Most ISO 22000-certified food safety management systems contain a hazard analysis that was correct when it was written. The PRPs it assumed were in place matched the sector specification at the time β typically ISO/TS 22002-1:2009. The oPRPs and CCPs it identified reflected what those PRPs did not cover. The Hazard Control Plan documented the logic. And then the FSSC 22000 V7 hazard analysis baseline changed.
ISO 22002-100:2025 and ISO 22002-1:2025 β published in July 2025 β replace the Technical Specification series that has governed sector PRPs for over fifteen years. When FSSC 22000 Version 7 adopts these as its mandatory PRP reference (expected May 2026, with a 12-month transition), every hazard analysis scoped under the old baseline faces a structural problem: the control environment it assumed no longer matches the control environment the standard requires.
Call it a documentation update and you will miss the point. It is a scope invalidation β and the failure point sits at the interface between PRPs, oPRPs, and CCPs in ISO 22000:2018 Clauses 8.2, 8.5.2, and 8.5.4.
The Three-Clause Chain That Breaks
ISO 22000:2018 treats PRPs, hazard analysis, and the Hazard Control Plan as a linked system. Clause 8.2 requires the organisation to establish, implement, and monitor PRPs appropriate to its context, referenced to the applicable sector specification. Clause 8.5.2 requires a hazard analysis that identifies hazards, evaluates them, and selects control measures β including an explicit determination of which hazards are controlled at PRP level (and therefore excluded from oPRP/CCP evaluation). Clause 8.5.4 documents the result: the Hazard Control Plan, where each oPRP has defined action criteria and each CCP has defined critical limits, with documented rationale for both.
The chain works when the PRP baseline is stable. The FSSC 22000 V7 hazard analysis framework makes assumptions about what PRPs control. Those assumptions are valid because the sector PRP specification has not changed. The categorisation logic at Clause 8.5.2.4 β which assigns control measures to oPRP or CCP tiers using a systematic approach β produces outputs that reflect the actual control environment.
When the PRP specification changes materially, every assumption in that chain is subject to revalidation. Not because ISO 22000:2018 explicitly requires rescoping on PRP specification change β Clause 8.2.4 requires documented information on PRP selection and monitoring but does not mandate re-establishment review when the normative reference is replaced β but because the hazard analysis scope at Clause 8.5.2 is defined by the control environment it evaluates. Change the environment, and the scope is no longer valid.
Clause references reflect mapped standard requirements from T1 certification body guidance (NQA, SGS). Verify against current edition before audit use.
What ISO 22002:2025 Actually Changes for PRPs
The replacement of ISO/TS 22002-1:2009 with ISO 22002-100:2025 and ISO 22002-1:2025 is not an incremental revision. It is a structural redesign.
ISO 22002-100:2025 introduces a universal common PRP baseline applicable across all food, feed, and packaging sectors. The sector-specific parts (ISO 22002-1 for food manufacturing, -2 for catering, and so on) now cover only sector-unique requirements. All shared requirements migrate to Part 100. This alone changes the architecture β organisations previously referencing ISO/TS 22002-1:2009 as a single document now reference two: Part 100 for common PRPs and Part 1 for manufacturing-specific PRPs.
Part 100 is where the scope expansion hits. Food fraud mitigation β previously a VACCP exercise sitting alongside the FSMS, not inside the PRP structure β enters as a formal PRP requirement, alongside food defence controls against intentional contamination that were previously handled through standalone TACCP programmes. Food safety culture, digital traceability, formalised supplier and contractor approval, and sustainability considerations all appear as PRP-level obligations too β none of which had a formal home in the 2009 Technical Specification.
ISO 22002-1:2025, covering food manufacturing specifically, strengthens microbial zoning and segregation requirements and formalises allergen management at higher specificity than the 2009 edition. It no longer repeats common requirements β it references Part 100 and adds only what is unique to the manufacturing environment.
The practical consequence for any FSSC 22000 V7 hazard analysis: an organisation that conducted its hazard analysis under the 2009 PRP scope made specific assumptions about what PRPs covered. Food fraud was probably not a PRP. Food defence was probably a standalone programme. Allergen management at the specificity now required may have been handled as an oPRP because no PRP specification formally addressed it at that level. All of those assumptions are now incorrect under the 2025 baseline.
Three Ways the PRPβHazard Analysis Interface Breaks
The PRP baseline shift creates failure at the categorisation interface β the Clause 8.5.2.4 decision point where control measures are assigned to PRP, oPRP, or CCP tiers. Three distinct failure scenarios emerge, and all produce audit exposure under FSSC 22000 V7.
