ISO 22000:2018 Food Safety Management System Implementation (DSTU ISO 22000:2019): Engineering Guide to Dual PDCA, OPRPs vs CCPs, and Turnkey Certification with Ekontrol

ISO 22000:2018 food safety management system implementation starts where clipboard temperature logs fail. Walk onto the floor of a fluid dairy plant, an IQF freezing tunnel, or an infant formula blending line, and you're looking at dozens of thermal, chemical, and microbiological variables shifting every minute. Waiting to test the finished batch is a losing bet. By the time a Petri dish confirms Listeria monocytogenes or Salmonella spp., the contaminated pallets have already cleared your loading dock and entered a retail distribution center. That's why the international ISO 22000 standard (adopted identically in Ukraine as DSTU ISO 22000:2019) shifts quality control from post-mortem product testing to upstream process engineering across the entire food supply chain.

In practice, many food processors confuse a standalone HACCP plan with a complete Food Safety Management System (FSMS). The seven principles codified by the FAO/WHO Codex Alimentarius Commission do a great job of mapping biological, chemical, and physical hazards on the production line. Yet even the best Critical Control Point (CCP) fails when purchasing switches to a cheaper laminate film supplier without migration testing, maintenance skips preventive calibration on steam diversion valves, or night-shift operators don't know how to isolate work-in-progress during a grid blackout. ISO 22000:2018 fixes this disconnect through an engineering design you won't find in ISO 9001 or ISO 14001: the dual PDCA (Plan-Do-Check-Act) cycle.

How the Macro and Micro PDCA Loops Interact in ISO 22000:2018

The dual PDCA cycle in ISO 22000 runs two simultaneous control loops that feed data into each other: an organizational management loop at the business level and an operational hazard control loop on the shop floor. When we audit failing systems at Ekontrol, nine times out of ten the root problem is that these two loops don't talk to each other. Here's how they fit together when engineered properly:

1. First Loop: Organizational PDCA Cycle (Clauses 4-7 and Clauses 9-10). This outer macro-cycle governs business-level planning (Clause 4 Context, Clause 5 Leadership, Clause 6 Planning for organizational risks and objectives, Clause 7 Support and resources), system evaluation (Clause 9 Performance monitoring, internal auditing, management review), and system-wide improvement (Clause 10). It handles business and structural threats: raw material supply disruptions, turnover among sanitation staff, changes in EU mycotoxin limits, or ransomware targeting SCADA controllers.
2. Second Loop: Operational Hazard Control PDCA Cycle (Clause 8 Operation). Nested directly inside the "Do" block of the organizational loop, this micro-cycle puts Codex Alimentarius HACCP principles to work on the processing line. It covers Prerequisite Programs (PRPs, Clause 8.2), Traceability (Clause 8.3), Emergency Preparedness and Response (Clause 8.4), Hazard Analysis and the OPRP/CCP Hazard Control Plan (Clause 8.5), Updating PRP/Hazard Information (Clause 8.6), Control of Monitoring and Measuring (Clause 8.7), Validation and Verification (Clause 8.8), and Control of Product and Process Nonconformities (Clause 8.9).

Worth noting: certification auditors specifically test the handoff between these two loops. Suppose your Clause 8.9 records show three metal detector rejections in one quarter caused by worn polyurethane conveyor scrapers. That operational failure must travel up into Clauses 9.1, 9.3, and 10.1 so top management approves budget for metal-detectable polymer scrapers and updates the preventive maintenance schedule under Clause 7.1.3. If the incident stays buried in a shop-floor binder, the auditor writes a nonconformity against Clauses 6.1 and 9.3.

When a plant starts FSMS development and implementation under DSTU ISO 22000, the biggest temptation is copying Clauses 4 through 7 straight out of an existing ISO 9001 quality manual. Don't do it. That shortcut triggers immediate Stage 1 audit findings. Even though ISO 22000:2018 shares the 10-clause High-Level Structure (HLS), every organizational clause carries food-specific requirements tied directly to consumer safety.

