Auditing ISO 22000 Clause 8.2 Prerequisite Programmes

Prerequisite Programmes as the Operational Foundation

Under DS/EN ISO 22000:2018, establishing a food safety management system (FSMS) requires a robust operational foundation before executing hazard analysis. Clause 3.35 defines a prerequisite programme (PRP) as the basic conditions and activities necessary within the organization and throughout the food chain to maintain food safety. PRPs encompass equivalent industry terms such as Good Manufacturing Practice (GMP), Good Hygiene Practice (GHP), Good Agricultural Practice (GAP), Good Veterinary Practice (GVP), Good Production Practice (GPP), Good Distribution Practice (GDP), and Good Trading Practice (GTP). Quality managers, compliance leads, and internal auditors must recognize that PRPs establish baseline sanitary, environmental, and structural controls across the operating facility.

Clause 8.2.1 obliges the organization to establish, implement, maintain, and update PRPs to facilitate the prevention or reduction of contaminants, including food safety hazards, in products, product processing, and the work environment. The systemic rationale for Clause 8.2 is to ensure that environmental and operational hazards are controlled through basic hygiene programs. Controlling baseline environmental contamination through PRPs prevents routine sanitation issues from cluttering the hazard analysis under Clause 8.5.2 or being inappropriately classified as Operational Prerequisite Programmes (OPRPs) or Critical Control Points (CCPs).

Failing to maintain site-specific PRPs invalidates the assumptions made during hazard identification under Clause 8.5.2.2. If basic controls such as pest management, utility quality, or equipment cleanability fail, unmodeled hazards can enter the processing stream. Internal auditors must evaluate whether PRPs are actively managed, monitored, and verified, rather than treated as passive static documentation.

Establishing and Tailoring Site-Specific PRPs

To ensure PRPs provide effective hazard prevention, Clause 8.2.2 sets out four mandatory structural conditions. PRPs must be appropriate to the organization and its context regarding food safety, and appropriate to the size and type of operation as well as the nature of products manufactured or handled. Furthermore, PRPs must be implemented across the entire production system, either as general facility-wide programmes or as process-specific controls, and must be formally approved by the food safety team.

When selecting and establishing PRPs, Clause 8.2.3 dictates that applicable statutory, regulatory, and mutually agreed customer requirements must be identified. Clause 8.2.3 notes that organizations should consider the applicable part of the ISO/TS 22002 series alongside relevant standards, codes of practice, and sector guidelines. Under Clause 8.2.4, the food safety team must evaluate twelve specific operational areas when establishing PRPs:

• Construction and layout of buildings and associated utilities
• Layout of premises, including zoning, workspace, and employee facilities
• Supplies of air, water, energy, and other utilities
• Pest control, waste and sewage disposal, and supporting services
• Suitability of equipment and its accessibility for cleaning and maintenance
• Supplier approval and assurance processes for raw materials, chemicals, and packaging
• Reception of incoming materials, storage, dispatch, transportation, and product handling
• Measures for the prevention of cross-contamination
• Cleaning and disinfecting procedures
• Personal hygiene controls
• Product information and consumer awareness
• Other operational factors, as appropriate

Clause 8.2.4 mandates that documented information must specify the selection, establishment, applicable monitoring, and verification of all PRPs. Documenting these elements ensures that every programme has defined operational boundaries, assigned responsibilities, and clear verification protocols.

Audit Matrix for Prerequisite Programmes

Internal auditors should utilize a structured audit matrix when evaluating PRP compliance against Clause 8.2 and related verification requirements under Clause 8.8.1. This matrix connects standard requirements directly with auditor verification checks and required documented evidence.