The silent reclassification. The organisation adopts ISO 22002-100:2025 PRPs and moves hazards previously controlled at oPRP level β food fraud controls, food defence measures β to the PRP tier. Except the hazard analysis has not been updated. The Hazard Control Plan at Clause 8.5.4 still lists oPRPs for control measures that are now PRP-level. The plan references actions and action criteria for controls that no longer sit at that tier. An auditor tracing from PRP documentation to the Hazard Control Plan finds orphaned oPRPs with no corresponding hazard pathway in the current analysis.
The missing PRPs. The organisation does not adopt the new PRP categories. Food fraud mitigation, food defence, and the other Part 100 additions simply do not appear in PRP documentation. The hazards that these PRPs are intended to control remain either at oPRP level with outdated justification, or absent from the system entirely. At a V7 recertification audit, the gap between the mandatory PRP specification and the actual PRP programme is immediate and visible.
The documentation-only update. This is the most common pattern. The organisation updates PRP documentation to reference ISO 22002:2025, changes document headers, and declares the transition complete. But the hazard analysis still contains scope assumptions made under the 2009 baseline. No re-evaluation of Clause 8.5.2 has occurred. No categorisation revalidation at Clause 8.5.2.4 has been performed. The PRP document says 2025. The hazard analysis still thinks it is 2009. The auditor finds the mismatch in minutes.
What Auditors Already Find β Before the Baseline Shift
The PRP/oPRP/CCP categorisation interface is already the dominant failure point in ISO 22000 audits. The baseline shift will amplify existing weaknesses, not create new ones.
PRP lists disconnected from hazard analysis remain the most documented pattern in certification body guidance. PRPs established at initial certification as standalone documents, with no traceable link from “hazard controlled at PRP level” back to the hazard analysis output. When auditors ask how the hazard analysis accounts for PRP effectiveness, the answer is a reference to a static document that has never been reviewed against the hazard analysis scope. The link was never built. It was assumed.
Categorisation by convention compounds the problem. Clause 8.5.2.4 requires a documented systematic approach to assign control measures to oPRP or CCP tiers β evaluating likelihood of control failure, severity of consequence, relationship to other control measures, and measurability of action criteria. Auditors find that CCP/oPRP assignments were made historically, often inherited from a pre-ISO 22000 HACCP study, without the required assessment. The decision logic is absent or replaced by a generic decision tree not calibrated to the organisation’s actual hazard profile.
Then there are oPRP action criteria that are not measurable. Clause 8.5.4 requires that oPRP action criteria be measurable or observable, with documented rationale. “Adequate cleaning” is not an action criterion. “Visual inspection confirms no residue on contact surfaces” is. Auditors find the former far more often than the latter.
PRP monitoring that does not feed back into hazard analysis review closes the loop β or rather, fails to. Clause 8.2 requires PRP monitoring and effectiveness evidence. Monitoring records exist β temperature logs, cleaning schedules, pest control reports. But no analysis of trends, no formal effectiveness evaluation, and no documented decision on whether PRP failures should trigger a Clause 8.5.2 review. The feedback loop from PRP performance to hazard analysis scope does not exist in practice.
Every one of these patterns becomes more consequential when the PRP baseline expands. An organisation that cannot demonstrate PRP-to-hazard-analysis linkage under the old specification will certainly fail to demonstrate it under a specification that adds food fraud, food defence, allergen zoning, and digital traceability to the PRP scope.
FSSC 22000 V7 Timeline and Transition Window
FSSC 22000 Version 7 is expected in May 2026, with a 12-month transition from the publication date. Under V7, the scheme composition becomes: ISO 22000:2018 + ISO 22002:2025 series (Part 100 plus applicable sector part) + FSSC 22000 V7 scheme requirements. The ISO/TS 22002-x series remains valid only for V6 audits β once an organisation transitions to V7, only ISO 22002:2025 is the normative PRP reference.
The V7 scheme requirements document is not yet publicly available. Specific V7 audit protocol details β including whether hazard analysis rescoping must be demonstrated at surveillance or only at recertification β have not been published by any certification body as of March 2026. What is clear from the scheme composition is the logical consequence: an auditor conducting a V7 audit will verify that Clause 8.2 PRP documentation references ISO 22002:2025, then trace from PRP scope to hazard analysis at Clause 8.5.2 and to the Hazard Control Plan at Clause 8.5.4. Any break in the chain β PRPs updated but hazard analysis unchanged, or hazard analysis rescoped but categorisation logic not revalidated β is a nonconformity against the clauses involved.