Clauses 4 and 6: Defining Scope Boundaries and Separating Clause 6.1 Business Risks

Under Clause 4.3, you define your FSMS scope by specifying product categories, processes, production sites, and food chain categories under ISO 22003-1 (such as Category CI for perishable animal products, CIII for mixed animal and plant processing, Category G for transport and storage, or Category I for food packaging). If your facility runs both a cheese plant and a whey drying tower sharing raw milk intake, CIP return lines, or compressed air mains, you can't carve the whey tower out of your scope without proving complete physical and hygienic separation.

Clause 6.1 ("Actions to address risks and opportunities") trips up even experienced quality managers. You have to keep two risk registers separate:

• Organizational Risks (Clause 6.1): business, regulatory, or operational events that could prevent your FSMS from working as intended. Think 40% annual turnover among night-shift sanitation crews, single-source dependency on an imported allergen ELISA test kit, power grid instability, or ERP database corruption.
• Operational Food Safety Hazards (Clause 8.5): biological, chemical, physical, or allergen agents present in the food or processing environment that can harm the consumer (such as Campylobacter jejuni, aflatoxin $B_1$, glass shards, or undeclared soy lecithin).

Every significant organizational risk in Clause 6.1 should link to measurable food safety objectives under Clause 6.2 (for example, cutting unscheduled pasteurizer flow-diversion failures to zero or achieving 98% first-pass qualification for CIP operators).

Clauses 5 and 7: Food Safety Policy, FST Competence, and Communication Channels

Clause 5.3 requires top management to appoint a Food Safety Team Leader (FSTL) with direct authority to manage the multidisciplinary Food Safety Team (FST) and report on FSMS suitability to executives. Unlike the old "management representative" title, the FSTL must understand thermal processing, microbiology, and sanitary equipment design.

Clause 7.2 demands documented proof that the Food Safety Team collectively holds formal education, specialized HACCP/ISO 22000 training, and practical engineering experience covering your exact products, equipment, and hazards. If your cannery installs a new rotary steam-water retort for low-acid pouches and nobody on the FST knows how to run heat-penetration studies or calculate $F_0$ lethality, Clause 7.1.2 requires you to contract an external technical expert with a formal agreement defining scope, authority, and confidentiality.

Clause 7.4 splits communication into external and internal streams. Internal communication (Clause 7.4.3) ensures the Food Safety Team reviews any change BEFORE it hits the production floor: new raw material origins, modified CIP detergent concentrations, relocated packaging lines, or promotional plastic inserts placed inside snack bags. External communication (Clause 7.4.2) governs binding raw material specifications with suppliers, storage and allergen handling instructions on B2B/B2C labels, and statutory reporting to food safety authorities.

Clauses 9 and 10: Risk-Based Internal Auditing and Management Review

Under Clause 9.2, an internal audit can't just be a monthly hygiene walk-through. You schedule internal audits based on process risk: CCP stations, high-care slicing rooms, and allergen changeover lines get audited quarterly, while dry secondary carton warehouses might be audited twice a year. Impartiality is mandatory: the FSTL can't audit the hazard analysis they wrote themselves.

Management review (Clause 9.3) closes the macro loop. Top management evaluates verification results (Clause 8.8.2), OPRP/CCP deviation trends, 4-hour mock recall scores, regulatory inspection reports, and customer complaints, issuing signed decisions on capital upgrades, staffing, and FSMS updates (Clause 10.3). For a broader clause-by-clause overview, check our complete guide to ISO 22000 certification.

Clause 8 kicks off the operational PDCA loop by building the sanitary and infrastructural foundation of the plant. If condensation drips from an overhead evaporator coil into an open blending vat, no mathematical CCP model will save the batch from post-process contamination.

