Mandatory documents for ISO 22000
ISO 22000 sets requirements for documented information: procedures, plans and records that show your system works. The standard is published by ISO , the legal hygiene basis is set out in EU Regulation 852/2004 (EU food hygiene regulation) , and HACCP principles are explained by the NVWA (Netherlands Food and Consumer Product Safety Authority) . You can find more about the substantive requirements of ISO 22000 on the related page.
ISO 22000 does not set requirements for form: a Word document, a spreadsheet or a digital system are all valid. What matters is that information is available, readable, controlled and demonstrably up to date.
Overview of mandatory documented information for ISO 22000
| Document / record | Clause reference | What it covers |
|---|---|---|
| Scope of the FSMS | 4.3 | Which products, processes, sites and supply chain positions fall under the certification |
| Food safety policy | 5.2 | Written policy commitment from management on food safety |
| Food safety objectives | 6.2 | Measurable targets, responsible persons and timelines |
| Employee competence files | 7.2 | Evidence that relevant employees are trained and competent |
| PRP documentation | 8.2 | Which PRPs apply, how they are carried out and monitored |
| HACCP hazard analysis | 8.5.2 | Identification of hazards, assessment of likelihood and impact, choice of control measures |
| CCP plan (HACCP plan) | 8.5.4 | Critical control points with limits, monitoring and responsibilities |
| OPRP plan | 8.5.4 | Operational prerequisite programme controls with criteria and monitoring methods |
| CCP/OPRP monitoring records | 8.9.2 | Evidence that measurements were carried out and limits were met |
| Traceability system | 8.3 | Records that make forward and backward tracing possible |
| Recall and withdrawal procedure | 8.9.5 | Step-by-step plan for taking back product, communication and customer information |
| Nonconformities and CAPA | 10.1 | Recording of nonconformities, root cause analysis, corrective action and follow-up |
| Internal audit programme and reports | 9.2 | Planned audits, audits carried out, findings and follow-up |
| Management review reports | 9.3 | Management review decisions including input and output |
| Supplier assessment | 7.1.6 | List of approved suppliers, selection criteria and performance records |
Explanation per document category
HACCP plan and hazard analysis
This is the heart of ISO 22000. For each process step, you record which biological, chemical, physical or allergen hazards are present, how large the likelihood and impact are, and which control measures you apply. The HACCP and PRPs page gives a practical explanation of this process. Want to check first whether your HACCP basis is complete before you build the ISO documents? Then use the HACCP checklist.
A hazard analysis that is never reviewed is a common audit trap. Every change to a product, process or supplier requires a new assessment.
PRP documentation
PRPs (Prerequisite Programmes) are basic conditions such as cleaning, personal hygiene, pest control and supplier management. You document which PRPs apply, how you carry them out, and how you record that they have been carried out.
| PRP category | Typical documents |
|---|---|
| Cleaning and disinfection | Cleaning plan, task list, verification records |
| Personal hygiene | Employee hygiene code, access rules, instructions |
| Pest control | Monitoring schedule, site plan overview, treatment records |
| Supplier management | Approved supplier list, specifications, audits and reviews |
| Storage and transport | Temperature records, FIFO/FEFO instructions, loading records |
Monitoring records
These are the daily proof that you keep watch over your CCPs and OPRPs. Think of temperature records for the pasteurisation step, metal detector checks, or pH measurements. Missing records or gaps in the sequence are a common finding at Stage 2 audits.
Common mistake: records are filled in but never verified. A second signature or a periodic verification round is needed to show that monitoring is reliable.
Traceability and recall
You must be able to trace forwards and backwards: from raw material to end product and back. In practice, you test this with a mock recall: choose a product and, within the agreed time, prove where the raw materials came from and where the end product went.
A recall procedure that is never practised is a risk. How to set up a mock recall has its own page. ISO 22000 requires that the system works, not just that it exists.
Which documents are really critical at audit?
Stage 1 (documentation review)
At Stage 1, the auditor checks the design and completeness of your documentation:
- Is the scope complete and realistic?
- Is the hazard analysis present and justified?
- Are CCPs and OPRPs documented with limits?
- Do recall and traceability procedures exist?
Missing documents at Stage 1 lead to a delay of Stage 2.
How much documentation is enough?
ISO 22000 does not prescribe a specific format or thickness. A practical rule of thumb: document what is needed for a new employee or auditor to understand how you control food safety, who does it, and how you know it works. More is not better if it is not controlled or kept up to date.
The ISO 22000 step-by-step plan shows in which phase you build which documents.