NQA ISO 22000 Food Safety Transition Gap Guide
3 likes411 views
The document outlines key changes between the ISO 22000:2005 and ISO 22000:2018 standards, highlighting new requirements for food safety management systems and the importance of transitioning within a set timeline. Organizations are required to adapt their systems to consider internal and external context, risks, and opportunities while integrating food safety policies into business processes. The transition period ends on June 18, 2021, and emphasizes the need for leadership, performance evaluation, and continual improvement in food safety management.
NQA ISO 22000 Food Safety Transition Gap Guide
- 1. ISO 22000:2018 TRANSITION GAP GUIDE 43,000 TRANSPARENT 90TRANSPARENT 90TRANSPARENT 90TRANSPARENT
- 2. INTRODUCTION 1. Scope 2. Normative References 3. Terms and Definitions 4. Context of the Organization 5. Leadership 6. Planning 7. Support 8. Operation 9. Performance Evaluation 10. Improvement This document provides an overview of the key changes between the 2005 and 2018 version of ISO 22000 – there are several new requirements in addition to changes to key definitions. You will need to prepare for these changes and adapt your food safety management system to meet the new requirements within the transition timeline. Proposal stage November 2014 NQA no longer provides quotes for ISO 22000:2005 From May 2020 FSMS Certified clients encouraged to schedule transition audit and complete GAP analysis From Jan 2020 Last day to schedule any transition audits April 31 2021 No further audits for ISO 22000:2005 permitted. ISO 22000:2018 audits are scheduled July 2020 Transition period ends June 18 2021 Preparatory stage November 2015 Committee stage (CD) December 2016 Enquiry stage (DIS) July 2017 Approval stage (FDIS) February 2018 Publication ISO 22000:2018 June 2018 Training for all NQA staff March - April 2019 ISO 22000:2018 TIMELINE ISO 22000:2018 was published on 19th June 2018 and is the replacement for ISO 22000:2005. For organizations currently using ISO 22000:2005 there will be a three-year period to transition to ISO 22000:2018. STRUCTURE OF ISO 22000:2018 The structure of ISO 22000:2018 follows the Annex SL high level structure being applied to all new and revised ISO management system standards: OUR VALUES We will help you understand the changes, interpret the new concepts and act on the implications. Please get in touch if you have any questions. Keep updated with the changes at www.nqa.com
- 3. 4 Context of the Organization GAP ANALYSIS AND GUIDANCE 4.1 Understanding the organization and its context New requirement! This new concept relates to the factors and conditions affecting organizational operation e.g. regulation, governance and interested parties. What drives the culture and requirements of your organization? Be prepared to discuss with your assessor, how the context of the organization influences the ability to achieve the intended outcomes of your food safety management system 4.2 Understanding the needs and expectations of interested parties New requirement! Consider who the interested parties might be and what their relevant interests might be, e.g. workers, customers, regulators, competitors and external providers. Consider the risks and opportunities that are generated for the context. Be prepared to discuss stakeholder interests with your assessor. 4.3 Determining the scope of the environmental management system Partially covered by 4.1 When determining this scope, the organization shall consider: a) the external and internal issues referred to in 4.1; b) the requirements referred to in 4.2. Therefore the Scope can only be defined when 4.1 - 4.2 have been considered. Do not forget the Scope shall specify the products and services, processes and production sites that are addressed by the FSMS and shall include the activities, processes, products or services that can have an influence on the food safety of the end products. 4.4 Food Safety Management System Partially covered by 4.1 Largely unchanged, only highlight that 2018 version do not longer require a documented FSMS, how to manage the system it is now your decision. ISO 22001:2005 CLAUSES ISO 22001:2018 CLAUSES GUIDANCE 5 Leadership 5.1 Leadership and commitment Partially covered by 5.1, 7.4.3 Top management of the organization are now required to demonstrate leadership and commitment to the FSMS in a number of specified ways: ensuring integration of the FSMS requirements into the organization’s business processes, support persons that contribute to the effectiveness of the FSMS, etc. 5.2 Food safety policy Partially covered by 5.2 The policy must be now also appropriate to the context, address also internal and external communications and need to ensure competencies related to food safety, provide a framework for setting and reviewing objectives, include commitment to continual improvement among other previously required requisites. The policy shall be also documented and available to relevant interested parties. 5.3 Organizational roles, responsibilities and authorities Partially covered by 5.4, 5.5, 7.3.2 Apart from communicating responsibilities and authorities, top management shall ensure they are also understood within the organization. New responsibilities and authorities for ensuring that the FSMS conforms to the requirements of the standard and reporting on the performance of the FSMS to top management are to be assigned.
