ISO 22000 Food safety management systems

Background

Food safety concerns resulting from the presence of biological, chemical or physical agents in food, with the potential to cause adverse health effects, continue to grow at an alarming rate.  For example, the CDC (Centers for Disease Control and Prevention) estimate that each year in the United States 76 million people are affected by foodborne illness, 325,000 people are hospitalized and 5,000 die from foodborne diseases.

Recalls are usually voluntary actions by manufacturers or distributors to protect the public from products that may cause health problems.  However, they may also be conducted by FDA request, or by FDA order under statutory authority.  The FDA monitors problems problems with non-meat food products i.e., cereals, fish, produce, fruit juice, pastas, cheeses, etc.  (Class I Recalls and Safety Alerts).

In turn, problems with meat, poultry and egg products are monitored by the USDA's Food Safety Inspection Service (FSIS Recalls).  Recent recalls have included some of America's favorite foods:

a

peanut butter (3/09/07), chocolate (10/03/07), pancake mix (03/04/08), cantaloupe (3/25/08),
cereal (04/07/08), and tomatoes (06/03/08) for Salmonella;

a

spinach, steaks (1/04/08) and beef products (07/03/08) (Topps Meat Co. update¹ 6/08/08) for E. Coli;

a

canned green beans (1/18/08), canned vegetables (2/07/08) and dips (2/05/08) for C. Botulinum; and,

a

hot dogs (2/08/08) and ice cream (2/21/08) for undeclared Allergens.

¹"Documents obtained by The Associated Press and interviews show that the now-defunct company cut back on testing for the dangerous pathogen and disregarded sanitary issues, but also that federal food inspectors overlooked crucial evidence that Topps used risky processing procedures and operated under a flawed food safety plan."

Food problems/recalls already cost government, industry (e.g., recent tomato recall tops $100 M) and consumers billions of dollars every year and the trend is growing; so much so, that Representative DeLauro (D-CT) and Senator Durbin (D-IL) introduced companion bills (H. R. 1148 and S. 654 respectively) both named The Safe Food Act of 2007 to create a Food Safety Administration responsible for ensuring the security of the food supply from all forms of contamination.

Separate government agencies are responsible for protecting different segments of the food supply and consumers who experience a problem with a food product should know the appropriate public health organization to contact.

ISO 22000 Food safety management systems - Requirements for any organization in the food chain, published September 1, 2005, was designed "to meet an increasing need to demonstrate and provide adequate records of the control of all conditions, which have an impact on food safety", throughout the food chain.

ISO/TS 22003 — Impact on ISO 22000 Certifications

Unlike certification to ISO 14001 Environmental management systems — Requirements with guidance for use, which does not require compliance with statutory and regulatory requirements, "certification to ISO 22000 Food safety management systems requires an organization to meet all applicable food safety related statutory and regulatory requirements through its management system", according to ISO/TS 22003 Food safety management system — Requirements for bodies providing audit and certification of food safety management systems, that was published February, 2007.
In fact ISO 22000:2005 includes the phrase, "statutory and regulatory requirements" in 12 areas/clauses: Introduction page vii; 1 Scope b); 5.1; 5.2 b); 5.6.1 c); 5.6.2 h); 7.2.2; 7.2.3; 7.3.3.1; 7.3.3.2; 7.9; and, 7.10.4 b) 1).
Therefore, if an organization is seeking ISO 22000 certification it might be prudent to verify that the Certification Body (Registrar) that it is going to use is accredited to ISO/TS 22003 and that the auditor(s) assigned meet the requirements in clause 7.2.4 Auditors and have completed and passed a food safety auditor course based on ISO 22000 and ISO 19011 that was approved by IRCA, RABQSA or other recognized authority.

ISO 22000 Requirements

4

ISO 22000 Food safety management systems incorporates generally accepted management system requirements with the 7 principles from Codex Alimentarius Commission's HACCP¹ system together with its 12 applications steps.  The result – a set of auditable requirements, 194 to be exact, that when effectively implemented, provide confidence that your organization has control of those conditions which have an impact on food safety.

