ISO 22000 allergen control requires businesses to embed allergen management into their food safety management system rather than treating it as a standalone programme. ISO 22000 is a globally recognised standard designed to boost food safety management throughout the entire food supply chain[30]. The framework integrates ISO 22000 standards with HACCP principles and sector-specific prerequisite programmes to create a complete approach[31][30]. In fact, allergen management is a critical component that focuses on preventing unintended allergen presence, which can pose serious health risks to consumers[32]. This piece gets into how organisations integrate ISO 22000 allergen management requirements into their FSMS and meet certification expectations.
What Is ISO 22000:2018 and Why Does Allergen Control Matter?
“undeclared allergens in food products now accounts for over half of all food recalls in the UK according to The Food Standards Agency” — The Food Standards Agency, Government agency responsible for food safety
The Role of Allergen Management in Food Safety
Food allergies affect millions globally, with 44% of British adults suffering from at least one allergy[33]. Reactions range from mild symptoms such as skin irritation and itching to severe anaphylactic shock that requires immediate medical care[34]. Even trace amounts of allergenic proteins can trigger responses in sensitive individuals. This makes allergen control fundamentally different from managing microbial contamination[34].
Undeclared allergens have become a leading cause of food recalls worldwide and account for nearly half of all product withdrawals in recent years[35]. This pattern holds across jurisdictions. Cross-contact during processing, inadequate cleaning protocols, or labelling errors drive it. The only protective measure available to consumers managing food allergies is avoidance. This places absolute responsibility on food businesses to prevent unintended allergen presence and provide accurate declarations[36].
The international standard for food safety management systems, ISO 22000, classifies allergens as food safety hazards that require systematic control[37]. Organisations implementing ISO 22000 allergen management must address these risks through their FSMS rather than treating allergen control as a separate compliance exercise.
ISO 22000 as a Framework for Allergen Control
ISO 22000:2018 provides a complete framework for businesses in the food chain of all types to establish, implement, and maintain food safety management systems[3]. The standard combines core elements from ISO 9001 quality management with HACCP principles and creates a blended approach to food safety[3]. This structure applies to any organisation involved in the food supply chain, from feed producers and primary producers through manufacturers, transport operators, retailers, and food service outlets[3].
The framework requires organisations to meet applicable statutory and regulatory food safety requirements. They must also develop proactive, systematic controls for identified hazards[3]. ISO 22000 enables businesses to address allergen risks at multiple control levels by blending prerequisite programmes (PRPs) with operational prerequisite programmes (oPRPs) and critical control points (CCPs)[38].
The 2018 revision adopted ISO’s High Level Structure, which is the most important advantage. This enables compatibility with other management system standards including ISO 9001, ISO 14001, and ISO 45001[1]. The standard also incorporates two interrelated PDCA cycles covering both the FSMS itself and product production processes based on Codex HACCP principles[1]. This structure allows organisations to apply risk thinking at both organisational and operational levels. They can establish controls to minimise adverse effects and take advantage of food safety opportunities[1].
ISO 22000 emphasises communication throughout the supply chain for allergen control. This ensures hazards are identified and controlled at every stage[38]. The standard distinguishes between PRPs (maintaining hygiene standards such as sanitation and pest control) and oPRPs (controlling food safety hazards at critical points). It provides clear guidance for implementing allergen measures[38].
How ISO 22000 Differs from Stand-Alone HACCP
HACCP focuses on hazard analysis and critical control points for product safety. ISO 22000 provides a broader management system framework[38]. HACCP addresses the technical aspects of identifying hazards, determining critical control points, and implementing preventive measures at operational level. Standalone HACCP systems may lack the organisational infrastructure, documentation requirements, and continual improvement mechanisms embedded within ISO 22000 because of this focused approach[38].
ISO 22000 incorporates HACCP principles and adds management system requirements including leadership commitment, resource allocation, internal communication protocols, and performance evaluation[38]. This integration ensures allergen control receives organisational support beyond operational procedures. The standard requires monitoring of oPRPs and CCPs, corrective actions for non-conformities, regular audits, and continuous updates based on risk assessments[38].
ISO 22000 treats food safety as an organisational priority rather than solely a production concern. It establishes accountability structures and verification processes that extend throughout the business.
Where Does Allergen Management Fit Within an FSMS?
Allergen Control Across ISO 22000 Clauses
Allergen management within ISO 22000 operates through a three-tier control structure that determines how different allergen risks are addressed throughout the FSMS. This layered approach shows the difference between basic hygiene conditions, process-specific controls, and critical safety points based on the severity and likelihood of allergen hazards.
