ISO 22002: A Practical Guide to Prerequisite Programs (PRP) for Food Businesses in 2026

In the classical food safety pyramid established by the Codex Alimentarius Commission (General Principles of Food Hygiene CXC 1-1969), Prerequisite Programs (PRPs) form the foundational infrastructural and sanitary base upon which Hazard Analysis and Critical Control Points (HACCP) are built. Without robust prerequisite programs, a HACCP team would be forced to designate every routine shop-floor activity, from operator handwashing to raw material receiving temperatures, as a Critical Control Point. Such an overloaded HACCP plan quickly becomes unmanageable in live manufacturing.

International standard ISO 22000:2018 Clause 7.2 requires every food chain organization to implement PRPs appropriate to its operational context, yet Subclause 7.2.3 lists only 12 high-level topic areas (from building construction to personal hygiene) without prescribing technical engineering parameters. That lack of prescriptive detail was the primary reason why the Global Food Safety Initiative (GFSI) declined to benchmark standalone ISO 22000 certification: international retailers and multinational processors needed explicit rules on floor drainage gradients, air filtration classes, brittle material registers, allergen segregation, and site security.

The ISO 22002 standard series (which evolved from British specification PAS 220 and the ISO/TS 22002 technical specifications) bridges this gap. Combined with ISO 22000 and the FSSC Additional Requirements, it forms the backbone of the FSSC 22000 certification scheme (official FSSC Foundation portal). During a certification audit, the auditor inspects the factory floor directly against the clauses of the applicable ISO 22002 part: not against a generic statement that "the facility is kept clean," but verifying whether floor slopes prevent standing water puddles, whether light fixtures are shatterproof, and whether CIP detergent concentrations are conductivity-controlled and validated.

In July 2025, the International Organization for Standardization completed a structural overhaul of the entire prerequisite program series. Previously, standalone technical specifications (ISO/TS) repeated core requirements for building layout, utilities, personnel hygiene, pest control, and waste handling with slightly different wording across sectors. Under the new modular architecture, all common prerequisite requirements applicable across the entire food, feed, and packaging supply chain are consolidated into the umbrella standard ISO 22002-100:2025 (for a deep dive into its clause structure, see our dedicated guide to the ISO 22002-100:2025 PRP foundation).

The sector-specific parts (Parts 1, 2, 4, 5, 6, and 7) have been upgraded from Technical Specifications (ISO/TS) to full International Standards (ISO) and are now applied strictly in conjunction with ISO 22002-100:2025. For vertically integrated manufacturers that process food and also blow-mold their own PET bottles or thermoform cups on-site, this dual structure eliminates documentation duplication: universal PRPs are managed once under ISO 22002-100, while process-specific food and packaging controls are addressed under Parts 1 and 4.

We provide a clause-by-clause breakdown of the changes across all sector standards in our analytical review of the ISO 22002:2025 series update.

One of the most frequent methodological errors during Food Safety Management System design is blurring the boundary between basic Prerequisite Programs (PRPs), Operational Prerequisite Programs (OPRPs), and Critical Control Points (CCPs). ISO 22000 establishes a clear engineering distinction between these three layers of defense.

Basic PRPs (ISO 22000 Clause 7.2 and the ISO 22002 series) create the baseline hygienic environment across the site and are established before conducting the hazard analysis. They do not target a single specific pathogen or physical hazard at one isolated processing step; instead, they lower the background probability of contamination facility-wide. By contrast, OPRPs and CCPs are designated by the Food Safety Team after hazard analysis (ISO 22000 Clause 8.5) to control specific significant hazards at defined process steps.

When an FSSC 22000 auditor sees routine floor mopping or hairnet checks listed inside the OPRP hazard control plan, it triggers a nonconformity under Clause 8.5.2: site-wide hygiene belongs in the ISO 22002 PRP program so operators remain focused on genuine process control points.

Unlike administrative procedures, compliance with the ISO 22002 series is audited physically across production halls, boiler rooms, compressor stations, warehouses, and staff amenities. Below are the four engineering pillars that generate the majority of external audit findings.

ISO 22002-100 and ISO 22002-1 mandate that internal plant layout enforce unidirectional forward flow without backtracking or cross-intersection across five streams: raw materials, work-in-progress, finished products, packaging materials, personnel, and production waste. Where physical segregation of corridors is constrained by legacy building walls, the standard requires strict time segregation of movements followed by documented intermediate sanitation.

