Preparing for ISO 22000 Certification: An Engineering Roadmap for Food and Agro Enterprises

Certification under ISO 22000 (ISO 22000:2018, harmonized in Ukraine as DSTU ISO 22000:2019) is an engineering and management discipline for constructing a Food Safety Management System (FSMS). Unlike isolated sanitation checklists, this international standard integrates HACCP hazard analysis principles into the ISO High Level Structure (HLS) for corporate risk governance. For enterprises in the food industry, agricultural processors, grain elevators, cold-chain logistics operators, and food packaging manufacturers, certification requires proving to third-party auditors not merely that manuals exist on a shelf, but that production lines consistently control biological, chemical, physical, and allergen hazards across every shift.

Preparation projects most frequently stall when quality teams attempt to draft procedures in isolation from plant engineering, equipment layout, raw material routing, and shop-floor operator routines. Certification body auditors evaluate operational reality: chemical titration of clean-in-place (CIP) solutions, metrological calibration of pasteurizer RTD temperature probes, sensitivity verification of metal detectors, strict record-keeping during line deviations, and immediate physical quarantine of nonconforming batches.

This technical guide is written for plant directors, Food Safety Team Leaders (FSTL), chief food technologists, maintenance heads, and QA managers. It breaks down ISO 22000:2018 preparation at the clause level: from designing the dual PDCA architecture and categorizing prerequisite programs to calculating mass balance within a 4-hour mock recall exercise and passing Stage 1 and Stage 2 certification audits.

The structure of ISO 22000:2018 operates on two interconnected Plan-Do-Check-Act (PDCA) cycles that run simultaneously at two distinct organizational tiers and converge inside Clause 8:

1. Organizational Planning and Control PDCA (Management System Tier): spans Clause 4 (Context of the Organization), Clause 5 (Leadership), Clause 6 (Planning), and Clause 7 (Support) as the Plan and resource allocation foundation; Clause 8 (Operation) as the Do execution phase; Clause 9 (Performance Evaluation, internal audit, and management review) as the Check phase; and Clause 10 (Nonconformity, corrective action, and continual improvement) as the Act phase. At this level, executive management evaluates internal and external issues (Clause 4.1), interested party expectations (Clause 4.2), and organizational risks and opportunities (Clause 6.1), such as high turnover of line operators, backup power reliability for refrigeration rooms, or supply chain disruptions for imported ingredients.
2. Operational PDCA (Food Safety Hazard Control Tier inside Clause 8): translates Codex Alimentarius HACCP principles into daily shop-floor engineering. Here, Plan covers establishing Prerequisite Programs (PRPs, Clause 8.2), traceability systems (Clause 8.3), emergency preparedness (Clause 8.4), conducting hazard analysis, and validating control measures prior to implementation (Clauses 8.5.1-8.5.3). Do represents executing the Hazard Control Plan (OPRPs and CCPs) during production runs. Check encompasses verification activities for PRPs and the Hazard Control Plan (Clause 8.8) alongside control of monitoring and measuring equipment (Clause 8.7). Act governs immediate corrections, root-cause corrective actions, and disposition of potentially unsafe products when critical limits or action criteria are breached (Clause 8.9).

Maintaining a clear boundary between organizational risks (Clause 6.1) and operational food safety hazards (Clause 8.5.2) is a strict requirement during third-party audits. Auditors raise nonconformities when companies merge commercial business risks (such as currency fluctuation or delayed freight) with microbiological hazards (Salmonella spp., Listeria monocytogenes, or mycotoxins) in a single risk matrix without separate assessment methodologies.