PRPs and Allergen-Specific Hygiene Practises
Food allergen risks are controlled through prerequisite programmes within ISO 22000 food safety management systems[39]. These programmes establish the conditions and measures needed to prevent and minimise allergen cross-contact[39]. PRPs represent the foundational layer and address general hygiene practises that apply broadly in operations of all types rather than at specific process steps.
The core team relies on key PRPs for allergen management that include supplier approval and assurance, allergen segregation and zoning, cleaning and sanitation, personnel hygiene and training, transport and storage controls, and rework management[39]. PRPs can control allergens based on two approaches: keeping allergens out of the premises through resilient supplier control or implementing strict measures to minimise cross-contamination[40].
PRPs have a characteristic feature. Their failure does not lead to immediate and imminent food safety risk[41]. A prolonged period and repeated failures are needed to shift product safety by a lot[41]. To cite an instance, cleaning and sanitising are activities that can apply to all steps, rooms, items and building fabric[41].
Operational PRPs (oPRPs) for Allergen Cross-Contact Prevention
Operational prerequisite programmes represent process-specific controls identified through hazard analysis as needed to control significant allergens[42]. oPRPs focus on preventing the introduction of food safety hazards in the product or processing environment at defined steps or lines, unlike general PRPs[42].
Allergen control in bakeries and confectionery provides concrete examples: validated changeover cleaning between allergen recipes, label verification checks before packaging, and dedicated utensils for allergen-containing products[42]. An oPRP is a particular action linked to the process that plays an indispensable role in mitigating the likelihood of a specific hazard’s occurrence, although not critical for food safety in the CCP sense[41].
Common oPRP applications include allergen changeover cleaning verification in bakeries producing both peanut and peanut-free products[42]. These controls are applied to specific production scenarios where allergen cross-contact risk requires targeted intervention beyond general hygiene practises.
HACCP-Based Hazard Analysis and CCPs for Allergens
Critical control points represent steps where control must be implemented to prevent, eliminate, or reduce a food safety hazard to an acceptable level[41]. Allergens can be controlled as CCPs, but they are more often managed through PRPs and oPRPs given the nature of cross-contact prevention.
The difference between oPRP and CCP classification depends on process risk and documented justification in the hazard assessment[42]. The same control measure may be categorised as CCP or oPRP depending on how the hazard analysis evaluates severity and control capability[42]. A risk assessment determines whether the hazard is significant and requires designation as a CCP after specific hazards are identified at a process step[41].
How Does ISO 22000:2018 Address Allergen Control?
The standard’s clause structure provides a systematic pathway for embedding allergen control throughout organisational operations. Each clause serves a specific function in building and maintaining allergen management capabilities within the broader FSMS framework.
Clause 4: Understanding Allergen Risks in Context
Organisations must identify internal and external factors that affect their ability to achieve food safety objectives before implementing allergen controls[43]. This contextual understanding forms the foundation for a resilient FSMS. Production equipment design, facility layout, or ingredient handling procedures that affect allergen segregation capability might be internal factors. Regulatory requirements for allergen declaration, customer specifications for allergen-free products, and supplier allergen management practises cover external factors[44].
Businesses must determine which interested parties are relevant to the FSMS and understand their allergen-related requirements and expectations[45]. A bakery producing gluten-free products faces different allergen risks than a multi-line facility processing nuts, dairy, and soy-based ingredients at the same time[44]. The contextual analysis establishes whether allergen management focuses on complete exclusion, controlled presence with accurate labelling, or prevention of cross-contact between product streams.
Clause 5: Leadership Commitment to Allergen Safety
Top management accountability drives effective allergen control implementation. Clause 5 requires leaders to establish food safety policies, allocate adequate resources, and demonstrate visible commitment to allergen management[46]. Leadership responsibilities extend beyond delegating tasks to quality departments. They involve strategic decisions about equipment investment, facility modifications, and personnel allocation that affect allergen control capability[44].
Management must appoint a food safety team leader who coordinates FSMS implementation and makes sure allergen risks receive appropriate attention during hazard analysis[44]. Consistent leadership engagement is required to build a safety-focused culture where employees understand the serious health consequences of allergen cross-contact[46]. Therefore, staff awareness and adherence to protocols improve by a lot at the time management treats allergen control as a strategic priority rather than regulatory compliance activity.