In the Introduction section of ISO 22000:2005 it states, "It [ISO 22000:2005] requires an organization to meet any applicable food safety related statutory and regulatory requirements through its food safety management system."

Because the most effective food safety systems are established, operated and updated within the framework of a structured management system and incorporated into the overall management activities of the organization, ISO 22000 was aligned with the management structure outlined in ISO 9001.

The requirements of ISO 22000 can be addressed with a stand alone system or with an ISO 9001 system that has integrated the food safety requirements.

Fully conforming ISO 22000 Food safety management systems (FSMS) will address the following areas:

Food safety management system

à

General requirements

Including the requirements for evidence of a documented, effective FSMS; definition of scope specifying the products, processes and sites included; the identification of food safety hazards; etc.

à

Documentation requirements (Principle 7, Step 12¹)

Management responsibility

à

Management commitment (a common requirement of ISO-based management systems)

Including the requirement for evidence that food safety is supported by the business objectives and a requirement that top management provide evidence of communicating to the organization the importance of meeting the requirements of the standard and any statutory and regulatory requirements, e.g.:

Current Good Manufacturing Practice In Manufacturing, Packing, or Holding Human Food (21CFR110) which identifies statutory and regulatory requirements applicable to personnel, plant and grounds, sanitary operations, sanitary facilities and controls, equipment and utensils, processes and controls, warehousing and distribution, and, natural or unavoidable defects in food for human use that present no health hazard;

Food Allergen Labeling and Consumer Protection Act of 2004 which identifies and addresses labeling requirements for the eight most common allergenic foods;

Bioterrorism Act and Final Rule December 9, 2004 which addresses requirements for the establishment and maintenance of related records; and

U.S. Food Code 2005 for "food establishments" as defined within this code; etc.

à

Food safety policy (a common requirement of ISO-based management systems)

à

Food Safety management system planning

à

Responsibility and authority

à

Food safety team leader (requires appointment of a 'food safety team leader' as opposed to a management representative)

à

Communication

Including the requirement for establishing, implementing and maintaining effective arrangements for ensuring that sufficient information on issues concerning food safety is available throughout the food chain.

Also including the requirement for establishing, implementing and maintaining effective arrangements for communicating with internal personnel on matters having an impact on food safety.

à

Contingency preparedness and response

à

Management review (a common requirement of ISO-based management systems)

Resource management

à

Provision of resources

à

Human resources

Including the requirements for the identification of competencies for personnel having an impact on food safety (an organization might want to investigate the application of ISO/IEC 17025 General requirements for the competence of testing and calibration laboratories to its laboratory) and take any needed actions to ensure its personnel having an impact on food safety have the necessary competencies.

à

Infrastructure

à

Work environment

Planning and realization of safe products

à

General

Including the requirement for evidence that the processes needed for the realization of safe products have been planned and developed

à

Prerequisite Programs (PRPs)

Including the requirement for the establishment and maintenance of PRPs to assist in controlling: the possibility of introducing food safety hazards to the product through the environment; biological, chemical and physical contamination of the product, including cross contamination between products; etc.

These may include PRPs such as the Current Good Manufacturing Practice in Manufacturing, Packing, or Holding Human Food (21 CFR Part 110) that is organized by Subpart:

A--General Provisions, which states that the definitions and interpretations of terms in section 201 of the Federal, Food, Drug and Cosmetic Act are also applicable to such terms used in this part; defines requirements for personnel; and identifies operations that are permitted an exclusion — "Establishments engaged solely in the harvesting, storage, or distribution of one or more 'raw agricultural commodities,'"; and, contains '6 shalls' (mandatory requirements).

B--Buildings and Facilities, which defines requirements for plant and grounds, sanitary operations, sanitary facilities and controls; contains '29 shalls' (mandatory requirements); and requires procedures for testing and sanitizing.

C--Equipment, which defines requirements for equipment and utensils; and, contains '12 shalls' (mandatory requirements).

