What Is ISO 22000 Clause 7.4 and Why Does It Matter?
If you are working towards ISO 22000 certification, or you are already certified and preparing for a surveillance audit, Clause 7.4 is one of those requirements that looks simple on paper but causes real problems in practice. The clause covers communication, specifically how your food safety management system (FSMS) handles the flow of information both inside your organisation and with the outside world.
On this page
Food safety does not operate in a vacuum. A contamination risk identified by your supplier, a regulatory change from a government authority, a complaint from a customer about a foreign object in a product, all of these require fast, accurate, and documented communication. When that communication breaks down, food safety hazards get missed. That is when people get sick, recalls happen, and certifications get suspended.
This guide breaks down exactly what Clause 7.4 requires, with practical examples that show you how to implement it correctly. Whether you are a food manufacturer, a caterer, a cold storage operator, or a packaging supplier, the principles here apply to your operation.
The Structure of Clause 7.4: Two Types of Communication
ISO 22000 Clause 7.4 is divided into two distinct sub-clauses. Understanding the difference between them is the starting point for getting this right.
Clause 7.4.1: External Communication
This sub-clause requires your organisation to establish, implement, and maintain effective arrangements for communicating with parties outside your business that are relevant to food safety. The standard specifically calls out the following external parties:
- Suppliers and contractors
- Customers and consumers, particularly regarding product information, enquiries, contracts, order handling, and feedback including complaints
- Regulatory and statutory authorities
- Organisations that have an impact on the effectiveness of the food safety management system
The key word here is effective. The standard is not asking you to set up a generic communication process. It is asking you to ensure that food safety relevant information actually gets to the right people, in a usable form, at the right time.
One thing auditors look for under 7.4.1 is whether your external communication is two-way. Sending out a product specification sheet to a customer ticks part of the box, but if you have no mechanism for receiving feedback, updates, or concerns from that customer, you are only halfway there.
Clause 7.4.2: Internal Communication
This sub-clause requires your organisation to communicate internally on all matters that affect food safety. The standard lists specific topics that must be covered:
- Products or new products
- Raw materials, ingredients, and services
- Production systems and equipment
- Production premises, location of equipment, and surrounding environment
- Cleaning and disinfection programs
- Packaging, storage, and distribution methods
- Competence levels and allocation of responsibilities
- Statutory and regulatory requirements
- Customer and interested party enquiries and complaints
- Other enquiries and communications from external parties affecting food safety
- Information affecting food safety from other organisations
This is a substantial list. The standard is essentially telling you that any change in any of these areas must be communicated to the people responsible for maintaining and updating your FSMS, particularly your food safety team.
Clause 7.4.2 also includes an important requirement: the food safety team must be informed in a timely manner of changes so they can update the hazard analysis and the system accordingly. This is a direct link between your communication process and the technical core of your FSMS.
Get 3 ISO Quotes. 24 Hours Response
Tell us what you need and compare vetted ISO consultants or certification bodies within 24 hours. Free, no obligation.
Trusted by 400+ businesses like yours
Practical Examples of External Communication Under Clause 7.4.1
Let me give you some real-world scenarios that show how external communication should work in an ISO 22000 certified operation.
Example 1: Supplier Notification of Ingredient Change
A dairy processor receives a call from their milk powder supplier advising that a new batch has a slightly different protein content due to a change in their processing method. Under Clause 7.4.1, the dairy processor needs a documented process for receiving this kind of notification, logging it, and passing it to the food safety team for review.
If there is no formal process, this information might be noted by the purchasing officer and never reach the HACCP team. The result could be a product that does not meet its nutritional labelling claims, or worse, a change in allergen status that was not caught before product went to market.
What good external communication looks like here: a supplier communication register, a requirement in your supplier agreements that any changes to materials must be notified in writing, and a clear internal escalation path to your food safety team.
Example 2: Regulatory Authority Communication
Food Standards Australia New Zealand (FSANZ) updates a maximum residue limit for a pesticide used on a raw ingredient you source. Your organisation needs a process for monitoring regulatory changes and ensuring that information reaches the right people internally.
This might involve subscribing to FSANZ update notifications, assigning someone responsibility for reviewing those updates, and having a documented process for escalating relevant changes to your food safety team. Auditors will ask who in your organisation is responsible for monitoring regulatory changes and what evidence you have that this actually happens.
