The requirement that applies today
The organization makes sure the data from monitoring OPRPs and CCPs is evaluated by designated people who are competent and empowered to start corrections and corrective actions.
ISO 22000:2018, 8.9.1 Control of product and process nonconformities: general; ISO/DIS 22000:2026, 8.9.1.
What the draft does
Unchanged title: The public contents keep 8.9.1 at the same number and title. No structural change is shown.
Source: public contents and foreword at 8.9.1, retrieved 2026-10-19.
Why this clause matters
This is about authority at the point of decision. A deviations log that waits for a weekly meeting is not control. The clause names competence as well as authority, because the judgement about a deviation is technical.
Suggested evidence to discuss with your auditor
For 8.9.1, these are the artefacts we suggest discussing with your auditor. The standard publishes no evidence list, so this is our reading, not a requirement.
- Named people with the authority to hold product and start action
- Evidence of their competence for that judgement
- A deviation record showing the evaluation and the decision
Where systems usually fall short
- A supervisor who can stop the line but cannot authorise a release
- Data evaluated days after the event
How to prepare
List the people who can hold product, and the people who can release it. If the lists are empty or the same person, the authority is not designed. Name deputies as well. List the people who can hold product and the people who can release it, with deputies. If the two lists are the same person, the control has a single point of failure. Put the list in the deviation procedure and check it at the start of every shift.
Dates
Cross-references
Source
Clause 8.9.1. Current edition: ISO 22000:2018. Draft: ISO/DIS 22000:2026. Retrieved 2026-10-19. The full DIS text for 8.9.1 is sold by ISO and not held here; the sources page lists what is.
Not legal advice; does not certify; our words, not the standard's, and the planning date is an estimate.