Most ISO 22000-certified food safety management systems contain a hazard analysis that was correct when it was written. The PRPs it assumed were in place matched the sector specification at the time \u2014 typically ISO\/TS 22002-1:2009. The oPRPs and CCPs it identified reflected what those PRPs did not cover. The Hazard Control Plan documented the logic. And then the FSSC 22000 V7 hazard analysis baseline changed.<\/p>\n\n\n\n

ISO 22002-100:2025 and ISO 22002-1:2025 \u2014 published in July 2025 \u2014 replace the Technical Specification series that has governed sector PRPs for over fifteen years. When FSSC 22000 Version 7 adopts these as its mandatory PRP reference (expected May 2026, with a 12-month transition), every hazard analysis scoped under the old baseline faces a structural problem: the control environment it assumed no longer matches the control environment the standard requires.<\/p>\n\n\n\n

Call it a documentation update and you will miss the point. It is a scope invalidation \u2014 and the failure point sits at the interface between PRPs, oPRPs, and CCPs in ISO 22000:2018 Clauses 8.2, 8.5.2, and 8.5.4.<\/p>\n\n\n\n

The Three-Clause Chain That Breaks<\/h2>\n\n\n\n

ISO 22000:2018 treats PRPs, hazard analysis, and the Hazard Control Plan as a linked system. Clause 8.2 requires the organisation to establish, implement, and monitor PRPs appropriate to its context, referenced to the applicable sector specification. Clause 8.5.2 requires a hazard analysis that identifies hazards, evaluates them, and selects control measures \u2014 including an explicit determination of which hazards are controlled at PRP level (and therefore excluded from oPRP\/CCP evaluation). Clause 8.5.4 documents the result: the Hazard Control Plan, where each oPRP has defined action criteria and each CCP has defined critical limits, with documented rationale for both.<\/p>\n\n\n\n

The chain works when the PRP baseline is stable. The FSSC 22000 V7 hazard analysis framework makes assumptions about what PRPs control. Those assumptions are valid because the sector PRP specification has not changed. The categorisation logic at Clause 8.5.2.4 \u2014 which assigns control measures to oPRP or CCP tiers using a systematic approach \u2014 produces outputs that reflect the actual control environment.<\/p>\n\n\n\n

When the PRP specification changes materially, every assumption in that chain is subject to revalidation. Not because ISO 22000:2018 explicitly requires rescoping on PRP specification change \u2014 Clause 8.2.4 requires documented information on PRP selection and monitoring but does not mandate re-establishment review when the normative reference is replaced \u2014 but because the hazard analysis scope at Clause 8.5.2 is defined by the control environment it evaluates. Change the environment, and the scope is no longer valid.<\/p>\n\n\n\n

Clause references reflect mapped standard requirements from T1 certification body guidance (NQA, SGS). Verify against current edition before audit use.<\/em><\/p>\n\n\n\n

What ISO 22002:2025 Actually Changes for PRPs<\/h2>\n\n\n\n

The replacement of ISO\/TS 22002-1:2009 with ISO 22002-100:2025 and ISO 22002-1:2025 is not an incremental revision. It is a structural redesign.<\/p>\n\n\n\n

ISO 22002-100:2025 introduces a universal common PRP baseline applicable across all food, feed, and packaging sectors. The sector-specific parts (ISO 22002-1 for food manufacturing, -2 for catering, and so on) now cover only sector-unique requirements. All shared requirements migrate to Part 100. This alone changes the architecture \u2014 organisations previously referencing ISO\/TS 22002-1:2009 as a single document now reference two: Part 100 for common PRPs and Part 1 for manufacturing-specific PRPs.<\/p>\n\n\n\n

Part 100 is where the scope expansion hits. Food fraud mitigation \u2014 previously a VACCP exercise sitting alongside the FSMS, not inside the PRP structure \u2014 enters as a formal PRP requirement, alongside food defence controls against intentional contamination that were previously handled through standalone TACCP programmes. Food safety culture, digital traceability, formalised supplier and contractor approval, and sustainability considerations all appear as PRP-level obligations too \u2014 none of which had a formal home in the 2009 Technical Specification.<\/p>\n\n\n\n