Production areas must be classified into sanitary zones based on microbiological risk to the exposed product:

• Non-Production and External Zones: external yard, boiler houses, maintenance workshops, administrative offices.
• Basic Hygiene (Low Risk) Zones: ambient pallet warehouses, raw agricultural intake bays, primary root-crop washing or grain cleaning.
• Medium Care Zones: processing halls where product moves inside enclosed piping or undergoes a subsequent lethal thermal kill step (baking, retorting, extrusion).
• High Care / High Risk Zones: post-lethality cooling, slicing, dosing, and filling areas handling Ready-to-Eat (RTE) products prior to hermetic primary sealing.

Personnel entry into High Care zones must pass exclusively through a dedicated hygiene lock requiring footwear change (or automated brush boot-washers), hands-free washing, alcohol-based hand disinfection interlocked with a turnstile, and clean protective garments free of external pockets or buttons. Floor drainage channels must be engineered so effluent never flows from a raw or low-risk area through a high-care finished product room.

Plant utilities often fall outside the daily oversight of the quality department because they report to the chief engineer, yet ISO 22002 subjects them to rigorous food safety controls:

1. Water Supply and Culinary Steam: all water, ice, and culinary steam that come into direct contact with food products or food-contact surfaces must meet potable water standards (in Ukraine, DSanPiN 2.2.4-171-10 and EU Drinking Water Directive parameters). Where a facility operates a secondary non-potable water loop (for cooling towers, fire suppression, or ammonia condensers), non-potable piping must be color-coded, have zero cross-connections with the potable supply, and be fitted with testable backflow preventers.
2. Compressed Air and Process Gases: whenever compressed air is used for PET bottle blowing, pneumatic conveying of flour or sugar, product agitation, or blowing off primary packaging, it must undergo multi-stage filtration for moisture, particulates, microorganisms, and oil aerosols (using oil-free compressors or NSF H1 food-grade compressor oils with air purity verified against ISO 8573-1).
3. Ventilation, Air Conditioning, and Positive Pressure: in rooms where microbiologically sensitive products are exposed, air handling units must maintain positive air pressure relative to adjacent corridors so unfiltered air is not drawn inward when doors open. Supply air systems require fine filtration (F7-F9 or HEPA H13 for high-care zones) equipped with differential pressure gauges and a scheduled filter replacement log.
4. Lighting: illumination intensity at inspection stations, sorting belts, and quality control laboratories must allow accurate visual assessment of product color and cleanliness, and every light fixture suspended above production or storage areas must be shatterproof or protected by unbreakable IP65 covers.

ISO 22002 equipment requirements follow hygienic engineering principles (EHEDG): food-contact surfaces must be fabricated from inert, corrosion-resistant stainless steel (typically AISI 304 or AISI 316L for acidic and high-salt applications), feature smooth continuous welds free of pitting, use radiused internal corners, and eliminate piping dead legs where stagnant liquid can harbor Listeria monocytogenes or Salmonella biofilms.

Sanitation programs under ISO 22002 are structured across three methodologies:

• CIP (Cleaning-in-Place): automated cleaning of closed tanks, pasteurizers, homogenizers, piping networks, and fillers governed by Sinner's Circle (TACT: Temperature, Action requiring a minimum flow velocity of 1.5 m/s in pipes to achieve turbulent scouring, Concentration of caustic and acid verified via conductivity sensors, and Time).
• COP (Cleaning-out-of-Place) and Low-Pressure Foam Cleaning: disassembly and immersion washing of removable parts (valves, nozzles, cutter blades) in wash tanks alongside low-pressure alkaline and acidic foaming of open conveyors.
• Dry Cleaning: mandatory for flour mills, milk powder plants, cocoa, spices, dry cereals, and compound feed mills where introducing water into production areas is strictly prohibited because moisture immediately triggers mold and Salmonella proliferation. These facilities rely on HEPA-filtered industrial vacuums, color-coded scrapers, and targeted rapid-evaporation alcohol sanitization.

