ISO 22000 Prerequisite Programmes: Foundation for Food Safety
Prerequisite Programmes (PRPs) are the foundational conditions and activities that maintain a hygienic environment throughout the food chain. In the context of ISO 22000:2018 – the international standard for food safety management systems – PRPs are not optional extras; they are mandatory building blocks upon which the entire food safety management system (FSMS) is constructed. Without effective PRPs, even the most rigorous HACCP plan cannot guarantee food safety.
This article explains what PRPs are, the specific ISO 22000 PRP requirements, how PRPs differ from HACCP, the main PRP categories (construction, utilities, cleaning, pest control, waste, equipment), documentation requirements, and what auditors look for.
What Are Prerequisite Programmes (PRPs)?
Prerequisite Programmes are the basic environmental and operational conditions necessary for the production of safe food. They address the hygiene, sanitation, and facility-related aspects of food production, processing, and handling. PRPs are not specific to a particular product or process; they apply across the entire organisation and form the hygiene baseline upon which product-specific controls (HACCP) are built.
ISO 22000:2018 defines PRPs as “basic conditions and activities that are necessary within the organisation and throughout the food chain to maintain food safety.” They are distinct from operational PRPs (oPRPs), which control specific identified hazards, and HACCP plans, which control critical control points (CCPs).
ISO 22000 PRP Requirements
Clause 8.2 of ISO 22000:2018 specifies that the organisation shall establish, implement, maintain, and update PRPs. The standard provides detailed requirements across multiple categories. Organisations must tailor their PRPs to their specific context, including the nature of the food product, the type of processes, and the operational environment.
| ISO 22000 Clause | PRP Category | Key Requirements |
|---|---|---|
| 8.2.2 | Construction and layout of buildings and facilities | Premises designed to prevent contamination; separate clean and dirty areas; appropriate surfaces (walls, floors, ceilings) that are cleanable; adequate drainage and ventilation |
| 8.2.3 | Utilities (air, water, energy, steam) | Potable water supply; steam and ice quality; compressed air filtered to food-grade; regular monitoring and testing of water quality |
| 8.2.4 | Waste disposal | Waste segregation (general, hazardous, food waste); covered and labelled containers; scheduled removal; waste disposal records |
| 8.2.5 | Equipment suitability, cleaning, and maintenance | Food-contact surfaces of suitable material (stainless steel, food-grade plastic); hygienic design (no crevices, dead ends); preventive maintenance schedule; calibration of monitoring equipment |
| 8.2.6 | Purchasing and supply management | Supplier approval criteria; incoming material inspection; raw material specification; traceability of inputs |
| 8.2.7 | Cross-contamination prevention measures | Physical separation of raw and cooked products; allergen management; colour-coded utensils; dedicated equipment for high-risk areas; personnel segregation |
| 8.2.8 | Cleaning and sanitising | Cleaning schedules (SOPs); validated cleaning methods; cleaning chemical control; post-cleaning verification (ATP testing, swabs); sanitation records |
| 8.2.9 | Pest control | Pest management programme; bait station placement maps; preventive measures (netting, screening, proofing); monitoring devices; pest trend analysis; pesticide approval and control |
| 8.2.10 | Personnel hygiene and welfare | Handwashing facilities; protective clothing policy; health screening; illness reporting; no-jewellery policy; training on hygiene procedures |
| 8.2.11 | Rework | Rework identification and traceability; rework limits; rework handling procedures; rework records |
| 8.2.12 | Product recall and withdrawal | Recall plan; traceability system; mock recall exercises (at least annually); recall team and communication protocol |
| 8.2.13 | Warehousing and storage | Temperature-controlled storage; FIFO/FEFO rotation; allergen segregation; storage hygiene; cleaning of storage areas |
| 8.2.14 | Product information and consumer awareness | Labelling compliance; allergen declaration; shelf-life determination; storage and preparation instructions |
| 8.2.15 | Food defence, biovigilance, and bioterrorism | Security assessment; access control; intentional adulteration risk assessment; employee background checks |
PRPs vs HACCP: What Is the Difference?
A common point of confusion in food safety management is the distinction between Prerequisite Programmes and HACCP (Hazard Analysis and Critical Control Points). They serve different but complementary roles within the FSMS.
| Aspect | Prerequisite Programmes (PRPs) | HACCP |
|---|---|---|
| Purpose | Maintain a hygienic environment and basic operational conditions | Control specific significant hazards at Critical Control Points (CCPs) |
| Scope | Organisation-wide, applies to all products and processes | Product-specific, process-specific |
| Hazard focus | General hygiene hazards, cross-contamination, environmental contamination | Specific biological, chemical, and physical hazards identified through hazard analysis |
| Control level | Baseline controls (e.g., clean premises, pest-free environment, potable water) | Critical limits, monitoring, corrective actions at CCPs |
| Critical limits | Not typically specified (e.g., “clean surfaces”) | Yes – specific, measurable limits (e.g., core temperature > 75°C) |
| Monitoring | Routine (visual inspection, temperature logs, cleaning records) | Continuous or scheduled at defined frequency |
| Corrective actions | General (e.g., re-clean, retrain, repair) | Specific actions when critical limit is breached (e.g., reject, rework, isolate) |
| Validation | Less rigorous (verification of effectiveness) | Rigorous validation of critical limits and monitoring methods |
| Documentation | Procedures, schedules, logs, records | HACCP plan, hazard analysis worksheets, CCP monitoring records |
In ISO 22000, PRPs, operational PRPs (oPRPs), and the HACCP plan work together. PRPs control the general hygiene environment. The hazard analysis determines whether a hazard is controlled by an oPRP (where a critical limit is not easily measurable or the risk is lower) or by a CCP (where critical limits are essential for control).