ISO 22002-1:2025, covering food manufacturing specifically, strengthens microbial zoning and segregation requirements and formalises allergen management at higher specificity than the 2009 edition. It no longer repeats common requirements \u2014 it references Part 100 and adds only what is unique to the manufacturing environment.<\/p>\n\n\n\n

The practical consequence for any FSSC 22000 V7 hazard analysis: an organisation that conducted its hazard analysis under the 2009 PRP scope made specific assumptions about what PRPs covered. Food fraud was probably not a PRP. Food defence was probably a standalone programme. Allergen management at the specificity now required may have been handled as an oPRP because no PRP specification formally addressed it at that level. All of those assumptions are now incorrect under the 2025 baseline.<\/p>\n\n\n\n

<\/figure>\n\n\n\n

Three Ways the PRP\u2013Hazard Analysis Interface Breaks<\/h2>\n\n\n\n

The PRP baseline shift creates failure at the categorisation interface \u2014 the Clause 8.5.2.4 decision point where control measures are assigned to PRP, oPRP, or CCP tiers. Three distinct failure scenarios emerge, and all produce audit exposure under FSSC 22000 V7.<\/p>\n\n\n\n

The silent reclassification.<\/strong> The organisation adopts ISO 22002-100:2025 PRPs and moves hazards previously controlled at oPRP level \u2014 food fraud controls, food defence measures \u2014 to the PRP tier. Except the hazard analysis has not been updated. The Hazard Control Plan at Clause 8.5.4 still lists oPRPs for control measures that are now PRP-level. The plan references actions and action criteria for controls that no longer sit at that tier. An auditor tracing from PRP documentation to the Hazard Control Plan finds orphaned oPRPs with no corresponding hazard pathway in the current analysis.<\/p>\n\n\n\n

The missing PRPs.<\/strong> The organisation does not adopt the new PRP categories. Food fraud mitigation, food defence, and the other Part 100 additions simply do not appear in PRP documentation. The hazards that these PRPs are intended to control remain either at oPRP level with outdated justification, or absent from the system entirely. At a V7 recertification audit, the gap between the mandatory PRP specification and the actual PRP programme is immediate and visible.<\/p>\n\n\n\n

The documentation-only update.<\/strong> This is the most common pattern. The organisation updates PRP documentation to reference ISO 22002:2025, changes document headers, and declares the transition complete. But the hazard analysis still contains scope assumptions made under the 2009 baseline. No re-evaluation of Clause 8.5.2 has occurred. No categorisation revalidation at Clause 8.5.2.4 has been performed. The PRP document says 2025. The hazard analysis still thinks it is 2009. The auditor finds the mismatch in minutes.<\/p>\n\n\n\n

What Auditors Already Find \u2014 Before the Baseline Shift<\/h2>\n\n\n\n

The PRP\/oPRP\/CCP categorisation interface is already the dominant failure point in ISO 22000 audits. The baseline shift will amplify existing weaknesses, not create new ones.<\/p>\n\n\n\n

PRP lists disconnected from hazard analysis remain the most documented pattern in certification body guidance. PRPs established at initial certification as standalone documents, with no traceable link from “hazard controlled at PRP level” back to the hazard analysis output. When auditors ask how the hazard analysis accounts for PRP effectiveness, the answer is a reference to a static document that has never been reviewed against the hazard analysis scope. The link was never built. It was assumed.<\/p>\n\n\n\n

Categorisation by convention compounds the problem. Clause 8.5.2.4 requires a documented systematic approach to assign control measures to oPRP or CCP tiers \u2014 evaluating likelihood of control failure, severity of consequence, relationship to other control measures, and measurability of action criteria. Auditors find that CCP\/oPRP assignments were made historically, often inherited from a pre-ISO 22000 HACCP study, without the required assessment. The decision logic is absent or replaced by a generic decision tree not calibrated to the organisation’s actual hazard profile.<\/p>\n\n\n\n

Then there are oPRP action criteria that are not measurable. Clause 8.5.4 requires that oPRP action criteria be measurable or observable, with documented rationale. “Adequate cleaning” is not an action criterion. “Visual inspection confirms no residue on contact surfaces” is. Auditors find the former far more often than the latter.<\/p>\n\n\n\n