For food business operators in Ukraine, implementing permanent procedures based on HACCP principles is a statutory duty, whereas ISO 22000 certification is a voluntary, accredited confirmation of system maturity for B2B buyers and export markets. During audit preparation, internal procedures must align with national regulatory acts and international references:

• Law of Ukraine No. 771/97-VR "On Basic Principles and Requirements for Food Safety and Quality": Articles 20 and 21 mandate that market operators develop, validate, and apply permanent HACCP-based procedures and maintain "one step back - one step forward" traceability (Article 22).
• Law of Ukraine No. 2042-VIII "On State Control over Compliance with Legislation on Food, Feed, Animal By-products, Animal Health and Welfare": defines the risk-based inspection checklists and state HACCP audit protocols used by inspectors of the State Service of Ukraine on Food Safety and Consumer Protection.
• Order of the Ministry of Agrarian Policy and Food of Ukraine No. 590 "On Approval of Requirements for the Development, Implementation and Application of Permanent Procedures Based on HACCP Principles": establishes detailed statutory rules for prerequisite programs (facility layout, water quality, cross-contamination prevention, pest control, personnel hygiene) and the 7 HACCP principles.
• Codex Alimentarius General Principles of Food Hygiene CXC 1-1969: the international benchmark underpinning both Ukrainian law and ISO 22000:2018.

When a facility already operates a baseline HACCP system compliant with Order No. 590, upgrading to ISO 22000:2018 requires constructing the management system architecture: organizational context and risk planning (Clauses 4 and 6), control of externally developed FSMS elements and outsourced processes (Clauses 7.1.5 and 7.1.6), formal separation of Operational Prerequisite Programs (OPRPs) from CCPs, documented pre-implementation validation of control measures (Clause 8.5.3), and structured Management Review meetings (Clause 9.3). Furthermore, if the enterprise targets Private Label contracts with European retail chains or multinational food manufacturers, the system should be engineered with GFSI-benchmarked schemes in mind, specifically FSSC 22000, BRCGS Food Safety, or IFS Food.

Project execution starts with defining the exact FSMS Scope (Clause 4.3). The scope statement that will appear on the accredited certificate must specify the applicable food chain category under ISO/TS 22003-1:2022 (for example, Category CI for processing of perishable animal products, CII for perishable plant products, CIII for mixed animal and plant products, CIV for ambient-stable products, G for transport and storage services, or I for production of food packaging). The scope must explicitly list all physical production addresses, processing lines, product families, and outsourced operations (such as external blast-freezing warehouses or contracted transport fleets).

Under Clause 5.3, top management formally appoints the Food Safety Team and the Food Safety Team Leader (FSTL). An effective team cannot consist solely of the quality manager; it must be multidisciplinary, combining the chief technologist, chief maintenance/automation engineer, production manager, warehouse supervisor, and procurement or laboratory specialist. Collective competence (Clause 7.2) must be backed by objective evidence: academic degrees in food technology or microbiology, training certificates in ISO 22000:2018 and internal auditing under ISO 19011, and written knowledge assessment records.

Within Clause 7 (Support), preparation must address three specific clauses that frequently trigger audit findings:

• Clause 7.1.5 (Externally Developed Elements of the FSMS): if the facility uses industry hygiene guides, external software templates, or hazard plans drafted by outside consultants, the Food Safety Team must document how these elements were verified as applicable to the facility's specific equipment and approved internally.
• Clause 7.1.6 (Control of Externally Provided Processes, Products or Services): establishing a documented supplier approval and performance evaluation program covering raw materials, ingredients, primary packaging, sanitation chemicals, food-grade lubricants (NSF H1), pest control contractors, calibration labs, and accredited testing laboratories.
• Clause 7.4 (Communication): formalizing external communication protocols (with regulatory authorities, suppliers, and B2B clients regarding product specifications and allergens) and internal communication triggers. Internal communication rules require engineering, R&D, and purchasing departments to notify the Food Safety Team before implementing any change: new recipes, alternative packaging films, heat-exchanger modifications, piping reroutes, or revised sanitation schedules.

To manage the implementation project systematically, engineering and quality teams verify readiness against every mandatory clause of ISO 22000:2018:

• Clause 4 (Context of the Organization): documented register of internal and external issues (PESTEL/SWOT focused on food safety); matrix of interested parties and their regulatory/contractual requirements; approved FSMS Scope statement mapped to site layouts and product groups.
• Clause 5 (Leadership): signed Food Safety Policy displayed across production areas and understood by shop-floor workers (Clause 5.2); responsibility and authority matrix integrated into job descriptions; formal appointment order for the Food Safety Team and FSTL.
• Clause 6 (Planning): organizational risk and opportunity register with mitigation actions (Clause 6.1); measurable food safety objectives linked to numerical KPIs, target dates, budgets, and owners (Clause 6.2); documented Management of Change (MoC) procedure (Clause 6.3).
• Clause 7 (Support): infrastructure and work environment inspection reports (Clauses 7.1.3-7.1.4); personnel competence matrix and completed training logs with effectiveness verification (Clause 7.2); documented information control procedure governing document coding, version control, retention periods, and protection of paper/electronic logs against unauthorized alteration (Clause 7.5).
• Clause 8 (Operation): implemented PRPs aligned with the relevant ISO/TS 22002 part (Clause 8.2); bidirectional batch identification and traceability logs (Clause 8.3); emergency preparedness plan and tested response drills (Clause 8.4); validated Hazard Control Plan with active OPRP and CCP monitoring (Clause 8.5); metrological calibration/verification records for all measuring devices traceable to national/international standards (Clause 8.7); executed verification schedule (Clause 8.8); active procedures for corrections, corrective actions, and handling of potentially unsafe products (Clause 8.9).
• Clause 9 (Performance Evaluation): trend analysis of monitoring and verification data (Clause 9.1); completed full cycle of internal audits across all processes and shifts conducted by impartial auditors (Clause 9.2); complete Management Review minutes covering all mandatory inputs and outputs (Clause 9.3).
• Clause 10 (Improvement): documented root cause analysis (5 Whys or Ishikawa fishbone) and verified corrective actions for every nonconformity (Clause 10.1); records of continual improvement and periodic FSMS updating (Clauses 10.2-10.3).

The core technical challenge in preparing for ISO 22000:2018 certification is conducting a rigorous hazard analysis (Clause 8.5.2) and accurately classifying controls into three tiers: foundational Prerequisite Programs (PRPs), Operational Prerequisite Programs (OPRPs), and Critical Control Points (CCPs). The 2018 revision tightened the engineering criteria distinguishing OPRPs from CCPs.

The engineering workflow follows three sequential steps:

1. Preliminary Steps to Enable Hazard Analysis (Clause 8.5.1): the Food Safety Team compiles detailed specifications for all raw materials, ingredients, processing aids, and food-contact packaging (Clause 8.5.1.2), alongside finished product specifications detailing composition, physicochemical parameters ($pH$, water activity $a_w$, moisture), microbiological limits, storage conditions, shelf life, and intended consumers including vulnerable groups (Clauses 8.5.1.3-8.5.1.4). Process flow diagrams (Clause 8.5.1.5) are then drawn showing every process step, where raw materials, water, culinary steam, compressed air, and packaging enter, where rework is re-introduced, and where waste exits. Every flow diagram must be physically verified on the shop floor during active production.
2. Hazard Identification and Assessment (Clauses 8.5.2.2-8.5.2.3): for each process step, biological, chemical, physical, radiological, and allergen hazards are identified with an explicit definition of the acceptable level in the end product. Each hazard is evaluated using a two-dimensional matrix: Likelihood of occurrence (prior to applying specific control measures) multiplied by Severity of adverse health effects. This assessment determines which hazards are Significant Food Safety Hazards.
3. Selection and Categorization of Control Measures (Clause 8.5.2.4): every significant food safety hazard must be controlled by an OPRP, a CCP, or a combination of both. Categorization is based on evaluating two technical factors: (a) the strictness of the control measure's effect on the hazard (likelihood of failure and severity of consequence if control fails), and (b) the feasibility of real-time monitoring to detect any failure immediately and enable timely correction before product release.

The operational distinctions between the three control levels are defined as follows:

• PRP (Prerequisite Program, Clause 8.2): baseline environmental and sanitary conditions across the facility that do not target a single specific hazard at one process step, but maintain general hygiene (floor sanitation, pest management, personnel hygiene locks, building maintenance, general HVAC ventilation).
• OPRP (Operational Prerequisite Program, Clause 8.5.4): a control measure identified by hazard analysis as essential to control a significant hazard, managed via an Action Criterion that can be either measurable (e.g., differential pressure across an air filter or disinfectant ppm concentration) or observable (e.g., visual inspection of a $1.2\ \text{mm}$ rotary sifter mesh before and after shift, allergen changeover cleaning inspection between peanut-containing and allergen-free batches, or optical inspection of glass jars). A deviation from an Action Criterion indicates elevated risk requiring root-cause review and product impact evaluation, but does not automatically render the entire batch critically unsafe.
• CCP (Critical Control Point, Clause 8.5.4): a step in the process where the control measure is decisive for preventing or reducing a significant hazard to an acceptable level, governed by a strictly measurable Critical Limit. Monitoring at a CCP detects loss of control in real time so that affected product is immediately diverted or quarantined. Industrial examples include milk pasteurization at $\ge 72\ ^\circ\text{C}$ for $\ge 15\ \text{s}$ equipped with an automated flow-diversion valve, final-pack metal detection with validated sensitivity limits ($Fe \le 1.5\ \text{mm}$, $Non\text{-}Fe \le 2.0\ \text{mm}$, $SUS\ 316 \le 2.5\ \text{mm}$), or X-ray foreign-body inspection.

A major source of nonconformities during ISO 22000:2018 audits is confusion among plant personnel between validation, monitoring, and verification. The standard separates these activities by timing and objective:

• Validation (Clause 8.5.3): obtaining objective evidence prior to implementation (and whenever process changes occur) that a selected control measure or combination of OPRPs/CCPs is capable of achieving the intended control of the significant hazard when operated within its critical limits or action criteria. For example, validating a baking or retorting step requires thermal mapping with data loggers placed in the slowest-heating cold spot of the product and demonstrating a $5\text{-log}$ or $6\text{-log}$ reduction of the target pathogen (or calculating thermal lethality $F_0$), supported by scientific literature, statutory tables, or challenge-test trials. Validating an allergen cleaning procedure requires conducting swab tests using specific ELISA protein kits across 3 consecutive changeover washes to prove the protocol consistently removes allergen residues below the limit of quantification ($< 5\ \text{ppm}$).
• Monitoring (Clause 8.5.4.4): conducting a planned sequence of observations or measurements in real time during operation to assess whether a control measure is operating within its Critical Limit or Action Criterion (for example, continuous SCADA temperature logging every 10 seconds or hourly metal detector checks using certified test wands).
• Verification (Clause 8.8): confirming through objective evidence after the fact that specified requirements have been fulfilled. Verification includes periodic microbiological testing of finished product batches and environmental swabs in an accredited laboratory, shift supervisor review and sign-off of CCP monitoring logs, metrological calibration of sensors, and internal audits.

Under Clause 8.3, the traceability system must uniquely identify incoming lots of raw materials, ingredients, and primary food-contact packaging and link them through all processing stages to finished product batches and first-tier customer deliveries. The system must explicitly capture rework incorporation, bulk storage in intermediate silos or buffer tanks, and packaging batch roll changes.

To demonstrate compliance with Emergency Preparedness and Response (Clause 8.4) and Withdrawal/Recall Controls (Clause 8.9.5), the enterprise must conduct at least an annual Mock Recall and Traceability Drill incorporating a full Mass Balance (Mass Balance) reconciliation. Across international certification audits (especially when aligning with FSSC 22000, BRCGS, and IFS), the industry benchmark for completing the end-to-end exercise is under 4 hours.

During the certification audit, the auditor selects a random batch number of finished product (or a lot number of raw material or primary packaging), and the team must compile the complete traceability dossier within the 4-hour window:

1. Backward Traceability: all lots of raw materials, minor ingredients, processing aids, and primary packaging used in the selected batch, along with their incoming inspection records, Certificates of Analysis (CoA), and batch recipe sheets.
2. Production Process History: CCP and OPRP monitoring logs covering the exact production window of the batch, pre-operational sanitation verification records, and any rework batch numbers blended into the run.
3. Forward Traceability: all dispatch bills of lading, customer names, delivery warehouse addresses, remaining stock held in the plant's finished goods warehouse, and retention samples stored in the quality archive room.
4. Mass Balance Calculation: mathematical reconciliation comparing the total weight/units of raw material consumed (or finished product manufactured) against the sum of dispatched quantities, warehouse inventory, retention samples, and documented technological loss/scrap. Mass balance recovery must fall within validated process yield tolerances (typically $98.5%-101.5%$). An unexplained discrepancy of $5%-10%$ results in a major audit finding for broken traceability.