Clause 8.2: Prerequisite Programs (PRPs) and the ISO 22002-100:2025 Framework

Clause 8.2.3 requires organizations to reference the ISO/TS 22002 series when designing Prerequisite Programs. In 2025, ISO restructured these standards into a unified modular architecture led by ISO 22002-100:2025 (which sets common PRP requirements across the food, feed, and packaging supply chain) paired with sector-specific standards like ISO 22002-1:2025 for food manufacturing, ISO 22002-4 for food packaging, and ISO 22002-5 for transport and storage. You can explore the engineering specifics in our deep dives on the ISO 22002-100:2025 PRP foundation and the 2025 ISO 22002 series update.

Implementing Clause 8.2.4 on the factory floor comes down to concrete engineering controls:

• Hygienic zoning and process flow (Clause 8.2.4 a, b, c): strict physical separation between raw intake/dirty zones, intermediate processing, and High-Care / High-Risk finished product zones after thermal lethality. High-care rooms maintain positive air overpressure of $\Delta P = 5-15\text{ Pa}$ supplied through F7-F9 and HEPA H13 filtration cascades so unfiltered air from raw corridors can't get pulled in when doors open.
• Utilities contacting food or food-contact surfaces (Clause 8.2.4 d): potable water loops, culinary steam injected directly into product (free of boiler corrosion inhibitors like morpholine or hydrazine above statutory limits), and oil-free compressed air exhausting over open filling lines filtered through $0.2,\mu\text{m}$ sterile membrane cartridges.
• Cross-contamination and allergen zoning: color-coded sanitation tools segregated by zone (e.g., blue or white strictly for food-contact surfaces, red for restrooms and drains, yellow for warehouses) and dedicated storage for allergenic ingredients.

Clause 8.3: Traceability System and the 4-Hour Mass-Balance Mock Trace

Clause 8.3 requires a traceability system that links incoming raw materials and primary packaging from immediate suppliers through all internal processing steps (including rework/reprocessing) to the first commercial customer ("one step back, one step forward"). During certification and surveillance audits, auditors test this system with a timed 4-hour mass-balance traceability exercise.

Here's how the mass-balance equation works during an audit. The auditor picks a specific lot of raw material or finished product (say, $M_{\text{in}} = 10,000\text{ kg}$ of skimmed milk powder received four months ago) and starts a four-hour clock. Your team must pull receiving logs, batching tickets, rework logs, laboratory sampling records, warehouse stock reports, waste disposal certificates, and customer shipping manifests to balance the mass equation:

$$M_{\text{in}} = \sum M_{\text{FG}} + M_{\text{stock}} + M_{\text{loss}} + M_{\text{waste}} + M_{\text{samples}}$$

where $\sum M_{\text{FG}}$ is the quantity of the raw material lot incorporated into shipped and stored finished goods (calculated via validated recipe yield factors), $M_{\text{stock}}$ is remaining inventory in the warehouse, $M_{\text{loss}}$ covers documented technological shrinkage (evaporation, pipe purge losses), $M_{\text{waste}}$ is scrapped material on signed disposal manifests, and $M_{\text{samples}}$ accounts for QC retention and lab samples. Auditors expect reconciliation between $98%$ and $102%$ (and exactly $100%$ for serialized packaging units when accounting for machine reject counters). Where do plants fail? Unrecorded rework. If operators dump underweight dough or chocolate trim into the next day's mixer without logging the parent batch code, traceability breaks and a single contaminated lot forces you to recall an entire month of production.

Clause 8.4: Emergency Preparedness and Response in Modern Operations

Clause 8.4 requires documented, tested playbooks for emergencies that threaten food safety:

1. Power grid blackouts and voltage drops: your Clause 8.4.2 protocol defines automatic transfer switch (ATS) cutover times to backup diesel generators (e.g., under 45 seconds) and load-shedding priorities (pasteurizer flow-diversion valves, cold-storage ammonia compressors, PLC/SCADA historians, and CCP sensors). Thermal systems must use fail-safe engineering: if electrical power or pneumatic air pressure drops during pasteurization, the spring-returned Flow Diversion Valve (FDV) automatically fails into the divert position so under-pasteurized liquid never enters the sterile surge tank.
2. Water supply contamination or municipal shutoff: immediate halt of wet processing and CIP cycles, switchover to buffered potable water tanks with automated chlorine dosing or UV disinfection, and mandatory microbiological clearance before restarting lines.
3. Cyberattacks on ERP/MES/SCADA systems: paper fallback logbooks stored at every CCP/OPRP station, offline batch-coding procedures, and immutable air-gapped backups of traceability records.
4. Annual Mock Recalls: full simulation testing 24/7 emergency contact trees for commercial customers and regulatory inspectors at the State Service of Ukraine on Food Safety and Consumer Protection (DPSS).

