Prerequisite Programmes and GMP: The Foundation Auditors Check Before They Look at Your HACCP Plan

Home / Guides / Prerequisite programmes and GMP

Good manufacturing practice · Prerequisite programmes

By Mthokozisi Nkosi, food scientist, registered Lead Auditor with Exemplar Global and IRCA, and one of four SAATCA registered R638:2018 Lead Implementers. Founder of ASC Food Safety Consultants. Last updated 9 September 2026.

What is a prerequisite programme, and how is it different from a CCP and an operational PRP?

A prerequisite programme is a basic condition and activity that keeps the whole production environment fit to make safe food. It applies everywhere. A critical control point is a single step where control is essential and where you hold a validated critical limit. An operational prerequisite programme sits between them: a control measure that hazard analysis identified as necessary, applied to a process, monitored, but without a critical limit.

The practical distinction is where the control lives. Pest control does not sit at step 14 of your flow diagram, it sits across the building, the yard, the intake bay and the warehouse. Metal detection does sit at a step, with a reject threshold you can validate and a monitoring record you can read. Allergen changeover cleaning between a peanut product and a non peanut product usually lands in the middle: it is a control measure that came out of hazard analysis, it is applied to a specific changeover, and it is validated using an allergen specific method such as an ELISA or a validated lateral flow test, and then verified at each changeover by a protein swab and a documented visual clearance, rather than by a critical limit read off an instrument.

Prerequisite programmes are established before hazard analysis, because hazard analysis assumes they are already working. If you conduct hazard analysis while your PRPs are unstable, every hazard you assess will look uncontrolled, and you will end up promoting things to CCP status that should have been handled by cleaning, maintenance or supplier control. The tell, when I ask a team to walk me through a long CCP list, is that nobody can produce a validation study for most of the limits, because those steps were never critical control points in the first place.

The seven principles and twelve steps of Codex CXC 1-1969, General Principles of Food Hygiene, revised 2022, are covered in the ASC HACCP master guide. This article deals with the layer that sits underneath them, which is Chapter 1 of that same Codex document.

What is the difference between GMP, GHP and a PRP?

GMP, good manufacturing practice, is the industry term for the practices that keep product safe and legal. Codex CXC 1-1969, revised 2022, calls Chapter 1 Good Hygiene Practices and puts the HACCP system in Chapter 2. The ISO 22000 family calls the same ground prerequisite programmes and details them in the ISO 22002 series.

The overlap is genuine, so the loose usage is understandable. Where it becomes a problem is on your documents. I regularly open a manual that calls the same programme a GMP procedure in the index, a PRP in the FSMS scope statement, a GHP in the training matrix and a support programme in the internal audit schedule. Nothing is technically wrong, but the auditor now has to reconcile four names to work out whether anything is missing, and that reconciliation exercise always finds gaps.

Choose the vocabulary of the standard you are certified to and hold it across every document, register and record. A site certified to FSSC 22000 should say prerequisite programme, because that is what the certification structure calls it. A site working only to R638 with a customer GMP audit on top can say GMP, because that is what the customer questionnaire will say. What no auditor will accept is a set of programmes that cannot be listed on one page because nobody agrees what they are called.

There is one substantive difference worth knowing. GMP as used in food factories tends to emphasise the practices people perform. Prerequisite programme as used in ISO 22002 emphasises the programme: the documented standard, the responsible owner, the monitoring, the verification and the improvement loop. That difference is exactly why a plant can have excellent hygiene behaviour on the floor and still fail an audit. The behaviour was there, the programme was not.

What does the ISO 22002 series cover, and which part applies to your operation?

The ISO 22002 series translates the general requirement for prerequisite programmes into sector specific detail. It was restructured in July 2025. Most parts moved from Technical Specification to full International Standard, and a new common baseline, ISO 22002-100:2025, was published on 29 July 2025 for the food, feed and packaging supply chain. Food manufacturers use ISO 22002-1:2025.

Farming is the one part that did not move: ISO/TS 22002-3:2011 was reviewed and confirmed in 2025 and remains a Technical Specification. Catering, feed and animal food production, and retail and wholesale each have their own part, all set out in the full ISO 22002 series and how it sits under ISO 22000.

The move from Technical Specification to International Standard is not cosmetic. A Technical Specification is published where the subject is still developing or where full consensus has not yet been reached. An International Standard carries full consensus and is the document type that certification structures and customer contracts prefer to name. A series that spent more than fifteen years as a set of technical specifications now speaks with the same authority as ISO 22000:2018 itself.

For a South African manufacturer, the practical consequences are immediate. Your FSMS documents, your gap analyses, your internal audit checklists and your supplier questionnaires almost certainly cite ISO/TS 22002-1:2009. That designation is now out of date. Your PRP manual was written against a clause structure that has been restructured under a new common part. And your team was trained on a document that has been superseded.

