ISO 22000:2018 clause by clause in six hours online, for R1 450 once. Clause 8.5 gets its own 25 minute practical lesson and knowledge test.
Course facts
| Course | The ISO 22000 Standard |
|---|---|
| Provider | ASC Food Safety Training |
| What you leave with | Clause by clause knowledge of ISO 22000:2018, tested four times, and a certificate of completion |
| Level | Intermediate |
| Time | 6 hours |
| Price | R1 450 |
| Format | Online, self paced, lifetime access. Instructor: Mthokozisi Nkosi |
| Assessment | Knowledge tests on clauses 4 to 7, on clause 8.5 and on clause 8, then a final test across all clauses |
| Certificate | Certificate of completion |
| Who it is for | People who develop and maintain the food safety management system, and managers and supervisors who need awareness |
Enrol in The ISO 22000 Standard, R1 450
Questions people ask before they enrol
How long does The ISO 22000 Standard course take?
The course is six hours of self paced lessons and knowledge tests. Access does not expire, so you can spread it over a week or two and come back to the clause 8.5 lesson when you revise your own hazard analysis.
How much does it cost, and how do I pay?
The course costs R1 450 once, with lifetime access. Payment is by card or EFT through PayFast.
Do I need to know ISO 22000 before I start?
Some food safety background helps. The course is intermediate level, and it covers standards, definitions and the process approach before clause 4. If ISO 22000 is completely new to you, Introduction to ISO 22000:2018 at R999 is the lighter option.
How is the course assessed, and do I get a certificate?
There are knowledge tests after clauses 4 to 7, after the clause 8.5 practical lesson and at the end of clause 8, then a final test covering all clauses. You receive a certificate of completion. It is a training certificate, not an auditor registration.
Can I buy the course from outside South Africa?
You can. Prices are in rand, and the course page shows an indicative equivalent in US dollars, euros and pounds. Payment settles in rand.
If your plan started life as somebody else’s Codex template, rebuild it in the order above. One major nonconformity against clause 8.5 costs a root cause investigation, an evidence pack for the certification body, possibly a follow up visit, and a customer asking why. The ISO 22000 Standard online course costs R1 450 and six hours, and tests you on clause 8.5 by itself. Enrol before the next audit date, not after it. More reading is on the ISO 22000 training hub.
ISO 22000 is published by ISO and FSSC 22000 is owned by Foundation FSSC. This course is an independent training product and is not approved or endorsed by ISO, Foundation FSSC or any certification body. Clause descriptions here are paraphrased.