ISO 22000 Documents Checklist: HACCP Plan, PRPs and the Records Behind Them

Your auditor walks in, asks for your documents, and you have about ten seconds before they form an opinion. Not about your food. About your system. The good news: ISO 22000 does not ask for a mountain of paper. The bad news: most food businesses either write far too much or far too little, and both fail in exactly the same way — the auditor cannot see the system working.

The short answer: ISO 22000:2018 asks for a small set of named documents — scope, food safety policy and objectives, prerequisite programmes, and a hazard control plan built on a proper hazard analysis — plus the records that prove you follow them. There is no fixed document count in the standard; a single-site unit usually lands around fifteen to thirty documents and records in total.

Documents vs records — the split that saves you half the work

Everything an auditor asks for falls into one of two buckets, and mixing them up is the first mistake most units make.

A document says how the work should be done. A record proves it was done, on a particular day, by a particular person. Think of it like a kitchen. The recipe book is the document. The diary entry that says "cooked batch 42 at 2 pm, core temperature 74°C, checked by Ramesh" is the record. One tells you the method. The other proves the method happened.

Why does this matter? Because documents and records are controlled differently. A document needs a version number, an approval, and a way to make sure the old version stops circulating. A record needs to be filled in honestly, kept legible, and stored where you can find it when the auditor asks. If you treat a record like a document — rewriting it, tidying it up after the fact — you have just destroyed evidence. Auditors notice that fast.

The 7 documents the standard actually names

ISO 22000:2018 is a paywalled standard, so I am working from the clause mapping that independent guides agree on — and they do agree, which is why I can name these with confidence. Here is the core set, with the clause each one answers to.

1. The scope of your food safety management system (clause 4.3). One page that names the products, the processes, the sites and the activities covered — and the ones left out. If you make pickles at one unit and pack spices at another, say so. The scope is also where you name outsourced processes and who is responsible for them. Keep it tight. A scope that says "everything we do" tells the auditor nothing.

2. The food safety policy (clause 5.2). A short statement, signed by top management, that says you are committed to food safety, to meeting legal and customer requirements, and to improving the system. It has to be communicated inside the unit — a framed policy nobody has read is decoration, not a document. One paragraph of honest intent beats a page of borrowed language.

3. Food safety objectives (clause 6.2). Measurable targets with a plan behind them. "Reduce customer complaints" is a wish. "Cut foreign-body complaints from 6 a quarter to 2 a quarter by December, by adding a metal detector check at packing" is an objective. The auditor will ask how you track it, so pick numbers you actually measure.

4. Your prerequisite programmes, the PRPs (clause 8.2). The basic hygiene conditions that have to be in place before any hazard control can work. I take these apart in detail below — they are the longest document set in the system.

5. Product, raw material and process descriptions (clause 8.5.1). For each product or product group: what it is, what goes into it, how it is made, how it is packed, how long it lasts, and who eats it. Raw materials and food-contact materials get the same treatment — name, specification, supplier, and the hazards each one can bring in. This is the information your hazard analysis feeds on. Thin descriptions here mean a thin hazard analysis later.

6. Flow diagrams, confirmed on site (clause 8.5.1). A step-by-step diagram of every process, from receiving to dispatch — and the food safety team must walk the floor and confirm the diagram matches what actually happens. This is the single most-checked document in a Stage 1 audit, because a wrong diagram means the hazard analysis was done on a factory that does not exist.

7. The hazard control plan — your HACCP/OPRP plan (clause 8.5.4). The document that says, for every significant hazard, what controls it, where, and how you know it worked. This is the heart of the system, and it gets its own section below.

Two more things the standard expects as documented information: your criteria for evaluating and selecting suppliers, and the method you use to assess hazards — the criteria and the scoring that decide whether a hazard is significant. Write both down. An auditor who cannot see your method cannot trust your conclusions.

The HACCP plan, piece by piece

ISO 22000 does not replace HACCP. It contains it. Clause 8.5 runs the Codex sequence, and your hazard control plan is where it lands. Before the seven principles, there are pre-steps, and skipping them is how plans go wrong.

The pre-steps are: appoint a food safety team with the right mix of knowledge; describe your products, raw materials and ingredients; describe the intended use — who eats this, and are any of them vulnerable, like infants or the elderly; and draw the flow diagram and confirm it on site. Only then does the analysis start.

Then the seven principles, in order:

1. Hazard analysis. For every step, list the biological, chemical — including allergens — and physical hazards that could reasonably be expected, and assess each one for likelihood and severity. A hazard that is possible but trivial is not significant. A hazard that is unlikely but lethal is.

2. Critical control points. The steps where control is essential and a loss of control means unsafe food. Not every step is a CCP. Most are not.

3. Critical limits. A measurable line for each CCP — a temperature, a time, a pH. "Cook until done" is not a limit. "Core temperature of 74°C or above" is.

4. Monitoring. Who measures what, how often, and with which instrument. Monitoring has to be frequent enough to catch a drift before the product leaves your control.

5. Corrective actions. What happens when a limit is breached — who acts, what happens to the affected product, and how you stop it happening again. A plan with no corrective action is a wish list.

