FOOD SAFETY

A Recipe for Safe

Food: ISO 22000
and HACCP
by John G. Surak

ood safety experts insist that the U.S. food

supply is one of the safest in the world.
However, the Centers for Disease Control
and Prevention (CDC) estimate that more than
76 million people get sick from food related illnesses each year.1 This results in more that 300,000

In 50 Words
Or Less
Three recent major recalls highlight the
importance of food safety, particularly in
a global food chain.
ISO 22000 incorporates and strengthens the
hazard analysis and critical control point
system to create an effective food safety
management system.
It is designed for the entire chain, starting
with producers.

hospitalizations and 5,000 deaths.

Recently, there have been several high profile
food recalls. These incidents include three national
recalls: spinach contaminated with a pathogenic
strain of E. coli, peanut butter contaminated with
Salmonella, and tainted pet food.
In the spinach incident, 199 people in 28 states
were infected. As a result, 141 individuals were
hospitalized, 31 developed a type of kidney failure,
and three died.2
When tainted peanut butter turned up on store
shelves, 425 people were infected with Salmonella,
and 71 of them were hospitalized. This contamination produced no known deaths.3
The tainted pet food recall began this May and
involved a long list of both store and major brands
containing melamine in product imported from
China. The exact number of deaths is unknown, but
it has been estimated that more than 20 pets died.
It can be estimated that more than 1 billion meals
are consumed each day in the United States, and
each meal contains multiple opportunities to consume a food safety hazard like pathogenic bacteria.
These statistics are further influenced by changes
in the dietary patterns of Americans. They are consuming fresher and minimally prepared foods. The

QUALITY PROGRESS

I OCTOBER 2007 I 21

FOOD SAFETY
FIGURE 1

Food Chain
Food producers

typical preparation process for these foods

might not remove or destroy all pathogens
that could be present. In addition, the consolidation and globalization of the food industry
has allowed Americans to consume these products year-round rather than in season. Thus,
if there is a food safety incident, it will affect
more consumers.
As a result, serious questions are raised:
How can food supplies remain safe in a
global environment?
How can the food system be improved?
Ensuring safe food is a responsibility of
everyone in the food chain. Food safety starts
on the farm, continues with the food manufacturers and distributors, and ends with the consumer (see Figure 1).

Regulatory
agencies

Suppliers
Pesticides fertilizers
and veterinary drugs

Food manufacturers

Ingredients and
food additives

Wholesalers

Equipment

Distributors

Cleaning and
sanitizing supplies

Retailers

Food
service

Packing
Other services

Consumers
Adapted from ISO 22000:2005, Food Safety Management
SystemsRequirements for Any Organization in the Food
Chain, International Organization for Standardization, 2005.

incidents on manned space flights (see HACCP in

a Nutshell).
Hazard analysis and critical control point
The original concept of HACCP consisted of
(HACCP) is an effective tool to prevent food
three principles:4
from being contaminated. HACCP is not a new
1. Identify and assess hazards associated with
concept. The Pillsbury Co. developed it for
food, from growing to marketing.
NASA in the late 1950s to prevent food safety
2. Determine critical control points (CCPs) to
control any hazard.
3. Establish a system to monitor CCPs.
As various food safety practitioners implemented these concepts, HACCP evolved from the
original three principles to five preliminary
TABLE 1
Five Preliminary Steps
steps and seven principles listed in Table 1
And Seven Principles of HACCP
that are supported by prerequisite programs
(PRPs) detailed in Table 2.
Step
Description
The first U.S. HACCP standard was pubPreliminary step one Assemble the HACCP team.
lished
in 1989 by the National Advisory
Preliminary step two Describe the product.
Committee on the Microbiological Criteria
Preliminary step three Identify intended use of the product.
for Foods and was revised in 1992 and 1997.
Preliminary step four Construct a flow diagram.
In 1993, the Codex Alimentarius Commission
Preliminary step five Conduct an on-site verification of the flow diagram.
published the first international HACCP
Principle one
Conduct a hazard analysis.
standard, which was revised in 1997.
Principle two
Determine critical control points (CCPs).
Both of these are guidance standards,
rather than auditable standards. They are
Principle three
Establish critical limits for CCPs.
designed to help organizations implement
Principle four
Establish a monitoring system for CCPs.
HACCP.
Principle five
Establish corrective actions.
HACCP has been slowly incorporated into
Principle six
Establish verification procedures.
the food safety system. In the early 1970s, the
Principle seven
Establish documentation and recordkeeping.
Food and Drug Administration (FDA) incor-