- 4. 6 Planning 6.1 Actions to address risks and opportunities New requirement! Consideration needs to be given to its identified internal and external issues (4.1), the needs and expectations of its interested parties (4.2) during planning and determined scope of the FSMS (4.3). A new concept of “risks and opportunities” is introduced. Planning now requires the identification of the risks (defined as the effect of uncertainty) and opportunities related to the performance and effectiveness of the FSMS. Risks and opportunities identified in section 4 become inputs to a comprehensive planning approach. 6.2 Objectives of the FSMS and planning to achieve them Partially covered by 5.3 Objectives must be consistent with the food safety policy, follow the SMART criteria, and consider customer, statutory and regulatory requirements. There should be detail of who is responsible, agreed timings and measures in place to establish progress, resources available and whether proposed achievements have been met. Established objectives will be documented information. 6.3 Planning of changes Partially covered by 5.3 When determining the need for changes to the FSMS, the organization must be also taken into consideration the purpose of changes, resources and responsibilities apart from ensuring its integrity. ISO 22001:2005 CLAUSES ISO 22001:2018 CLAUSES GUIDANCE 7 Support 7.1.1 General Partially covered by 6.1 The organization shall also consider the capability of and any constraints on existing internal resources and resources required from external sources. 7.1.2 People Partially covered by 6.2 Where external experts where used in the development, implementation, operation or assessment of the FSMS, the organization must ensure they retained documented information such as an agreement or contract that defines their relevant competency, responsibility and authority. 7.1.3 Infrastructure Partially covered by 6.3 Largely unchanged 7.1.4 Work Environment Partially covered by 6.4 Largely unchanged, note added highlighting examples of what factors need to be considered within environment 7.1.5 Externally developed elements of the FSMS Partially covered by 1 New information regarding externally developed elements of the FSMS to be considered when used 7.1.6 Control of externally provided processes, products or services Partially covered by 4.1 New information regarding control of externally provided processes, products or services 7.2 Competence Partially covered by 6.2, 7.3.2 External providers are now also considered when determining competence of persons doing work under the organization’s control that may affect the FSMS. The term “competent” replaces “trained”. The organization shall retained documented information as evidence of competence. 7.3 Awareness Partially covered by 6.2.2 Now personnel must also be aware of the food safety policy, objectives of the FSMS relevant to their tasks, and the benefits of improved food safety performance. 7.4 Communication 5.6, 6.2.2 Some terms have been replaced to make them more clear (suppliers by external providers and qualifications by competencies) 7.5 Documented Information Partially covered by 4.2, 5.6.1 The organization’s FSMS must include also documented information and food safety requirements required by statutory, regulatory authorities and customers.
- 5. 8 Operation 8.1 Operational Planning and Control New requirement! Specific reference is now made to the planning of operations, as well as their control and update. Controls for processes should now be implemented to ensure the realisation of safe products as well as the implementation of defined actions to address risk and opportunities. There are requirements for the control of planned changes and the review of unintended changes. It is now specified that outsourced processes are to be controlled. 8.2 Prerequisite Programmes (PRPs) Partially covered by 7.2 Statutory and regulatory requirements shall be taken into consideration when selecting PRPs. Likewise, when establishing the PRPs, the organization must consider also supplier approval, labelling and control of incoming materials, storage, dispatch and distribution. 8.3 Traceability Partially covered by 7.9 Further details regarding what to be considered when establishing and implementing the traceability exercise. Documented information must be retained for a defined period, as a minimum, the shelf-life of the product. Its effectiveness shall be also tested. 8.4 Emergency preparedness and response Partially covered by 5.7 Documented information is now required to be established and maintained in case of potential emergency situations and incidents. Steps to handle emergencies are now specified. 8.5.1 Preliminary steps to enable hazard analysis Partially covered by 7.3, 7.2.4 Source of products is now required to be specified in the documented information concerning raw materials, ingredients and packaging specifications. Documented information regarding characteristics of ends products must include method of distribution and delivery. “Description of processes steps and control measures” has been replaced by “description of processes and process environment” detailing also additional requirements. Processing aids, packaging and utilities are also to be added to the flow diagram/s. 8.5.2 Hazard analysis Partially covered by 7.3.5.2, 7.4, 7.6.2 The identification of hazards shall also be based on internal information and customer requirements. The systematic approach for assessing each control measure, must also consider the viability of establishing measurable critical limits and applying timely corrections in case of failure. Additionally, external requirements that can impact the choice and strictness of control measures shall be documented. 8.5.3 Validation of control measure(s) and combination(s) of control measure(s) Partially covered by 8.2 The decision making process and categorization of control measures as well as their validation must be maintained as documented information. It is also mentioned that this validation must be conducted before the implementation of the Hazard control plan. 8.5.4 Hazard Control Plan Partially covered by 7.5, 7.6 A Hazard Control Plan includes OPRP plan and monitoring systems for OPRPs as well as a HACCP Plan and monitoring system for CCPs. The organization shall implement, maintain and retained evidence of the hazard control plan as documented information. When critical limits or action criteria are not met the organization shall ensure, among others, that the potentially unsafe products are not released. 8.6 Updating the information specifying the PRPs and the hazard control plan Partially covered by 7.7 Once the Hazard Control Plan is established, the information to be updated, if necessary, is listed (process steps and control measures now replaced by descriptions of processes and process environment). 8.7 Control of monitoring and measuring Partially covered by 8.3 Included also that software used in monitoring and measuring needs validation prior to use. ISO 22001:2005 CLAUSES ISO 22001:2018 CLAUSES GUIDANCE Operation section continues on next page