The updated ISO 22002:2025 series places particular emphasis on separating sanitation validation from routine verification. Validation proves scientifically that the designed cleaning protocol removes residues, biofilms, and allergens to safe thresholds (conducted during commissioning or chemical changes), whereas verification confirms that a specific shift executed the protocol correctly (pre-operational visual inspection, ATP bioluminescence swabbing, final rinse pH strips, and scheduled environmental microbiological swabbing).

Protecting products against physical, chemical, and biological contamination during daily production relies on three operational programs:

1. Glass, Brittle Plastic, and Sharps Policy: unprotected glass, ceramics, and wood are prohibited inside processing and packing halls. The facility maintains an itemized Glass and Brittle Plastic Register covering reactor sight glasses, pressure gauge dials, indicator tubes, and HMI screens, conducting scheduled line-by-line integrity inspections. Where glass packaging is inherent to the process (filling sauces, juices, or preserves into glass jars and bottles), a strict glass breakage SOP defines immediate line stoppage, the quarantine radius of adjacent containers, machine cleanup, and documented QA sign-off before restart. Snap-off utility blades are replaced with metal-detectable safety cutters, and first-aid kits stock exclusively blue metal-detectable bandages.
2. Allergen Management: every raw material and recipe is mapped in an allergen matrix (covering the 14 regulated allergens under EU Regulation No 1169/2011 and Ukrainian Law No. 2639-VIII, plus target export lists such as US FDA or Japan CAA where applicable). Allergenic ingredients are stored in segregated bays or exclusively on the lowest rack levels to prevent spill cross-contact onto non-allergenic goods, utensils are color-coded, and production scheduling runs allergen-containing batches at the end of the campaign prior to validated full sanitation.
3. Integrated Pest Management (IPM): pest control begins with structural pest-proofing rather than poison baits: brush seals on loading dock doors, self-closing door mechanisms, insect mesh screens (1-2 mm aperture), and trapped floor drains. Tamper-resistant numbered bait stations containing toxic rodenticides are restricted strictly to the external building perimeter; inside production and storage rooms, toxic baits are prohibited in favor of mechanical live traps, glue boards, and sticky-board UV fly killers (replacing high-voltage electric zappers that scatter insect fragments across open lines). Monthly inspection logs feed into a site activity trend analysis per station.

For food business operators in Ukraine, implementing prerequisite programs is both a requirement of international certification bodies and a statutory mandate. The Law of Ukraine "On Basic Principles and Requirements for Food Safety and Quality" and the National HACCP Implementation Requirements approved by Order of the Ministry of Agrarian Policy and Food No. 590 oblige every registered food facility to operate 13 mandatory prerequisite programs.

During state inspections conducted by the State Service of Ukraine on Food Safety and Consumer Protection (DPSS), inspectors audit the facility using a standardized inspection checklist directly aligned with Order No. 590. Many Ukrainian plants make the mistake of maintaining two separate documentation sets: one folder formatted for state inspectors under Order No. 590 and a second folder written for international auditors under ISO 22002. Maintaining dual systems inevitably creates conflicting log entries and shop-floor confusion. The sound engineering approach is a single unified PRP system where each Standard Operating Procedure (SOP) satisfies both regulatory frameworks simultaneously.

When a facility prepares for its initial ISO 22000 or FSSC 22000 certification audit or upgrades its existing system to the ISO 22002:2025 series (see our detailed ISO 22002-100:2025 transition plan), 80% of the effort happens on the shop floor rather than at a desk. Below is the structured 90-day engineering rollout roadmap we use during standards implementation projects.

Month one focuses on a comprehensive engineering and sanitary walkthrough of the entire site (conducting a formal diagnostic audit identifies up to 95% of infrastructural gaps before capital is spent):

• Physical Floor Walkthrough Against ISO 22002-100 + Sector Part: a joint inspection by the QA Manager, Chief Engineer, and Production Manager covering everything from perimeter fencing and roof drainage to basements, compressor rooms, and packaging stores.
• Flow and Zoning Verification: plotting raw material, finished product, packaging, waste, and personnel routes on architectural floor plans to eliminate cross-contamination intersections and design hygiene locks.
• Costed Infrastructure Action Plan (CAPEX/OPEX): compiling a prioritized defect list (sealing wall-to-floor coving, repairing cracked tiles, installing shatterproof light covers, fitting insect screens and door closers, upgrading floor drains) with budget sign-off from executive management.
• Glass and Brittle Plastic Inventory: conducting a complete census of sight glasses, gauges, and brittle plastics across all production halls and removing all non-essential glass and wood.

