The Foundation That Most Food Businesses Get Wrong
If you are working towards ISO 22000 certification, you will quickly encounter the term prerequisite programs, often abbreviated as PRPs. They are one of the most misunderstood parts of the standard, and getting them wrong can derail your entire food safety management system before you even get to the hazard analysis stage.
On this page
Prerequisite programs under ISO 22000 are the basic conditions and activities that are necessary to maintain a hygienic environment throughout the food chain. Think of them as the non-negotiable baseline your operation must meet before you can even begin building the more complex layers of food safety control. Without solid PRPs in place, your hazard analysis will be built on shaky ground, and any auditor worth their salt will pick that up immediately.
This article explains what PRPs are, how they differ from other control measures in ISO 22000, what categories they cover, and how to implement them in a way that actually works in practice, not just on paper.
What ISO 22000 Actually Says About PRPs
ISO 22000 addresses prerequisite programs primarily in Clause 8.2. The standard defines PRPs as basic conditions and activities that are necessary to maintain a hygienic environment throughout the food chain, suitable for the production, handling and provision of safe end products and safe food for human consumption.
That definition sounds straightforward, but the practical scope is broad. The standard does not prescribe a fixed list of what your PRPs must include. Instead, it requires you to identify, implement, maintain, and verify PRPs that are appropriate to your organisation and its position in the food chain.
This is where many businesses stumble. They either adopt a generic PRP template that does not reflect their actual operations, or they treat PRPs as a documentation exercise rather than a genuine operational discipline. Neither approach will hold up under audit, and more importantly, neither approach will actually protect your product or your customers.
For a broader understanding of how ISO 22000 works as a complete system, the ISO 22000 essential guide to safe and reliable food production is a useful starting point before you dive into the specifics of PRPs.
PRPs vs CCPs vs OPRPs: Understanding the Difference
One of the most common points of confusion in ISO 22000 is understanding how PRPs relate to Critical Control Points (CCPs) and Operational Prerequisite Programs (OPRPs). These are three distinct layers of control within the food safety management system, and they serve different purposes.
Prerequisite Programs (PRPs)
PRPs address general hygiene and operational conditions. They are not specifically designed to control identified food safety hazards at a particular point in the process. Instead, they create the environment in which safe food production can occur. Examples include pest control, cleaning and sanitation, personal hygiene, and supplier management.
Operational Prerequisite Programs (OPRPs)
OPRPs sit between PRPs and CCPs. They are identified through the hazard analysis process and are designed to control specific hazards or reduce the likelihood of hazard introduction. Unlike CCPs, OPRPs do not have critical limits in the traditional sense, but they do require defined corrective actions and monitoring. An example might be a specific allergen cleaning procedure between product runs.
Critical Control Points (CCPs)
CCPs are specific steps in the process where a control measure can be applied to prevent, eliminate, or reduce a food safety hazard to an acceptable level. They have defined critical limits, continuous or frequent monitoring, and immediate corrective action requirements. Pasteurisation temperature and metal detection are classic examples.
The distinction matters because your hazard analysis determines which category each control measure falls into. Getting this classification right is essential, and it directly affects how you document, monitor, and verify each control.
Common Categories of PRPs in Food Businesses
While ISO 22000 does not prescribe a fixed list, it does reference ISO/TS 22002 series as a source of sector-specific PRP guidance. The categories below represent the most common areas that food businesses need to address, regardless of where they sit in the food chain.
Construction and Layout of Buildings
The physical design of your facility plays a significant role in food safety. PRPs in this category cover the separation of raw and ready-to-eat areas, traffic flow patterns to prevent cross-contamination, floor and wall construction that allows effective cleaning, and drainage design. If your building layout creates opportunities for contamination, no amount of paperwork will fix that.
Cleaning and Disinfection
This is one of the most operationally intensive PRP categories. You need documented cleaning schedules, validated cleaning procedures, approved chemicals at correct concentrations, trained staff, and verification that cleaning has actually been effective. Many businesses have cleaning schedules that look thorough on paper but are rarely followed in practice. Auditors know this, and they will check.
Pest Control
Pest control PRPs require a documented program that includes facility inspection, identification of entry points, bait station placement maps, records of pest activity, and evidence of corrective action when pests are detected. You can manage this internally or through a licensed contractor, but either way, the records must be complete and current.
Personal Hygiene
Personal hygiene PRPs cover handwashing procedures, illness reporting requirements, protective clothing, jewellery policies, and visitor controls. This category is frequently cited in audit findings because the gap between the written procedure and actual staff behaviour can be significant. Training records and observable compliance are both assessed.
Supplier and Raw Material Management
You cannot control what you do not know about. PRPs for supplier management include approved supplier lists, supplier qualification criteria, incoming material specifications, and receiving inspection procedures. If a supplier delivers contaminated raw material and you have no controls at the receiving stage, your entire downstream process is compromised.
Cross-Contamination Prevention
This is particularly critical for businesses handling allergens or operating with multiple product lines. PRPs here cover physical separation, scheduling controls, dedicated equipment, and air handling considerations. Allergen management has become one of the most scrutinised areas in food safety audits globally.
Water and Air Quality
Water used in food production or that contacts food surfaces must meet potable water standards. PRPs in this area cover water testing schedules, treatment procedures where required, and records of results. Compressed air that contacts food or food contact surfaces also requires attention.
