ISO 22000 Certification in Iraq: Food Safety Audit Readiness Checklist

Food businesses in Iraq should enter an ISO 22000 audit with a defined scope, working HACCP controls, prerequisite programs, traceability, trained staff, internal-audit evidence, management review, and closed corrective actions—not only a folder of procedures.

ISO 22000:2018 is the international food safety management system standard for organizations in the food chain. Amendment 1:2024 added climate-change considerations to the harmonized management-system clauses. Organizations should evaluate whether climate change is relevant to their context and whether interested parties have related requirements.

Who should prepare for ISO 22000?

• Food manufacturers, processors, restaurants, caterers, and central kitchens.
• Storage, cold-chain, transport, import, export, and distribution organizations.
• Packaging, food-contact material, ingredient, additive, and raw-material suppliers.
• Organizations responding to customer, supplier-approval, export, or tender requirements.

ISO 22000 and HACCP

HACCP focuses on identifying food safety hazards, selecting and managing controls, monitoring, corrective action, verification, and records. ISO 22000 includes HACCP principles within a broader management system covering leadership, communication, resources, documented information, internal audit, management review, and continual improvement.

1. Define the scope clearly

Identify the sites, products, processes, storage, transport, packaging, subcontracted work, and interfaces included in the food safety management system. The scope should match actual operations and any customer or tender requirement.

2. Verify process-flow diagrams onsite

Process flows should cover receiving, storage, preparation, processing, packaging, labeling, finished-product storage, dispatch, cleaning, waste, rework, returns, and other relevant steps. Verify the diagrams where the work happens before finalizing hazard analysis.

3. Confirm prerequisite programs

Auditors look for both the planned control and evidence that it operates. A cleaning procedure, for example, should be supported by schedules, completed records, chemical controls, verification, and follow-up when results are unacceptable.

4. Review hazard analysis and control measures

• Identify relevant biological, chemical, physical, and allergen hazards.
• Connect hazards to the verified process flow and product characteristics.
• Justify control-measure selection and categorization.
• Set realistic limits or action criteria, monitoring, corrections, and corrective actions.
• Retain validation and verification evidence appropriate to the control.

5. Test traceability and withdrawal readiness

Run a practical exercise using a real or sample batch. Confirm that the team can connect suppliers, materials, processing records, quality checks, release, storage, and distribution. Record the time taken, missing information, reconciliation, decisions, and corrective actions.

6. Check competence and awareness

Training evidence should show that staff understand the controls assigned to them. Use role-specific instruction, attendance records, observation, questions, demonstrations, or other competence checks. Refresh training after incidents, changes, weak performance, or audit findings.

7. Complete the internal audit

Audit the full system and sample actual records. Cover scope, prerequisite programs, HACCP, suppliers, traceability, complaints, incidents, corrective actions, training, objectives, document control, and management review. Assign findings, close them, and verify effectiveness before the external audit.

8. Hold management review

Management should evaluate food-safety performance and make decisions. Inputs commonly include audit results, verification data, complaints, incidents, withdrawals, supplier performance, objective progress, changes, risks, resources, corrective actions, and improvement opportunities.

9. Close corrective actions

For significant gaps, document the immediate correction, cause, action to prevent recurrence, owner, target date, completion evidence, and effectiveness review. Open high-risk issues should not be hidden or postponed until the certification audit.

10. Prepare for Stage 1 and Stage 2

Stage 1 usually focuses on documented readiness, scope, site conditions, internal audit, and management review. Stage 2 evaluates implementation and effectiveness through interviews, observation, and record sampling. The exact process depends on the certification body and scope.

Common readiness gaps

• Generic procedures that do not match the site or product.
• Incomplete monitoring, sanitation, pest-control, calibration, or temperature records.
• Hazard analysis not updated after product, supplier, equipment, or process changes.
• Traceability or withdrawal exercises never tested.
• Supplier approval based only on price or purchase history.
• Internal audits completed too late or limited to document checks.
• Management review minutes without clear decisions, resources, or action owners.

A focused 30-day readiness plan

1. Week 1: confirm scope, process flow, current documents, key hazards, customer requirements, and missing evidence.
2. Week 2: review PRPs, HACCP, suppliers, traceability, calibration, sanitation, temperatures, and competence.
3. Week 3: complete the internal audit, assign findings, and close high-risk gaps.
4. Week 4: hold management review, verify corrective actions, organize evidence, and brief process owners.

This plan is suitable only where foundational controls already exist. It does not guarantee certification.

How ISO IRAQ can help

Support can include gap assessment, ISO 22000 documentation, HACCP review, training, internal-audit support, management-review preparation, corrective-action tracking, and certification-readiness checks.

Primary sources

• ISO 22000:2018 standard page
• ISO 22000:2018/Amd 1:2024 standard page