IWA 37-3:2022

INTERNATIONAL IWA
WORKSHOP 37-3
AGREEMENT
First edition
2022-10
Safety, security and sustainability of
cannabis facilities and operations —
Part 3:
Good production practices (GPP)
Reference number
© ISO 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 2
3 Terms and definitions . 2
4 General .10
4.1 Understanding the organization and its context . 10
4.2 Understanding the needs and expectations of interested parties . 10
4.3 Establishing the CQP . 11
4.3.1 General . 11
4.3.2 Control of externally provided processes, products or services . 11
4.4 Licences . 11
4.5 Policy . 11
4.5.1 Establishing the CQP policy . 11
4.5.2 Communicating the CQP policy .12
4.6 Organizational roles, responsibilities and authorities .12
4.6.1 General .12
4.6.2 Quality and safety team leader .12
4.6.3 Product security . 13
4.7 Planning of changes .13
5 Support .13
5.1 Resources . 13
5.1.1 General .13
5.1.2 People . 14
5.1.3 Infrastructure . 14
5.1.4 Work environment . 14
5.2 Documented information . 14
5.2.1 General . 14
5.2.2 Creating and updating . 15
5.2.3 Control of documented information . 15
5.2.4 Data integrity and backup . 15
6 Designing and implementing GPP within the operation .15
6.1 Development of processes . 15
6.2 Establishing criteria for processes . 16
6.2.1 Characteristics of raw materials, ingredients and product contact materials . 16
6.2.2 Characteristics of end products (finished products) . 16
6.2.3 Intended use . 17
6.2.4 Flow diagrams and description of processes . 17
6.3 Risk assessment/Hazard analysis . 18
6.3.1 General . 18
6.3.2 Hazard identification and determination of acceptable levels . 18
6.3.3 Hazard assessment . 19
6.3.4 Selection and categorization of control measures . 19
6.4 Implementing process controls . 20
6.4.1 Good production practices (GPP) . 20
6.4.2 Control measures for significant hazards . 21
6.4.3 Validation of control measures for significant hazards . 21
6.4.4 Control of monitoring and measuring methods .22
6.5 Process control documentation .22
6.5.1 Master manufacturing records (MMRs) .22
6.5.2 Batch manufacturing records . 23
6.6 Verification related to GPP and the hazard control plan . 24
iii
6.6.1 Verification . 24
6.6.2 Verification results . 24
6.6.3 Analysis of results of verification activities . 25
6.7 Laboratory system/Product testing . 25
6.7.1 Testing for phytocannabinoids . 25
6.7.2 Testing for contaminants . 25
6.7.3 Testing for pesticides . 26
6.7.4 Sample retention .26
6.7.5 Durable life/Durable life date . 26
6.8 Control of product and process nonconformities . 27
6.8.1 General . 27
6.8.2 Corrections . 27
6.8.3 Corrective actions .28
6.8.4 Handling of potentially unsafe products .28
6.9 Complaint management .30
6.10 Identification and traceability . 30
6.11 Packaging system . . 31
6.11.1 General . 31
6.11.2 Packaging: Sustainability, safety and quality . 31
6.11.3 Packaging: Containers and wrappers . 31
6.11.4 Packaging labelling: Product identifiers . 32
6.11.5 Packaging labelling: Advertising . 33
Annex A (normative) GPP for cannabis and cannabis product quality and safety .34
Annex B (informative) Guidance on applying GPP to cannabis edibles .54
Bibliography .66
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
International Workshop Agreement IWA 37 was approved at a series of workshops hosted by the
Standards Council of Canada (SCC), in association with Underwriters Laboratories of Canada (ULC),
held virtually between December 2020 and June 2021.
A list of all parts in the IWA 37 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
v
Introduction
While cannabis has been fully legalized in Canada and in many states in the USA, it is a new and emerging
industry that is moving at a very fast pace in many other parts of the world. While legalization is being
deliberated by governments and legislative bodies, companies are creating their own infrastructure
in anticipation of legal approval. Meanwhile, government regulators and the societies they serve are
grappling with the lack of consistent rules and guidance to deliver safety, security and sustainability
of cannabis facilities and operations, while growers and producers use their own judgment on how to
establish and operate facilities.