Waste Management
Waste PRPs address the identification, collection, storage, and disposal of waste in a way that prevents contamination. This includes food waste, packaging waste, and chemical waste. Poorly managed waste is a significant pest attractant and contamination risk.
Temperature Control
For businesses handling temperature-sensitive products, PRPs for refrigeration and freezing equipment cover calibration of monitoring devices, alarm systems, maintenance schedules, and records of temperature readings. This overlaps with some CCP monitoring but the PRP layer addresses the general maintenance and operational reliability of the equipment itself.
How to Develop PRPs That Actually Work
Developing PRPs is not a desk exercise. It requires you to walk your facility, understand your processes, and think honestly about where contamination or hygiene failures could occur. Here is a practical approach.
Start With a Facility Walk-Through
Before you write a single procedure, spend time observing your operation. Watch how staff move through the facility, how raw materials are received and stored, how cleaning is actually performed, and how waste is handled. What you observe will often differ from what you assumed was happening. Document what you find, including the gaps.
Identify Applicable PRP Categories
Based on your position in the food chain and the nature of your products, determine which PRP categories are relevant to your operation. A primary producer has different PRP requirements than a food manufacturer or a caterer. Use the relevant part of the ISO/TS 22002 series as a reference for your sector.
Write Procedures That Reflect Reality
Your PRP procedures need to describe what actually happens in your facility, not an idealised version of it. If your cleaning procedure says a task takes 15 minutes but it actually takes 45 minutes, you have a problem waiting to happen. Procedures that staff cannot realistically follow will simply be ignored.
Define Monitoring and Verification
For each PRP, you need to define how you will monitor that it is being implemented, and how you will verify that it is effective. Monitoring might be a daily supervisor check. Verification might be a monthly environmental swab for microbial contamination. Both need to be documented and the records retained.
Train Your People
PRPs only work if the people responsible for implementing them understand why they matter, not just what they are supposed to do. Training should cover the rationale behind each PRP, not just the procedure steps. Staff who understand the food safety reason for a control are far more likely to follow it consistently.
For guidance on building a competency framework to support this, the article on how to build an ISO training matrix for your team provides a practical approach that applies equally well to food safety roles.
Documenting PRPs for ISO 22000 Certification
ISO 22000 requires documented information relating to your PRPs. This includes the procedures themselves, the monitoring records, verification results, and any corrective actions taken when a PRP is found to be not implemented or ineffective.
The level of documentation required is proportionate to the risk. A simple PRP like hand hygiene at a low-risk operation might be documented with a brief procedure and a training record. A complex cleaning validation for allergen removal at a high-risk manufacturer will require far more detailed documentation including validated cleaning methods and test results.
One common mistake is treating PRP documentation as a one-time setup task. PRPs need to be reviewed regularly, particularly when there are changes to your processes, products, facilities, or personnel. A PRP that was appropriate two years ago may not adequately address current risks. For practical guidance on keeping your documentation current and organised, the article on how to document your ISO 22000 system covers the key requirements in detail.
PRPs and the Hazard Analysis Connection
Here is something that is easy to miss: your PRPs directly inform your hazard analysis. When you conduct your hazard analysis under Clause 8.5 of ISO 22000, you assess each identified hazard and consider whether existing control measures, including your PRPs, are sufficient to manage it to an acceptable level.
If a hazard is adequately controlled by a PRP, it may not need to be addressed by an OPRP or CCP. But if your PRPs are weak or poorly implemented, your hazard analysis will identify gaps that need to be filled with more specific controls. This is why getting your PRPs right early in the process saves significant effort later.
For a step-by-step approach to the hazard analysis itself, the article on how to conduct a hazard analysis for ISO 22000 walks through the process in practical terms.
What Auditors Look for When Assessing PRPs
Having worked in ISO certification auditing, I can tell you that PRPs are one of the first areas an auditor will examine, and they will look beyond the documentation. Here is what they are actually assessing.
First, they will check that your documented PRPs reflect your actual operation. Generic templates that clearly do not match your facility layout or processes are a red flag. Second, they will look at your monitoring records to see if they are being completed consistently and if anyone is actually reviewing them. Records that are always perfect with no variation are suspicious. Third, they will observe your facility and staff behaviour to see if PRPs are being followed in practice. Fourth, they will check that when monitoring identified a failure, a corrective action was recorded and followed up.
The most common PRP-related findings in ISO 22000 audits include incomplete monitoring records, PRPs that have not been updated to reflect operational changes, lack of evidence that verification activities have been performed, and training records that do not cover PRP procedures.
Getting Expert Help With Your PRP Development
Developing a comprehensive and effective set of PRPs requires both knowledge of the ISO 22000 requirements and genuine understanding of food safety principles. For many businesses, particularly those going through certification for the first time, working with an experienced food safety consultant makes a significant difference in both the quality of the system and the time it takes to get there.
If you are looking for qualified ISO 22000 consultants or accredited certification bodies to help you through the process, CertBetter makes it straightforward. You submit one form and receive up to three competing quotes from vetted providers who have been assessed for their credentials and experience. The service is completely free for businesses, and it removes the guesswork from finding someone who actually knows food safety management systems, not just ISO documentation in general.