Clause 6: Planning and Allergen Risk Assessment
Risk-based thinking underpins allergen management planning within ISO 22000. Organisations must identify risks and opportunities that could affect FSMS effectiveness and take actions to address them[45]. Allergen risk assessment thinks about potential scenarios: supplier ingredient substitutions introducing undeclared allergens, equipment failures compromising cleaning effectiveness, or production scheduling errors causing allergen carryover between batches[47].
The planning process establishes measurable food safety objectives specific to allergen control, such as validated cleaning protocols for all allergen changeovers or zero customer complaints related to undeclared allergens[44]. These objectives must line up with broader organisational strategy and receive sufficient resource allocation to achieve intended outcomes[43].
Clause 7: Resources, Training and Allergen Awareness
Personnel competence represents a critical support element for allergen management. Staff must understand personal hygiene requirements, cleaning procedures, contamination risks, and proper allergen handling protocols relevant to their roles[44]. Training cannot be a one-time activity. Regular refresher sessions reinforce allergen awareness across production, quality assurance, and cleaning teams[19].
The standard requires controlled documentation that makes sure employees access current, approved procedures rather than outdated instructions[44]. Communication protocols must function both internally amongst staff and externally with suppliers regarding allergen declarations and customers about product allergen status[48].
Clause 8: Operational Controls for Allergen Management
Clause 8 constitutes the operational core where allergen hazard analysis, control measure implementation, and verification activities occur[49]. This clause covers operational planning, PRPs, traceability systems, hazard analysis procedures, validation of control measures, verification activities, and emergency response protocols[49]. The hazard analysis process identifies biological, chemical, and physical hazards, with allergens falling under chemical hazards requiring control[44].
Traceability systems enable rapid identification and withdrawal of products if allergen control failures occur[44]. Emergency preparedness procedures define responses when products containing undeclared allergens are found before or after distribution[49].
Clause 9-10: Monitoring, Verification and Continual Improvement
Performance evaluation determines whether allergen controls function. Internal audits verify procedure compliance, identify documentation gaps, and assess whether staff follow allergen handling protocols correctly[44]. Management review gets into audit results, customer complaints, allergen-related non-conformities, and system performance trends[44].
Organisations must learn from allergen incidents and implement preventive actions for continual improvement[44]. The standard mandates corrective action processes that make sure non-conformities receive investigation and resolution to prevent recurrence[45].
ISO 22000 Allergen Management: Key Requirements and Practical Steps
Effective allergen control under ISO 22000 just needs specific actions in five critical operational areas. These requirements translate framework principles into verifiable practises that auditors assess during certification.
Identifying Allergens Throughout the Supply Chain
Food business operators must identify the allergenic nature of foods, ingredients and processing aids they handle throughout their operations[11]. This identification extends beyond primary ingredients to include compound ingredients, additives and materials that contact food during production. Allergen characterisation begins with understanding which foods present safety hazards for susceptible individuals. We recognise that food allergies result from adverse immune reactions to specific food proteins[11].
Factors you need to assess include allergens present in the facility, allergens sharing processing lines, the physical nature of allergens (particle, powder, liquid or paste) and processing steps where allergens are used[11]. Businesses must also evaluate the ease of preventing cross-contact between processing lines and the effectiveness of equipment cleaning for products with different allergen profiles[11].
Preventing Cross-Contact During Processing
Allergen cross-contact results from many factors during processing, preparing and handling foods[11]. Food business operators must conduct risk assessments. Control measures implemented to prevent or minimise cross-contact likelihood must be based on these assessments[11]. Processing controls include procedures such as process scheduling, traffic control, physical segregation and air filtration systems designed to prevent allergen transfer[2].
Production scheduling separates allergen-containing and non-allergen products. You should give thought to clustering allergen-containing production runs[2]. Rework and work-in-progress need storage in labelled containers with tracking systems that ensure allergen information accompanies each container[2]. Inappropriate establishment design in terms of area separation, equipment location, traffic patterns and ventilation systems contributes by a lot to cross-contact risk[11].
Cleaning Validation and Verification Protocols
Cleaning validation proves that procedures can effectively and repeatedly remove allergen residues. You should conduct it ideally before regime implementation[12]. Verification proves the validated cleaning regime was performed correctly and remains effective through ongoing monitoring[12]. Neither process should proceed without full visual inspections, complemented by analytical testing of finished products, work-in-progress, rinse water, flush material or environmental surface swabs[12].