It has become very clear that the global cannabis market is opening up very rapidly. The cannabis
product and the industry will become more and more ubiquitous as the global barriers start to lower
and come down. If the current trend continues, it is predicted that well over one third of the globe will
accommodate cannabis by 2024.
What is unique about this new and emerging industry is that it is coming from an illicit status into
decriminalization and evolving into a legitimate burgeoning business. Due to its pioneering status, very
little exists in terms of research, studies, historical experience and best practices. Standardization is
likewise very slow on the uptake and the cannabis industry remains severely underserved.
There are therefore distinct challenges for the safety, security and sustainability of cannabis facilities
and operations, which the IWA 37 series seeks to address as follows:
— Part 1: Requirements for the safety of cannabis buildings, equipment and oil extraction operations;
— Part 2: Requirements for the secure handling of cannabis and cannabis products;
— Part 3 (this document): Good production practices (GPP).
The good production practices (GPP) specified in this document are intended to ensure product quality
by mitigating threats of mislabelling or adulterating cannabis products. These practices are compatible
with the requirements for safety, product security and facility safety specified in IWA 37-1 and IWA 37-
2.
To align with international best practices, this document builds upon the internationally recognized
framework and principles used in good manufacturing practices (GMP) and GPP, which comprise
a system of processes, procedures and documentation that help to ensure products are consistently
produced and controlled in accordance with quality standards. These practices are typically required
to conform to guidelines and regulations recommended by agencies that control authorization and
licensing for the manufacture and sale of food, drug products and active pharmaceutical products. The
application of these guidelines require that manufacturers, processors and packagers of drugs, medical
devices and food take proactive steps to ensure that their products are safe, pure and effective.
The production of cannabis products presents unique and challenging hazards and requires additional
control measures and prerequisite programmes, from the perspectives of safety, product quality and
safety, product security and facility safety, as well as from the perspective of compliance with statutory
or regulatory requirements, which in most jurisdictions are in addition to those governing conventional
product manufacturing.
The production and sale of cannabis products encompasses the full supply chain from the cultivation
and harvesting of the cannabis plant, through the processing of the plants and the extraction of
concentrated oils to the manufacturing of cannabis products using conventional methods, and it
includes the storage, handling, distribution and retailing of these products.
Given the unique aspects associated with cannabis edibles, this sub-set of cannabis products is
considered separately. It is felt that the most effective approach for the development of future ISO
standards for cannabis edibles is to build upon the strong foundation for food safety management
systems set out in ISO 22000 and in ISO/TS 22002-1 together with the technical guidance contained
in the main body of this document, rather than to develop a new set of GPP exclusively for cannabis
edibles. Annex B outlines this approach in more detail.
vi
Supporting material to accompany the IWA 37 series is available at the following website:
IWA 37 — Safety, security and sustainability of cannabis facilities and operations.
A list of workshop participants is available from the Standards Council of Canada (SCC).
vii
International Workshop Agreement IWA 37-3:2022(E)
Safety, security and sustainability of cannabis facilities and
operations —
Part 3:
Good production practices (GPP)
1 Scope
This document specifies requirements and recommendations for organizations directly or indirectly
involved in the cannabis supply chain, to enable them to:
— plan, implement, operate, maintain and update a good production practice programme for providing
products that are safe, according to their intended use;
— demonstrate compliance with applicable statutory and regulatory requirements;
— evaluate and assess mutually agreed customer requirements and demonstrate conformity to them;
— effectively communicate with interested parties and demonstrate conformity to relevant interested
parties;
— demonstrate conformity to stated policies in a cannabis quality programme (CQP) for product
safety, product quality, product security and facility safety;
— support the evaluation of quality programmes by external organizations or to permit self-assessment
or self-declaration of adherence to some or all of the guidance contained in this document.