Monitoring, Verification, and Auditing PRPs in Practice

Auditing Clause 8.2 requires tracing prerequisite programmes from initial design and food safety team approval down to operational execution and independent verification under Clause 8.8.1. Internal auditors should apply a systematic six-step procedure when evaluating PRP effectiveness:

• Review the legal, regulatory, customer, and ISO/TS 22002 sector requirements identified by the organization under Clause 8.2.3.
• Verify that documented information covers all twelve operational topics listed in Clause 8.2.4 and carries food safety team approval under Clause 8.2.2(d).
• Inspect physical premises, utilities, equipment layouts, zoning boundaries, and sanitation practices to confirm live operational implementation.
• Audit routine monitoring records to verify that measurements and observations are conducted at specified frequencies by assigned personnel per Clause 8.2.4.
• Check verification records under Clause 8.8.1 to confirm that verification activities are executed by individuals independent of routine monitoring duties.
• Evaluate verification analysis records under Clause 8.8.2 to ensure PRP performance data is presented to top management during management review under Clause 9.3.2.

Example

During an internal audit of a beverage processing facility, the auditor evaluates sanitation and hygiene PRPs under Clause 8.2.4(i) and Clause 8.8.1. The auditor reviews daily cleaning schedules and observes that the quality assurance supervisor conducts weekly environmental swabbing to verify cleaning effectiveness. However, when examining daily sanitation inspection logs, the auditor notes that the same supervisor signs off on both the operational monitoring checks and the weekly verification sign-offs. Furthermore, ATP swab testing results showing recurring elevated microbiological counts were never analyzed or reported during management review under Clause 8.8.2 or Clause 9.3.2. The auditor logs a nonconformity against Clause 8.8.1 for failing to ensure that verification activities are conducted independently of monitoring duties, and against Clause 8.8.2 for failing to analyze verification results to evaluate FSMS performance.

Before your audit

• Verify that all PRPs have been formally reviewed and approved by the food safety team under Clause 8.2.2(d).
• Confirm that statutory, regulatory, and customer requirements relevant to facility PRPs are identified per Clause 8.2.3.
• Check that documented information specifies the selection, establishment, monitoring, and verification for all PRPs under Clause 8.2.4.
• Ensure that all twelve operational topics listed in Clause 8.2.4, including utilities, zoning, pest control, and cross-contamination, are addressed.
• Validate that personnel conducting PRP verification activities are independent of routine monitoring duties under Clause 8.8.1.
• Confirm that PRP verification results are systematically analyzed by the food safety team under Clause 8.8.2.
• Verify that PRP verification analysis outputs are included in inputs to management review under Clause 9.3.2.

Questions people ask

What is the difference between a PRP, an OPRP, and a CCP in ISO 22000?

A prerequisite programme (PRP) maintains basic environmental and operational conditions across the facility. An Operational Prerequisite Programme (OPRP) is a control measure identified through hazard analysis to control a significant food safety hazard, managed with action criteria. A Critical Control Point (CCP) is a specific process step applied to prevent or reduce a significant hazard to acceptable levels, managed with measurable critical limits.

Are ISO/TS 22002 sector standards mandatory when establishing PRPs under Clause 8.2?

No, the ISO/TS 22002 series is not strictly mandatory, but Clause 8.2.3 states that the organization should consider the applicable part of the ISO/TS 22002 series alongside relevant codes of practice and guidelines. However, applicable statutory, regulatory, and customer requirements for PRPs are obligatory.

Who must approve prerequisite programmes under ISO 22000?

Under Clause 8.2.2(d), prerequisite programmes must be formally approved by the food safety team. Documented information confirming this approval must be retained within the food safety management system.

How does ISO 22000 require organizations to verify prerequisite programmes?

Under Clause 8.8.1, the organization must plan and conduct verification activities to confirm that PRPs are effectively implemented and maintained. Verification must be performed by individuals independent of those responsible for daily monitoring, and verification results must be analyzed under Clause 8.8.2.

Reference documents

• DS/EN ISO 22000:2018 Food safety management systems – Requirements for any organization in the food chain
• DS/ISO 22003-1:2022 Food safety – Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022 Food safety – Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system