Organisations with recertification audits scheduled in late 2026 or 2027 face the tightest window. The FSSC 22000 V7 hazard analysis rescoping described below is not a weekend exercise β it requires the food safety team to re-examine every hazard assumption tied to the PRP scope, re-run the categorisation logic, revalidate affected control measures, and update the Hazard Control Plan with revised action criteria and critical limit rationale. Starting after V7 publication leaves insufficient time for organisations with complex process environments.
Closing the Hazard Analysis Gap Before Recertification
The implementation sequence runs in four phases, each gated by the previous.
Phase 1 β PRP delta analysis. Before touching the hazard analysis, map the gap between current PRP documentation (referenced to ISO/TS 22002-1:2009 or equivalent) and ISO 22002-100:2025 plus ISO 22002-1:2025. Identify every new PRP requirement not previously in scope, every requirement that has changed in specificity, and every hazard currently managed as an oPRP that now has a formal PRP baseline under the 2025 specification. Document the delta as a structured gap register β this becomes the input to hazard analysis rescoping. No certification body has published a gap assessment tool for this step as of March 2026, so organisations will need to build their own or commission one.
Phase 2 β Hazard analysis scope review under Clause 8.5.2. Re-examine the hazard analysis to identify every hazard recorded as “controlled by PRP” and verify whether that assumption holds under the new baseline. For each new PRP category introduced by ISO 22002-100:2025 β food fraud, food defence, digital traceability, strengthened allergen zoning β determine whether corresponding hazards need to enter the hazard analysis or whether the new PRPs adequately control them with documented justification for exclusion. Update the hazard analysis scope document. Most organisations will discover at this stage that their hazard analysis has never explicitly documented which hazards are assumed PRP-controlled. Clause 8.5.2 requires this documentation. The assumption was invisible while the PRP baseline was stable.
Phase 3 β Categorisation revalidation at Clause 8.5.2.4 and 8.5.4. For every oPRP affected by the baseline change, re-apply the systematic assessment: likelihood of control failure, severity of consequence, relationship to other control measures, measurability of action criteria. Reclassify where the assessment demands it. Update the Hazard Control Plan β revised action criteria rationale for retained oPRPs, revised critical limit rationale for any CCPs affected by the changed PRP environment. The four-factor assessment must be documented, not assumed.
Phase 4 β Validation and documented information update. Validate effectiveness of revised control measures at their new classification per Clause 8.5.3. Update documented information required by Clauses 8.2.4 (PRP monitoring and verification), 8.5.4.2 (critical limits and action criteria rationale), and 8.5.4.3 (monitoring systems). The food safety team review at Clause 8.8.1 must formally accept the updated hazard analysis and Hazard Control Plan before the V7 recertification audit. This acceptance is auditable evidence β without it, the rescoping is incomplete.
What Remains Unresolved
No T1 certification body document maps the delta between ISO/TS 22002-1:2009 and ISO 22002-1:2025 at the hazard analysis scope level. SGS and Kiwa describe the structural changes, but no clause-level mapping connects ISO 22002:2025 additions to specific Clause 8.5.2 rescoping obligations. Organisations are left to build that mapping themselves.
The Codex Alimentarius HACCP framework (CXC 1-1969, as revised) does not address PRP integration into hazard analysis scope β Codex treats hazard analysis primarily as a CCP identification exercise and does not require documented assumptions about PRP-controlled hazards. The FSSC 22000 V7 scheme requirements document, once published, may prescribe specific PRP integration audit criteria beyond what ISO 22000:2018 requires at Clauses 8.2 and 8.5.2 β but that remains speculation until the document is available.
What is not speculative: the PRP baseline has changed, the hazard analysis scope is defined by that baseline, and any organisation entering a V7 audit cycle with an unreconstructed FSSC 22000 V7 hazard analysis will face the question that exposes the gap β “Show me how your hazard analysis accounts for the control environment defined by ISO 22002:2025.” The answer needs to exist before the auditor asks.
This content is for educational purposes only and does not constitute certification, legal, or regulatory advice. Organizations should consult qualified professionals for implementation specific to their context.
About AEC International
AEC International provides ISO certification, training, and consultancy services at the intersection of food safety management, HACCP implementation, and GFSI-recognised scheme compliance. We support organisations across the food and beverage industry in achieving and maintaining ISO certification β from gap analysis and implementation through audit preparation and continual improvement.
Learn more: www.aec.llc