D--[Reserved].

E--Production and Process Controls, which defines requirements for processes and controls, and warehousing and distribution; contains '43 shalls' (mandatory requirements); and requires that testing procedures be used for chemical, microbial, or extraneous-material where necessary to identify sanitation failures or possible food contamination and for sanitary handling.

F--[Reserved].

G--Defect Action Levels, which explains the natural or unavoidable defects in food for human use that present no health hazard; and, contains '2 shalls' (mandatory requirements).

The PRPs that are needed depend upon the segment of the food chain in which the organization operates and they provide the foundation upon which the HACCP plan is established.

à

Preliminary steps to enable hazard analysis

Including the requirements for assembling a food safety team (HACCP¹ application step 1); identification of product characteristics (step 2), identification of the intended use (step 3); preparation of flow diagrams (step 4) and their confirmation (step 5)

à

Hazard analysis (Principle 1, Step 6¹⁾

Including the requirements for identification and determination of acceptable levels, hazard assessment and assessment of control measures

à

Establishing the operation prerequisite programs (PRPs)

Including the requirement that PRPs be documented and include the prescribed information for each programme

à

Establishing the HACCP plan (Principles 2 thru 5, Steps 7 thru 10¹)

Including the requirements for identification of critical control points (CCPs), determination of critical limits, monitoring and actions when monitoring results indicate CCPs are exceeded

CAUTION - ISO 22000 clause 7.6.1 HACCP plan, contains 7 specific requirements for plan content and many existing HACCP plans do not address all 7 requirements and/or regulations may stipulate different requirements.

à

Updating of preliminary information specifying the PRPs and the HACCP plan

Including the requirement for the updating of product characteristics, intended use, flow diagrams, process steps, and control measures; after the operational PRP(s) and/or the HACCP plan were were established, as necessary

à

Verification planning (Principle 6, Step 11¹)

à

Traceability system

Including the requirements for establishing and applying a traceability system that enables the identification of product lots and their relation to batches of raw materials, processing and delivery records.  This is currently a significant missing link in the produce industry, e.g., contaminated tomatoes - where did they come from?

NOTE Organizations may want to evaluate the benefit of integrating/implementing
ISO 22005:2007 Traceability in the feed and food chain — General principles and basic requirements for system design and implementation into their organization's FSMS.

à

Control of nonconformity

Including the common ISO-based management system requirements for corrections and corrective actions

Validation, verification, and improvement of the food safety management system

à

General

Including the requirements for planning and implementation of the processes needed to validate the control measures or their combinations

à

Validation of control measure combinations

à

Control of monitoring and measuring

Including the requirements for monitoring and measuring methods (e.g., reference various sources such as AOAC International's online Official Methods of Analysis, FDA's online Bacteriological Analytical Manual, APHA's Compendium of Methods for the Microbiological Examination of Foods, etc.) and equipment that are sufficient enough to support the performance of the monitoring and measuring procedures

Including the requirement that the measuring equipment and methods used (this would also encompass preparation of media and reagents) are calibrated or verified at defined intervals, or prior to use to ensure valid results; and, if found out of calibration, adjusted as necessary

And, also including the requirement for an analysis of verification activities to confirm that the overall performance of the food safety management system is meeting planned arrangements and the requirements of the organization; and, to provide evidence that any corrections and corrective action have been effective.

à

Food safety management system verification

Including the common management system requirements for internal audit, evaluation of verification results and analysis of results of verification activities

Including the requirement for evaluation of individual results of verifications planned to demonstrate conformity to requirements and if verification does not demonstrate conformity that appropriate actions taken

à

Continual improvement (a common requirement of ISO-based management systems)

This is to be achieved through the use of communication, internal audit, evaluation of individual verification results, etc.