All requirements in this document are generic and intended to be applicable to all organizations in the
cannabis supply chain, regardless of size and/or complexity. Organizations that are directly or indirectly
involved include (but are not limited to) growers/cultivators, harvesters, primary processors, producers
of cannabis, manufacturers of cannabis derivatives, cannabis edibles and/or cannabis products, testing
providers, retailers and organizations providing transportation, storage and distribution services,
suppliers of equipment, packaging materials and other contact materials.
This document intended to enable any organization, including small and/or less developed
organizations, to implement externally developed elements in its CQP.
NOTE 1 Organizations in the cannabis supply chain are diverse in nature and not all the requirements
specified in this document apply to each establishment or process. Justifications for exclusions or the use of
alternative measures can be documented by a risk assessment/hazard analysis or other appropriate means.
This document provides guidance related to the following categories of cannabis, cannabis derivatives
and cannabis products:
— cannabis plant seeds;
— cannabis plants;
— fresh cannabis;
— dried cannabis;
— cannabis derivatives;
— cannabis topicals;
— inhalable cannabis.
NOTE 2 Annex B provides additional guidance on applying GPP to cannabis edibles with respect to
requirements and recommendations in existing food safety standards.
Where buildings or premises combine cultivation and processing of cannabis plants, including ancillary
activities, along with other operational activities, the requirements and recommendations in this
document apply only to that portion of the facility.
NOTE 3 Where joint use activities are present in a common building, specific statutory and regulatory
requirements can apply for each category.
This document does not address the following:
— requirements related to research and development activities for finished products;
— general fire prevention or building construction features that are normally a function of local
building and fire codes where applicable;
— premises used exclusively for operational activities, such as office space, call centres and retail
outlets, used for the distribution, marketing, or sale of cannabis;
NOTE 4 Shipping and receiving of products from the production facility for further distribution are not
considered as a retail outlet.
— the safe consumption or use of the cannabis or cannabis products produced by organizations
applying these good production practices;
— occupational health and safety requirements governing cannabis workers and personnel except as
identified in A.8.4 and A.8.6;
— the protection of the environment;
— security of the supply chain monitoring system, including cybersecurity and notifications;
NOTE 5 Security and monitoring of the supply chain are dealt with specifically in IWA 37-2.
— outdoor cultivation of cannabis and industrial hemp;
— growing of cannabis intended for personal use;
— the use of cannabinoids as ingredients that are derived from plants other than cannabis, or derived
from other organisms, or created synthetically.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
acceptable level
level of a safety hazard (3.38) not to be exceeded in the end product (3.18) provided by the organization
(3.27)
[SOURCE: ISO 22000:2018, 3.1]
3.2
audit
systematic, independent and documented process (3.32) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization (3.27) itself, or by an external party on its
behalf.
Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
Note 4 to entry: Relevant disciplines are, for example, food safety management, quality management or
environmental management.
[SOURCE: ISO 22000:2018, 3.3]
3.3
cannabis
genus of flowering plants made up of many different phytocannabinoids and chemical compounds
Note 1 to entry: Research into cannabis by governing bodies and organizations is ongoing around the world,
and drug classifications are constantly under review. Regulation of cannabis legalization frameworks can vary
between jurisdictions, based on the levels of tetrahydrocannabinol (THC) available in the plant.
3.4
cannabis derivative
secondary product (3.33) that can be extracted or obtained from a cannabis (3.3) biomass
Note 1 to entry: Classification of synthetically derived cannabinoids can vary between jurisdictions.
3.5
cannabis edible
food (3.19) which includes cannabis (3.3) or cannabis derivative (3.4) as an ingredient
Note 1 to entry: Dried cannabis, fresh cannabis, cannabis plants or cannabis plant seeds are not in themselves
considered food.
3.6
cannabis product
packaged goods containing cannabis (3.3) or cannabis derivative (3.4), available in multiple formats for
commercial and/or retail distribution
3.7
cannabis waste
solid, liquid or gaseous material that is a cannabis product (3.6), contains cannabis (3.3) or has come
into contact with cannabis, destined for disposal and not intended for sale or for use in any way other
than for agronomic purposes such as compost
Note 1 to entry: Definitions of cannabis waste can vary between jurisdictions. For example, in a jurisdiction that
sets a specific tetrahydrocannabinol (THC) threshold to define cannabis waste at a specific concentration of THC
(e.g. 10 μg/g), waste that has a concentration below that threshold is not considered to be cannabis waste.
