The requirement that applies today
Based on the assessment, the organization selects a control measure or combination that can prevent or reduce each significant hazard to the defined acceptable level. It categorises each selected measure as an OPRP or as a CCP, using a systematic approach. For each measure it weighs how likely the measure is to fail and how bad the result would be, including the effect on the hazard, the position relative to other measures, whether the measure was specifically established for the hazard, and whether it stands alone or is part of a combination. It also assesses the feasibility of measurable limits or criteria, monitoring, and timely correction. The decision process and the results are documented, along with external requirements that affect the choice and strictness.
ISO 22000:2018, 8.5.2.4 Hazard analysis: selection and categorization of control measures; ISO/DIS 22000:2026, 8.5.2.4.
What the draft does
Subclause of 8.5.2; not listed separately in the public contents: The public contents name 8.5.2 at this position but do not list its subclauses. The subclause structure shown here comes from the held current edition; whether the draft keeps it is sold by ISO and not held here.
Source: public contents and foreword at 8.5.2.4, retrieved 2026-10-19.
Why this clause matters
The OPRP versus CCP decision is the most argued point in food safety audits. The clause does not say "use a tree"; it says use a systematic approach and record it. A site that cannot explain why a measure is an OPRP rather than a CCP has a finding waiting. The draft adds an informative annex on this selection, which signals how much the committee cares about it.
Suggested evidence to discuss with your auditor
For 8.5.2.4, these are the artefacts we suggest discussing with your auditor. The standard publishes no evidence list, so this is our reading, not a requirement.
- A decision record for each control measure, showing the reasoning for OPRP or CCP
- The likelihood and severity assessment behind each decision
- External requirements that affected the choice or strictness
Where systems usually fall short
- A decision tree copied from a template with no recorded reasoning
- Every measure classified as a CCP to be safe, which dilutes attention
How to prepare
Take the measure that has been argued about most and write the decision in five sentences: what it controls, what happens if it fails, why it is an OPRP or a CCP, what limit or criterion it uses, and who monitors it. That note is the evidence.
Dates
Cross-references
Source
Clause 8.5.2.4. Current edition: ISO 22000:2018. Draft: ISO/DIS 22000:2026. Retrieved 2026-10-19. The full DIS text for 8.5.2.4 is sold by ISO and not held here; the sources page lists what is.
Not legal advice; does not certify; our words, not the standard's, and the planning date is an estimate.