Validation procedures should occur at least annually, when you introduce new products or allergenic ingredients, when you implement new cleaning procedures or equipment, or when you modify cleaning frequencies[13]. Testing methods include allergen-specific ELISA kits, lateral flow devices, protein swabs, ATP swabs or PCR methods[13]. Qualitative ELISA testing of cleaned surfaces combined with quantitative ELISA testing of finished products provides strong verification evidence[13].
Allergen Labelling Accuracy and Compliance
Allergen-related recalls in the UK are predominantly caused by labelling or packaging errors. These include incorrect or missing allergen declarations, product-to-packaging mismatches, incorrect free-from allergen claims and failure to declare unintentional allergen presence[14]. Mispacks present very high risk to allergic consumers as they conceal the presence of allergenic ingredients[14]. So businesses need strong line clearance procedures to remove previous products and packaging from production lines before starting new products[14].
False or unverified free-from allergen claims pose high risk to allergic consumers who rely on these declarations for safe food choices[14]. Verification needs full processes for checking, approving and monitoring ingredient specifications with suppliers for both intentional and unintentional allergen presence[14].
Supplier Allergen Declarations and Verification
Supplier management systems must include agreements that require suppliers to notify of any changes in ingredient or allergen profiles, with periodic reconfirmation[14]. Businesses should conduct full assessments of new supplier allergen control procedures. These include both internal and third-party audits, laboratory testing of supplied ingredients and evaluation of detailed ingredient specifications[2]. You should incorporate questionnaires to assess potential allergen cross-contact risks at supplier sites, especially when precautionary allergen labelling statements appear[14]. Ingredient suppliers should report cross-contact concentrations in parts per million for readily dispersible allergens and identify particulate cross-contact allergens where present. This allows manufacturers to determine how this information informs final product labelling decisions[15].
What Does an ISO 22000 Certification Audit Check for Allergens?
Certification audits verify that documented allergen controls function as intended within the operational environment. Auditors get into objective evidence across four critical areas to confirm ISO 22000 allergen management meets standard requirements.
Documentation and Allergen Risk Assessments
Trained internal auditors must verify internal compliance with allergen control instructions and procedures[16]. Auditors get into documented allergen policies, site-specific risk assessments, and control measures set up for each identified hazard. The allergen risk assessment must identify every allergen present at the site and include flow maps that show allergen movement through receiving, storage, production and packaging areas. It must also document assessments for each potential cross-contact point. These include rework, shared equipment and airborne contamination zones[17].
Manufacturers can implement management programmes that work only after they calculate allergen hazards through risk assessments[18]. Auditors verify that assessments think about cross-contact scenarios at each process step. Storage, handling, rework and cleaning practises all need evaluation[19]. Documentation must also demonstrate that control measures are based on these risk assessments rather than generic templates.
Evidence of Cleaning Procedures That Work
Written cleaning procedures for shared equipment must specify disassembly steps, cleaning agents, contact times, rinse protocols and swab verification requirements[17]. Validation proves procedures remove allergens through worst-case allergen challenge testing. ELISA or PCR confirmation shows that residues reach non-detectable levels[17]. Validation should occur at least once a year. It’s also needed when introducing new products or allergenic ingredients, when implementing new cleaning procedures or equipment, or when modifying cleaning frequencies[13].
Post-clean samples include swabs, rinse waters or purge material. Industry best practise requires three consecutive rounds that achieve non-detectable results[4]. Certification-agnostic tools like DrCleanish support this verification. They provide equipment-specific cleaning protocols with mandatory ELISA verification and automated documentation that auditors expect under ISO 22000 PRP/OPRP requirements.
Allergen Training Records and Staff Competence
Training programmes must cover allergen awareness, cross-contact risks, cleaning procedure execution and swab collection technique. All personnel involved in production, sanitation and maintenance need this training[17]. Records must include competency verification through written tests or demonstrated proficiency. Operators must pass these before they are authorised to perform allergen changeovers[17]. Auditors interview staff informally to verify their understanding of allergen obligations and company processes[6].
Traceability and Batch Control
Digital batch records must link every finished product lot to allergen changeover cleaning records, swab results and ingredient lot numbers[17]. Annual mock recall exercises verify that allergen-related incidents can be traced forward to affected lots and backward to root cause within four hours. This satisfies traceability requirements[17].
How Do Other Standards Compare to ISO 22000 for Allergen Control?
Multiple food safety standards address allergen control. Each has distinct requirements and scope. These differences help organisations select appropriate certification pathways based on operational needs and market access requirements.