Auditors also test the team's execution of Clause 8.9.4 (Handling of Potentially Unsafe Products): any product manufactured while a CCP Critical Limit was exceeded must be immediately placed on physical and ERP quarantine hold and cannot be released until it undergoes documented hazard evaluation, rework, or destruction.

An accredited certification body will not proceed to Stage 2 until the facility has completed a full cycle of Internal Audits (Clause 9.2) and conducted a formal Management Review (Clause 9.3).

The internal audit program must be scheduled based on process risk criticality, recent system changes, and previous audit findings. Impartiality is strictly enforced: auditors cannot audit their own work (for example, the FSTL cannot audit the Hazard Control Plan they authored; another trained internal auditor from a different department must perform that check, or the company can commission an external diagnostic audit). Internal audits must inspect active production lines across day, night, and weekend shifts.

Following the internal audit cycle and initiation of corrective actions, executive leadership convenes the Management Review (Clause 9.3). The documented meeting minutes must address every mandatory input listed in Clause 9.3.2:

• status of actions from previous management reviews;
• changes in external and internal issues relevant to the FSMS, including changes in organization and context;
• information on FSMS performance and effectiveness: extent to which food safety objectives have been met, monitoring and measurement results, analysis of verification activities related to PRPs and the Hazard Control Plan, nonconformities and corrective actions, internal and external audit results, and regulatory/customer inspections;
• adequacy of resources;
• any emergency situations, incidents, or withdrawals/recalls that occurred;
• relevant information obtained through external and internal communication, including customer complaints;
• opportunities for continual improvement.

Management Review outputs (Clause 9.3.3) must record formal decisions regarding resource allocation, infrastructure upgrades, training budgets, and revisions to the FSMS and its objectives.

Initial certification under ISO 22000:2018 is executed in two sequential stages governed by ISO/IEC 17021-1 and ISO/TS 22003-1:2022. Total audit duration (in auditor-days) is calculated by the certification body based on the food chain category baseline, the number of distinct HACCP studies (separate processing technologies), facility square footage, and Full-Time Equivalent (FTE) headcount.

Stage 1 Audit (Readiness Review and Documentation Assessment): The objective of Stage 1 is to verify that the documented FSMS addresses all clauses of ISO 22000:2018 and that the facility is prepared for the Stage 2 on-site evaluation. The auditor inspects:

• accuracy of the certification scope statement and food chain category classification;
• appropriateness of Prerequisite Programs (PRPs) for the facility's infrastructure and process environment;
• hazard analysis methodology, risk scoring logic, OPRP/CCP selection criteria, and pre-implementation validation dossiers;
• objective evidence that a complete internal audit cycle and Management Review have been executed;
• statutory compliance documents (operating permit or state facility registration, waste disposal contracts, pest control agreements, potable water lab reports).

At the close of Stage 1, the auditor issues a report listing any Areas of Concern that could become nonconformities during Stage 2. The interval between Stage 1 and Stage 2 is typically 2 weeks to 3 months (and cannot exceed 6 months under accreditation rules), giving the enterprise time to close any identified gaps.

Stage 2 Audit (On-Site Implementation and Effectiveness Audit): During Stage 2, the auditor spends $60%$ to $75%$ of total audit time directly on the production floor, in raw material and finished goods warehouses, laboratories, utility rooms (boilers, air compressors, water treatment), and external grounds. Key activities include:

• observing line operators executing CCP and OPRP monitoring and performing live Challenge Tests on metal detectors, X-ray units, checkweighers, and thermal diversion valves;
• interviewing operators, sanitation staff, and maintenance technicians to verify they understand critical limits, action criteria, and deviation protocols;
• inspecting equipment hygiene, sifter mesh integrity, gasket condition, air-handling filtration, and personnel handwashing compliance in hygiene locks;
• cross-checking real-time warehouse temperature/humidity displays against historical monitoring logs;
• timing a live traceability and mass balance exercise;
• auditing preventive maintenance logs, Glass & Brittle Plastic registers, allergen segregation, and chemical storage.