Clause 8.5 ("Hazard control plan") is where auditors spend up to 50% of their on-site time. It's also where outdated consulting templates fail most often, because ISO 22000:2018 replaced arbitrary CCP decision trees with explicit engineering criteria in sub-clauses 8.5.2.4.1 and 8.5.2.4.2.

Step 1: Hazard Identification, Acceptable Levels, and the $L \times S$ Risk Matrix (Clause 8.5.2.3)

For every step on your verified process flow diagram (from raw material intake, water treatment, and rework addition to primary packaging and dispatch), the Food Safety Team lists all reasonably expected biological, chemical, physical, radiological, and allergen hazards and defines the acceptable level in the end product (e.g., Salmonella absent in $25\text{ g}$, patulin $\le 50,\mu\text{g/kg}$, no ferrous metal fragments $\ge 1.5\text{ mm}$).

Next, you assess each hazard using a two-dimensional risk matrix:

• Likelihood ($L$): probability that the hazard occurs in the end product at an unacceptable level if no specific control measure is applied at this step (assuming base PRPs under Clause 8.2 are running), scored 1 (rare, once in several years) to 5 (frequent/expected without a dedicated barrier).
• Severity ($S$): magnitude of adverse health effects on the consumer, scored 1 (minor transient discomfort) to 5 (permanent disability, anaphylactic shock, botulism, hemolytic uremic syndrome, or death).

The risk score is calculated as:

$$R = L \times S$$

When $R$ crosses your methodology threshold (for instance, $R \ge 9$, or any hazard where $S = 5$ and $L \ge 2$), it is classified as a Significant Food Safety Hazard. Non-significant hazards ($R < 9$) stay managed by routine PRPs (Clause 8.2). Every significant hazard MUST move forward to Clause 8.5.2.4 to be controlled by either an OPRP (Operational Prerequisite Program) or a CCP (Critical Control Point).

Step 2: Categorizing Control Measures into OPRPs vs CCPs (Clauses 8.5.2.4.1 and 8.5.2.4.2)

What is the exact engineering difference between PRP, OPRP, and CCP in Clause 8.5? Look at the two-stage filter mandated by ISO 22000:2018:

1. Clause 8.5.2.4.1 (Systematic Risk Assessment of the Control Measure Itself): For each selected control measure, you evaluate (a) the likelihood of failure of its functioning (process variability, reliance on human intervention versus automated hardware) and (b) the severity of the consequence in case of failure of its functioning, specifically examining: its effect on identified significant hazards; its location relative to other control measures in the process flow (is there a downstream kill step?); whether it is specifically established and applied to reduce the hazard to an acceptable level; and whether it is a single decisive barrier or part of a multi-hurdle combination.
2. Clause 8.5.2.4.2 (Feasibility Assessment of Monitoring and Corrections): You evaluate the feasibility of: (a) establishing measurable critical limits (for CCPs) and/or measurable or observable action criteria (for OPRPs); (b) monitoring to detect any failure to remain within the critical limit or action criterion in a timely manner; and (c) applying timely corrections in case of failure.

