ISO 22000:2018 sets out the requirements for a food safety management system applicable to any organisation in the food chain. In a winery or a food business, that system must integrate prerequisite programmes, hazard analysis, operational control, traceability, withdrawal, communication and continual improvement. Certification does not replace health authorisations, official registrations, PDO/PGI designations or customer-specific requirements.
Scope
The first step is to define the products, processes, sites and activities covered by the system. Dependencies must also be included: raw materials, water, packaging, cleaning, laboratory, storage, transport and subcontractors.
In Castilla y León, the applicable health authorisations or notifications and registrations must be reviewed according to the company's activity.
Food safety team
The food safety team must be multidisciplinary and include representation from:
- Production.
- Quality.
- Maintenance.
- Purchasing.
- Laboratory.
- Logistics.
- Management.
Each member's competence and responsibility are documented, along with who acts as team leader.
Prerequisite programmes
Before tackling HACCP, the prerequisite programmes (PRPs) must be in place:
- Cleaning and disinfection.
- Pest control.
- Maintenance.
- Personnel hygiene.
- Water.
- Waste.
- Suppliers.
- Allergens.
- Storage.
- Transport.
- Contamination prevention.
- Traceability.
PRPs must be adapted to the sector and verified periodically.
Product description
For each product family, the following are documented:
- Ingredients.
- Characteristics.
- Treatment.
- Packaging.
- Shelf life.
- Storage.
- Distribution.
- Intended use.
- Sensitive population.
For wine, this covers the grape or must, additives, allergens, the process, bottling and storage conditions.
Flow diagram
The diagram must show reception, storage, production, treatments, racking, ageing, bottling, dispatch and rework. The team verifies it physically by walking the facility: it is not designed from the office without checking it on site.
Hazard analysis
Biological, chemical and physical hazards, as well as allergens, are identified at each stage. Their likelihood and severity are assessed and control measures are determined. Points to consider include:
- Residues and contaminants.
- Foreign bodies.
- Cleaning products.
- Lubricants.
- Glass.
- Allergens.
- Pests.
- Fraud or substitution when it affects safety.
- Suppliers.
OPRPs and CCPs
ISO 22000 distinguishes between controls managed as operational prerequisite programmes (OPRPs) or as critical control points (CCPs), depending on the outcome of the analysis. Each one requires:
- Hazard.
- Control measure.
- Limit or criterion.
- Monitoring.
- Person responsible.
- Correction.
- Record.
- Verification.
Controls should not be classified as CCPs out of habit, but based on the actual hazard analysis.
Traceability
It must be possible to link:
- Supplier and batch.
- Reception.
- Process and tank.
- Materials.
- Final batch.
- Customers.
- Quantities.
A mass balance and a withdrawal drill are carried out. Traceability must work within a target time.
Suppliers
Supplier approval considers risk, specification, certificates, history, analyses and changes. Critical suppliers are reassessed periodically.
A supplier's certificate does not replace the company's own checks on reception.
Allergens and labelling
Allergens, segregation, cleaning, formulation and the corresponding declaration are identified. Ingredient or label changes must go through an approval process.
Label review covers the batch, date, operator, ingredients, allergens and applicable specific requirements.
Emergencies
Scenarios to consider include:
- Water contamination.
- Refrigeration failure.
- Spillage.
- Glass.
- Supplier alert.
- Power outage.
- Fire.
- Product withdrawal.
- Laboratory unavailability.
Every emergency plan must be tested.
Communication
Communication must run both internally and externally, with suppliers, customers, authorities and the certification body. Changes affecting hazards must be communicated: formulation, process, equipment, supplier or legislation.
Verification and validation
Control measures must be validated to confirm they can control the hazards before being applied, and their operation must be verified through audits, sampling, record review, calibrations and analysis. Validation and verification are not the same thing.
Calibration and maintenance
Measuring equipment must have an inventory, calibration frequency, traceability and a procedure for handling deviations. Preventive maintenance avoids contamination and failures.
Non-conformities and withdrawal
Potentially unsafe product is identified, held, assessed and disposed of. Withdrawal covers the decision, communication, recovery and reconciliation of quantities.
The withdrawal drill is tested at least as often as established, seeking to improve response times.
Integration with ISO 9001
The harmonised high-level structure allows context, documentation, audits and management review to be shared with ISO 9001. HACCP and the specific food safety controls, however, remain unique to ISO 22000.
Certification
The certification body assesses the system and how it actually operates. If customers require a scheme recognised by the GFSI, it may be necessary to opt for FSSC 22000 or another recognised scheme, such as IFS or BRC; ISO 22000 on its own does not always satisfy that commercial requirement.
120-day plan
Days 1-30
Scope, team, PRPs and requirements.
Days 31-60
Product, flow and hazards.
Days 61-90
Controls, traceability, emergency response and training.
Days 91-120
Audit, drill, review and certification.
Common mistakes
- Starting with HACCP without PRPs in place.
- Copying generic hazards without adapting them to your own process.
- Not verifying the flow diagram on site.
- Too many critical control points.
- Not carrying out a mass balance of the batches.
- Relying solely on supplier certificates.
- Not controlling label changes.
- Confusing validation with verification.
- Not testing the product withdrawal.
- Ignoring local health authorisations.
Checklist
- Scope and registrations defined.
- Competent team.
- PRPs verified.
- Product and flow documented.
- Hazards identified.
- OPRPs/CCPs established.
- Traceability tested.
- Suppliers approved.
- Emergencies and withdrawal tested.
- Audit and management review carried out.
Frequently asked questions
Does ISO 22000 replace HACCP?
No. It integrates HACCP within the food safety management system.
Does it apply to wineries?
Yes, as an organisation in the food chain, adapting the hazard analysis and processes to winemaking activity.
Is it equivalent to FSSC 22000?
No. FSSC 22000 is a scheme that incorporates ISO 22000 and adds further requirements recognised by the GFSI.
Sources
- ISO: ISO 22000.
- FSSC 22000.
- Junta de Castilla y León: health authorisation (official source, in Spanish).
- Junta de Castilla y León: register of food business activities, RAAL (official source, in Spanish).
Summum Calidad can support the implementation of ISO 22000 for PRPs, HACCP, traceability, audit and certification.