ISO 22000 and FSSC 22000 Allergen Requirements
FSSC 22000 builds upon ISO 22000 by incorporating the standard as its foundational management system framework[20]. ISO 22000 provides the core FSMS structure. FSSC 22000 adds sector-specific prerequisite programmes and additional certification requirements to ensure consistency and system integrity[20]. These supplementary elements include process controls, allergen management specifications and food defence measures[21].
A critical difference lies in GFSI recognition. FSSC 22000 holds GFSI approval and demonstrates alignment with globally recognised food safety standards. This facilitates international supply chain acceptance[20]. ISO 22000 does not carry GFSI recognition on its own, though it is respected around the world. FSSC 22000 Version 6 expanded allergen requirements beyond earlier versions. It mandates risk assessment validation of control measures and detailed verification of cross-contamination controls. The version also requires improved labelling protocols for precautionary statements and explicit training for all personnel in allergen management. Annual reviews of allergen management plans are now mandatory[22].
The PCHF Rule allergen preventive control requirements exceed those specified in ISO/TS 22002-1 and FSSC 22000 Part 2, especially when you have allergens on-site. Labelling controls must ensure correct allergen declarations and packaging application[23].
Differences Between ISO 22000 and BRCGS
BRCGS contains the most detailed allergen management requirements amongst major food safety schemes[7]. But no single standard addresses all foundational pillars of allergen management in a detailed way[7]. Most standards, including BRCGS, concentrate mainly on preventing cross-contamination and labelling requirements. They don’t address complete allergen control frameworks[7]. Companies hold certifications under these standards in countries where allergen recalls happen frequently. Current requirements prove insufficient to reduce recall frequency[7].
The Broader UK Regulatory Context for Allergen Control
UK legislation mandates declaration of 14 specific allergens: celery, crustaceans, eggs, fish, gluten-containing cereals (wheat, rye, barley, oats), lupin, milk, molluscs, mustard, peanuts, sesame, soybeans, sulphur dioxide and sulphites, and tree nuts[8]. Food businesses must inform consumers when these allergens appear in products sold[8]. Legislative definitions vary between countries and regions. Businesses must understand full regulatory scope in both production and sale locations[24]. The Codex Alimentarius General Standard for Labelling of Pre-packaged Foods provides the compliance assessment baseline where no legal allergen labelling requirements exist[24].
Integrating Allergen Control Into Your ISO 22000 FSMS
Translating ISO 22000 allergen control requirements into operational reality requires structured implementation across documentation, procedures, monitoring systems and verification activities. This integration will give allergen management the status of an embedded FSMS component rather than an isolated compliance exercise.
Building an Allergen Management Plan
A documented allergen management programme translates risk awareness into operational controls[10]. Core components include supplier allergen declarations that specify intentional presence and shared processing risks. These declarations are reviewed on defined cycles and re-requested after supplier site or formulation changes[10]. Production scheduling documents allergen sequencing rationale. The preference is to schedule allergen-free products at production day start or right after full allergen cleaning to reduce residual carry-over[10]. The allergen risk assessment identifies every point where allergens could unintentionally enter products and reviews likelihood and severity. It outputs a risk matrix that prioritises control measures[10]. This structured analysis is a foundation of HACCP and ISO 22000 hazard analysis steps[10].
Developing SOPs for Allergen Handling
Allergen control SOPs guide prevention of cross-contact through full processes. They cover HACCP alignment, supplier and raw material verification, storage and segregation of allergenic ingredients, correct recipe and packaging controls, production sequencing and rework traceability[9]. Procedures include hygiene rules, staff training, equipment design that allows for cleanability, cleaning between product changeovers and post-production testing where relevant[9]. Internal audits, incident reporting and nonconforming product handling procedures complete the documentation set[9]. Ingredient control requires colour-coded, dedicated handling tools for single allergen groups. Ingredient substitutions require formal change control review[10].
Implementing Digital Monitoring and Record-Keeping
Many manufacturers now use digital FSMS platforms to track allergen risks, manage cleaning records, monitor training and organise audit documentation. This improves traceability, compliance and operational efficiency[25]. Digital systems enable immediate verification that allergen controls are functioning, with automated alerts for deviations.
Conducting Internal Audits Focused on Allergens
Internal audits address FSMS conformance to specified requirements, proper implementation effectiveness, systems approach application, risk concept incorporation and audit report accuracy[26]. ISO 22000 expects internal audits at least once a year, with frequency based on food safety risks[26].