This gives you a rock-solid boundary between CCPs and OPRPs:

• Critical Control Point (CCP): a step where the control measure is a decisive, specifically designed safety barrier with high severity if it fails and no downstream step to eliminate the hazard. It operates with a strictly measurable Critical Limit (never subjective visual observation) separating safe from unsafe product, monitored continuously or at a frequency that guarantees no affected product escapes before isolation.
• Operational Prerequisite Program (OPRP): a control measure (or combination of measures) controlling a significant hazard where boundary control uses an Action Criterion that can be either measurable (e.g., CIP final rinse conductivity and caustic concentration between allergen runs) or observable (e.g., hourly visual inspection of a $0.8\text{ mm}$ sifter screen for mesh tears, or an ATP/ELISA swab sign-off). Exceeding an Action Criterion triggers process adjustment and a mandatory safety evaluation of the affected lot (Clause 8.9.2.3), rather than automatic classification as potentially unsafe product.

Shop-Floor Engineering Examples: Thermal Lethality ($F_0 / PU$), Metal Detection, X-Ray, and Optical Sorters

Let's look at how auditors verify real parameters on the line:

1. Thermal Sterilization and Pasteurization (Biological CCP): In low-acid canned foods ($ ext{pH} > 4.6$, $a_w > 0.85$), the target hazard is Clostridium botulinum spores. The critical limit integrates time-temperature lethality $F_0$ at reference temperature $T_{\text{ref}} = 121.1,^\circ\text{C}$ and thermal resistance constant $z = 10,^\circ\text{C}$: $$F_0 = \int_{0}^{t} 10^{\frac{T(t) - 121.1}{10}},dt \ge 3.0\text{ min}$$ (with commercial retort recipes typically validated at $F_0 = 6-12\text{ min}$ to destroy thermophilic spoilage spores). For beverages and beer pasteurization, engineers use Pasteurization Units ($PU$ at $T_{\text{ref}} = 60,^\circ\text{C}$, $z = 7,^\circ\text{C}$): $PU = \int 10^{(T-60)/7},dt$.
2. In-Line Metal Detectors, X-Ray Systems, and Optical Sorters (Physical CCP or OPRP): A tunnel metal detector on a packaging line uses certified test wands for three metal types: Ferrous (Fe) e.g., $\varnothing 1.5\text{ mm}$; Non-Ferrous (Non-Fe, brass/aluminum) $\varnothing 2.0\text{ mm}$; and Stainless Steel (SS AISI 316) $\varnothing 2.5\text{ mm}$. Because wet, salty, or warm products generate a strong magnetic "product effect," operators verify detection and automatic pneumatic rejection (into a locked reject bin with photo-eye confirmation) by passing each test piece at the leading edge, center (weakest magnetic flux zone of the aperture), and trailing edge of a real product pack. When products are packed in foil pouches or glass jars, or when hazards include glass shards, stones, calcified bone, or dense plastics, plants deploy X-Ray inspection systems and high-speed optical sorters (using NIR/VIS cameras and air-jet ejectors on grain, nut, and berry lines).
3. In-Line Strainers, Sifters, and Rare-Earth Magnetic Traps (Physical OPRP): Neodymium magnetic traps ($10,000-12,000\text{ Gauss}$) and mesh strainers catch ferrous wear particles and foreign bodies. Finding metal filings on a magnet during shift cleaning proves the magnet did its job. The Action Criterion of the OPRP is the physical integrity of the screen mesh or magnet assembly: if a strainer basket is torn during the 2-hour check, every batch pumped since the last intact check is quarantined for evaluation and re-screening.

Confusing validation with verification is one of the top three causes of major nonconformities during Stage 2 certification audits. ISO 22000:2018 draws a sharp line between the two in Clauses 3.44, 3.45, 8.5.3, and 8.8.

Pre-Implementation Validation (Clauses 8.5.3 and 8.8.1): Proving the Control Measure Works in Principle

Validation is obtaining objective evidence BEFORE live production (and whenever equipment, recipes, or packaging change) that a control measure or combination of control measures in your OPRPs and CCPs is capable of effectively achieving the intended control of the significant hazard. Put simply, validation asks: "Does the physics, chemistry, and microbiology of our chosen regime actually kill or remove the hazard under worst-case operating conditions?"

What do auditors accept as valid Clause 8.8.1 evidence?