6. Verification. The checks that prove the plan itself works — calibration, internal audits, testing, reviewing monitoring records. Monitoring asks "did we follow the plan today?" Verification asks "does the plan actually control the hazard?"

7. Recordkeeping. The monitoring logs, the corrective-action records, the verification evidence. If it is not written down, the auditor treats it as not done.

One ISO addition to the classic sequence: each significant hazard is managed either at a CCP with a measurable critical limit, or by an operational prerequisite programme — an OPRP — with an action criterion. OPRPs cover the hazards that matter but cannot be controlled at a single measurable point. A cleaning regime that keeps allergen cross-contact down is an OPRP. The cooking step that kills pathogens is a CCP. Knowing which is which is the whole skill of the plan.

PRPs — the 13 things that keep the floor clean

Prerequisite programmes are the basic conditions and activities that keep the environment hygienic. For food manufacturing, the sector specification ISO/TS 22002-1 lists them. Here they are, in plain words:

• Site and layout — the building, the drains, the flow of people and product so clean and dirty work never cross.
• Utilities — water, air and energy supplies that are safe for food contact.
• Waste — how waste leaves the building without coming back in.
• Equipment — design, maintenance and suitability for food use.
• Purchased materials — supplier approval and incoming checks.
• Cross-contamination — including allergens and foreign bodies, kept apart by design, not by hope.
• Cleaning and sanitising — schedules by zone, chemicals named, responsibility assigned.
• Pest control — prevention first, then monitoring, then treatment — with records.
• Personnel hygiene — handwashing, clothing, illness rules, training.
• Rework — how reworked product is identified, handled and traced.
• Warehousing and transport — storage conditions and vehicles that hold them.
• Product information — labelling and the information that travels with the product.
• Food defence and food fraud — protecting the product from deliberate harm and from substitution.

Not every PRP needs a twenty-page procedure. A small unit can cover several in one short document each, as long as each one says what is done, who does it, and how it is checked. What the auditor will not accept is a PRP that exists only in someone's head. If the pest contractor visits and nobody records it, the programme does not exist as far as the audit is concerned.

The records that prove it happened

Documents describe the system. Records prove it ran. Here is the record set an auditor will ask for, and roughly what each one must show:

• Training and competence records (clause 7.2) — who was trained, on what, when, and whether it worked. A certificate on the wall is not enough; the auditor wants to see that the person monitoring the CCP actually knows how.
• Calibration records (clause 7.1.5) — every thermometer, scale and metal detector that a decision depends on, calibrated on schedule, with the results kept.
• CCP and OPRP monitoring records — the daily logs, filled in at the time, signed, with deviations noted rather than hidden.
• Traceability records (clause 8.3) — one step back to the supplier, one step forward to the customer, for every batch. Test it before the auditor does: pick a batch and trace it both ways in under four hours.
• Emergency preparedness records (clause 8.4) — the plan, the drills, and what the drills taught you.
• Nonconforming product and recall records (clause 8.9) — what was held, what was decided, and the mock recall that proves the system works when it matters.
• Verification records — internal audit reports, management review minutes, corrective-action closures.
• Supplier records — evaluations, approvals, and what you did when a supplier slipped.

How long do you keep all this? Here is the honest answer: ISO 22000 does not fix a number of years. It requires you to control retention — to decide, write down, and follow your own retention periods, taking customer and legal requirements into account. A common working practice is to keep records at least as long as the product's shelf life plus a margin, but that is practice, not a rule in the standard. Whatever period you choose, the auditor will check that you actually follow it. A retention rule you ignore is worse than no rule at all.

Do you need a food safety manual?

Short answer: no, not as a mandatory document. The standard requires documented information — the items above — but it does not demand a single bound manual. That said, almost every certified unit has one, and for a good reason. A manual is the map: it says what the system is, where each document lives, and how the pieces fit. Without it, an auditor has to assemble the picture from scattered files, and a scattered picture reads as a scattered system.

Write the manual last. It should describe the system you actually built, not the one you planned to build. A manual written first is a work of fiction. A manual written last is an index. Keep it short — twenty pages is plenty for a single-site unit — and let it point to the procedures rather than repeating them.

Which document do you write first?

The order matters, because each document feeds the next. Writing the HACCP plan before the flow diagram is like writing a recipe before seeing the kitchen. Here is the order that works:

First, the scope and the team. Decide what the system covers and who owns it. Appoint the food safety team leader — the standard wants a named person, not a committee.

Second, the descriptions and the flow diagram. Products, raw materials, intended use, and the process on paper — then walk the floor and confirm it.

Third, the PRPs. Get the hygiene basics documented and running. Many hazard controls depend on PRPs working, so this is the foundation.

Fourth, the hazard analysis and the hazard control plan. Now you have the information the analysis needs. This is the document the auditor will spend the most time on, so give it the most time.

Fifth, the policy, objectives and the rest of the management-system documents. These are quick once the technical core exists, and they read better when they describe a real system.

