ISO 22000 HACCP, Allergens & Traceability. Food Safety in 3 Seconds.

A Critical Control Point (CCP) is a step in the production process where a control measure is essential to prevent, eliminate or reduce a significant food safety hazard to acceptable levels. To identify whether a step is a CCP, the Codex Alimentarius decision tree is commonly used (although ISO 22000:2018 does not explicitly require it): it asks whether a control measure exists, whether the step is specifically designed to eliminate or reduce the hazard to acceptable levels, and whether a measurable critical limit can be established at that step. The key is the measurability of the critical limit: exact temperature, specific pH, disinfectant concentration. If the control depends on combined procedures without a measurable limit at the specific point, the step is an Operational Prerequisite Programme (OPRP), not a CCP.

Allergen control is a specific Prerequisite Programme (PRP) in ISO 22000:2018. EU Regulation 1169/2011 establishes 14 allergens requiring mandatory declaration: gluten-containing cereals (wheat, rye, barley, oats), crustaceans, eggs, fish, peanuts, soybeans, milk (including lactose), tree nuts (almond, hazelnut, walnut, cashew, pecan, pistachio, macadamia, Brazil nut), celery, mustard, sesame seeds, sulphur dioxide and sulphites, lupin and molluscs. In practice, the HACCP team must include allergens as chemical hazards in the hazard analysis (clause 8.5.2), assess whether they represent a significant hazard for allergic consumers, and establish control measures: ingredient segregation, validated cleaning programmes to remove the allergen, line coding and staff training. If cross-contamination is unacceptable and can be controlled with a measurable critical limit, the cleaning step becomes a CCP.

ISO 22000:2018 (clause 8.9.4) and EU Regulation EC 178/2002 require a traceability system capable of identifying the suppliers of any ingredient, the direct customers of each lot, and the processing and distribution route. EU Regulation EC 178/2002 (Article 19) establishes that traceability must be exercisable within a maximum of 4 hours for food sector entities. Mandatory records include: finished product lot number, raw material and ingredient lot numbers (linked to the product lot), production date, recipient (customer and lot delivered) and any documented rework or deviation. A simulated traceability exercise (from the finished product back to the raw material, and from the raw material forward to finished products and customers) is the verification tool that ISO 22000 and FSSC 22000 certification auditors typically request during audit.

Cleaning and disinfection is a foundational Prerequisite Programme (PRP) in ISO 22000:2018. The plan must specify: areas, equipment and surfaces to be cleaned (including food-contact and non-food-contact surfaces), cleaning and disinfection products (trade name, active ingredient, use concentration, contact time), detailed step-by-step procedure, responsible person and frequency for each operation, record-keeping system (who, when, visual result), and method for verifying effectiveness (visual inspections, ATP bioluminescence, microbiological surface analyses). For allergens, the plan must include validation that the cleaning product and procedure remove the allergen to non-detectable levels. Cleaning records are a primary piece of evidence during official sanitary inspections and certification audits.

Preparation for a first ISO 22000 certification audit includes: (1) Full internal audit of the FSMS prior to the Stage 1 audit, identifying non-conformities and improvement opportunities. (2) Verification that the HACCP Plan covers all steps in the production flow, that each CCP has measurable critical limits and a documented monitoring system, and that OPRPs are described with clear action criteria. (3) Review of records from the last 3–6 months: CCP monitoring, PRPs (cleaning and disinfection, pest control, maintenance), lot traceability, customer complaints. (4) Traceability exercise: verify that the complete lot can be identified in less than 4 hours. (5) Verification of calibration for critical measuring instruments (thermometers, scales, pH meters). (6) Evidence of training for the HACCP team and food handlers. IgeraIndustria allows querying any of these points and retrieves the applicable clause and the most common errors detected by certification auditors.

FSSC 22000 (Food Safety System Certification) is a certification scheme that combines ISO 22000:2018 with category-specific Prerequisite Programme documents (ISO/TS 22002-1 for food manufacturing, ISO/TS 22002-2 for catering, etc.) and additional scheme requirements from FSSC. FSSC 22000 is recognised by the Global Food Safety Initiative (GFSI), making it mandatory for suppliers to major retailers (Carrefour, Lidl, Nestle, Walmart, etc.) that require GFSI certification. ISO 22000 alone is not GFSI-recognised. If your customer requires GFSI certification, you need FSSC 22000, IFS Food, BRC Global Standards or SQF — ISO 22000 alone is not sufficient. If your motivation is to improve the internal food safety management system without a customer GFSI requirement, ISO 22000 may be sufficient.