HACCP

22

I OCTOBER 2007 I www.asq.org

porated HACCP principles into the regulations

that govern the production of low acid canned
foods. These regulations have successfully prevented outbreaks of foodborne disease caused by
Clostridium botulinum toxin in commercially
canned foods.
In 1985, the Food Protection Committee of the
National Academy of Sciences issued a report
stating that HACCP was the most effective system for ensuring the safety of the food supply.5
As a result, U.S. regulatory agencies incorporated HACCP requirements into the regulations
that govern the processing of red meats (primarily beef and pork), poultry (primarily chicken
and turkey), fruit and vegetable juices, and seafood.
As of Jan. 1, 2006, the European Union mandated all food manufacturing facilities that
produce food for the European market to incorporate HACCP into their food safety systems.
Starting in the 1990s, various customers in the
food chain required their suppliers to have certified HACCP systems. Therefore, a number of
countries, including Australia, Denmark,
Germany, Ireland, the Netherlands and the
United States, developed auditable national food
safety management standards (FSMSs).
In addition, some private organizations developed standards. The national and private standards provided auditable standards that could be
used for third-party certifications. All of these

TABLE 2

Prerequisite Programs

Prerequisite programs (PRPs) provide the foundation for hazard

analysis and critical control point (HACCP) to function. Food safety
experts have found that well-functioning PRPs simplify and
strengthen the HACCP plan. The PRPs are based on good manufacturing practices or good hygienic practices.1
PRPs include:
Facilities, including construction and layout of buildings, associated utilities, premises, workspace and employee facilities.
Supporting utilities including air, water and energy.
Supporting services including waste and sewage disposal.
Suitability of equipment and accessibility of equipment for
cleaning and maintenance.
Management and control of purchased materials.
Prevention of cross contamination.
Cleaning and sanitizing.
Pest control.
Personal health and hygiene.
Environmental monitoring.
Chemical control.
Glass and hard plastic control.
Product trace and recall.
Complaint investigation.
Labeling.
Employee training and competencies.
REFERENCE

1. V.N. Scott and K. E. Stevenson, HACCPA Systematic Approach to Food Safety,

Food Products Assn., 2006.

HACCP in a Nutshell
Hazard analysis and critical control point (HACCP) is a food safety system designed to prevent
biological, chemical and physical hazards in food.
The process starts with identifying the food safety hazards most likely to occur in a specific food
product manufactured by a specific process. Next, the food safety team determines the likelihood of
occurrence of the hazard and its severity.
Hazard analysis has the same roots as failure mode effects analysis. A strategy is developed to
prevent the occurrence of the food hazards by controlling the environment and processes that keep
food safe. The strategy is summarized in the HACCP plan.
The success of a food safety management system depends on ensuring a safe environment to
produce food, implementing a proper HACCP program and having management commitment to
food safety and the HACCP approach. J.S.

QUALITY PROGRESS

I OCTOBER 2007 I 23

FOOD SAFETY
TABLE 3

standards and audit programs are similar

but vary slightly .

