WHAT RECORDS ARE MANDATORY FOR ISO 22000 CERTIFICATION AUDITS?

The mandatory records required for an ISO 22000 certification audit are not merely compulsory documents; they are evidence proving that the food safety management system is operating effectively, controlling risks efficiently, and fully complying with international audit requirements.

This article provides a comprehensive overview of ISO 22000 audit records from a practical auditing perspective, clarifying the evidence businesses must have to demonstrate food safety control capability.

 1.What do businesses commonly misunderstand about ISO 22000 records?

During ISO 22000 certification preparation, many businesses assume that simply having a “complete set of documents” is enough to pass the audit.

ISO 22000 Audit records for food businesses

However, in reality, audits do not only check whether records exist or not. Auditors will evaluate:
• Whether the system is actually operating
• Whether the records can demonstrate effective food safety control
• Whether the entire production process can be fully traced

Therefore, the right question is not “how many records are there,” but “which records are mandatory to prove the system complies with the standard.”

2.Mandatory record groups for ISO 22000 certification audits

ISO 22000 audit records are divided into 4 mandatory groups based on audit logic.

Group 1: System establishment documents (System Documents)

This is the foundational document group proving that the business has established a food safety management system.

Mandatory documents include:
• Food safety policy
• Scope of the system
• Food safety objectives
• Organizational structure and responsibilities
• Document and record control procedures

Without this group, the system is considered “not fully designed.”

Group 2: HACCP records and hazard control (Core System)

This is the most important part of ISO 22000.

Mandatory records include:
• Hazard Analysis
• HACCP Plan
• Identification of CCPs and OPRPs
• Critical Limits
• CCP/OPRP monitoring plans

Auditors typically spend 70% of the audit time on this group because it determines the level of food safety control.

Group 3: Operational records

This is the most critical group in determining whether the company “passes or fails” the audit.

Mandatory records include:
• CCP/OPRP monitoring logs
• Sanitation records (SSOP)
• Incoming material control records
• Batch production records
• Equipment maintenance records
• Employee training records

Key point: records must contain real-time operational data and must not be recreated before the audit.

Group 4: System evaluation & Improvement records

This group demonstrates that the system is capable of “self-control and continuous improvement.”

Mandatory records include:
• Internal audit reports
• Management review meeting minutes
• Food safety incident handling records
• Corrective action records
• Continuous improvement records

This group reflects a “living system,” not just a paperwork system.

3.Expert perspective: Why do businesses still receive NCs despite having enough records?

In actual ISO 22000 record audits, the problem is often not “missing records,” but rather:

Issue 1. Records are not linked into a complete chain
There is no traceability from raw materials → production → finished products.

Issue 2. No evidence of continuous operation
Records are inconsistent or prepared only for audit purposes.

Issue 3. CCPs exist but lack real monitoring data
The controls are established but not actually implemented.

Issue 4. No records of deviation handling
The system cannot demonstrate response capability.

4.Quick checklist of mandatory ISO 22000 records

Businesses can self-review ISO 22000 audit records using the following checklist:

✔ System Documentation Group
• Food safety policy
• System scope
• Quality objectives
• Document control procedures

✔ HACCP Group
• Hazard analysis
• Clearly defined CCPs/OPRPs
• Monitoring plans

✔ Operational Group
• CCP/OPRP logs
• Sanitation records
• Batch production records
• Training records

✔ Improvement Group
• Internal audits
• Management reviews
• Corrective actions

5.“Mandatory” is not just a list — It is system logic

In ISO 22000, records are not simply required documents; they are evidence proving that the business can effectively control food safety in actual operations.

Therefore, mandatory records are not meant to “complete a set,” but to answer three critical questions:
• Is risk effectively controlled?
• Is the system actually operating?
• Is there continuous improvement?

Does your business need to review or establish an ISO 22000 audit record system to ensure certification success on the first attempt?

👉 Contact NAPHA for an expert assessment and guidance in building an audit-ready documentation system, helping you avoid common certification audit mistakes.

CONTACT FOR FREE CONSULTING VIA HOTLINE: 0938.161.564

NAPHA CONSULTING CO., LTD

Địa chỉ:  3 Floor, An Phu Plaza, 117 - 119 Ly Chinh Thang Street, District 3, HCMC
Email: tuvannapha@gmail.com