Common Challenges and Solutions in ISO 22000 Allergen Management
“My sense is that the food industry generally understands and appreciates the potential health risk associated with food allergens, but that the nature of the hazard, inherently a food ingredient, makes its management and control within a dynamic food manufacturing environment very challenging.” — Joseph Scimeca, Ph.D., Vice President, Global Regulatory and Scientific Affairs, Cargill
Four operational challenges emerge during ISO 22000 allergen control implementation. Each requires specific solutions to maintain FSMS effectiveness.
Rework and Allergen Carryover Management
Rework material containing allergens must be managed and documented through storage, processing, identification and labelling protocols[16]. Rework refers to finished or partially finished products reincorporated into manufacturing. Work-in-progress consists of partially finished products between production stages[27]. Both increase risk of introducing allergens through erroneous addition into products not containing specific allergens or through cross-contact via shared containers during storage[27].
Storage requires sturdy containers with secure covers in designated, marked areas[11]. Labelling must highlight all food allergens. Proper inventory accounting during storage and use will prevent incorporation into wrong products[11]. Manufacturers should implement policies requiring rework addition back to similar products whenever feasible[11]. This proves impractical at times. Predetermined compatibility lists must then identify which products may receive specific rework materials, with product specifications identifying all allergens within rework[27].
Shared Equipment and Production Line Control
Production scheduling separates allergen-containing from non-allergen products by time and processes foods without allergens before those with allergens[11]. Allergenic ingredients should be added as late in production as possible to minimise equipment contact with allergens[11]. Dedicated processing lines for products containing different allergen types should be used when possible. Avoid line crossovers and enclose processing equipment[27].
Personnel working on lines containing allergens should be restricted from working on allergen-free lines at the same time[11]. Colour-coded uniforms or hair nets can identify personnel working on lines manufacturing foods with different allergen profiles[11].
Allergen Awareness Across Shifts
Staff training effectiveness determines allergen management success[5]. Regular training will give employees understanding of allergen risks and compliance necessity[5]. Role-specific training, allergen awareness drills, visitor controls and PPE protocol adherence must blend into daily routines[5]. Retail and food service personnel must know allergens in foods provided to customers and understand cross-contact likelihood from preparation processes[11].
Allergen-Related Non-Conformity Response
Allergen management plans require updates following near-misses or consumer complaints[19]. Every incident represents a learning chance that demands prompt plan review with documented corrective and preventive actions[19].
Frequently Asked Questions (FAQ)
Is allergen management mandatory under ISO 22000?
Allergen management is mandatory under ISO 22000 as allergens are classified as food safety hazards requiring control[28]. The standard requires organisations to establish PRPs that facilitate prevention and reduction of contaminants, including food safety hazards[28]. Therefore, facilities must implement well-laid-out allergen management programmes within their prerequisite programmes to comply with ISO 22000:2018 requirements[29].
What is the difference between a PRP, oPRP, and CCP for allergens?
PRPs establish foundational hygiene conditions that apply broadly in operations. oPRPs control specific allergen hazards at defined process steps identified through hazard analysis. CCPs represent critical points where control prevents, eliminates, or reduces hazards to acceptable levels. We manage allergens through PRPs and oPRPs rather than CCPs given the nature of cross-contact prevention.
How often should allergen cleaning procedures be validated?
Validation must occur at least once a year to account for any changes[29]. You need additional validation when you introduce new products or allergenic ingredients, implement new cleaning procedures or equipment, or modify cleaning frequencies[13]. Any changes to production, process, or potential risk situations require additional validation activities[29].
Does ISO 22000 require allergen testing?
ISO 22000 mandates verification of allergen controls, but not all allergens have specific test kits available. Some finfish and allergens modified by fermentation, heating, or hydrolysis lack testing options[29].
What role do third-party audits play in allergen control?
Third-party audits confirm that allergen management systems meet ISO 22000 requirements through objective evidence assessment of documentation, procedures, training records, and operational effectiveness.
Conclusion
Above all, ISO 22000 allergen control succeeds when organisations treat it as an integrated FSMS component rather than a standalone compliance programme. Businesses that embed allergen management in hazard analysis, prerequisite programmes, operational controls and verification activities create resilient food safety systems. These systems protect consumers while reducing recall risks.
Organisations implementing these requirements must focus on three priorities: complete staff training, verified cleaning procedures and resilient supplier verification. Digital tools that support verification activities streamline documentation and provide objective evidence auditors expect during certification assessments.
Organisations committed to continual improvement should review allergen incidents regularly. They must update risk assessments and strengthen controls based on operational experience.