• 3D Thermal Mapping and Cold-Spot Heat Penetration Studies: In smokehouses, baking ovens, or autoclaves, reading the wall-mounted RTD sensor isn't validation. Engineers place calibrated data loggers inside the geometric center of the thickest product units located at the coldest spots of the rack across three consecutive full-load production runs, proving that the slowest-heating unit achieves target lethality (e.g., a $6\text{-log}$ reduction of Listeria monocytogenes at $70,^\circ\text{C}$ for $2\text{ minutes}$ in the core).
• Allergen Cleaning Validation (Three-Run Swab Protocol): To validate an OPRP changeover from peanut butter cookies to nut-free biscuits, the sanitation crew executes the written cleaning SOP across three separate changeovers. Quality engineers swab hard-to-clean dead spots (deposit nozzles, scraper blades, belt seams) and test both rinse water and first-off nut-free product using quantitative ELISA kits. Only when all three consecutive runs test below the limit of quantification ($< 2.5\text{ ppm}$ peanut protein) is the cleaning regime validated.
• Scientific Literature and Mathematical Microbial Modeling: For standardized processes (such as HTST pasteurization of whole bovine milk under Codex Alimentarius guidelines), you may cite statutory parameters provided you document that your product's solids, fat content, viscosity, pH, $a_w$, and pipe Reynolds number ($\text{Re} > 4000$ turbulent flow) match the reference boundary conditions.

Ongoing Verification (Clause 8.8.2) and ISO/IEC 17025 Accredited Laboratories

Verification happens AFTER implementation during routine operations. It provides objective evidence that specified requirements have actually been fulfilled day after day. Verification asks: "Did our team follow the validated plan last shift, last month, and last quarter, and is the output still safe?"

Clause 8.8.2 verification activities include supervisory sign-off on CCP/OPRP monitoring logs, internal audits, environmental monitoring swabs (EMP Zones 1 to 4 for Listeria spp. and Enterobacteriaceae), and periodic testing of raw materials, potable water, and finished products.

Here's a rule that catches many plants off guard: external laboratory test reports used to verify food safety only hold validity during an audit if the testing was performed by accredited laboratories certified to ISO/IEC 17025 with those specific biological or chemical test methods listed in their official accreditation scope. Furthermore, if you run an in-house plant lab for incoming raw material screening or hygiene swabs, Clause 7.1.5 requires full metrological traceability (calibrated reference weights, thermometers, pH meters, and incubators) and proficiency cross-checks against an ISO/IEC 17025 lab.

When a pasteurizer temperature drops or a metal detector fails its hourly test-wand challenge at 2:00 AM, Clause 8.9 takes over. Auditors scrutinize your nonconformity logs to verify that your team separates Correction (Clause 8.9.2) from Corrective Action (Clause 8.9.3).

Correction vs. Corrective Action: A Real Production Example

• Correction (Clause 8.9.2): immediate action taken to eliminate the detected nonconformity and isolate the affected product right now. Suppose at 14:00 an operator discovers that the inline metal detector fails to reject the $\varnothing 2.5\text{ mm}$ stainless steel test piece (the previous passed check was at 13:00). The Correction is stopping the line, recalibrating or repairing the detector head, quarantining 100% of finished pallets produced between 13:00 and 14:00 with red HOLD tags, and re-passing every single pack through a verified metal detector.
• Corrective Action (Clause 8.9.3): systemic engineering action taken to eliminate the root cause of the failure so it can't happen again. Why did the detector fail at 14:00? Using a 5-Whys root-cause analysis, the Food Safety Team finds that an operator had unrestricted access to the sensitivity menu and lowered the gain to stop false rejects on warm packs. Writing "retrained operator" on the form will get rejected by any competent auditor. A true Corrective Action is locking the sensitivity parameters behind a chief automation engineer password, programming an automated phase-angle product profile for warm packs, and verifying password protection during monthly internal audits.

