ISO 22002: A Practical Guide to PRP for Food Businesses in 2026

ISO 22002 describes the basic sanitary-hygienic and operational conditions that must be established before launching and maintaining a HACCP system and the food safety management system as a whole. In everyday terms, this is the "foundation" upon which the following are built:

• personnel hygiene;
• environment and facility control;
• equipment management;
• cleaning and disinfection;
• pest control;
• traceability and product handling.

When PRPs are implemented formally, the system may appear "correct on paper" but fails to withstand real risks during production, storage, or transportation. That is why ISO 22002 plays a practical rather than declarative role: it makes basic processes repeatable, controllable, and verifiable during audits.

One of the key takeaways from the SoftExpert article: in July 2025, the ISO 22002 series was significantly revised. The main change is the transition to a modular architecture with a new central document ISO 22002-100:2025, which sets the general requirements.

Sector-specific modules are then layered on top of this foundation. This approach reduces duplication, simplifies the structure, and allows companies to more quickly understand which requirements are common and which are specific to their type of activity.

Another important point: many documents in the series transitioned from the ISO/TS format to ISO, which strengthens consistency and predictability of the standard's use in international practice.

As of the 2025 update, the series is built around the common core of ISO 22002-100 and seven sector-specific parts.

For businesses, this logic is convenient because you can clearly assemble "your package" of requirements: the common base plus the relevant module, rather than working with fragmented documents without a unified structure.

In practice, ISO 22002 is relevant not only for large production facilities. It is needed by all participants in the food chain where stable environment and process control requirements exist.

Key groups:

1. Food product manufacturers.
2. Filling and food packaging companies.
3. Logistics operators and warehouses in the food chain.
4. Catering operators.
5. Agricultural enterprises and feed producers.
6. Retail and wholesale distributors.

For each of these categories, ISO 22002 helps level the basic safety conditions and reduce the risk of incidents, complaints, and audit nonconformities.

Companies often mistakenly perceive ISO 22002 as an "additional document" that can be deferred. In reality, it is one of the supporting pillars of the food safety ecosystem.

The practical connection looks like this:

• ISO 22000 defines food safety management system requirements.
• ISO 22002 details PRP as the operational foundation.
• FSSC 22000 integrates ISO 22000 requirements + relevant PRPs + additional scheme requirements.

Therefore, in real certification projects, gaps in ISO 22002 almost always manifest as findings in the ISO 22000/FSSC 22000 system. If the PRP foundation is unstable, the upper level of the system also operates unstably.

The source article emphasizes three fundamental actions that companies should prioritize. Below is a practical interpretation of these steps.

Compare your current system not just against clause titles but against the actual logic of the new structure:

• ISO 22002-100 requirements;
• requirements of the relevant sector module;
• current procedures, records, and responsibilities.

The result should not be a "long list" of observations but a prioritized gap map: critical, important, and supporting.

After the gap analysis, documents, roles, and practices need to be synchronized. A typical mistake is rewriting a procedure but not updating staff briefings.

At a minimum, you should review:

• PRP policies and procedures;
• record forms and logs;
• the internal audit plan;
• shift-based role briefings.

Updated requirements must be verified internally before the external audit. For this, it is useful to conduct a short "pre-audit" on critical points and check whether the team can demonstrate not just the existence of documents but the effectiveness of actions.

To prevent the transition from turning into chaos, a short cyclical plan works well:

• define the scope of application (facilities, processes, products);
• build a PRP risk map;
• prepare a list of critical changes.

During this phase, the team analyzes which existing PRPs already meet the requirements of ISO 22002-100 and the relevant sector module, and where gaps exist. The goal is not merely to catalog documents but to compare actual production practices against the standard's criteria. The deliverable should be a prioritized change matrix that clearly indicates what requires immediate intervention and what can be scheduled for a later stage of implementation.

• update key procedures and forms;
• conduct role-based training;
• launch execution control on the shift level.

At this stage, changes move from the documentation level into daily operations. Every updated procedure must be communicated to the relevant personnel through briefings and practical explanations. It is especially important to ensure that frontline staff understand not only "what to do" but also "why this has changed." Execution control is maintained through shift supervision, record reviews, and regular weekly meetings of the PRP working group to track implementation progress.

• perform an internal audit;
• close nonconformities;
• prepare the evidence base for the external review.

This rhythm provides manageability and helps avoid the situation where everything is postponed "until the last month before the audit." During this final phase, a comprehensive internal audit is conducted against the updated requirements. Identified nonconformities are systematically addressed with effectiveness verification. The evidence base includes records, photo reports, training protocols, and monitoring results. The team also conducts an external audit simulation to verify that key personnel are prepared to respond to auditor inquiries confidently.

Even experienced teams often make the same mistakes:

• treating ISO 22002 as a formal appendix to ISO 22000;
• not separating general and sector-specific requirements;
• focusing on paperwork rather than actual execution;
• not updating training after procedure updates;
• not conducting a readiness check before the external audit.

The critical principle here is simple: a resilient food safety system starts with working PRPs, not presentation documents.

For management to see real progress, it is worth tracking simple metrics:

• percentage of critical gaps closed;
• percentage of personnel who completed role-based training;
• number of recurring PRP nonconformities;
• corrective action closure time;
• pre-audit review results.

When these KPIs are part of the management rhythm, the transition becomes predictable in terms of timelines and resources.

ISO 22002 in its 2025 version is not a "cosmetic" update but a structural change in the approach to PRP. The new architecture through ISO 22002-100 and sector modules makes the system more logical, transparent, and scalable.

For businesses in 2026, this means a clear priority: move PRP from the formal level to the operational level. Companies that start the gap analysis early, synchronize documents with practice, and test the system before the external audit achieve more stable operations and better review outcomes. Get annual support for your ISO 22002 system or learn more at iso.org.