Key Takeaways
ISO 22000:2018 mandates allergen management as a core food safety hazard requiring systematic control through your FSMS, not as a separate compliance exercise. With undeclared allergens causing over half of UK food recalls, effective integration is business-critical.
Essential implementation requirements include:
• Three-tier control structure: Allergens are managed through PRPs (foundational hygiene), oPRPs (process-specific controls), and CCPs (critical points), with most allergen risks addressed via PRPs and oPRPs rather than critical control points.
• Validated cleaning protocols: Annual validation of allergen cleaning procedures is mandatory, requiring ELISA or PCR testing to confirm non-detectable residue levels, with additional validation when introducing new allergens or equipment.
• Comprehensive staff competency: Role-specific allergen training with documented competency verification proves essential, as personnel awareness directly impacts cross-contact prevention effectiveness across all shifts and production lines.
• Supply chain verification: Robust supplier allergen declarations, periodic reconfirmation, and change notification agreements form the foundation for preventing undeclared allergen introduction through raw materials.
• Digital traceability systems: Real-time monitoring and automated documentation enable rapid identification of affected batches during allergen incidents, with mock recalls demonstrating four-hour trace capability from finished product to root cause.
The standard’s integration with HACCP principles and compatibility with ISO 9001 enables organisations to build scalable allergen management systems that satisfy both certification requirements and regulatory obligations whilst protecting allergic consumers from potentially life-threatening exposure.
FAQs
Q1. Is ISO 22000:2018 certification compulsory for food businesses? ISO 22000 certification is not legally mandatory, but it has become increasingly essential for market access. Major retailers, export markets, and GFSI-benchmarked schemes now commonly require it as a baseline condition for supplier approval, making it a practical necessity for businesses seeking to compete in global food supply chains.
Q2. What exactly is ISO 22000:2018 and how does it relate to food safety? ISO 22000:2018 is an international standard that establishes requirements for a comprehensive food safety management system (FSMS). It enables organisations throughout the food chain to consistently provide safe products by integrating HACCP principles with prerequisite programmes and management system requirements, creating a structured framework for identifying, controlling, and preventing food safety hazards.
Q3. Are food businesses legally required to have a food safety management system? Yes, every food business operating in the UK, regardless of size, is legally required to implement a food safety management system based on HACCP principles. This structured, documented framework must identify, control, and prevent food safety hazards across all operations, ensuring compliance with statutory food safety requirements.
Q4. How does ISO 22000 specifically address allergen management? ISO 22000 classifies allergens as food safety hazards requiring systematic control through a three-tier structure: prerequisite programmes (PRPs) for foundational hygiene, operational PRPs (oPRPs) for process-specific controls, and critical control points (CCPs) where necessary. The standard mandates allergen risk assessment, validated cleaning procedures, staff training, supplier verification, and traceability systems as integrated components of the FSMS.
Q5. What benefits does ISO 22000 certification provide for food safety? ISO 22000 certification enhances an organisation’s ability to consistently deliver safe products that meet customer expectations and regulatory requirements. It provides a globally recognised framework that demonstrates commitment to food safety, facilitates international trade, reduces recall risks, and creates systematic controls for managing hazards including allergens throughout the entire food production process.