Example 3: Customer Complaint About a Foreign Object
A retail customer contacts your bakery to report finding a piece of blue plastic in a loaf of bread. Under 7.4.1, you need a documented process for receiving this complaint, recording it, investigating it, and communicating the outcome back to the customer. The information from that complaint also needs to feed back into your internal food safety review process.
A complaint register, a defined response timeframe, and a link to your corrective action process are the minimum requirements here. The complaint is not just a customer service issue. It is food safety data that needs to be analysed.
Practical Examples of Internal Communication Under Clause 7.4.2
Internal communication failures are, in my experience, the most common source of nonconformances under Clause 7.4. Here is why, and what to do about it.
Example 1: New Product Development
Your snack food company decides to launch a new product that contains sesame, which was not previously used in your facility. The production team starts sourcing sesame seeds and scheduling a trial run. If the food safety team is not informed before this happens, your allergen controls, cleaning procedures, and product labelling all need to be updated before the first batch runs. If they find out after the fact, you have a potential allergen cross-contamination risk that was never assessed.
Under Clause 7.4.2, you need a formal process for notifying the food safety team of new product development before production begins. This is often built into a new product introduction checklist or a change management procedure.
Example 2: Equipment Change
Your meat processing facility installs a new slicing machine. The maintenance team manages the installation and signs off on the mechanical commissioning. But has anyone told the food safety team? The new machine may have different cleaning requirements, different metal detection parameters, or new lubricants that need to be assessed for food safety compliance.
A change management procedure that requires food safety sign-off before any new equipment goes into production is the practical control here. The food safety team reviews the change, updates the hazard analysis if needed, and gives clearance for production to commence.
Example 3: Staff Turnover in a Critical Role
Your HACCP coordinator leaves the business. Under Clause 7.4.2, the competence and allocation of responsibilities is a food safety relevant matter that needs to be communicated. Who is covering that role in the interim? Has the food safety team been notified? Is there a documented handover process?
This is an area where many small food businesses struggle. The food safety system is often held in the head of one person, and when that person leaves, the system effectively goes with them. A documented communication process for role changes helps prevent this.
Documented Information Requirements Under Clause 7.4
ISO 22000 requires you to retain documented information as evidence that your communication processes are working. Specifically, you need to be able to show an auditor that external and internal communication is happening, that it is being recorded, and that food safety relevant information is reaching the food safety team.
Typical documents and records that support Clause 7.4 compliance include:
- A supplier communication log or register
- Customer complaint records and response documentation
- Records of regulatory monitoring activities
- Internal communication records such as meeting minutes, emails, or memos relating to food safety relevant changes
- Change management records showing food safety team notification and sign-off
- Evidence that the food safety team has reviewed and, where necessary, updated the FSMS in response to communicated changes
The standard does not prescribe the format of these records. What matters is that you can demonstrate, with evidence, that the process is functioning. A well-maintained communication register is far more useful in an audit than a beautifully written procedure that nobody follows.
For more on how to set up and maintain your documentation effectively, the guide on how to document your ISO 22000 system covers the practical steps in detail.
How Clause 7.4 Connects to the Rest of ISO 22000
Clause 7.4 does not sit in isolation. It has direct connections to several other parts of the standard, and understanding those connections helps you build a communication process that actually supports food safety rather than just satisfying an audit requirement.
Connection to Clause 6.1: Actions to Address Risks and Opportunities
When your external communication process picks up a new regulatory requirement or a supplier quality issue, that information may need to be assessed as a risk or opportunity under Clause 6.1. The communication process is effectively a trigger for risk assessment activity.
Connection to Clause 8.1: Operational Planning and Control
Changes communicated internally, such as a new ingredient, a new piece of equipment, or a new cleaning chemical, need to be assessed for their impact on your operational controls. The food safety team needs this information to determine whether existing controls are still adequate or whether new controls need to be established.
Connection to Clause 8.5.2: Hazard Analysis
This is the most critical connection. Any change in the information that feeds your hazard analysis must be communicated to the food safety team so they can determine whether the hazard analysis needs to be updated. The standard is explicit about this. If your communication process is not feeding changes into your hazard analysis review, you have a systemic gap that an auditor will find.
You can learn more about this process in the guide on how to conduct a hazard analysis for ISO 22000.