PRP monitoring that does not feed back into hazard analysis review closes the loop \u2014 or rather, fails to. Clause 8.2 requires PRP monitoring and effectiveness evidence. Monitoring records exist \u2014 temperature logs, cleaning schedules, pest control reports. But no analysis of trends, no formal effectiveness evaluation, and no documented decision on whether PRP failures should trigger a Clause 8.5.2 review. The feedback loop from PRP performance to hazard analysis scope does not exist in practice.<\/p>\n\n\n\n

Every one of these patterns becomes more consequential when the PRP baseline expands. An organisation that cannot demonstrate PRP-to-hazard-analysis linkage under the old specification will certainly fail to demonstrate it under a specification that adds food fraud, food defence, allergen zoning, and digital traceability to the PRP scope.<\/p>\n\n\n\n

FSSC 22000 V7 Timeline and Transition Window<\/h2>\n\n\n\n

FSSC 22000 Version 7 is expected in May 2026, with a 12-month transition from the publication date. Under V7, the scheme composition becomes: ISO 22000:2018 + ISO 22002:2025 series (Part 100 plus applicable sector part) + FSSC 22000 V7 scheme requirements. The ISO\/TS 22002-x series remains valid only for V6 audits \u2014 once an organisation transitions to V7, only ISO 22002:2025 is the normative PRP reference.<\/p>\n\n\n\n

The V7 scheme requirements document is not yet publicly available. Specific V7 audit protocol details \u2014 including whether hazard analysis rescoping must be demonstrated at surveillance or only at recertification \u2014 have not been published by any certification body as of March 2026. What is clear from the scheme composition is the logical consequence: an auditor conducting a V7 audit will verify that Clause 8.2 PRP documentation references ISO 22002:2025, then trace from PRP scope to hazard analysis at Clause 8.5.2 and to the Hazard Control Plan at Clause 8.5.4. Any break in the chain \u2014 PRPs updated but hazard analysis unchanged, or hazard analysis rescoped but categorisation logic not revalidated \u2014 is a nonconformity against the clauses involved.<\/p>\n\n\n\n

Organisations with recertification audits scheduled in late 2026 or 2027 face the tightest window. The FSSC 22000 V7 hazard analysis rescoping described below is not a weekend exercise \u2014 it requires the food safety team to re-examine every hazard assumption tied to the PRP scope, re-run the categorisation logic, revalidate affected control measures, and update the Hazard Control Plan with revised action criteria and critical limit rationale. Starting after V7 publication leaves insufficient time for organisations with complex process environments.<\/p>\n\n\n\n

<\/figure>\n\n\n\n

Closing the Hazard Analysis Gap Before Recertification<\/h2>\n\n\n\n

The implementation sequence runs in four phases, each gated by the previous.<\/p>\n\n\n\n

Phase 1 \u2014 PRP delta analysis.<\/strong> Before touching the hazard analysis, map the gap between current PRP documentation (referenced to ISO\/TS 22002-1:2009 or equivalent) and ISO 22002-100:2025 plus ISO 22002-1:2025. Identify every new PRP requirement not previously in scope, every requirement that has changed in specificity, and every hazard currently managed as an oPRP that now has a formal PRP baseline under the 2025 specification. Document the delta as a structured gap register \u2014 this becomes the input to hazard analysis rescoping. No certification body has published a gap assessment tool for this step as of March 2026, so organisations will need to build their own or commission one.<\/p>\n\n\n\n

Phase 2 \u2014 Hazard analysis scope review under Clause 8.5.2.<\/strong> Re-examine the hazard analysis to identify every hazard recorded as “controlled by PRP” and verify whether that assumption holds under the new baseline. For each new PRP category introduced by ISO 22002-100:2025 \u2014 food fraud, food defence, digital traceability, strengthened allergen zoning \u2014 determine whether corresponding hazards need to enter the hazard analysis or whether the new PRPs adequately control them with documented justification for exclusion. Update the hazard analysis scope document. Most organisations will discover at this stage that their hazard analysis has never explicitly documented which hazards are assumed PRP-controlled. Clause 8.5.2 requires this documentation. The assumption was invisible while the PRP baseline was stable.<\/p>\n\n\n\n