Addition of ISO 22000

An international effort developed to harmonize the food safety standards into a
single International Organization for Standardization (ISO) standard. ISO 22000
Food Safety Management SystemsRequirements for Any Organization in the Food Chain6
was published in 2005 (see Table 3).
The standard defines a state-of-the-art
FSMS as having the following characteristics:
Can be used by all organizations in the
food chain.
Incorporates the five preliminary steps
and seven principles of HACCP.
Provides an auditable standard that
can be used as part of third-party certification.
Ensures that the process to control food
safety is validated, verified, implemented, monitored and managed.
Focuses only on food safety.
ISO 22000 strengthens the HACCP system in several ways. It is a management
standard; therefore, it shares the following
common elements with other management
system standards:
Policy.
Planning.
Implementation and operation.
Performance assessment.
Improvement.
Management review.
The standard is fully compatible with
other ISO management system standards
such as ISO 9001. However, there are differences between the two standards.
The focus of ISO 9001 is quality, while the
focus of ISO 22000 is food safety. ISO 22000
assumes a food product exists alongside a
process to manufacture that product. This
includes having an effective purchasing sys24

I OCTOBER 2007 I www.asq.org

General Structure of ISO 22000:2005

Element Description
4
Food safety management system
4.1
General requirements
Documentation requirements:
4.2
Control of documents
Control of records
5
Management responsibility
5.1
Management commitment
5.2
Food safety policy
5.3
Food safety management system planning
5.4
Responsibility and authority
5.5
Food safety team leader
Communications
5.6
External
Internal
5.7
Emergency preparedness and response
Management review
5.8
Review input
Review output
6
Resource management
6.1
Provision of resources
Human resources
6.2
Competence, awareness and training
6.3
Infrastructure
6.4
Work environment
7
Planning and realization of safe products
7.1
General
7.2
Prerequisite programs
Preliminary steps to enable hazard analysis
Food safety team
7.3
Product characteristics
Intended use
Flow diagrams, process steps and control measures
Hazard analysis
Hazard identification and determination of acceptable levels
7.4
Hazard assessment
Selection and assessment of control measures
7.5
Establishing the operational prerequisite programs
Establishing the hazard analysis and critical control point (HACCP) plan
Identification of critical control points
7.6
Determination of critical limits for critical control points
System for the monitoring of critical control points
Actions when monitoring results exceed critical limits
Updating of the preliminary information and documents specifying the
7.7
prerequisite programs and the HACCP plan
7.8
Verification planning
7.9
Traceability system
Control of nonconformity
Corrections
7.10
Corrective actions
Handling of potentially unsafe products
Withdrawals
Validation,
verification and improvement of the food safety management
8
system
8.1
General
8.2
Validation of control measure combinations
8.3
Control of monitoring and measuring
Food safety management system (FSMS) verification
Internal audit
8.4
Evaluation of individual verification results
Analysis of results of verification activities
Improvement
8.5
Continual improvement
Updating the FSMS

tem and a product quality assurance system. In addition, there are small differences in the organizational
structure between the two standards.
Other additions to ISO 22000 beyond ISO 9001
include:
No exclusions in the requirements are permitted.
The FSMS must conform to appropriate statutory and regulatory requirements.
The organization must demonstrate that food
safety is supported by the business objectives.
The organization must develop an emergency
preparedness procedure.
The infrastructure or prerequisite programs
(PRPs) needed for a FSMS are defined in detail.
These programs provide the environment for the
production of safe food.
PRPs are recognized as being managed in different ways. For example, different protocols are
needed to implement and maintain training and
competencies, facilities, cleaning and sanitation,
and personal hygiene.
Analysis for food safety hazards must be conducted as a part of the process for planning the
safe realization of food production.
There is an assumption that it is possible for an
unsafe product to enter the food chain; therefore,
organizations must have recall or product withdrawal procedures.
The traceability system requires organizations to
trace all ingredients and components for food
products from the immediate suppliers through
the manufacturing processes. In addition, it
requires the traceability of end products to the
immediate customers.
If the organization produces an unsafe product,
the hazard must either be eliminated or reduced
to an acceptable level before the product enters
the food chain.
Concessions cannot be made if the product is
unsafe or contains a food safety hazard.
ISO 22000 does not have a requirement for a preventive action procedure. HACCP is inherently a system to prevent food safety hazards. However, ISO
22000 recognizes that new food hazards emerge and
new technologies are developed to control food safety
hazards. Therefore, ISO 22000 uses a systems
approach (continual updating of the FSMS) to prevent
new hazards from occurring in the food products.
When compared with other food safety standards,
ISO 22000 strengthens a number of the management
related elements with the following:
The organization must first effectively plan for

