Tuesday, September 30, 2014

ISO 22000: Externally Developed Combination of Control Measures in Food Safety

Externally Developed Control Measures 


Externally developed combinations of control measures are being created for many segments of the food chain in a wide variety of countries. This work has been done by industry associations, colleges and universities or in some cases, by governments as an aid to small food businesses where industry needs expert knowledge which is lacking in their organizations.  Intergovernmental organizations such as the Food and Agriculture Organization of the United Nations (FAO) have also done some work in this area. There are many examples of such programmes for primary production and some for small processors, packers and distributors, truckers, retailers and food service operators.

In this regard, ISO 22000 allows a small and/or less developed organization at any stage of the supply chain (e.g. a farm, a packer-distributor, a processor, a transporter, a retail or food service outlet) to implement an externally developed combination of control measures. This permits an organization to choose between developing its own control measures or using one of the developed food safety system by an industry association, government agency, university, etc., while customizing it according to the requirements of the company. The option of using an externally developed combination of control measures is important for a small and/or less developed organization, because small organizations may not have the scale or the resources required to undertake the hazard assessment and hazard analysis required by ISO 22000 to develop a site-specific food safety management system which basically affect their business if the organization mostly depends on the export market or with few specific buyers or a buyer. In such instances, it is much easier for a company to look out to get a consultant’s help as well as to use externally developed food safety measures to control the food safety.  ISO 22000 states that externally developed combinations of control measures must have been developed as specified. Not all the currently available programmes will meet this requirement, nor have all of them been developed using HACCP principles.

An externally developed combination of control measures to meet the requirements of ISO 22000 must be developed in compliance with exact  requirements in the given food business. In particular, the external body must demonstrate that it has followed the steps set out in respecting the hazard assessment, hazard analysis and selection of control measures outlined in the standard.

ISO 22000 sets out the steps for the development of a food safety management system. Those dealing with the development of control measures are detailed in Clause 7 of ISO 22000. They are particularly rigorous. Organizations that seek to provide generic combinations of control measures for specific segments of the supply chain (e.g. vegetable farmers or truckers or small poultry processing facilities, black tea manufacturers) must show that they have complied with these requirements.

These organizations need to make available to other organization, and to any third-party auditors, detailed information about:
  1. The food safety team and the competence of team members;
  2. The scope of the combination of control measures;
  3. Product characteristics (e.g. raw materials, ingredients and product contact materials) as well as the end product characteristics and intended use;
  4. Generic flow diagrams and site schematics;
  5. Descriptions of process steps and control measures;
  6. Details of the hazards identified and their acceptable limits;
  7. Hazard assessment;
  8. Selection of the control measures;
  9. Prerequisite programes, including both those -initially selected and those determined by the hazard analysis;
  10. Operational prerequisite programes;
  11. Critical control points and their critical limits, etc.;
  12. Program elements concerning control of non-conformist, verification, etc.;
  13. Results of validations 


An external organization providing a commodity or segment-specific combination of control measures is taking on a long-term obligation. Just as an organization developing its own control measures which must have in place a process for evaluating effectiveness and updating the system, whereas the external organization must have same specific controls.

Externally developed combinations of control measures will have been established using a generic model (e.g. a set of facilities, processes, operational circumstances, etc.) which reflects the most likely situations for a small organization producing the specified products. As a result, the control measures will require adaptation to your organization and its operations.

Small organization must adapt any externally developed combination of control measures to the specific processes in the given organization. The control measures will have been developed based on certain assumptions which should be clearly stated in the material provided to that organization. The organization’s food safety team needs to review these control measures in detail to determine whether or not they correspond to the circumstances within organization. For example, the team must review the process flow diagram and conduct an on-site verification to identify any significant differences that might result in new hazards entering generic system or require changes to control measures (PRPs, operational PRPs and CCPs). The organization also need to take into account the differences between regulatory or customer requirements in the generic model and the requirements applicable to company’s operation. The process of adopting and then adapting an externally developed combination of control measures is not simply one of following the “guide”. Company’s food safety team needs to assure itself that the guide’s recommendations fit to the organization’s circumstances. Company’s food safety team should document the review and provide records that demonstrate it has undertaken the required comparisons, made the necessary changes, etc. If the company uses an externally developed combination of control measures, the organization will have to demonstrate that such measures have been implemented and are being operated in accordance with all the other requirements of ISO 22000.


The implementation of an externally developed combination of control measures is in principle and practice no different than implementing a set of control measures developed internally. For example, the organization needs to undertake training, monitoring and verification activities, as well as engage in the evaluation and updating of the food safety management system. An externally developed combination of control measures reduces the burden of the development phase but does not limit the given organization’s responsibility and accountability for implementation of the food safety management system.

No comments:

Post a Comment