Phase 3 \u2014 Categorisation revalidation at Clause 8.5.2.4 and 8.5.4.<\/strong> For every oPRP affected by the baseline change, re-apply the systematic assessment: likelihood of control failure, severity of consequence, relationship to other control measures, measurability of action criteria. Reclassify where the assessment demands it. Update the Hazard Control Plan \u2014 revised action criteria rationale for retained oPRPs, revised critical limit rationale for any CCPs affected by the changed PRP environment. The four-factor assessment must be documented, not assumed.<\/p>\n\n\n\n

Phase 4 \u2014 Validation and documented information update.<\/strong> Validate effectiveness of revised control measures at their new classification per Clause 8.5.3. Update documented information required by Clauses 8.2.4 (PRP monitoring and verification), 8.5.4.2 (critical limits and action criteria rationale), and 8.5.4.3 (monitoring systems). The food safety team review at Clause 8.8.1 must formally accept the updated hazard analysis and Hazard Control Plan before the V7 recertification audit. This acceptance is auditable evidence \u2014 without it, the rescoping is incomplete.<\/p>\n\n\n\n

What Remains Unresolved<\/h2>\n\n\n\n

No T1 certification body document maps the delta between ISO\/TS 22002-1:2009 and ISO 22002-1:2025 at the hazard analysis scope level. SGS and Kiwa describe the structural changes, but no clause-level mapping connects ISO 22002:2025 additions to specific Clause 8.5.2 rescoping obligations. Organisations are left to build that mapping themselves.<\/p>\n\n\n\n

The Codex Alimentarius HACCP framework (CXC 1-1969, as revised) does not address PRP integration into hazard analysis scope \u2014 Codex treats hazard analysis primarily as a CCP identification exercise and does not require documented assumptions about PRP-controlled hazards. The FSSC 22000 V7 scheme requirements document, once published, may prescribe specific PRP integration audit criteria beyond what ISO 22000:2018 requires at Clauses 8.2 and 8.5.2 \u2014 but that remains speculation until the document is available.<\/p>\n\n\n\n

What is not speculative: the PRP baseline has changed, the hazard analysis scope is defined by that baseline, and any organisation entering a V7 audit cycle with an unreconstructed FSSC 22000 V7 hazard analysis will face the question that exposes the gap \u2014 “Show me how your hazard analysis accounts for the control environment defined by ISO 22002:2025.” The answer needs to exist before the auditor asks.<\/p>\n\n\n\n

This content is for educational purposes only and does not constitute certification, legal, or regulatory advice. Organizations should consult qualified professionals for implementation specific to their context.<\/em><\/p>\n\n\n\n

About AEC International<\/h2>\n\n\n\n

AEC International provides ISO certification, training, and consultancy services at the intersection of food safety management, HACCP implementation, and GFSI-recognised scheme compliance. We support organisations across the food and beverage industry in achieving and maintaining ISO certification \u2014 from gap analysis<\/a> and implementation through audit preparation and continual improvement.<\/p>\n\n\n\n

Learn more: www.aec.llc<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

ISO 22002:2025 replaces the PRP baseline underpinning most ISO 22000 hazard analyses. When FSSC 22000 V7 mandates the new reference, every unreconstructed hazard analysis faces scope invalidation at the PRP\u2013oPRP\u2013CCP categorisation interface.<\/p>\n","protected":false},"author":1,"featured_media":70,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[29,16,30,12],"class_list":["post-67","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audit-preparation","tag-food-beverage","tag-gap-analysis","tag-iso-22000","tag-risk-management"],"reading_time":"10 min read","_links":{"self":[{"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/posts\/67","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/comments?post=67"}],"version-history":[{"count":1,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/posts\/67\/revisions"}],"predecessor-version":[{"id":71,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/posts\/67\/revisions\/71"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/media\/70"}],"wp:attachment":[{"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/media?parent=67"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/categories?post=67"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aec.llc\/blog\/wp-json\/wp\/v2\/tags?post=67"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}