ISO 22000 Mandatory Documents: All 30 Explained by Clause (2026)

Last updated 19 September 2026

ISO 22000 mandatory documents are the documented information the standard explicitly requires an organisation to maintain or retain — and ISO 22000:2018 requires more of it than most ISO management system standards, because clause 8 turns each Codex HACCP step into a documented requirement and adds prerequisite programmes, traceability, emergency preparedness and verification on top. Thirty items is the honest count: nine from the management-system clauses 4 to 7, eighteen from clause 8, and three from clauses 9 and 10.

The list below gives each one with its clause, whether it is a document to maintain or a record to retain, and what an auditor expects it to contain — followed by the documents that are not required by the text but that every certification audit asks for anyway, and a sequence for producing the set without duplicating it.

How ISO 22000 uses “documented information”

ISO 22000:2018 follows the harmonised structure, so it never says “procedure” or “record” as a requirement; it says documented information that must be maintained (a living document) or retained (evidence of what happened). The distinction decides how each item is controlled under clause 7.5: maintained information is version-controlled and approved; retained information is protected from alteration and kept for a defined period. The list below marks each item accordingly. Our guide to ISO 22000 covers the structure the list follows.

ISO 22000 mandatory documents: clauses 4 to 7

ISO 22000 mandatory documents in clause 8: the operational set

ISO 22000 mandatory documents in clauses 9 and 10

Counting 9.3.3 and 10.1 separately gives 32 ISO 22000 mandatory documents; they are grouped here because most organisations hold them in the same records as 8.9 and 9.2. Our guide to product recall under clause 8.9.5 covers item 28 in depth.

Documents not required by the text but expected at audit

Producing the ISO 22000 mandatory documents without duplication

1. Start with clause 8.5.1. Product and material characteristics, intended use and flow diagrams are the inputs to everything; write them first and keep them current.
2. Do the hazard analysis in one worksheet. Identification, acceptable levels, assessment, control measure selection and CCP/OPRP categorisation are one document with columns, not five documents. Our guide to OPRP vs CCP covers the categorisation.
3. Let the hazard control plan generate the monitoring records. Each row in the plan defines a record; design the forms from the rows.
4. Put the PRPs on ISO/TS 22002-1’s list. One procedure per PRP topic, each with its verification method, gives 8.2 and half of 8.8 at once.
5. Combine the small procedures. Traceability, emergency preparedness and recall are three procedures that one incident may invoke together; cross-reference them and test them in one exercise.
6. Build the clause 9 records from the clause 8 ones. Verification analysis (8.8.2) is the input management review (9.3) needs; internal audit (9.2) samples the same records the auditor will.

Frequently asked questions

How many mandatory documents does ISO 22000 require?
Around thirty explicitly required items of documented information: nine in clauses 4–7, eighteen in clause 8 and three or more in clauses 9–10, depending on how the records are grouped. Clause 8 is the largest because each Codex HACCP step and each of PRPs, traceability, emergency preparedness and verification is a documented requirement.

Does ISO 22000 require a food safety manual?
No. The 2018 edition requires documented information, not a manual; many organisations keep a short FSMS description because it helps the auditor, but it is not mandatory.

What is the difference between maintain and retain?
Maintained documented information is a living document — policy, procedures, the hazard control plan — under version control. Retained documented information is a record — monitoring results, verification, audits — kept as evidence and protected from alteration.

Is the HACCP plan a mandatory document?
Yes — as the hazard control plan under clause 8.5.4, covering CCPs and OPRPs, together with the preliminary-step documents (8.5.1), the hazard analysis (8.5.2) and validation records (8.5.3).

Do the PRPs have to be documented?
Yes. Clause 8.2 requires the PRPs to be established, implemented, maintained and updated, and documented information on their selection, establishment, monitoring and verification to be kept — normally against ISO/TS 22002 for the relevant sector.

Where this leaves you

Build the ISO 22000 mandatory documents from clause 8 outward: the preliminary-step descriptions first, a single hazard analysis worksheet, a hazard control plan whose rows define the monitoring records, PRP procedures with their verification, and the traceability, emergency and recall procedures tested together — then the policy, objectives, communication and control documents of clauses 4–7 and the audit and review records of clauses 9–10 that sit around them.

References

• ISO 22000:2018 — Food safety management systems — Requirements for any organization in the food chain — Documented-information requirements by clause.
• ISO — ISO 22000 food safety management — The ISO 22000 family, including the ISO/TS 22002 PRP standards.

More on ISO 22000

• ISO 22000 mandatory documents — you are here
• ISO 22000: how the food safety management standard works
• ISO 22000 implementation: the 10 steps
• OPRP vs CCP
• Product recall under clause 8.9.5
• The traceability system: clause 8.3

The FSMS manual set, the food safety policy and objectives, the prerequisite programme manual, the hazard analysis of raw, packing and product contact materials, the CCP and OPRP monitoring and verification plans, the identification and traceability, emergency preparedness, non-conforming product, internal audit and management review procedures are in the ISO 22000 Toolkit, or start with the free templates.