Templates and records · ISO 22000 · Clause 8.5.2
ISO 22000 hazard analysis template
The document that justifies the whole plan: what can go wrong at each step, what level is acceptable in the end product and why each hazard is controlled the way it is.
In one sentence
The ISO 22000 hazard analysis identifies, step by step, the biological, chemical and physical hazards reasonably expected to occur, sets their acceptable level in the end product, assesses their likelihood and severity to decide which are significant and categorises each control measure as a CCP or an OPRP, all as documented information required by clause 8.5.2.
- Where the standard requires it
- ISO 22000 · Clause 8.5.2 Clauses are cited using the numbering of ISO 22000:2018, the current edition. ISO is preparing a third edition that may renumber them; when it is published it will have its own transition period.
- Type of information
- Mandatory record Documented information on identification, assessment and categorisation (8.5.2)
- Who fills it in
- The multidisciplinary food safety team Production, quality, maintenance and, if needed, external experts with evidence of competence
- When
- Before production and with every change A new product, recipe, supplier, equipment or process requires it to be reviewed (8.6)
- How long it is kept
- Set by the organisation ISO 22000 only sets a minimum for traceability (8.3: the shelf life of the product). Covering the shelf life plus the three-year certification cycle lets you show the history at recertification.
What the standard requires
What ISO 22000 demands and what it leaves to your judgement
Starting from the preliminary information — raw materials, end product, intended use and flow diagrams confirmed on site — the food safety team identifies the hazards reasonably expected according to the type of product, the process and the environment, and determines for each one the acceptable level in the end product, taking into account legislation, customer requirements and intended use.
Each hazard is assessed according to the likelihood of it occurring in the end product before control measures are applied and the severity of its effects. Significant ones are controlled with a measure that is categorised, using a systematic approach, as a CCP or an OPRP. The standard asks you to document the method and parameters used for that categorisation, as well as the outcome.
It does not impose a particular likelihood-by-severity matrix or decision tree: the Codex one or another can be used, provided it is consistent and applied in the same way to every hazard.
Structure
Fields the template should include
- Product or product family and flow diagram version
- Process step
- Hazard identified and its type: biological, chemical (allergens included) or physical
- Cause or source of the hazard at that step
- Acceptable level in the end product and its justification
- Likelihood, severity and outcome of the assessment
- Significant hazard? Yes or no, with reasoning
- Control measure chosen
- Category (CCP or OPRP) and criteria used to decide it
- Date, version and team members approving it
Example
Example: pasteurised pumpkin soup in 500 g tubs (fictitious company)
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Product | Chilled pumpkin soup, 500 g tub · flow diagram v4 |
| Step | 6. Heat treatment in kettle |
| Hazard | Biological: survival of Listeria monocytogenes and other vegetative pathogens |
| Source | Raw vegetables carrying a microbial load from the field |
| Acceptable level | According to the applicable microbiological criteria and the customer's specification for ready-to-eat products |
| Assessment | High likelihood without control · high severity · significant |
| Control measure | Heat treatment at a validated time and temperature |
| Category | CCP: there is a measurable critical limit and it is the last step that eliminates the hazard |
| Step 9. Cooling | Hazard: germination of spore-formers · measure: rapid cooling · OPRP category, with a time and temperature action criterion |
| Approval | Food safety team · version 5 · 20 February 2026 |
At the audit
Mistakes auditors commonly flag
- Generic hazards ("contamination") with no specific agent or step where they occur.
- The acceptable level in the end product is missing, or confused with the critical limit.
- The categorisation as CCP or OPRP is not reasoned: only the outcome appears.
- Allergens are not analysed as a chemical hazard and are left to labelling alone.
- The flow diagram was not confirmed on the floor and omits rework or holding steps.
In Kimobox
How this record is kept in Kimobox
- 1The analysis is built on the process map: each step in the diagram carries its hazards and their assessment.
- 2Each significant hazard links to its control measure and, if it is a CCP or OPRP, to its sheet in the plan.
- 3A change in recipe or in a supplier's technical data sheet triggers a review of the affected steps.
- 4Versions are saved with their date and approval.
Frequently asked questions
What people ask us before getting started
Do we have to use the Codex decision tree?
It is not mandatory. ISO 22000 requires a systematic, documented approach to categorising control measures, and the Codex tree is one option. What matters is that the criterion is explicit and applied in the same way to every hazard.
What is the acceptable level?
It is the level of a hazard that must not be exceeded in the end product for it to be safe in its intended use. It is set on the basis of legislation, customer requirements and the use of the product, and it is the benchmark for knowing whether the control measures are sufficient.
Keep your ISO 22000 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Hazard control and the HACCP/OPRP plan
The core of ISO 22000: analysing hazards, validating control measures, monitoring CCPs and OPRPs, verifying…
ISO 22000 prerequisite programmes (PRP) plan template
How to document ISO 22000 prerequisite programmes: selection, responsibilities, monitoring and verification…
ISO 22000 validation of control measures template
How to document validation of ISO 22000 control measures before applying them: method, evidence, outcome and…
ISO 22000 HACCP/OPRP plan (hazard control plan) template
What the ISO 22000 hazard control plan must include for each CCP and OPRP: limits, action criteria…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 22000:2018 — Food safety management systems. Requirements for any organization in the food chain ISO · 2018 ed., with Amd 1:2024
- General Principles of Food Hygiene, CXC 1-1969 Codex Alimentarius (FAO/WHO) · 2020 revision