ISO 22000 Through the Eyes of an Auditor. Issue No. 2

Before building your defense, understand where the threat may come from. Context of the Organization (clause 4.1)
At many companies, clause 4.1 is a “dusty folder” with a SWOT analysis downloaded from the internet three years ago. But let’s be honest: ISO 22000 is a system written in the “blood” and bankruptcies of companies that failed to notice how the world outside their fence had changed.
The requirement to understand the context is not a marketing exercise. It is your intelligence system. You cannot build an effective HACCP plan if you do not know what is happening beyond the walls of your production area.
1. Why does the auditor care about what is happening outside?
The auditor is looking for evidence that your food safety management system (FSMS) is not an isolated bunker. It must respond to external and internal factors.
External context: If a waste incineration site or chemical terminal has opened near your plant, but your context analysis says nothing about it, the auditor understands one thing: you are not controlling air contamination risks.
Internal context: If 70% of your equipment is worn out and held together with “blue duct tape”, while your context says that the “resource base is stable”, this is a direct lie to the system.
Case from practice: A company ignored clause 4.1, treating it as a formality. When the quality of incoming well water in the region sharply deteriorated due to climate-related changes, the filtration system failed to cope. The result: a product recall worth millions and loss of certification. They simply failed to “see” the threat in their context.
2. How to connect context with reality: the IFC method
Based on the recommendations of the IFC, the International Finance Corporation, context should become the foundation for hazard analysis. The auditor will check this chain:
Identification: You recorded a risk in the context, for example, power outages in the region.
Assessment: You transferred this risk to clause 6.1, Actions to address risks.
Solution: You implemented a control measure, for example, purchased a generator or installed temperature recorders with phone alerts.
If this chain does not exist, your SWOT analysis is useless.
3. Evidence matrix: what should you prepare?
To successfully pass the audit for clause 4.1, show the expert not just a document, but a process:
A live SWOT/PESTLE analysis: It should include points specific to the food industry: the veterinary situation in the region, changes in legislation such as new pesticide limits, and a shortage of qualified food technologists in the labor market.
Records of review: Context cannot be permanent. Show meeting minutes where you discussed questions such as: “How will the closure of this port affect us?” or “What will we do if our main packaging supplier leaves the market?”
Connection with the scope of application, clause 4.3: Prove that your certification scope takes into account all sites and processes identified during the context analysis.
ISO 22000 teaches us that in food safety, there are no “sudden” disasters. There are only unaccounted factors. Clause 4.1 is your radar system. If it is switched off, you are building your defense blindly.
The auditor wants to see that you understand the world in which you operate. Because only by understanding where the threat may come from can you build a defense that cannot be broken.
In the next issue: Interested Parties, clause 4.2. Why your clients’ “wish lists” and inspectors’ requirements are not a headache, but part of your defense.
Your expert view on certification - Guard is Certification.