Connection to Clause 9.3: Management Review
Communication outputs, including customer complaints, regulatory changes, and internal change notifications, are inputs to your management review process. Your management review agenda should include a standing item on communication outcomes so that leadership is aware of food safety relevant information flowing through the system.
Common Audit Findings Under Clause 7.4
After years of auditing food businesses, the same gaps come up repeatedly under Clause 7.4. Here is what to watch out for.
No Defined Responsibility for External Communication
The organisation has no one formally assigned to monitor regulatory updates, manage supplier communications, or handle customer complaints from a food safety perspective. Communication happens ad hoc, and there is no evidence trail.
Communication Happens But Is Not Recorded
Verbal conversations happen, emails get sent, but nothing is logged. In an audit, if it is not documented, it did not happen. A simple communication register that captures the date, the nature of the communication, who was involved, and what action was taken is sufficient.
The Food Safety Team Is Not Being Notified of Changes
Changes to ingredients, equipment, or processes are happening without the food safety team being informed. This is the most serious gap because it means your hazard analysis may be based on outdated information.
One-Way External Communication Only
The organisation sends information to customers and suppliers but has no documented process for receiving and acting on information from them. Clause 7.4.1 requires both directions to be covered.
Building a Communication Process That Actually Works
Here is a practical framework for implementing Clause 7.4 in a way that is both audit-ready and genuinely useful for your food safety system.
- Map your communication channels: Identify every way that food safety relevant information enters and leaves your organisation. Supplier notifications, regulatory subscriptions, customer complaint channels, internal change requests, staff feedback mechanisms. Write them down.
- Assign clear ownership: Every communication channel needs a named owner. Who is responsible for monitoring FSANZ updates? Who manages customer complaints? Who receives supplier notifications? Ambiguity is the enemy of effective communication.
- Create a simple logging system: You do not need complex software. A shared spreadsheet or a simple paper register works fine for most small to medium food businesses. The key is consistency. Every food safety relevant communication gets logged.
- Build the escalation path to the food safety team: Define what types of communications require notification to the food safety team, and set a timeframe. A new allergen in a supplier ingredient should trigger an immediate notification. A minor packaging change might have a defined review window.
- Link communication to your change management process: Any internal change that is food safety relevant should trigger a formal review by the food safety team before implementation. This is where Clause 7.4.2 and Clause 8.1 connect in practice.
- Include communication performance in your management review: Report on communication activities at your management review. How many customer complaints were received? Were any regulatory changes identified? Were all internal changes reviewed by the food safety team? This keeps leadership engaged with the communication process.
For businesses that are still working towards their initial certification, understanding the broader requirements of the standard is important before diving into individual clauses. The essential guide to ISO 22000 gives you a solid overview of what the standard covers and what certification involves.
If you are unsure about the costs involved in getting certified, the article on how much ISO 22000 certification costs gives you a realistic breakdown of what to expect.
A Note on Communication During Food Safety Incidents
Clause 7.4 takes on particular importance during a food safety incident or a product recall. Your communication process needs to be able to scale up rapidly when something goes wrong. Who contacts the regulator? Who notifies affected customers? Who communicates internally to halt production and quarantine product?
These are not questions you want to be answering for the first time during an actual incident. Your communication procedures should include a food safety incident communication plan that defines roles, responsibilities, and contact details for all relevant parties. Food Standards Australia New Zealand maintains a product recall process that food businesses should be familiar with, and your communication procedures should align with those requirements.
Testing your incident communication process periodically, through a tabletop exercise or a simulated scenario, is good practice and demonstrates to auditors that your communication process is not just documented but actually functional.
Getting Help With ISO 22000 Implementation
Clause 7.4 is one of those requirements where the gap between having a procedure and actually having an effective system is significant. Many food businesses invest time in writing a communication procedure but then find that the procedure is not being followed consistently, records are incomplete, or the food safety team is still finding out about changes after the fact.
If you are working through ISO 22000 implementation and want to make sure your communication process will hold up under audit scrutiny, getting advice from an experienced food safety consultant is worthwhile. The challenge is finding someone who genuinely understands the food industry and the standard, rather than someone who will hand you a template and call it a day.
CertBetter connects food businesses with verified ISO consultants and accredited certification bodies who specialise in ISO 22000. You submit one form, receive up to three competing quotes, and can compare experience, approach, and pricing before committing to anyone. The service is completely free for businesses. It is a straightforward way to find the right support without spending weeks searching and vetting providers yourself.