Food Safety
In the Home
Most consumers believe the primary cause of
foodborne illness is unsafe food handling practices
in food processing plants or restaurants.
In contrast, most food safety experts believe the
biggest source of foodborne illness is unsafe food
handling practices in the home. Therefore, food
safety is also the responsibility of individuals who
prepare food in the home.
The Partnership for Food Safety Education is an
association of industry, government and academia
with a mission to educate the public on safe food
handling practices. This partnership developed the
Fight BAC (Fight Bacteria) program.1
Fight BAC consists of the following four principles:
1. Clean: Wash hands and food preparation surfaces often.
2. Separate: Do not
create an environment in which
potentially pathogenic bacteria can
spread through
cross contamination.
3. Cook: Cook all foods
to the proper temperature.
4. Chill: Chill food
quickly because cold
temperatures slow
the growth of all
bacteria, including pathogenic bacteria. J.S.
REFERENCE

1. Partnership for Food Safety Education, Fight BAC program,

www.fightbac.org.

QUALITY PROGRESS

I OCTOBER 2007 I 25

FOOD SAFETY

ASQs Food, Drug and

Cosmetic Division
ASQs 5,600-member Food, Drug and Cosmetic (FDC) Division published the new Certified HACCP
[hazard analysis and critical control point] Auditor Handbook through ASQ Quality Press this spring.
The division is also currently in the process of developing a new pharmaceutical certification called
certified pharmaceutical good manufacturing compliance professional, or CPgmpCP. It also is working
with other divisions on a risk management book.
June M. Morita of Prospect Heights, IL, is chair of the division, and Diane G. Kulisek of Simi Valley,
CA, is chair elect. The Midwest Conference on Feb. 20, 2008, is the FDC Divisions next major event.
Additional information on the division, its activities and accomplishments can be found at
www.asq.org/fdc/index.html. Susan E. Daniels, editor at large

the realization of safe food and then implement the plans to ensure the production of
safe food.
The standard requires that food safety be
supported by the organizations business
objectives.
The standard defines the inputs and outputs
to the senior management review process.
The standard strengthens the internal and
external food safety communication requirements.
The standard requires the development of an
emergency response procedure.
The standard requires that responsibilities of
the food safety team leader (traditionally the
HACCP coordinator) be expanded to include
continual management of the FSMS, managing the food safety team and reporting to top
management on the status of the FSMS.
The standard requires the training element be
strengthened to include competencies.
The standard requires PRPs to be verified.
The standard formally accepts that an FSMS
might not have a CCP.
The standard requires continual improvement
and updating of the FSMS.
ISO 22000 is designed to be used by any organi26

I OCTOBER 2007 I www.asq.org

zation in the food chain, including producers, suppliers, manufacturers, distributors, retailers and
food service organizations.

Using Other ISO Standards

ISO technical committee 34, which deals with food
products, recognized the need to ensure a creditable
certification process for FSMSs. Thus, technical committee 34 and the ISO Committee on Conformity
Assessment developed a standard that defines the
requirements of accreditation bodies, certification
bodies and auditors that will be involved in the ISO
22000 certification process.
On Feb. 15, 2007, ISO published TS 22003:2007,
Food Safety Management SystemsRequirements for
Bodies Providing Audit and Certification of FSMSs.7
The working group intends to use ISO 22003, ISO
170218 and ISO 190119 to define the fundamental
principles for the accreditation, certification and
auditing processes for ISO 22000 certification.
ISO TS 22003 defines the specific competency
requirements FSMS auditors must demonstrate in
the following areas:
Management system audits.
Applicable laws and regulations.
HACCP and food safety, including the
identification and evaluation of food safety

hazards linked to the supply chain.

