ISO 22000 checklist: checkpoints with evidence
An ISO 22000 checklist helps you check, before the audit, whether you have evidence for each part of your food safety management system (FSMS). It is about demonstrable evidence, not a tick box: for each checkpoint, you note which document, record or practice on the shop floor the auditor wants to see. The standard itself is the benchmark; ISO 22000:2018 sets out what is required, and this checklist turns that into practical questions. The structure is a practical working layout and does not follow the clauses of the standard. For the full requirements, read requirements of the standard, and for how the audit runs, the audit process.
A checklist does not judge whether you are ready for certification. It shows where evidence is missing. The gaps you find are the first step in your improvement plan.
ISO 22000 checklist in brief
| Component | What you check | Typical evidence |
|---|---|---|
| Context and scope | Is the scope clear, and do products and sites match? | Scope document, process description |
| Leadership and responsibilities | Who decides, who carries out, who is accountable? | Organisation chart, job descriptions, food safety policy |
| HACCP and hazard analysis | Is the analysis up to date, and are CCPs (critical control points) and OPRPs (operational prerequisite programmes) justified? | Hazard analysis, decision tree, control plans |
| PRPs (prerequisite programmes for hygiene) | Have basic conditions been carried out and recorded? | Cleaning schedules, pest control reports, maintenance logs |
| Traceability and recall | Can you trace forwards and backwards and recall products? | Traceability exercise, recall procedure |
| Suppliers | Have suppliers been assessed and approved? | Approved supplier list, specifications, assessments |
| Deviations and improvement | Are deviations reported, resolved and reviewed afterwards? | Deviation register, corrective and preventive action (CAPA) forms |
| Internal audit and management review | Does evaluation happen, and are decisions taken? | Audit plan, report, management review minutes |
How to use this checklist
Divide the checklist by owner
Assign each block to one owner: quality, production, purchasing or logistics. A checklist that belongs to nobody stays unused.
Look for evidence, not the story
For each checkpoint, ask: which document or record shows this, and is it from the last few months? A procedure that exists but has never been filled in is not evidence.
Mark gaps as “yes”, “partly” or “no”
“Partly” is the hardest. Write down what is missing. Put gaps in the improvement plan, with an owner and a date.
Checklist per component
Context and scope
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Scope describes products, processes and sites | Scope document that matches actual activities | yes / partly / no |
| Outsourced processes are identified | List of outsourced activities and how they are managed | yes / partly / no |
| Relevant external and internal requirements are known | Overview of customer requirements, legislation and standards | yes / partly / no |
Leadership and food safety team
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Food safety policy is established and known | Signed policy, demonstrably communicated | yes / partly / no |
| Tasks and authorities are assigned | Job descriptions, organisation chart, cover arrangements | yes / partly / no |
| Team members have the right knowledge | Training records, competence requirements | yes / partly / no |
HACCP and hazard analysis
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Hazards are identified per process step | Hazard analysis covering biological, chemical, physical and allergen hazards | yes / partly / no |
| CCPs and OPRPs are justified | Decision tree or rationale per point | yes / partly / no |
| Limits and monitoring are recorded | Control plan with limit, measuring method and frequency | yes / partly / no |
| Analysis is updated after changes | Version history and link to change notifications | yes / partly / no |
HACCP stands for Hazard Analysis and Critical Control Points. PRP stands for prerequisite programme. See HACCP and PRPs within ISO 22000 for an explanation of CCPs and OPRPs.
PRPs (basic conditions)
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Cleaning and disinfection are carried out | Cleaning schedules with signed-off completion | yes / partly / no |
| Pest control is active | Reports, floor plan with traps, corrective actions | yes / partly / no |
| Equipment maintenance is planned | Maintenance plan and completed work orders | yes / partly / no |
| Personal hygiene is monitored | Instructions, spot checks, deviations | yes / partly / no |
Traceability and recall
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Batch numbers run from raw material to finished product | Example of a batch you trace forwards and backwards | yes / partly / no |
| Recall procedure is established and known | Procedure with responsible persons and contact lists | yes / partly / no |
| A traceability exercise has been carried out | Report with time taken and result | yes / partly / no |
For how to set up such an exercise, read the page on mock recall in ISO 22000.
Suppliers
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Suppliers are assessed before approval | Assessment form with criteria and decision | yes / partly / no |
| Specifications are recorded | Signed specifications or certificates | yes / partly / no |
| Performance is reassessed periodically | Review record with follow-up actions | yes / partly / no |
Deviations and improvement
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Deviations are reported and recorded | Register with date, description and owner | yes / partly / no |
| Cause has been investigated | Root cause analysis per deviation, not only treatment of the symptom | yes / partly / no |
| Corrective actions are checked for effect | Follow-up and closure with evidence | yes / partly / no |
For how deviations are rated in the audit, see the page on major and minor nonconformities.
Internal audit and management review
| Checkpoint | Evidence the auditor wants to see | Status |
|---|---|---|
| Internal audits are planned and carried out | Audit plan and reports for the recent period | yes / partly / no |
| Management review has been held | Minutes with decisions on performance and improvements | yes / partly / no |
| Decisions are followed up | Action list with status and closure date | yes / partly / no |
Example: one worked line
Fictional example of a bakery with a bread packaging line. Checkpoint: “CCP monitoring is demonstrably carried out.”
| Element | Content |
|---|---|
| Checkpoint | Metal detection after the packaging line is checked at every shift start |
| Evidence | Record with date, time, test pieces, result and the operator’s initials |
| Status | Partly: records complete up to and including week 14, then three days without initials |
| Gap | The shift handover has no separate check for the detector |
| Action | Add the check to the shift start list, owner production manager, no later than two weeks later |
A line like this becomes useful when you make the gap concrete. “Improve monitoring” is not an action.
Common mistakes with the checklist
- Marking everything “yes” without checking the evidence.
- Accepting a procedure as evidence when the record is missing.
- Filling in the checklist once and never updating it.
- Reviewing only documents and skipping the shop floor. The auditor also looks at what employees actually do.
- Reporting gaps without a cause and without an owner.
More information
Official references
- ISO 22000:2018 - Food safety management systems
- FSSC 22000 Scheme Version 7.0 (May 2026) , for the assessment of deviations and audit practice