Where do you start: PRPs or the hazard analysis?
With the PRPs. Prerequisite programmes set the basic hygiene conditions on which the hazard analysis reasons: a HACCP plan built on poorly cleaned premises or uncontrolled water ends up with too many CCPs. ISO 22000:2018 deals with PRPs in clause 8.2, before hazard control in clause 8.5.
The standard lets the organisation choose and justify its PRPs. The strongest basis today is the 2025 ISO 22002 series: the ISO page for ISO 22002-100:2025 presents it as supporting compliance with clause 8.2, to be read with the sector part for your activity, for example ISO 22002-1:2025 for manufacturing. It is not mandatory for ISO 22000 alone; it becomes mandatory if you move to FSSC 22000 Version 7.
For each PRP, a short sheet is enough, provided it answers these questions.
PRP sheet heading | What it must state | Example for pest control |
|---|---|---|
Purpose | What the programme controls | Prevent pests from entering and settling |
Hazard or requirement covered | Why it exists | Physical and microbiological contamination; customer requirement |
Reference | The standard or text that frames it | Applicable ISO 22002 part, regulations, customer specification |
Owner | Who runs it, who carries it out | Hygiene manager; contracted provider |
Method and frequency | How, when, where | Bait station map, visit frequency, alert criteria |
Record | What proves it is applied | Visit reports, readings, actions taken |
Verification | How you know it works | Internal inspection, trend analysis |
A PRP that cannot fill in the second row has no reason to exist, and the auditor will see it. Cross-cutting programmes, such as allergens, traceability or environmental monitoring, are covered on our food safety programmes page.
What are the steps, from the team to the hazard control plan?
Nine steps, which follow the Codex HACCP method and add the decisions specific to ISO 22000. The seven principles and twelve steps of the Codex are explained on our HACCP plan and ONSSA approval page; ONSSA, the Office national de sécurité sanitaire des produits alimentaires, is Morocco’s national food safety office, which approves food establishments. This table focuses on what ISO 22000 expects on top of the Codex.
Step | ISO 22000:2018 clause | What you produce | What ISO 22000 adds to the Codex |
|---|---|---|---|
1. Appoint the food safety team | 5.3 and 7.2 | Membership, team leader, evidence of competence | A team leader appointed by top management, proven competence |
2. Describe raw materials, finished products and intended use | 8.5.1.2 to 8.5.1.4 | Raw material and product sheets, uses, consumers | Food-contact materials are described too |
3. Establish and confirm the flow diagrams | 8.5.1.5 | Diagrams verified on site, dated | A description of the processes and of their environment |
4. Identify hazards and their acceptable level | 8.5.2.2 | Hazards listed by step, acceptable level in the finished product | The acceptable level is set and justified |
5. Assess each hazard | 8.5.2.3 | Significant hazards retained, written method | The assessment method is described |
6. Select and categorise the control measures | 8.5.2.4 | Each measure classified as a CCP or an OPRP, written reasoning | The OPRP category, absent from the Codex |
7. Validate the measures | 8.5.3 | Validation file for each CCP and each OPRP | Validation comes before implementation |
8. Write the hazard control plan | 8.5.4 | Critical limits, action criteria, monitoring, actions | CCPs and OPRPs in a single plan |
9. Verify and update | 8.6 and 8.8 | Verification programme, analysis of results, updates | PRPs and plan updated together |
Two steps are often rushed. Step 4 first: setting the acceptable level of the hazard in the finished product means reading the regulations of the countries of sale and your customers’ requirements, and it is that level that tells you whether a measure is sufficient. For an exporter, that can mean several sets of rules for the same product. Step 7 next: a measure applied before it is validated is a hypothesis put into production.
CCP or OPRP: how do you decide, measure by measure?
Through a written assessment of each measure, which takes into account, among other things, the likelihood that it fails and the severity of the consequences if it does. If the measure has a measurable critical limit and a deviation makes the product potentially unsafe, it is a CCP. If it has a measurable or observable action criterion and a deviation requires the product to be assessed, it is an OPRP.
To structure the reasoning, we ask the team five questions, measure by measure:
- Was the measure specifically designed to reduce this hazard to an acceptable level?
- Does another measure, downstream, catch its failure?
- Can it be monitored fast enough to act before the product leaves?
- Is its criterion a measurable value or an observable finding?
- What happens to the consumer if it fails without anyone noticing?
The example below is generic: it illustrates the method for a biscuit factory, with no numerical values. Your own classifications come from your own analysis.
Control measure | Hazard targeted | Possible classification | What tips the balance | If the measure fails |
|---|---|---|---|---|
Baking to a validated time and temperature combination | Pathogens brought in by eggs or flour | CCP | The only step that reduces the hazard; monitoring possible for every batch | Batches concerned isolated and assessed by a competent person |
Metal detection at the end of the line | Metal fragments | CCP | Last barrier before the customer, continuous control | Product passed since the last compliant test re-run or isolated |
Sieving flour before mixing | Foreign bodies, insects | OPRP | A targeted measure, but other barriers exist downstream | Sieve checked; batches sieved since the last compliant check assessed |
Validated cleaning between a recipe with tree nuts and a recipe without | Undeclared allergen through cross-contact | OPRP | Observable and testable criterion, plausible failure | Product held and assessed, allergen test if needed |
Label check at start-up and at each changeover | Undeclared allergen through a labelling error | OPRP | Observable criterion, plausible failure | Labels removed, product relabelled or isolated |
General cleaning of the premises | Contamination of the environment | PRP | Does not target an identified significant hazard | Correction |
In another biscuit factory, baking might be an OPRP if another measure, further downstream, controls the same hazard. That is precisely what the auditor checks: that the classification flows from your analysis and not from a template.
How do you validate, monitor and verify the plan?
Validate before applying, monitor during production, verify afterwards. The three activities are distinct, and confusing them is one of the most frequent causes of audit findings.
Validate (clause 8.5.3). Prove that the measure, or the combination of measures, is capable of controlling the hazard to the acceptable level. Possible evidence: published scientific data, trials on your line, regulatory requirements, sector guides, data from the equipment manufacturer. Validation is repeated after any change of recipe, equipment or process.
Monitor (clause 8.5.4.3). Measure or observe each CCP and each OPRP at a frequency that lets you trace the product concerned. A test whose result arrives after shipment is not monitoring: it is verification. The measuring equipment used is calibrated or verified (clause 8.7).
Verify (clause 8.8). Confirm that the PRPs and the plan work as intended: review of records, product testing, inspections, internal audits. Results are analysed, and the analysis feeds the update of the system (clause 8.6) and the management review.
Sites that later prepare for FSSC 22000 will find these requirements again, with additions: Version 7, for example, requires routine, risk-based site inspections to verify the PRPs (additional requirement 2.5.12 of the scheme).
Which mistakes should you avoid, and which checklist should you follow?
The ones that turn a plan that is right on paper into a plan that cannot be applied. Here are the six we find most often in the ISO 22000 plans submitted to us.
- Copying the CCPs of a site in the same sector. Same product, different line, different barriers: the classification does not transfer.
- Forgetting the acceptable level. Without it, you cannot say whether a measure is sufficient.
- An OPRP without an action criterion. Nobody knows at what point to react.
- Validation done once and for all. A new recipe or a new oven calls it into question.
- An action that fixes the machine and forgets the product. The batch made since the last compliant measurement must be traced.
- A plan that cannot be read at the workstation. Operators must know their limit, their criterion and what to do in case of deviation.
Before presenting the plan to an internal audit, then to the certification body, tick these points.