FSSC 22000 is built as ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements, with Version 7 published in May 2026. Which edition of the PRP standard applies to your certificate and your next audit date is a question for your certification body, and it is worth asking in writing now rather than discovering the answer during a stage 2. The scheme level changes are covered in what is changing in FSSC 22000 Version 7.

What prerequisite programmes does a food manufacturer need?

A food manufacturer needs a defined set of prerequisite programmes, each with a written standard, a named owner, a monitoring routine and a verification method. The working set below follows the programme areas a manufacturing plant is audited against. Check the exact clause structure against your current edition of ISO 22002-1 and the common requirements in ISO 22002-100:2025. If one of these has no document, no owner and no record, it is not a programme, it is an intention, and I will treat it that way in a report.

Product information and consumer awareness is usually owned by marketing or the technical labelling desk, and the food safety manager never sees the artwork approval trail until an allergen appears on a pack that does not contain it. Food defence is usually owned by security, who assess the risk of theft rather than the risk of deliberate contamination. Both belong in your prerequisite programme register with a named owner, and both get audited. The methodology for the second one is covered in the Food Fraud (VACCP) and Food Defence (TACCP) course at R1,450 and in the VACCP and TACCP guide.

Why a weak prerequisite programme makes a HACCP plan unworkable

Hazard analysis works by assuming a controlled background. You assess each step for hazards that are reasonably likely to occur given the conditions you already have in place. When the background is not controlled, the likelihood of almost every biological hazard rises, and hazards you would have handled through cleaning or maintenance now have to be controlled inside the process. The plan grows and becomes unrunnable.

An example from a chilled ready to eat plant. Environmental hygiene in the post lethality area was not managed as a programme: no zoning map, no environmental monitoring, cleaning done by the night shift with no verification. The hazard analysis correctly concluded that Listeria monocytogenes recontamination after the cook step was reasonably likely. With no environmental control to lean on, the only remaining control was the cook step itself, which is upstream of the contamination point and therefore cannot control it. The plan the team wrote could not be executed because the control they needed did not exist in the process. It existed in a prerequisite programme they had not built.

The second failure mode is noise. When PRPs are unstable, the deviation record fills up with routine nuisance findings, and the genuinely serious deviation gets lost among them. A team reviewing forty corrective actions a month stops reading them. I have seen a metal detector failure sitting in the same log as thirty cleaning findings, unactioned for six weeks, because everyone had learned that the log was full of things that did not matter.

The third is validation. Critical limits have to be validated, and validation evidence assumes a defined starting condition. If your incoming material control is weak and your microbiological load varies unpredictably, the thermal process you validated against an assumed starting count is not validated for what you are actually running. The number on the plan is still there. It just no longer means what it says.

How do prerequisite programmes connect to R638 for South African premises?

R638 of 2018, Government Gazette 41730, 22 June 2018, made under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, never uses the phrase prerequisite programme. It states the same requirements as law. Regulations 5 to 11 cover premises, facilities, equipment, storage, protective clothing, refuse and food handler health, which is most of the prerequisite list in legal form and applies whether or not you hold any certification.

The training provision is worth reading in full, because it is the one that turns a set of hygiene practices into an auditable programme with records:

The person in charge of food premises shall ensure that (a) he or she is suitably qualified or otherwise adequately trained in the principles and practices of food safety and hygiene, as appropriate, and that the training is accredited or conducted by an inspector, where applicable; (b) any other person working on the food premises, is suitably qualified or adequately trained in the principles and practices of food safety and hygiene, as appropriate, by an inspector or any other suitable person; (c) routine assessments are conducted to determine the impact of the training; (d) training programmes and records are kept and routinely updated, as applicable, and are made available to an inspector on request.Regulation 10(1), R638 of 2018, Government Gazette 41730

R638 names no specific course, provider, unit standard or SETA qualification anywhere. It states a competence outcome and a record keeping duty, and the environmental health practitioner decides whether your evidence meets it. And 10(1)(c) puts an evaluation obligation on you: routine assessments to determine the impact of the training, which means a certificate alone is not the whole answer. Non compliance is dealt with under regulation 15, with the penalty set by section 18(1) of Act 54 of 1972 as a fine or imprisonment, escalating with each conviction. The Act sets no rand amount.

The full premises and Certificate of Acceptability picture is covered in the ASC R638 and CoA guide, and provider level questions in food handler training in South Africa.

How do you write a prerequisite programme that survives an audit?

A prerequisite programme survives an audit when it answers five questions in writing without the auditor asking: what is being controlled and why, who owns it by job title, what the acceptance criterion is, how often it is checked and by whom, and how anybody would know the programme is working. Most PRP documents I read answer only the first and the fourth.

Two writing habits cause more audit findings than anything else. The first is aspirational frequency: a schedule that says daily when the site can only resource weekly. The auditor does not compare your cleaning against best practice, the auditor compares your cleaning against your own schedule, and a weekly clean written as weekly and performed weekly passes, while a daily clean performed weekly is a non conformance every time.

