Auditing Organizational Risk Management Under ISO 22000

Two-Level Risk Architecture in ISO 22000 and Rationale

Under ISO 22000:2018 Clause 6.1, an organization must determine the risks and opportunities that need to be addressed when planning for the food safety management system (FSMS). This determination requires considering internal and external issues under Clause 4.1, interested party requirements under Clause 4.2, and system scope under Clause 4.3.

This two-level structure applies to all organizations across the food chain seeking to maintain robust FSMS control. While Clause 8 applies Hazard Analysis and Critical Control Point (HACCP) principles to eliminate or reduce biological, chemical, and physical food safety hazards, Clause 6.1 addresses events and uncertainties that affect overall management system performance and effectiveness.

The rationale behind separating organizational risks from operational hazards is to prevent management system failure driven by business or environmental factors. A facility may operate validated Critical Control Points (CCPs), yet fail if supply chain disruptions, severe weather, IT cyber-incidents, or high staff turnover compromise system execution. Clause 6.1 ensures top management plans for macro-level uncertainties that threaten the organization's capability to deliver safe end products consistently.

Distinguishing Systemic Risks from Operational Hazards

To audit Clause 6.1 effectively, quality leads and auditors must clearly distinguish between organizational risks and operational hazards. A food safety hazard is defined in Clause 3.22 as a biological, chemical, physical, allergen, or radiological agent in food with the potential to cause an adverse health effect. Hazards are identified, assessed, and controlled through prerequisite programmes (PRPs), Operational Prerequisite Programmes (OPRPs), and CCPs under Clause 8.

In contrast, Clause 3.39 defines risk as the effect of uncertainty, which can be positive or negative. Notes to Clause 6.1.1 explicitly clarify that organizational risks and opportunities are limited to events relating to the performance and effectiveness of the FSMS. Public authorities address public health risks, whereas the organization manages internal operational hazards under Clause 8 and systemic business risks under Clause 6.1.

Under Clause 6.1.3, actions taken to address organizational risks and opportunities must be proportionate to their impact on food safety requirements, product conformity, and interested party expectations. Clause 6.1.2 mandates planning how to integrate these actions into FSMS processes and evaluate their effectiveness. Options for addressing organizational risks include avoiding risk, eliminating the risk source, changing likelihood or consequences, sharing risk, or accepting risk by informed decision.

Quality managers and internal auditors must implement a structured process to manage organizational risk planning systematically. Following a five-step procedure provides structured compliance across operational functions:

• Identify internal and external context issues under Clause 4.1 and interested party expectations under Clause 4.2 during strategy reviews.
• Determine potential events that could prevent the FSMS from achieving intended outcomes or create opportunities to enhance performance under Clause 6.1.1.
• Formulate proportionate action plans under Clause 6.1.2 and Clause 6.1.3 to address each identified systemic risk or opportunity.
• Integrate selected risk controls into support, operational, or evaluation processes across Clauses 7 through 10.
• Evaluate action effectiveness during management review under Clause 9.3.2 and update risk assessments when context changes occur.

Example

A cereal processing facility experiences frequent IT network outages and high turnover among sanitation supervisors. During an internal audit, the auditor notes that while the HACCP plan under Clause 8.5.2 correctly identifies allergen cross-contamination as a physical hazard, the facility has no risk plan for IT disruptions or supervisory turnover.

The food safety team conducts a Clause 6.1 assessment, recognizing that IT downtime threatens digital CCP monitoring logs and high turnover compromises PRP sanitation consistency. Under Clause 6.1.2, the team establishes manual logging backup procedures and implements a structured supervisor onboarding programme. The team integrates these actions into Clause 7.2 competence and Clause 8.7 monitoring processes, recording the risk review as input for management review under Clause 9.3.2.

Auditor Inspection Criteria and Evidence Matrix

Auditors evaluating Clause 6.1 examine whether top management has established systematic methods to identify, address, and review organizational risks and opportunities. They inspect risk registers, context records, action plans, and management review outputs to verify full compliance.

Before your audit

• Confirm that the organizational risk assessment explicitly considers context issues from Clause 4.1 and interested party needs from Clause 4.2.
• Verify that organizational risks are clearly distinguished from operational biological, chemical, physical, allergen, and radiological hazards.
• Ensure action plans to address organizational risks specify responsible personnel, implementation timelines, and required resources under Clause 6.1.2.
• Check that risk treatment actions are proportionate to the potential impact on food safety and product conformity under Clause 6.1.3.
• Review management review records to confirm that the effectiveness of actions taken to address risks and opportunities was evaluated under Clause 9.3.2.
• Confirm that organizational risk assessments are updated whenever significant context or operational changes occur.

Questions people ask

How does organizational risk under Clause 6.1 differ from hazard analysis under Clause 8?

Organizational risk under Clause 6.1 addresses uncertainties affecting management system performance, such as resource constraints, supply disruptions, or regulatory changes. Hazard analysis under Clause 8 identifies and controls biological, chemical, physical, allergen, and radiological agents in food that can cause adverse health effects.

Is documented information explicitly required for Clause 6.1 risk assessments?

While Clause 6.1 does not contain the explicit phrase "retained as documented information", Clause 4.4, Clause 7.5, and Clause 9.3.2 require maintaining management system records. Auditors expect documented evidence of risk identification, action planning, and management review evaluation to demonstrate conformity.

What options are available to an organization to address identified risks under ISO 22000?

Under Clause 6.1.3 notes, options to address risks include avoiding the risk, taking risk to pursue an opportunity, eliminating the risk source, changing the likelihood or consequences, sharing the risk, or accepting the risk by informed decision.

How often must organizational risks and opportunities be re-evaluated?

Clause 6.1 risk evaluations must be reviewed during planned management reviews under Clause 9.3.2 and updated whenever significant changes occur in external or internal context under Clause 4.1, interested party requirements under Clause 4.2, or system updates under Clause 10.3.

Reference documents

• DS/EN ISO 22000:2018, Food safety management systems — Requirements for any organization in the food chain
• DS/ISO 22003-1:2022, Food safety — Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022, Food safety — Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system