Auditing Equipment Calibration and Traceability Under ISO 22000

Control of Monitoring Equipment and Rationale

Under ISO 22000:2018 Clause 8.7, an organization must provide evidence that specified monitoring equipment and methods are adequate for activities related to Prerequisite Programmes (PRPs) and the hazard control plan. The hazard control plan includes control measures managed as Operational Prerequisite Programmes (OPRPs) and at Critical Control Points (CCPs).

To fulfill operational requirements, the organization must ensure monitoring equipment undergoes five mandatory controls prior to use. Equipment must be calibrated or verified at specified intervals, adjusted as necessary, identified to enable calibration status determination, safeguarded from invalidating adjustments, and protected from damage or deterioration.

The rationale behind Clause 8.7 is that monitoring data confirms whether control measures maintain food safety hazards within defined acceptable levels. Inaccurate readings from uncalibrated equipment can lead an organization to assume CCP critical limits or OPRP action criteria are met when they are not. Accurate, verifiable measurements prevent potentially unsafe products from entering the food chain.

Establishing Measurement Traceability and Calibration Protocols

Clause 8.7 mandates that calibration of all monitoring equipment must be traceable to international or national measurement standards. When no such standards exist, the organization must document and retain the specific basis used for calibration or verification. Results of calibration and verification activities must be retained as documented information.

Software used in monitoring and measuring within the food safety management system (FSMS) must be validated prior to use by the organization, software supplier, or a third party. Commercial off-the-shelf software used within its designed application range is considered sufficiently validated. Software modifications or custom configurations must be authorized, documented, and validated prior to implementation.

Quality managers and compliance leads must implement structured procedures to maintain measurement traceability. A systematic five-step procedure establishes operational control across monitoring equipment:

• Identify all monitoring devices utilized across PRPs, OPRPs, and CCPs, recording location and accuracy requirements.
• Establish a calibration schedule specifying intervals, methods, and acceptable tolerance limits aligned with equipment criticality.
• Secure traceable reference standards or contract accredited calibration laboratories providing certificates linked to national standards.
• Apply physical safeguards, tamper seals, and protective housing to prevent unauthorized adjustment or physical deterioration.
• Validate monitoring software and maintain documented information of software configurations and calibration results.

Managing Out-of-Calibration Events and Product Impact Assessment

When a monitoring device or process environment is found nonconforming, Clause 8.7 requires assessing the validity of previous measurement results. This evaluation determines whether process control was maintained during the period between the last valid calibration and discovery of the defect.

The organization must take appropriate action regarding affected equipment or process environments and any product impacted by the nonconformance. The assessment and resulting actions must be maintained as documented information. When previous measurements are invalidated, affected end products must be handled as potentially unsafe products under Clause 8.9.4.

Under Clause 8.9.2 and Clause 8.9.4, products monitored by nonconforming equipment cannot be released unless the organization demonstrates that hazards remain within defined acceptable levels. The organization must also evaluate the need for corrective action under Clause 8.9.3 to eliminate root causes and prevent recurrence.

Example

During a monthly verification check, an internal auditor discovers a digital temperature transmitter monitoring a pasteuriser CCP reading two degrees Celsius higher than actual fluid temperature. The CCP critical limit requires a minimum pasteurisation temperature of seventy-two degrees Celsius for fifteen seconds.

The food safety team conducts a Clause 8.7 assessment of previous measurement validity. Automated logs show that while the transmitter recorded seventy-three degrees, actual processing was seventy-one degrees, breaching the critical limit. The team quarantines finished product produced since the last valid calibration as potentially unsafe under Clause 8.9.4. Following thermal evaluation under Clause 8.9.4.3, the team applies corrective action under Clause 8.9.3 by replacing the sensor and shortening calibration intervals.

Auditor Inspection Criteria and Calibration Evidence Matrix

Certification body auditors assessing Clause 8.7 evaluate whether monitoring systems deliver reliable measurements capable of confirming food safety control. Auditors scrutinize calibration schedules, physical equipment conditions, traceability trails, out-of-calibration assessments, and software validation records.

Before your audit

• Confirm all monitoring devices used for PRPs, OPRPs, and CCPs are included in the master calibration register.
• Verify every measuring instrument displays clear identification showing its current calibration status and next due date.
• Ensure calibration certificates for reference standards and operational equipment demonstrate traceability to national standards.
• Review documented rationale for internal calibration methods or instances where national measurement standards do not exist.
• Check physical safeguards, tamper seals, or password controls prevent unauthorized adjustment of measuring equipment and software.
• Validate documented assessments of previous measurement validity are available for every out-of-calibration event occurring since the last audit.
• Confirm software used in monitoring systems is validated, up to date, and subject to documented change control procedures.

Questions people ask

What must an organization do when a measuring device is found out of calibration under ISO 22000?

The organization must assess the validity of previous measurement results obtained with nonconforming equipment and document the evaluation. It must take appropriate action regarding equipment, process environments, and affected products, handling impacted products as potentially unsafe when safety cannot be assured.

How is measurement traceability established when no national or international standard exists?

When no national or international measurement standards exist, Clause 8.7 requires documenting and maintaining the specific basis used for calibration or verification as documented information. This rationale must demonstrate that the chosen reference method provides adequate accuracy and consistency for monitoring food safety controls.

Is validation required for commercial off-the-shelf software used in food safety monitoring?

Commercial off-the-shelf software in general use within its designed application range is considered sufficiently validated under Clause 8.7 notes. Custom software configurations, user modifications, or custom-built monitoring applications must be authorized, documented, and validated prior to operational implementation.

What is the difference between calibration and verification of monitoring equipment?

Calibration compares a measuring device against a traceable reference standard to determine accuracy and make adjustments, whereas verification provides objective evidence that specified operational requirements or tolerances are fulfilled. Clause 8.7 permits either calibration or verification at specified intervals prior to use, provided measurement reliability is established.

Reference documents

• DS/EN ISO 22000:2018, Food safety management systems — Requirements for any organization in the food chain
• DS/ISO 22003-1:2022, Food safety — Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022, Food safety — Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system