Determining Acceptable Hazard Levels Under ISO 22000

Acceptable Hazard Levels and System Rationale

Under ISO 22000:2018 Clause 8.5.2.2.3, an organization must determine the acceptable level in the end product for each identified food safety hazard, whenever possible. The standard defines an acceptable level as the level of a food safety hazard not to be exceeded in the end product provided by the organization. An end product is defined as product that will undergo no further processing or transformation by the organization.

This requirement applies to all organizations across the food chain, regardless of size or complexity, including food manufacturers, animal feed producers, primary producers, packaging suppliers, and catering service operators. Establishing explicit hazard levels forms the foundation of operational risk-based thinking within the food safety management system.

The core rationale behind this requirement is that identifying a hazard is insufficient to guarantee food safety. Without defining a clear acceptable level, an organization cannot evaluate whether its processes provide adequate control or whether end products are safe for consumption. Acceptable levels establish the benchmark against which control measures, critical limits at Critical Control Points (CCPs), and action criteria for Operational Prerequisite Programmes (OPRPs) are validated, monitored, and verified.

Integrating Regulatory Limits, Customer Needs, and Intended Use

Clause 8.5.2.2.3 mandates that when determining acceptable levels, the organization must ensure that applicable statutory, regulatory, and customer requirements are identified. Statutory and regulatory requirements can include Food Safety Objectives (FSOs), defined by the Codex Alimentarius Commission as the maximum frequency or concentration of a hazard in a food at the time of consumption that provides or contributes to the appropriate level of protection.

In addition to legal limits, the organization must consider the intended use of end products under Clause 8.5.1.4. Intended use includes the reasonably expected handling of the end product, as well as unintended use and reasonably expected mishandling or misuse. The organization must identify specific groups of consumers or users for each product, with explicit focus on groups known to be especially vulnerable to specific food safety hazards, such as infants, pregnant women, elderly individuals, or immunocompromised persons.

The organization must also consider any other relevant information, including scientific literature, historical process data, epidemiological reports, and information communicated across the food chain. All determinations and the underlying justifications for acceptable levels must be maintained as documented information to satisfy Clause 8.5.2.2.3 audit criteria.

Conducting Hazard Assessments and Implementation Steps

Following hazard identification and the determination of acceptable levels, the organization must conduct a hazard assessment for each identified food safety hazard in accordance with Clause 8.5.2.3. The purpose of the hazard assessment is to determine whether the prevention or reduction of a hazard to an acceptable level is essential to produce safe food.

Under Clause 8.5.2.3, the organization must evaluate each food safety hazard against two distinct criteria:

a) The likelihood of its occurrence in the end product prior to the application of control measures.

b) The severity of its adverse health effects in relation to the intended use.

Hazards identified as significant food safety hazards through this assessment must be controlled using control measures selected and categorized under Clause 8.5.2.4 as OPRPs or at CCPs. The organization must describe the assessment methodology used and maintain the results as documented information.

To implement these requirements effectively, organizations should follow a structured five-step procedure:

1. Identify all biological, chemical, physical, allergen, and radiological hazards reasonably expected to occur for each product and process step under Clause 8.5.2.2.1.
2. Gather all applicable statutory limits, regulatory standards, Codex FSOs, and customer specifications relevant to target distribution markets.
3. Document product characteristics and intended use under Clause 8.5.1.4, identifying handling instructions, consumer preparation steps, and vulnerable target populations.
4. Establish and record the defined acceptable level for each hazard in the end product, creating documented justification that links legal thresholds, scientific evidence, and intended use factors.
5. Conduct the Clause 8.5.2.3 hazard assessment by scoring likelihood and health severity, identifying significant food safety hazards, and selecting validated control measures to maintain hazards within defined acceptable levels.

Example

A beverage manufacturer producing unpasteurised fruit juice conducts a hazard analysis under Clause 8.5.2.2. The food safety team identifies Escherichia coli as a biological hazard reasonably expected to occur in raw fruit inputs. Statutory regulations mandate zero detectable E. coli in ready-to-drink juices, and customer profiling identifies that children and elderly consumers frequently consume the product. The organization establishes the acceptable level in the end product as absence of E. coli per 25 mL.

During hazard assessment under Clause 8.5.2.3, the severity of health effects is rated as high and the likelihood of raw fruit contamination is rated as moderate, classifying E. coli as a significant food safety hazard. The team selects thermal pasteurisation as a control measure, categorises it as a CCP under Clause 8.5.2.4, and establishes validated critical limits to ensure the acceptable level in the end product is consistently achieved.

Auditor Inspection Criteria and Evidence Matrix

When assessing compliance with Clause 8.5.2.3 and its supporting clauses, auditors evaluate the alignment between hazard identification, legal frameworks, intended use, and operational controls. Internal and external auditors review whether acceptable levels are defined, justified, and effectively linked to operational control measures.

Before your audit

• Check that acceptable end product hazard levels are documented for every biological, chemical, physical, allergen, and radiological hazard identified.
• Confirm that statutory and regulatory requirements from all production and destination countries are identified and incorporated into hazard level determinations.
• Verify that customer contracts and mutually agreed food safety requirements are reconciled with internal acceptable hazard levels.
• Ensure that intended use documentation explicitly details handling instructions, potential product misuse, and vulnerable consumer groups.
• Review hazard assessment records to confirm that likelihood and health severity ratings are documented for every identified hazard.
• Validate that critical limits at CCPs and action criteria for OPRPs are directly linked to maintaining hazard levels within defined acceptable limits.
• Check that verification records, including end product sampling and analytical testing, demonstrate consistent compliance with acceptable levels.

Questions people ask

Must an organization determine acceptable hazard levels for every identified hazard under ISO 22000?

Clause 8.5.2.2.3 mandates that the organization must determine the acceptable level in the end product for each identified food safety hazard whenever possible. The organization is required to maintain documented information concerning the determination and the technical justification for each acceptable level.

How do statutory requirements and intended use influence acceptable hazard levels?

Statutory and regulatory limits, including regulatory food safety objectives, establish mandatory legal maximums that acceptable levels must not exceed. Intended use considerations under Clause 8.5.1.4 evaluate consumer handling, potential product mishandling, and vulnerable populations, requiring stricter acceptable levels when products target susceptible groups such as infants or elderly consumers.

What is the distinction between an acceptable hazard level and a critical limit?

An acceptable level is the maximum hazard threshold permitted in the end product delivered by the organization to ensure food safety. A critical limit is a measurable parameter established at a Critical Control Point to separate acceptable processing conditions from unacceptable conditions, ensuring that the end product acceptable level is not exceeded.

How does hazard assessment determine which hazards require operational control measures?

Under Clause 8.5.2.3, the hazard assessment evaluates each identified hazard based on its likelihood of occurrence prior to control measures and the severity of adverse health effects in relation to intended use. Hazards classified as significant food safety hazards through this assessment must be controlled by control measures managed as Operational Prerequisite Programmes or at Critical Control Points.

Reference documents

• DS/EN ISO 22000:2018, Food safety management systems — Requirements for any organization in the food chain
• DS/ISO 22003-1:2022, Food safety — Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022, Food safety — Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system