- 6. 9 Performance Evaluation 9.1 Monitoring, measurement, analysis and evaluation Partially covered by 8.4.2, 8.4.3 New clause including mandatory documented information and evaluation of performance and effectiveness with regard to monitoring, measurement, analysis and evaluation methods. 9.2 Internal audit Partially covered by 8.4.1 More aspects to consider in the audit programme such as changes in the FSMS, the results of monitoring, measurement and previous audits. The results of the audits must be reported to the food safety team and relevant management. All information must be retained as documented to show evidence of the implementation of the audit programme and audit results. The organization shall determine if the FSMS meets the intent of the food safety policy and objectives set. 9.3 Management Review Partially covered by 5.2, 5.8 Several inputs now also to be discussed during the management review meeting (monitoring and measurement results, nonconformities and corrective actions, the adequacy of resources, performance of external providers, etc.). ISO 22001:2005 CLAUSES ISO 22001:2018 CLAUSES GUIDANCE 10 Improvement 10.1 Nonconformity and corrective action New requirement! The standard provides all steps to be followed by the organization when a nonconformity occurs. 10.2 Updating the food safety management system Partially covered by 8.1, 8.5.1 The importance of improving suitability, adequacy and effectiveness of the FSMS is now highlighted as this was not specified in much detail in 2005 version. 10.3 Continual improvement Partially covered by 8.5.2 Largely unchanged 8 Operation (continued) 8.8 Verification related to PRPs and the hazard control plan Partially covered by 7.8, 8.4.2, 8.4.3 Verification activities shall confirm that PRPs and hazard control plan implemented and effective. The organization must ensure that verification activities are not carried out by the same person responsible for monitoring the activity or the control measures. 8.9 Control of product and process nonconformities Partially covered by 7.10 Version 2018 specifies clearly the steps to be followed when action criteria for an OPRP is not met. When reviewing nonconformities identified by consumer complaints and/or regulatory, the organization must ensure there are corrective actions in place. When doing the evaluation for release, conditions apply to all those products that do not comply with the established action criterion for OPRP. Products that are not accepted for release could be also reprocessed, destroyed and/or disposed as waste or redirected for other use as long as food safety in the food chain is not affected. All results of evaluation for release and disposition of nonconforming products shall be retained as documented information. AUDITING The standard is written for the benefit of organizations, not auditors. Auditors will need to understand and recognize the extent and type of evidence that would be acceptable to confirm to the 2018 requirements. ISO 22000:2018 auditors will be engaging in dialogue with business leaders, seeking understanding and explanations from them about policy, strategy and food safety objectives, and ensuring these are compatible. The audit experience from the client perspective is likely to be different because of this, but the end result would be more value being able to be added to the organization as a whole from the audit process.
- 7. Tip: The context will influence the type and complexity of management system needed. Tip: “Risk and opportunities” can be thought of as potential adverse deviations from the expected (threats) or potential beneficial deviations from the expected (opportunities). Tip: Review thoroughly your system emphasizing and documenting the how and why for the categorization of control measures managed as OPRPs or CPPs, make a final summary with different plans for each and ensure all established controls were previously validated. Tip: Ensure job descriptions, procedures for processes and continuous training are clearly defined and established so you have the right person in the right position. Tip: Evaluation is the interpretation of results and analysis. This is not new to managers but is made explicit in the standard for the first time. Processes may be well defined and effective, but do they yield optimum results? This may be a new challenge for internal audits. Context of the Organization This is a new requirement to identify the internal and external factors and conditions that affect an organization. Examples of internal issues could include an organization’s culture and capabilities, whilst external issues could include the variety of external providers, changes in consumption patterns and the technology advances to name but a few. The organization also needs to identify the interested parties to the FSMS and any requirements they have. Risk and Opportunities This is a new concept introduced in the ‘planning’ section of the standard. It requires the organization to identify the risks and opportunities that may affect the performance and effectiveness of the FSMS, and take action to address them. Hazard Control Plan The term of action criteria has been introduced to also clarify what OPRPs are meant for. The Hazard control plan must consider both OPRP and HACCP Plan. Competence Trained has been explicitly replaced by competent personnel in a way to emphasize the importance of considering also aspects such as experience, skills, knowledge, understanding of the task given among others apart from training and/or qualifications alone. Performance Evaluation There is a new emphasis on the need for evaluation in addition to the current requirements for monitoring, measurement and analysis. KEY CONCEPTS Tip: Top management will need to take accountability for the effectiveness of the FSMS, provide support and resources as necessary and promote continual improvement. Leadership There is an explicit requirement for top management to demonstrate leadership and commitment relating to the system. This is an enhanced requirement relating to top management. CONCLUSION ISO 22000:2018 incorporates more business management terminology and concepts and will ensure that the operational system will be integrated into the organization’s overall business processes rather than being separate entities. The changes will require effort from organizations to implement, however the overall result will be a more effective food safety management system capable of improving the intended results.
- 8. www.nqa.com