Last, the manual — the map of everything you just built. Then start generating records: run the system for a few months, hold an internal audit, hold a management review. A certification body will not audit a system with no records, because there is nothing to verify. That is why the timeline for a small unit is usually three to four months from a standing start, and four to six for a mid-sized one — those are guide ranges, and the records are what fills them.

Ready for audit? Run this checklist

Before the Stage 1 audit, sit with this list and be honest about every line:

• Scope document signed, products and sites named, exclusions justified.
• Food safety policy signed by top management and actually communicated.
• Objectives measurable, with a plan and a tracking method each.
• Flow diagrams confirmed on site, signed and dated by the food safety team.
• Hazard analysis complete for every product group, with the assessment method written down.
• Hazard control plan covering every significant hazard — CCPs with limits, OPRPs with action criteria.
• PRPs documented for all 13 areas that apply to you, with owners and checks.
• Supplier criteria written, suppliers evaluated, approvals on file.
• Monitoring records running for at least a few months, deviations recorded and corrected.
• Traceability tested both ways on a real batch.
• Mock recall done, with a report and lessons noted.
• Internal audit done, findings closed or on a dated plan.
• Management review held, minutes kept, decisions recorded.
• Calibration current on every instrument a decision depends on.
• Every document version-controlled, old versions withdrawn.

If three or more lines are blank, you are not ready for Stage 1. Fix them first — a failed Stage 1 costs you the audit fee and the month.

What it costs and how long it takes

Certification has two bills, and they are separate. The consultancy — gap analysis, documentation, training, internal audit support — is one. The certification body's audit fee is the other, and it is quoted per unit after the body sees your scope; no fixed tariff exists. On the consultancy side, our ISO 22000 packages are ₹12,999 for a Standard single-site unit and ₹24,999 for Growth, with certification-body fees extra at actuals — the detail, including what each tier covers, is in our ISO 22000 cost guide. If you want the full picture before you commit, that guide is the place to start, and our ISO 22000 certification page sets out the process end to end.

5 mistakes that cost food businesses their certificate

1. Buying a 108-document kit and filing it unread. A kit gives you templates. An auditor gives you questions. If nobody in your unit can explain a procedure in their own words, the document is not yours, and the audit will show it. Use templates as a starting point, then rewrite them in your own process.

2. A flow diagram drawn from memory. The diagram must match the floor. Walk it. Every auditor does, and the first place they look is the step you skipped on paper.

3. Monitoring records filled in at the end of the week. Backfilled records are easy to spot — identical handwriting, identical times, no deviations ever. One honest deviation with a corrective action is worth more than a year of perfect-looking logs.

4. Treating FSSAI as the same thing. Your FSSAI licence is the legal mandate under the Food Safety and Standards Act, 2006 — it is compulsory, and ISO 22000 does not replace it. The two systems overlap, but they answer to different masters. Our ISO 22000 vs FSSAI comparison sets out exactly where each one stops, and if you are a packaged-food brand, our FSSAI guide for packaged brands covers the licence side in detail.

5. No records before the audit. A system with no history cannot be verified. Run it, log it, audit it internally, review it — then invite the certification body. The few months of records are not a delay. They are the evidence.

Frequently asked questions

What documents are required for ISO 22000 certification?
The standard names a short core set: the FSMS scope, food safety policy and objectives, prerequisite programmes, product and raw-material descriptions, confirmed flow diagrams, the hazard assessment method, supplier criteria, and the hazard control plan. On top of that come the records — training, calibration, monitoring, traceability, audits and reviews. Anything beyond that is your choice or your customer's demand, not the standard's.

Is a food safety manual mandatory for ISO 22000?
No. ISO 22000:2018 requires documented information, not a manual as such. But almost every certified unit keeps one, because it maps the system for the auditor and for new staff. Write it last, keep it short, and let it point to your procedures instead of repeating them.

How many documents does ISO 22000 require?
The standard sets no number. The named documents plus the record set usually come to around fifteen to thirty documents and records for a single-site unit — a practical observation, not a rule in the standard. A 108-document kit is a vendor's product, not a requirement. Judge by coverage, not count.

How long must ISO 22000 records be kept?
The standard does not fix a number of years. It requires you to set retention periods, write them down, and follow them, taking customer and legal requirements into account. A common working practice is to keep records at least as long as the product's shelf life plus a margin — but the auditor checks that you follow your own rule, whatever it is.

Does ISO 22000 replace FSSAI, and what about FSSC 22000?
No — your FSSAI licence stays mandatory under Indian law, and ISO 22000 is voluntary. FSSC 22000 is a separate, GFSI-recognised scheme built on ISO 22000 plus the ISO/TS 22002 sector PRPs and extra scheme requirements — the route most retail and export buyers ask for by name. We compare the two in detail in the next post in this series.

The documents are not the system. They are the map of it. Build the system first — the hygiene, the hazard thinking, the daily discipline of writing things down as they happen — and the documents almost write themselves. Build the documents first and the system never arrives. If you want help turning your unit's real processes into a set that survives an audit, start with our ISO 22000 certification page, or run your numbers through the compliance fee calculator to see the full cost picture before you commit.