Including the requirement that top management must ensure that the food safety management system is continually updated

¹Codex Alimentarius Food Hygiene Basic Texts.  Food and Agricultural Organization of the United Nations, World Health Organization  (WHO), Rome, 2001

Food Chains

4

Food chains are usually complex and may start as early as crop farming and move through feed production.  They may involve many suppliers, from farms and food processors to grocers and restaurants that provide services such as farming, slaughtering, butchering, processing, handling, filling, canning, labeling, packaging, storage, distribution and preparation processes, some of which may recur several times in the chain prior to consumer consumption.

4

The longer the food chain the more the food may be susceptible to

a)

environmental changes such as wildlife population shifts and land, water or air contamination;

b)

threats to the food supply such as accidents, monitoring of imported food, acts of disgruntled employees, or even terrorist attacks - reference the FDA's Food Security Preventive Measures Guidance regulation (21 CFR 10.115; 65 FR 56468) and The Customs-Trade Partnership Against Terrorism (C-TPAT), and

c)

the biggest threat – contamination with Escherichia coli (E. coli), Salmonella, Clostridium botulinum or other bacterium.

ISO 22000 Documentation

4

ISO 22000 Food safety management systems has no formal requirements for an organization to establish and document a food safety manual.  However many organizations may choose to document a brief food safety manual to provide a 'roadmap' of their system; and, to provide a marketing piece for customers and other interested parties that provides a high level view of how the organization is meeting the requirements.

4

There are documentation requirements for:

1)

a scope that specifies the product or product categories and the processes as well as the production sites that are covered by the food safety management system;

2)

formal statements of the organization's food safety policy and related objectives;

3)

procedures required by the standard which may identify responsibilities, inputs, activities, control points, outputs and references to other documents and records;

There are 10 clauses in ISO 22000:2005 that specifically require a procedure(s):

Document control (cl. 4.2.2)

Record control (cl. 4.2.3)

Emergency preparedness and response (cl. 5.7)

Monitoring procedures that demonstrate that the operational PRPs are implemented (cl. 7.5 c)

Relevant monitoring system procedures for the monitoring of critical control points (cl. 7.6.4)

Handling of potentially unsafe products (cl. 7.6.5)

Identification and assessment of affected end products to determine their proper handling
(cl. 7.10.1)

Corrective action (cl. 7.10.2)

Procedure for notification; handling; and, the sequence of actions to be taken; for withdrawal of lots of unsafe end products (cl. 7.10.4)

NOTE 1 This procedure should address Class I, Class II, and Class III recalls as well as Market withdrawal if the end product is regulated by the FDA.

Internal audit (cl. 8.4.1)

NOTE 2 These procedures are in addition to any procedures that were established, or need to be established by the organization to meet the requirements of applicable Prerequisite Programs.

4)

flow diagrams for the products or processes included in the scope of the FSMS which illustrate the sequence and interaction of the steps in the operation, identify any subcontracted work or outsourced processes, identify recycle and/or rework points and identify where products are released;

5)

HACCP plan which includes the food safety hazard(s) to be controlled, controls, and actions when limits are exceeded; and

6)

other documents such as forms, tags and labels that prompt recording of evidence of conformance to requirements

ISO 22000 Food safety management systems - Benefits

a

closes the gap between ISO 9001 and HACCP

a

meets food industry expectations

a

based on system management, not on inspections or a product approach

a

provides an opportunity for international recognition through 3^rd party registration

a

makes savings from fewer customer audits possible

a

provides a baseline for the entire food chain

Training, Conferences, Meetings and Links

·

Internal Auditor Course
- Oak Brook, IL, July 23-24, 2008

·

Joint AMI/FMI Committee Meeting and FMI Food Protection Committee Meeting (for Proceedings)
- Charlotte, NC, April 24-26, 2007

 American Public Health Association

 AOAC International

 Centers for Disease Control and Prevention

 Customs-Trade Partnership Against Terrorism

 Food and Drug Administration (CFSAN)

 Food Business Review

 Food Info Net

 International Organization for Standardization

 The Packer.com

 United States Department of Agriculture

 United States Department of Health and Human Resources

 World Health Organization

Request a visit, more information or a quote