The requirement that applies today
The organization plans, establishes, implements and maintains an audit programme covering frequency, methods, responsibilities, planning and reporting, taking account of the importance of the processes, changes in the system and earlier audit results, measurement data and monitoring. It defines the criteria and scope of each audit, selects competent auditors and keeps the audit objective and impartial, reports results to the food safety team and relevant management, keeps records of the programme and results, takes correction and corrective action within an agreed time, and determines whether the system meets the intent of the policy and objectives. Follow-up includes verifying the actions and reporting the result.
ISO 22000:2018, 9.2.2 Internal audit: programme; ISO/DIS 22000:2026, 9.2.2.
What the draft does
Retitled in the draft contents: The current edition already numbers this paragraph 9.2.2. The public contents give it the heading Internal audit programme. That is an editorial change in the contents, not a new requirement, and the draft text is sold by ISO and not held here.
Source: public contents and foreword at 9.2.2, retrieved 2026-10-19.
Why this clause matters
The programme is where audit becomes a system rather than an event. The risk-based frequency is the part teams under-use: the line with the most deviations should be audited more often. The independence requirement is also here, and it is a common finding.
Suggested evidence to discuss with your auditor
For 9.2.2, these are the artefacts we suggest discussing with your auditor. The standard publishes no evidence list, so this is our reading, not a requirement.
- A risk-based programme with frequency and rationale
- Auditor competence and independence records
- Follow-up evidence that actions were verified
Where systems usually fall short
- The same frequency for every process regardless of risk
- Auditors auditing their own work
How to prepare
Rebuild the programme around risk: list the processes, score them by food safety importance and recent performance, and set the frequency from the score. That change alone often improves the next external audit.
Dates
Cross-references
Source
Clause 9.2.2. Current edition: ISO 22000:2018. Draft: ISO/DIS 22000:2026. Retrieved 2026-10-19. The full DIS text for 9.2.2 is sold by ISO and not held here; the sources page lists what is.
Not legal advice; does not certify; our words, not the standard's, and the planning date is an estimate.