Methods to determine, implement and manage control measures for HACCP plans and
PRPs.
Knowledge of products, processes and practices in the food sectors they will audit.
The food chain is quite diverse. Thus, different
technical competencies are needed to conduct food
safety audits. It will be unlikely any one auditor
will be able to effectively demonstrate competency
in all areas of the food chain.

Strengthening Food Safety

The Institute of Medicine of the National Academy of Sciences10 convened a special committee to
develop recommendations to Congress and the
two national agencies that regulate the production
of food: the FDA and the FDAs Food Safety and
Inspection Service. The recommendations include:
Food safety regulatory agencies must continue to emphasize prevention, reduction or
elimination of foodborne disease hazards.
HACCP plans that are specific to a product
and a processing line should be developed.
Statistical process control linked to continuous improvement must be a part of food safety regulations. The concept of continuous
improvement is central to food safety.
Imported produce should follow the same
good agricultural practices required for
domestic produce.
Microbiological samples provide organizations and the regulatory agencies with a scorecard of performance. Future significant gains
in the safety of the U.S. meat and poultry supply can be realized only by implementing
more effective process control measures.
The U.S. food processing industry must move
from an inspection based system to a process
control based one to ensure the production of
safe food.
The report makes additional recommendations
to improve the regulations governing the safety of
seafood, dairy products, fruits and vegetables. In
addition, it makes specific recommendations for
improving the process used for disease surveillance
and monitoring microbial contamination of food.
U.S. consumers expect their food supply to be
safe. ISO 22000 strengthens HACCP by linking the
plan to PRPs and defining managements responsibilities.

REFERENCES

1. Centers for Disease Control and Prevention (CDC),

www.cdc.gov/foodsafety.
2. CDC, www.cdc.gov/ecoli/2006/september/updates/
100606.htm.
3. CDC, www.cdc.gov/ncidod/dbmd/diseaseinfo/
salmonellosis_2007/outbreak_notice.htm.
4. V.N. Scott and K. E. Stevenson, HACCPA Systematic
Approach to Food Safety, Food Products Assn., 2006.
5. Ibid.
6. ISO 22000:2005Food Safety Management Systems
Requirements for Any Organization in the Food Chain, ISO, 2005.
7. ISO TS 22003: 2007Food Safety Management Systems
Requirements for Bodies Providing Audit and Certification of Food
Safety Management Systems, ISO, 2007.
8. ISO/IEC 17021:2006Conformity Assessment
Requirements for Bodies Providing Audit and Certification of
Management Systems, ISO, 2006.
9. ISO 19011:2002, Guidelines for Quality and/or
Environmental Management Systems Auditing, ISO, 2002.
10. National Academy of Sciences, Scientific Criteria to
Ensure Safe Food, National Academies Press, 2003,
www.nap.edu/catalog/10690.html?se_side.
BIBLIOGRAPHY AND NOTE

ASQ Certified HACCP Auditor, www.asq.org/certification/

haccp-auditor/index.html.
Food Safety Gateway, www.foodsafety.gov. This site provides links to food safety organizations.

JOHN G. SURAK is the principal of

Surak and Associates, which provides
consulting for food safety and quality
management systems, designing and
implementing process control systems,
and implementing Six Sigma and business analytics systems. Surak is a
fellow of ASQ and an ASQ certified quality engineer, manager of quality/organization excellence, quality auditor and
HACCP auditor. He is the ASQ standards committee liaison from the Food, Drug and Cosmetics Division.

Please
comment
If you would like to comment on this article,
please post your remarks on the Quality Progress
Discussion Board at www.asq.org, or e-mail
them to editor@asq.org.

QUALITY PROGRESS

I OCTOBER 2007 I 27