PRP Categories in Detail
Construction and Layout
Facilities must be designed and constructed to prevent contamination. Walls, floors, and ceilings should be of impervious, cleanable materials. Layout must separate high-risk and low-risk areas, with physical barriers where necessary. Drainage must be adequate to prevent standing water.
Utilities
Water is the most critical utility in food processing. ISO 22000 requires that water used as an ingredient, for cleaning, or for steam generation be potable and tested regularly. Compressed air that contacts food must be filtered. Steam must be culinary-grade where it directly contacts food.
Cleaning and Sanitising
Cleaning programmes must be documented, validated, and verified. Organisations must specify what is cleaned, how, when, by whom, and with which chemicals. Verification methods include visual inspection, swab testing (ATP, micro), and allergen swabbing. Cleaning chemicals must be approved for food industry use and stored separately from food.
Pest Control
A documented pest management programme must address common pests (rodents, insects, birds, reptiles). This includes preventive measures (sealing, screening, netting) and monitoring devices (baits, traps, light traps). Bait stations must be mapped, inspected regularly, and pesticides must be approved food-grade products applied by certified operators.
Waste Management
Waste must be segregated, stored in covered and labelled containers, and removed at scheduled intervals to prevent pest attraction and microbial growth. Food waste, hazardous waste (chemicals, oils), and general waste must be handled separately. Waste disposal records must be maintained.
Equipment
All equipment must be of hygienic design, suitable for its intended purpose, and maintained according to a preventive maintenance schedule. Food-contact surfaces must be non-toxic, non-absorbent, corrosion-resistant, and easily cleanable. Equipment must be installed to allow access for cleaning and maintenance.
Documentation Requirements
ISO 22000 requires documented information for PRPs to demonstrate their effective implementation and maintenance. Key documents include:
- PRP manual or policy – Describes the organisation’s approach to PRPs, scope, and responsibilities.
- PRP procedures and SOPs – Detailed instructions for each PRP category (cleaning schedules, pest control procedures, maintenance procedures, hygiene protocols).
- Specifications and standards – Water quality standards, supplier approval criteria, equipment specifications.
- Records and logs – Monitoring records (temperature logs, water test results, cleaning records, pest sighting logs), training records, maintenance records, corrective action reports.
- Verification records – ATP test results, environmental swab results, audit reports, pest trend analysis reports.
Audit and Verification
During an ISO 22000 audit, PRPs are scrutinised closely. Auditors typically examine:
- Site walkthrough – Auditor inspects facilities, equipment, storage areas, waste handling, cleaning stations, and pest control devices.
- Records review – Cleaning records, water test results, pest control reports, maintenance logs, training records.
- Interviews – Staff knowledge of hygiene procedures, cleaning responsibilities, pest reporting, and corrective actions.
- Traceability exercises – The auditor may test the traceability system from raw material to finished product.
- Mock recall – Verification of recall plan effectiveness.
Common nonconformities found in PRP audits include incomplete cleaning records, expired pest control certifications, unsealed gaps in walls or around pipes, inadequate handwashing facilities, and insufficient allergen segregation.
Frequently Asked Questions
What is the difference between PRPs and operational PRPs (oPRPs) in ISO 22000?
PRPs are general hygiene conditions that apply across the organisation (e.g., cleaning schedules, pest control). Operational PRPs (oPRPs) are specific controls identified through hazard analysis to control a significant hazard where a critical limit is not easily established or where the risk level does not justify a CCP. For example, allergen cross-contact may be controlled by an oPRP (colour-coded utensils, dedicated production lines) rather than a CCP.
Are PRPs mandatory under ISO 22000?
Yes. PRPs are mandatory under Clause 8.2 of ISO 22000:2018. Every organisation seeking ISO 22000 certification must establish, implement, maintain, and update PRPs appropriate to its context and the nature of its food products. PRPs are audited as part of the certification process.
Can PRPs replace HACCP?
No. PRPs and HACCP are complementary, not interchangeable. PRPs provide the basic hygienic environment. HACCP (or oPRPs) controls the specific hazards identified through hazard analysis that are not adequately controlled by PRPs alone. A food safety management system requires both.
What is the most common PRP nonconformity during ISO 22000 audits?
The most common nonconformities relate to documentation and record-keeping, particularly incomplete or inconsistent cleaning records, lack of water testing schedules, expired pest control certifications, and inadequate allergen management procedures. Poor facility maintenance (e.g., cracked wall surfaces, leaking pipes, missing insect screens) is also frequently cited.
How often should PRPs be reviewed and updated?
PRPs should be reviewed at least annually as part of the management review process (Clause 9.3). However, PRPs must also be updated whenever there is a change that affects their effectiveness, such as new equipment, facility expansion, new products, changes in regulations, or after a food safety incident.
Do small food businesses need the same PRPs as large manufacturers?
Yes, in principle, but the complexity and formality of PRPs should be proportionate to the size and risk profile of the business. A small café does not need the same level of documentation as a large food processing plant. However, the underlying requirements – clean premises, potable water, pest control, proper waste handling, staff hygiene – apply to all food businesses regardless of size. ISO 22000 allows for scaling of PRPs based on risk assessment.
How Bitrixme Can Help
Bitrixme provides comprehensive ISO 22000 implementation and certification support. Our services include PRP gap analysis, documentation development (PRP procedures, cleaning schedules, pest control programmes), staff training, internal auditing, pre-certification assessment, and ongoing FSMS maintenance. We also offer integrated management systems combining ISO 22000 with ISO 9001, ISO 14001, and ISO 45001.