References
[1] – https://knowledge.bsigroup.com/products/food-safety-management-systems-requirements-for-any-organization-in-the-food-chain
[2] – https://certified-laboratories.com/blog/food-allergen-testing-avoiding-allergen-cross-contact/
[3] – https://www.nqa.com/en-gb/certification/standards/iso-22000
[4] – https://www.rssl.com/insights/food-consumer-goods/designing-a-successful-allergen-cleaning-validation-strategy/
[5] – https://foodindustryhub.com/food-industry-knowledge-centre/know-allergen-management/
[6] – https://foodallergyaware.co.uk/wp-content/uploads/2021/09/20210909-Fact-sheet-Allergen-Management-Audits-Part-1.pdf
[7] – https://www.allergenenconsultancy.nl/en/allergenenmanagement?srsltid=AfmBOoqK6rQ5XmEY0NkMj9ixPjqjnHyymnquZKb0GK302hWhHuJtPxJ2
[8] – https://www.foodstandards.gov.scot/business-guidance/running-a-food-business/managing-allergens
[9] – https://safetyculture.com/library/manufacturing/s-o-p-1-4-1-allergens-control-hbnauuuanr3uabnl
[10] – https://tractian.com/en/glossary/allergen-control
[11] – https://www.fao.org/fao-who-codexalimentarius/sh-proxy/en/?lnk=1&url=https%253A%252F%252Fworkspace.fao.org%252Fsites%252Fcodex%252FStandards%252FCXC%2B80-2020%252FCXC_080e.pdf
[12] – https://www.hygiena.com/news/allergen-cleaning-validation-and-verification
[13] – https://www.fda.gov/media/129671/download
[14] – https://www.fdf.org.uk/globalassets/resources/publications/guidance/allergen-recall-prevention-guidance.pdf
[15] – https://allergenbureau.net/feature-article-a-matter-of-transparency-cross-contact-labelling-in-the-supply-chain-part-1-of-2/
[16] – https://www.fooddrinkeurope.eu/wp-content/uploads/2022/04/FoodDrinkEuropes-Guidance-on-Food-Allergen-Management-for-Food-Manufacturers-2022.pdf
[17] – https://oxmaint.ai/industries/fmcg/fmcg-allergen-management-cleaning-validation-changeover
[18] – https://pmc.ncbi.nlm.nih.gov/articles/PMC4792368/
[19] – https://ascfoodsafety.com/fssc-22000-additional-requirements-part-8/
[20] – https://www.kiwa.com/en/standards/fssc-22000-food-safety-management-system/difference-fssc-22000-and-iso-22000/
[21] – https://www.theknowledgeacademy.com/blog/difference-between-iso-22000-and-fssc-22000/
[22] – https://fsns.com/6-key-changes-in-fssc-22000-version-6/
[23] – https://www.fssc.com/wp-content/uploads/supplement-fssc-22000-and-fsma-v1-final-september-2017.pdf
[24] – https://www.brcgs.com/media/2170588/allergen-mgt-22-sample.pdf
[25] – https://nexustac.com/how-to-establish-an-effective-allergen-management-program/
[26] – https://www.food-safety.com/articles/3577-lete28099s-get-serious-about-internal-audits
[27] – https://www.fda.gov/media/129670/download
[28] – https://www.ifsqn.com/forum/index.php/topic/49599-allergens-as-a-hazard-in-iso-22000-and-fssc-22000—must-they-be-oprp-ccp/
[29] – http://iso22000resourcecenter.blogspot.com/2021/02/iso-220002018-allergen-management-iii.html
[30] – https://www.foodcompliancehq.com/article/show/comprehensive-guide-to-iso-22000:-enhancing-food-safety-management-systems
[31] – https://isocomplianceregister.co.uk/iso_article/fssc-22000/
[32] – https://www.linkedin.com/posts/hasanuzzaman-hasan-366b30227_allergen-management-activity-7368853099194540034-zssk
[33] – https://www.ncass.org.uk/news/the-importance-of-allergen-management/
[34] – https://safetyproducts.com/allergen-management-in-the-food-industry/
[35] – https://www.fooddocs.com/post/haccp-allergen-control-program
[36] – https://www.ift.org/food-technology-magazine/safety-and-quality-how-to-manage-food-allergens
[37] – https://pecb.com/en/article/the-importance-of-allergen-management-in-food-industry
[38] – https://pecb.com/en/article/difference-between-haccp-and-iso-22000
[39] – https://www.campdenbri.co.uk/blogs/allergen-cross-contact-food-chain.php
[40] – https://www.fsai.ie/business-advice/running-a-food-business/food-safety-management-system-(haccp)/prerequisite-programmes
[41] – https://safefood360.com/blog/understanding-the-difference-between-prp-oprp-ccp-an-introduction/
[42] – https://foodready.ai/blog/how-are-operational-prerequisites-different-from-ccps-and-prps/
[43] – https://nexustac.com/iso-22000-clause-4-explained-aligning-food-safety-goals-with-organizational-strategy/
[44] – https://everydayfoodsafety.com/iso-220002018-food-safety-management-system-each-clause-explained/
[45] – https://www.abs-biotrade.info/fileadmin/Downloads/1. PROJECTS/ABioSA/Activities_and_achievements/Three_workshops_for_22_SMEs/HACCP__Regulatory__training/ISO-22000-2018-Standard.pdf
[46] – https://www.qmii.com/iso-22000-requirements-the-role-of-leadership-in-food-safety-management/
[47] – https://techni-k.co.uk/contamination-control/allergen-management/
[48] – https://foodready.ai/blog/iso-22000-for-food-manufacturers/
[49] – https://www.theauditoronline.com/clause-8-of-iso-22000/