3.8
competence
ability to apply knowledge and skills to achieve intended results
[SOURCE: ISO 22000:2018, 3.4]
3.9
conformity
fulfilment of a requirement (3.35)
[SOURCE: ISO 22000:2018, 3.5]
3.10
contamination
introduction or occurrence of a contaminant including a safety hazard (3.38) in a product (3.33) or
processing environment
[SOURCE: ISO 22000:2018, 3.6]
3.11
continual improvement
recurring activity to enhance performance (3.29)
[SOURCE: ISO 22000:2018, 3.7]
3.12
control measure
action or activity that is essential to prevent a safety hazard (3.38) and/or significant safety hazard
(3.39) or reduce it to an acceptable level (3.1)
Note 1 to entry: Control measure(s) is (are) identified by risk assessment/hazard analysis.
[SOURCE: ISO 22000:2018, 3.8, modified — The words “a significant food safety hazard” have been
replaced with “a safety hazard and/or significant safety hazard” in the definition; the original Note 1
to entry has been deleted and the words “risk assessment” have been added to the remaining Note to
entry.]
3.13
corrective action
action to eliminate the cause of a nonconformity (3.25) and to prevent recurrence
Note 1 to entry: There can be more than one cause for a nonconformity.
Note 2 to entry: Corrective action includes cause analysis.
[SOURCE: ISO 22000:2018, 3.10]
3.14
documented information
information required to be controlled and maintained by an organization (3.27) and the medium on
which it is contained
Note 1 to entry: Documented information can be in any format and media, and from any source.
Note 2 to entry: Documented information can refer to:
— the management system (3.22), including related processes (3.32);
— information created in order for the organization to operate (documentation);
— evidence of results achieved (records).
[SOURCE: ISO 22000:2018, 3.13]
3.15
durable life
period, commencing on the day on which a cannabis product (3.6) is packaged as an end product (3.18),
during which the product, when it is stored under conditions appropriate to that product, will retain,
without any appreciable deterioration, normal palatability and any other qualities claimed for it
3.16
durable life date
date on which the durable life (3.15) of a cannabis product (3.6) ends
3.17
effectiveness
extent to which planned activities are realized and planned results achieved
[SOURCE: ISO 22000:2018, 3.14]
3.18
end product
product (3.33) that will undergo no further processing or transformation by the organization (3.27)
Note 1 to entry: A product that undergoes further processing or transformation by another organization is an
end product in the context of the first organization and a raw material, an input, or an ingredient in the context of
the second organization.
[SOURCE: ISO 22000:2018, 3.15, modified — The words “an input” have been added in the Note to entry.]
3.19
food
substance (ingredient), whether processed, semi-processed or raw, which is intended for consumption,
and includes drink, chewing gum and any substance which has been used in the manufacture,
preparation or treatment of “food” but does not include cosmetics or tobacco or substances (ingredients)
used only as drugs
[SOURCE: ISO 22000:2018, 3.18, modified — The original Note to entry has been deleted.]
3.20
interested party
person or organization (3.27) that can affect, be affected by, or perceive itself to be affected by a decision
or activity
[SOURCE: ISO 22000:2018, 3.23, modified — The admitted term “stakeholder” has been deleted.]
3.21
lot
defined quantity of a product (3.33) produced and/or processed and/or packaged essentially under the
same conditions
Note 1 to entry: The lot is determined by parameters established beforehand by the organization (3.27) and may
be described by other terms, e.g. batch.
Note 2 to entry: The lot may be reduced to a single unit of product.
[SOURCE: ISO 22000:2018, 3.24]
3.22
management system
set of interrelated or interacting elements of an organization (3.27) to establish policies (3.30) and
objectives (3.26) and processes (3.32) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The system elements include the organization's structure, roles and responsibilities, planning
and operation.