Handling Affected Lots: CCP Critical Limit Breach vs. OPRP Action Criterion Failure (Clauses 8.9.2.2, 8.9.2.3, and 8.9.4)

ISO 22000:2018 enforces different disposition rules depending on whether an excursion occurred at a CCP or an OPRP:

1. When a Critical Limit at a CCP is exceeded (Clauses 8.9.2.2 and 8.9.4): all product manufactured since the last compliant monitoring check is automatically classified as Potentially Unsafe Product. It cannot be released as-is unless an evaluation under Clause 8.9.4.2 proves with hard evidence that: (a) other control measures demonstrate the acceptable level was still achieved; (b) the combined effect of control measures for that specific lot meets required performance; or (c) statistically representative sampling and testing in an ISO/IEC 17025 laboratory confirms compliance with acceptable levels. If safety can't be proven, Clause 8.9.4.3 requires the lot to be reprocessed to eliminate the hazard, diverted to non-food/feed use (where legally permitted), or destroyed under witnessed disposal manifests.
2. When an Action Criterion at an OPRP is not met (Clause 8.9.2.3): the affected lot isn't automatically deemed potentially unsafe, but the Food Safety Team must document the cause of failure, assess the consequences for food safety, and evaluate the affected product before deciding between release or transfer to Clause 8.9.4 quarantine disposition.

In Ukraine, ISO 22000:2018 operates as the identical national standard DSTU ISO 22000:2019. Every clause, sub-clause, and definition matches the international text word for word. However, food businesses operating in Ukraine or sourcing from Ukrainian facilities need to understand how DSTU ISO 22000:2019 interacts with national food law and international accreditation.

Law of Ukraine No. 771/97-VR and State DPSS Audits

Under Articles 20 and 21 of the Law of Ukraine "On Basic Principles and Requirements for Food Safety and Quality" No. 771/97-VR, all food market operators must implement and maintain permanent procedures based on HACCP principles. Inspectors from the State Service of Ukraine on Food Safety and Consumer Protection (DPSS) enforce this mandate through scheduled and unscheduled state HACCP audits.

While holding an ISO 22000 certificate is voluntary under the statute and doesn't exempt a facility from state inspection, full FSMS development and implementation under DSTU ISO 22000 satisfies 100% of statutory HACCP requirements and goes much further by adding formal validation (Clause 8.8.1), 4-hour mass-balance traceability (Clause 8.3), emergency blackouts/water protocols (Clause 8.4), and internal auditing (Clause 9.2). When DPSS inspectors walk into a plant running a real ISO 22000:2018 system, every sanitary program and CCP record is already backed by engineering proof.

Verifying NAAU Accreditation and IAF CertSearch Registration

When bidding on public procurement tenders, qualifying as a vendor for major supermarket chains, or exporting to the EU, Middle East, or Asia, buyers demand an accredited ISO 22000 certificate. Beware of unaccredited "certificate mills" that sell cheap PDF certificates in three days without an on-site audit. Retail technical managers reject those immediately.

To hold legal and commercial validity worldwide, your certification body must be accredited under ISO/IEC 17021-1 and ISO 22003-1 by a national accreditation body that is a signatory to the International Accreditation Forum Multilateral Recognition Arrangement (IAF MLA):

1. In Ukraine, the sole state accreditation authority is the National Accreditation Agency of Ukraine (NAAU). Always verify that your chosen certification body appears in the active NAAU registry for the exact ISO 22003-1 food chain category of your factory.
2. For export markets, confirm that the certification body uploads issued certificates to the global IAF CertSearch database, where international buyers verify certificate authenticity in seconds.

One of the biggest engineering advantages of ISO 22000:2018 food safety management system implementation is modular scalability. If your plant currently runs a basic HACCP plan, upgrading to ISO 22000 builds the management system architecture that lets you step up to Global Food Safety Initiative (GFSI) benchmarked schemes without tearing down your existing procedures.