During month two, while the engineering team completes civil and mechanical upgrades, operational procedures and shop-floor logs are deployed:

• Sanitation Program and CIP/COP Overhaul: creating visual, photo-illustrated cleaning cards for each machine showing disassembly points, purchasing color-coded cleaning tools segregated by hygiene zone, and installing wall-mounted tool drying racks.
• Preventive Maintenance (PM) Restructuring: segregating NSF H1 food-grade lubricants in a dedicated locked cabinet, labeling lubrication points, and launching a mandatory Post-Maintenance Hygiene Clearance Ticket (requiring mechanics to account for all tools and fasteners and QA/shift supervisors to verify sanitation before line handover).
• Pest Control Contract Alignment: walking the site with the pest control contractor to replace any toxic interior baits with non-toxic mechanical or glue monitors, verify UV fly-killer placement, and institute quarterly trend reviews.
• Practical Shop-Floor Training: training line operators, maintenance technicians, warehouse staff, and sanitation crews on zone entry rules, glass breakage emergency response, blood/bodily fluid contamination cleanup, and allergen changeover discipline.

Month three builds the objective evidence package required for Stage 1 and Stage 2 external certification audits:

• Sanitation and Allergen Cleaning Validation: executing three consecutive cleaning cycles on the most complex processing lines and collecting swabs from hard-to-clean points (gaskets, valve dead legs, conveyor undersides) for Total Viable Count, Enterobacteriaceae, target pathogens (Listeria spp., Salmonella), and specific allergen protein lateral-flow/ELISA tests.
• Laboratory Verification of Utilities: obtaining accredited laboratory test reports for potable water at intake and distal points, ice, culinary steam condensate, and compressed air microbiological plates.
• Traceability and Mock Recall Exercise: testing the team's ability within 2 to 4 hours to reconcile a full mass-balance accounting of a specific raw material lot and primary packaging reel forward to customers and backward to suppliers, including rework batches.
• Cross-Functional Internal Audit Against ISO 22002: auditing every production and auxiliary area with independent internal auditors or through professional audit support to close minor operational findings before the certification body arrives.

Across food industry certification audits, 65-70% of all recorded nonconformities (Minor and Major NCs) stem not from theoretical errors in the HACCP hazard table, but from physical breakdowns in ISO 22002 prerequisite programs observed directly on the factory floor:

1. Overhead Condensation and Peeling Coatings Above Open Product: condensation droplets forming on chiller evaporator housings or ceiling beams directly above open conveyors or mixing vats create an immediate vector for Listeria monocytogenes contamination and frequently trigger a Major Nonconformity.
2. Temporary "Makeshift" Engineering Repairs: using duct tape, packing tape, cardboard, zip-ties, or baling wire to hold guards, sensors, or product chutes in place instead of permanent hygienic stainless-steel fasteners.
3. Breaches in Building Pest-Proofing: daylight gaps beneath loading dock sectional doors, unsealed wall penetrations around newly installed cables or pipes, or exterior doors propped open for ventilation during summer shifts.
4. Co-Mingling Industrial and Food-Grade Chemicals: storing non-food-grade (H2) lubricants next to NSF H1 food-grade lubricants on the same maintenance shelf without physical separation, or decanting cleaning chemicals into unlabeled drinking water bottles.
5. Unidentified Rework Containers: holding tubs of work-in-progress or trimmings in chillers without labels specifying product name, production date/time, original batch number, and allergen profile.

The updated ISO 22002:2025 standard series reinforces a fundamental truth of food manufacturing: food safety begins not in office binders, but in engineering discipline across sanitary zoning, utility purity, validated sanitation, and hygienic maintenance. When prerequisite programs are engineered systematically and unified with Ukraine's statutory Order No. 590 requirements into a single operational framework, a food business protects its brand from costly recalls, passes state inspections effortlessly, and maintains internationally recognized FSSC 22000 certification.

If your facility needs an expert engineering gap assessment against ISO 22002-100:2025 and its sector parts, unified PRP documentation design, or ongoing annual support between surveillance audits, contact the Ekontrol team to build a resilient food safety foundation.