Templates and records · ISO 22000 · Clause 8.9.4
ISO 22000 potentially unsafe product record
What is done with the batch produced while a control point was outside its limit: hold it, evaluate it with evidence and decide whether it is released, reprocessed or destroyed.
In one sentence
The potentially unsafe product record identifies the product affected by a failure to meet a critical limit or action criterion, documents its holding, the evaluation that justifies releasing it and the decision on its disposition — reprocessing, other use or destruction — as required by clause 8.9.4 of ISO 22000.
- Where the standard requires it
- ISO 22000 · Clause 8.9.4 Clauses are cited using the numbering of ISO 22000:2018, the current edition. ISO is preparing a third edition that may renumber them; when it is published it will have its own transition period.
- Type of information
- Mandatory record Documented information on evaluation and disposition (8.9.4)
- Who fills it in
- Whoever has authority to release Usually the food safety team leader or the quality manager, according to the plan
- When
- As soon as the deviation is detected The product stays on hold until the decision is made
- How long it is kept
- At least the shelf life of the product It is the only period the standard sets (8.3). For long-life products that period governs; for fresh products it is worth extending it to the certification cycle.
What the standard requires
What ISO 22000 demands and what it leaves to your judgement
The organisation must prevent potentially unsafe product from entering the food chain, unless it can show that the hazards have been reduced to their acceptable level, will be reduced before entering the food chain or that, despite the deviation, the product conforms.
Product leaving a CCP outside its critical limit cannot be released and must be dealt with: reprocessed within or outside the organisation to reduce the hazard, diverted to another use if safety is not compromised, or destroyed. For failed OPRPs, the available evidence is used to evaluate whether it can be released.
The evaluation and the decision are retained, identifying who authorises it. If the product has already left, withdrawal comes into play (8.9.5).
Structure
Fields the template should include
- Product, batch, quantity and location
- CCP or OPRP not met and description of the deviation
- Production period affected
- Holding and identification measures
- Evaluation: data, testing or evidence used
- Decision: release, reprocessing, other use or destruction
- Who authorises the decision
- Verification after reprocessing, if any
- Link to the corrective action and, where applicable, to the withdrawal
Example
Example: soup trolleys outside the cooling criterion
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Product | Pumpkin soup 500 g · batch L26-071 · 2 trolleys, 640 tubs |
| Deviation | OPRP-1: trolleys 5 and 6 exceeded the maximum cooling time by 25 minutes |
| Holding | Trolleys blocked in chiller 2 with a product-on-hold label |
| Evaluation | Microbiological testing of six units by an external laboratory and review of the chiller temperature |
| Result | Conforming to the product specification |
| Decision | Release of both trolleys |
| Authorised by | Food safety team leader · 14 March 2026 |
| Corrective action | CA-26-017: review the maximum blast chiller load |
At the audit
Mistakes auditors commonly flag
- Product from a CCP deviation is released after an evaluation instead of being dealt with.
- The hold does not cover the whole period since the last conforming monitoring.
- The decision to release does not identify who authorises it or what it is based on.
- It is confused with the system nonconformity log and the specific batch is lost.
In Kimobox
How this record is kept in Kimobox
- 1A deviation recorded at a CCP or OPRP puts the affected batch on hold.
- 2The evaluation and test results are attached to the batch, and release requires the signature of whoever has authority.
- 3The corrective action, with a mandatory root cause, is opened from the batch on hold.
- 4If the batch has already left, traceability returns the customers who received it.
Frequently asked questions
What people ask us before getting started
Can a batch that failed at a CCP be released if the test results are good?
ISO 22000 does not allow it: product leaving a CCP outside its critical limit is not released and must be reprocessed, diverted to another use or destroyed. Evaluation for release on the basis of evidence applies to OPRPs.
When do you move to a withdrawal?
When the potentially unsafe product has already left the company's control. Clause 8.9.5 then applies and, in the European Union, Article 19 of Regulation (EC) 178/2002, which requires it to be withdrawn and the authorities informed.
Keep your ISO 22000 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
FSSC 22000 line clearance and quality control record
How to record line clearance at every start-up and product changeover, quality parameters and quantity…
Hazard control and the HACCP/OPRP plan
The core of ISO 22000: analysing hazards, validating control measures, monitoring CCPs and OPRPs, verifying…
ISO 22000 prerequisite programmes (PRP) plan template
How to document ISO 22000 prerequisite programmes: selection, responsibilities, monitoring and verification…
ISO 22000 hazard analysis template
How to carry out the ISO 22000 hazard analysis: identification by step, acceptable level, significance…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 22000:2018 — Food safety management systems. Requirements for any organization in the food chain ISO · 2018 ed., with Amd 1:2024
- Regulation (EC) No 178/2002, Articles 18 and 19 (traceability and withdrawal) EUR-Lex · 28 January 2002