Direct Upgrade Paths to FSSC 22000, BRCGS, and IFS Food

When a manufacturer signs supply contracts with global food brands (Nestlé, Mondelez, Danone, PepsiCo) or produces Private Label lines for European retail chains (Lidl, Aldi, Tesco, Carrefour, Biedronka), buyers often mandate a GFSI-benchmarked certificate. Here's how your ISO 22000:2018 system maps onto those schemes:

• Upgrading from ISO 22000 to FSSC 22000: the FSSC 22000 scheme uses the verbatim text of ISO 22000:2018 as its management system core! Its structural equation is: $\text{ISO 22000:2018} + \text{ISO 22002-100:2025 and sector ISO 22002 PRPs} + \text{FSSC 22000 Additional Requirements}$ (covering Food Defense / TACCP, Food Fraud / VACCP vulnerability assessments, Food Safety Culture, allergen management, environmental monitoring, quality control, and food loss prevention). If you engineer your ISO 22000 system using ISO 22002-100:2025 from day one, stepping up to FSSC 22000 takes just 8 to 12 weeks. Compare both schemes in our article on the difference between ISO 22000 and FSSC 22000.
• Expanding to BRCGS Food Safety and IFS Food: while BRCGS (dominant in UK and North American retail) and IFS (dominant in German, French, and Polish retail) use prescriptive audit checklists and graded scoring (A/B/C or percentage scores), their operational core relies on the exact same Codex HACCP hazard analysis, 4-hour mass-balance traceability, thermal/cleaning validation, and root-cause corrective action mechanics you build under ISO 22000:2018.

Trying to handle ISO 22000:2018 food safety management system implementation entirely in-house while managing daily production usually drags on for 9 to 14 months. Projects typically stall when the team has to justify OPRP versus CCP categorization under Clause 8.5.2.4 or compile experimental validation dossiers under Clause 8.8.1. When your commercial timeline is tied to an upcoming retail tender or export shipment, turnkey ISO 22000 certification with Ekontrol compresses the project into a focused 3-to-5-month engineering roadmap.

Six Engineering Phases of Turnkey FSMS Implementation with Ekontrol

1. On-Site Diagnostic Gap Audit (Weeks 1-2): an Ekontrol lead auditor inspects your plant against ISO 22000:2018 and ISO 22002-100:2025, tracing raw material intake, air pressure differentials, water/steam lines, personnel traffic, and sanitation practices. You receive a photo-documented food plant diagnostic audit report ranking structural vs. procedural fixes by capital cost.
2. Dual PDCA Architecture & Clause 8.5 / 8.8 Engineering (Weeks 3-8): through our turnkey FSMS development and implementation service, we work alongside your technologists and maintenance engineers to verify flow diagrams, score hazards via $R = L \times S$, categorize OPRPs and CCPs under Clauses 8.5.2.4.1 and 8.5.2.4.2, and assemble scientific and experimental validation dossiers (Clause 8.8.1).
3. Shop-Floor Rollout, Operator Training & 4-Hour Mass-Balance Drill (Weeks 9-12): we replace 40-page text procedures with visual one-page SOPs mounted right at CCP and OPRP stations, train production shifts, test emergency blackout and water shutoff protocols (Clause 8.4), and run a timed 4-hour mass-balance traceability exercise to hit $98%-102%$ reconciliation.
4. Internal Audit & Management Review (Weeks 13-14): our auditors perform a rigorous internal audit under ISO 19011, help your team close gaps using 5-Whys root-cause corrective actions (Clause 8.9.3), and prepare the executive management review package (Clause 9.3). See our step-by-step ISO 22000 certification preparation guide for the complete 90-day readiness checklist.
5. NAAU / IAF Certification Audit Preparation & On-Site Support (Weeks 15-18): we help you select an accredited certification body holding the exact ISO 22003-1 scope for your product category and provide dedicated certification audit support during both Stage 1 (documentation readiness review) and Stage 2 (on-site operational verification).
6. Post-Certification Annual Support: keeping your FSMS sharp between surveillance audits requires ongoing verification, mock recalls, and hazard re-evaluations whenever new SKUs launch. Many manufacturers delegate these tasks to Ekontrol through our annual FSMS support program.

Ready to build an audit-proof food safety management system that protects your brand and opens export markets? Reach out via our contact page or explore our ISO 22000 consulting services to schedule your initial diagnostic audit.