To navigate both stages smoothly on the first attempt, food manufacturers frequently engage specialized audit support that includes a full mock Stage 2 inspection.

Reviewing third-party certification audit reports across food processors and agricultural facilities highlights 7 recurring nonconformities that delay certificate issuance:

1. Missing Validation Evidence for Control Measures (Clause 8.5.3): Critical Limits for thermal processing, drying moisture, or sanitizer concentration are listed in the Hazard Control Plan, but the team cannot provide experimental trials, thermal lethality records, or scientific references proving those parameters eliminate the target hazard.
2. Uncontrolled Process or Equipment Changes (Clauses 6.3 and 8.5.2): a new packaging line, ingredient supplier, or bypass pipe is installed in the plant, but the verified flow diagram and hazard analysis have not been updated.
3. Confusing Corrections with Corrective Actions (Clauses 8.9.2, 8.9.3, and 10.1): when a deviation occurs (such as an elevated aerobic plate count on a conveyor swab), the team records the immediate correction (re-washing the belt) but fails to perform Root Cause Analysis (RCA) to determine why the scheduled wash failed (e.g., clogged spray nozzle, low water temperature, or worn belt scraper) and implement systemic corrective action.
4. Gaps in Metrological Control (Clause 8.7): reference thermometers, scales, or pH meters used at CCPs lack valid calibration certificates traceable to national standards, or the procedure omits mandatory retroactive evaluation of product manufactured since the last passed calibration check when an instrument is found out of tolerance.
5. Weak Allergen and Foreign-Body Cross-Contamination Controls (Clause 8.2): lack of color-coded sanitation tools, storing allergen-containing powders (milk powder, soy lecithin, mustard, sesame, gluten) above non-allergen ingredients, or allowing wooden pallets and snap-off utility blades inside open product zones.
6. Superficial Pest Control Oversight: bait stations and insect light traps (ILTs) are installed, but the facility lacks pest catch trend analysis, Safety Data Sheets (SDS) for approved rodenticides, or mistakenly places toxic bait blocks inside internal production halls instead of mechanical traps.
7. Pre-filled or Backdated Monitoring Logs: operators recording hourly temperature or metal-detector checks ahead of time for future hours of the shift, or recording identical flatline temperatures across weeks without natural process variation.

A realistic engineering timeline to prepare a manufacturing facility for ISO 22000:2018 certification ranges from 3 to 6 months. Attempting to compress preparation into 3-4 weeks fails because accredited certification bodies require 2 to 3 months of operational records demonstrating active monitoring, verification, and management review prior to the Stage 2 audit.

The project budget is structured around four primary cost centers:

1. Infrastructure Upgrades for PRP Compliance (ISO/TS 22002-1): installing hands-free wash stations in hygiene locks, shatterproof light covers, insect mesh and air curtains, repairing epoxy floor coatings, purchasing color-coded cleaning equipment, and calibrating sensors.
2. Methodology and System Design (implementation): conducting the initial Gap Analysis, verifying flow diagrams, performing hazard assessment, and drafting SOPs, work instructions, and logbooks tailored to the plant's equipment.
3. Laboratory Verification and Personnel Training: funding microbiological and physicochemical testing of raw materials, potable water, environmental swabs, and finished products according to the verification schedule, plus certified training for the Food Safety Team and internal auditors.
4. Certification Body Fees: covering Stage 1 and Stage 2 auditor-days, travel expenses, certificate issuance, and subsequent annual surveillance audits over the three-year certification cycle.

Achieving ISO 22000 certification shifts food safety management from reactive firefighting to structured engineering control. When the dual PDCA architecture operates effectively, every line operator knows the exact critical limits of their station, the maintenance department aligns preventive maintenance with hygienic design rules, and procurement admits only verified raw materials into the plant.

Beyond fulfilling Ukrainian statutory requirements and passing state inspections, an accredited FSMS unlocks national retail tenders, B2B ingredient contracts with multinational processors, and export markets, while establishing the core foundation for GFSI-benchmarked schemes such as FSSC 22000, BRCGS, or IFS. If your enterprise requires engineering assistance to design its system or prepare for third-party verification, explore our end-to-end standard implementation and certification audit support services.