Note 3 to entry: The scope of a management system may include the whole of the organization, specific and
identified functions of the organization, specific and identified sections of the organization, or one or more
functions across a group of organizations.
Note 4 to entry: Relevant disciplines are, for example, a quality management system or an environmental
management system.
[SOURCE: ISO 22000:2018, 3.25]
3.23
measurement
process (3.32) to determine a value
[SOURCE: ISO 22000:2018, 3.26]
3.24
monitoring
determining the status of a system, a process (3.32) or an activity
Note 1 to entry: To determine the status, there may be a need to check, supervise or critically observe.
Note 2 to entry: In the context of cannabis safety (3.37), monitoring is conducting a planned sequence of
observations or measurements to assess whether a process is operating as intended.
Note 3 to entry: Distinctions are made in this document between the terms validation (3.44), monitoring and
verification (3.45):
— validation is applied prior to an activity and provides information about the capability to deliver intended
results;
— monitoring is applied during an activity and provides information for action within a specified time frame;
— verification is applied after an activity and provides information for confirmation of conformity (3.9).
[SOURCE: ISO 22000:2018, 3.27, modified — The words “food safety” have been replaced with “cannabis
safety” in Note 2 to entry.]
3.25
nonconformity
non-fulfilment of a requirement (3.35)
[SOURCE: ISO 22000:2018, 3.28]
3.26
objective
result to be achieved
Note 1 to entry: An objective can be strategic, tactical, or operational.
Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety (3.37), and
environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product
(3.33), and process (3.32).
Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an
operational criterion, as a food safety management system (3.22) objective, or by the use of other words with
similar meaning (e.g. aim, goal, or target).
Note 4 to entry: In the context of food safety management systems, objectives are set by the organization (3.27),
consistent with the food safety policy (3.30), to achieve specific results.
[SOURCE: ISO 22000:2018, 3.29]
3.27
organization
person or group of people that has its own functions with responsibilities, authorities and relationships
to achieve its objectives (3.26)
Note 1 to entry: The concept of organization includes, but is not limited to sole-trader, company, corporation, firm,
enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated
or not, public or private.
[SOURCE: ISO 22000:2018, 3.31]
3.28
outsource
make an arrangement where an external organization (3.27) performs part of an organization’s
function or process (3.32)
Note 1 to entry: An external organization is outside the scope of the management system (3.22), although the
outsourced function or process is within the scope.
[SOURCE: ISO 22000:2018, 3.32]
3.29
performance
measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.32), products (3.33)
(including services), systems or organizations (3.27).
[SOURCE: ISO 22000:2018, 3.33]
3.30
policy
intentions and direction of an organization (3.27) as formally expressed by its top management (3.41)
[SOURCE: ISO 22000:2018, 3.34]
3.31
potency
amount per unit of the standardized component(s) which further characterizes the quantity of the
ingredient
Note 1 to entry: For further clarification of the calculation of potency, see 6.7.1.4.
Note 2 to entry: The use of the term potency in this document is not intended to refer to product (3.33) efficacy.
3.32
process
set of interrelated or interacting activities which transforms inputs to outputs
[SOURCE: ISO 22000:2018, 3.36]
3.33
product
output that is a result of a process (3.32)
Note 1 to entry: A product can be a service.
[SOURCE: ISO 22000:2018, 3.37]
3.34
purity
extent to which an ingredient or cannabis derivative (3.4) is free from undesirable or adulterating
chemical, biological or physical entities as defined by specifications
Note 1 to entry: Requirements can vary between jurisdictions.
3.35
requirement
need or expectation that is stated, generally implied or obligatory
Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization (3.27) and
interested parties (3.20) that the need or expectation under consideration is implied.
Note 2 to entry: A specified requirement is one that is stated, for example in documented information (3.14).
[SOURCE: ISO 22000:2018, 3.38]
3.36
risk
effect of uncertainty
Note 1 to entry: An effect is a deviation from the expected – positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or
knowledge of, an event, its consequence, or likelihood.
Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73:2009,
3.5.1.3) and “consequences” as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including
changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence.
[SOURCE: ISO 22000:2018, 3.39, modified — The original Note 5 to entry has been deleted.]
3.37
safety
assurance that the product (3.33) will not cause an adverse health effect for the consumer when it is
prepared and/or used according to its intended use
Note 1 to entry: Safety is related to the occurrence of safety hazards (3.38) in end products (3.18) and does not
include other health aspects.
3.38
safety hazard
source or situation with the potential to cause an adverse health effect
Note 1 to entry: The term hazard is not to be confused with the term risk (3.36) which, in the context of safety
(3.37), means a function of the probability of an adverse health effect (e.g. becoming diseased) and the severity of
that effect (e.g. death, hospitalization) when exposed to a specified hazard.
Note 2 to entry: Safety hazards include allergens and radiological substances.
[SOURCE: ISO 22000:2018, 3.22, modified — The word “food” has been deleted from the term and from
Notes 1 and 2 to entry; the words “biological, chemical or physical agent in food” have been replaced
with “source or situation” in the definition; the original Notes 3 and 4 to entry have been deleted.]
3.39
significant safety hazard
safety hazard (3.38), identified through the hazard assessment, which needs to be controlled by control
measures (3.12)
[SOURCE: ISO 22000:2018, 3.40, modified — The word “food” has been deleted from the term and the
definition.]
3.40
stability
period of time during which the cannabis product (3.6), after being packaged for sale as an end product
(3.18), will continue to comply with its specifications when it is stored under its recommended storage
conditions or, if it does not have recommended storage conditions, when it is stored at room temperature
3.41
top management
person or group of people who directs and controls an organization (3.27) at the highest level
Note 1 to entry: Top management has the power to delegate authority and provide resources within the
organization.
Note 2 to entry: If the scope of the management system (3.22) covers only part of an organization, then top
management refers to those who direct and control that part of the organization.
[SOURCE: ISO 22000:2018, 3.41]
3.42
traceability
ability to follow the history, application, movement and location of an object through specified stage(s)
of production, processing and distribution
Note 1 to entry: Movement can relate to the origin of the materials, processing history or distribution of the
product (3.33).
Note 2 to entry: An object can be a product, a material, a unit, equipment, a service, etc.
[SOURCE: ISO 22000:2018, 3.42, modified — The word “food” has been replaced with “product” in Note
1 to entry.]
3.43
update
immediate and/or planned activity to ensure application of the most recent information
Note 1 to entry: Update is different from the terms maintain and retain:
— maintain is to keep something on-going/to keep in good condition;
— retain is to keep something that is retrievable.
[SOURCE: ISO 22000:2018, 3.43]
3.44
validation
obtaining evidence that a control measure (3.12) (or combination of control measures) will be capable of
effectively controlling the significant safety hazard (3.38)
Note 1 to entry: Validation is performed at the time a control measure combination is designed, or whenever
changes are made to the implemented control measures.
Note 2 to entry: Distinctions are made in this document between the terms validation, monitoring (3.24) and
verification (3.45):
— validation is applied prior to an activity and provides information about the capability to deliver intended
results;
— monitoring is applied during an activity and provides information for action within a specified time frame;
— verification is applied after an activity and provides information for confirmation of conformity (3.9).
[SOURCE: ISO 22000:2018, 3.43, modified — The word “food” has been deleted from the definition.]
3.45
verification
confirmation, through the provision of objective evidence, that specified requirements (3.35) have been
fulfilled
Note 1 to entry: Distinctions are made in this document between the terms validation (3.41), monitoring (3.24)
and verification:
— validation is applied prior to an activity and provides information about the capability to deliver intended
results;
— monitoring is applied during an activity and provides information for action within a specified time frame;
— verification is applied after an activity and provides information for confirmation of conformity (3.9).
[SOURCE: ISO 22000:2018, 3.45]
4 General
4.1 Understanding the organization and its context
4.1.1 The organization should determine
...