The second is writing for the auditor instead of for the operator. A cleaning instruction that says clean and sanitise the filler using approved chemicals in accordance with the manufacturer instruction is a sentence nobody can follow. The same instruction written as strip the filler to the seal housing, foam at two percent for ten minutes, rinse at 60 degrees Celsius, sanitise and leave for the stated contact time, and record the concentration on the shift sheet is a sentence an operator can execute and an auditor can verify.

How do you monitor and verify prerequisite programmes?

Monitoring is done by the people running the programme and asks whether it was performed. Verification is done by somebody else and asks whether performing it achieved anything. Separating the two is the single change that turns a paper programme into a working one. Sites that fail PRP verification almost always have monitoring records signed daily and no evidence anybody ever tested whether the programme was effective.

Give every prerequisite programme a place in the internal audit schedule at least annually, and audit it against your own document rather than against a generic checklist. Where verification finds the same failure repeatedly, the answer is root cause analysis and not another retraining record, which is the default response I see and the reason the same finding appears in three consecutive audit reports. The methods are covered in the Internal and Supplier Auditing Practices based on FSMS course at R3,500, the internal and supplier auditing guide, and the Overview of Root Cause Analysis course at R649.

Five prerequisite programme failures I find on nearly every audit

These five appear in most manufacturing audits I conduct, across all sizes of plant and all certification schemes. None of them is exotic. Each one is a programme that exists on paper, is performed in good faith, and produces no evidence that it works. That combination is what turns a routine audit into a major non conformance.

1. Cleaning schedules with no validation

The schedule exists, the sign off is complete, and there is no evidence anywhere that the method removes the soil from that surface. Nobody has run a validation study on the chemical at the concentration used, on the actual material of that conveyor, against the actual product residue. Add the two related gaps: nobody cleans the cleaning equipment, so the mop and the hose reel become the contamination route, and nobody has defined what visually clean means, so two operators clear the same line to two different standards.

2. Pest control reports that nobody actions

The contractor visits monthly, writes a report, notes the same gap under the dispatch door, and leaves. Eighteen months of reports carry the same recommendation, unclosed. There is no trend analysis, so nobody can say whether activity is rising or falling, and there is no in-house owner, so the programme belongs to a contractor who has no authority to fix the building. Pest control is your programme. The contractor is a service provider inside it.

3. Air handling never risk assessed

Compressed air blows into an open filling head and no risk assessment has ever been done on it: no filter grade specified, no moisture or oil check, no filter change record. Ambient air in the high care area has no pressure differential monitoring and the filter grade was chosen by whoever installed the unit. The same neglect covers water used for ice, steam in direct product contact and water reused in the plant. Utilities in contact with product are a control measure, and a control measure with no risk assessment behind it has no defensible basis.

4. Rework treated casually

An unlabelled bin at the end of the line, filled during the shift, added to the next batch by a decision taken on the floor. No like into like rule, so an allergen or a different shelf life basis moves into a product that does not declare it. No quantity recorded, no link to the original batch, so a recall cannot follow the rework. Rework is the fastest route to an undeclared allergen incident that I encounter, and it is almost always caused by a missing one page rule rather than by carelessness. Allergen carry over through rework is covered in the Allergen Management in Food Supply Chain course at R1,450.

5. Maintenance work done over open product

A fitter works above a running line with a spanner and no tool control, product moving underneath, no hygiene clearance before the line restarts. Temporary repairs made with cable ties and tape sit in place for a year with nobody tracking their age. Non food grade lubricant is used because that is what is in the store. The maintenance team usually has no food safety induction beyond the general one, and no post maintenance sign off exists as a document. This is where physical contamination comes from in most plants I audit.

What training do the different levels of staff actually need?

Prerequisite programme training fails when everyone gets the same course. A food handler needs the practices they personally perform. A supervisor needs to design, monitor and correct the programme. A QA or technical manager needs the clause requirements of ISO 22002-1:2025 and how they connect to hazard analysis. Regulation 10(1)(b) of R638 requires training appropriate to the person, and appropriate is the operative word.

Under regulation 10(1)(c) and 10(1)(d), keep the assessment result and the certificate together, and keep the training programme itself as a document that is routinely updated. An inspector or an auditor asking for training evidence wants three things: what was taught, that the person passed an assessment, and that the training matched the job. ASC certificates carry a QR code that verifies the record on the spot, which removes the argument about whether a certificate is genuine.

Frequently asked questions

ASC Food Safety Training · Leading with Science. Ensuring Food Safety. · Fully online, serving all of South Africa and beyond · info@ascfoodsafety.com · WhatsApp +27 61 483 0381 · SAATCA registered training centre (TC No. 065) · FoodBev SETA accredited provider No. 587/00337/1900 · B-BBEE Level 1 · Registered Lead Auditor (Exemplar Global and IRCA) · Consulting and document toolkits at ascfoodsafety.com