ISO 22000 Food Safety Management: 3 Hard Requirements Packaging Plants Must Pass — Auditors Don't Care About Documents

Last winter, a client in Wuxi making mooncake gift boxes was rejected for three large orders by a global food brand. The reason was not the high price or late delivery, but the fact that the ISO 22000 auditor gave them a "major non-conformity" after walking through their plant. The client came to me and asked: "Our documents are complete, our record books stacked half a person high — how are we not compliant?"

I helped them review that audit and discovered a fact that many business owners misinterpret: The focus of an ISO 22000 audit in a packaging plant has never been 'how beautifully the manual is written', but 3 categories of on-site evidence that can be traced, reproduced, and spot-checked. This article will explain these 3 categories in detail.

Category One: Two-Way Traceability Between Raw Material Batch Numbers and Finished Products

ISO 22000's first point of impact in a packaging plant is not the workshop, but the warehouse. The auditor will randomly pick a finished product from the finished goods warehouse, then trace backwards: what is the batch number of the paper used in this gift box, the batch number of the ink, the batch number of the laminating adhesive, which supplier provided the ribbon, which supplier provided the magnets. Each link must be able to retrieve records within 30 minutes.

Where did the Wuxi client fail last year? Their paper had batch numbers, but the ink was only recorded as "imported/domestic", without the specific manufacturer, batch number, or production date. The auditor asked: "If this batch of ink is found to have excessive benzene-series substances, how would you notify your downstream food brand customers to recall?" The client had no answer.

The traceability that truly satisfies the auditor looks like this: on the finished goods warehousing note, "Warehoused on 2024-09-15, batch number LX-PC-2410-018, using paper batch number YL-K-0935, ink batch number YQ-S-0922, laminating adhesive batch number FM-J-0907." Each raw material has its own batch number, and each finished product can be traced back to each raw material's supplier, production date, and incoming inspection result.

This sounds simple, but 90% of small and medium packaging plants cannot do it. The reason is not unwillingness, but that the raw material suppliers themselves do not provide batch number information. The solution: write into the procurement contract "each batch of raw material must be delivered with a quality inspection report and production date", and suppliers who cannot do so will not enter the qualified supplier list.

Category Two: The "Real-Time Evidence Chain" of Process Monitoring

The second thing the ISO 22000 auditor looks at is the on-site process monitoring records in the workshop, not the post-hoc summary report.

Specifically: the adhesive temperature, drying temperature, paper feeding speed in the laminating workshop; the gold foil tension in the hot-stamping workshop; the adhesive concentration, open time, and pressure in the mounting workshop — these parameters cannot only be written in the operating procedures, they must be written in the shift records and signed off.

Why? Because once migration levels in food packaging exceed the limit, what the auditor must trace back is not a single point in time, but a time period: on which day, which shift, and at which temperature parameters was this batch of problematic packaging produced? If there are only "pass/fail" result records, with no process parameter records, the auditor will rule it "monitoring failure".

Last year, when I accompanied a gift box factory in Suzhou for an ISO 22000 pre-audit, their mounting workshop temperature records were filled in once in the morning and once in the afternoon. The auditor asked: "What about between 12:00 noon and 1:00 pm?" The workshop director answered: "Lunch." The auditor immediately issued a non-conformity: "How do you ensure the quality of the products produced during the noon temperature drift?"

The solution is actually not complicated: install automatic temperature and humidity recorders at critical workstations (a few hundred each), with data stored automatically and not subject to manual modification. During the lunch break, the machine is stopped and there will be a gap in the data — the auditor will not deduct points for that; what he wants is "real records", not "perfect records".

Category Three: The "3-Hour Response" in Recall Drills

The third focus of the ISO 22000 auditor, and the most easily overlooked, is the recall drill.

He will not look at how beautifully you write it; he wants a live drill: "Suppose this batch of finished products has a problem, start the recall now, give me a timeline." Then he observes your response time, information transmission path, and product traceability speed.

The hard metric for the recall drill is 3 hours: from "receiving the recall notice" to "confirming the flow of the problematic product, initiating the recall, and notifying downstream customers", the entire process must be initiated within 3 hours.

The drill records of many packaging plants are written like this: "Recall drill conducted in June 2024, drill successful." No time records, no participants, no problem improvements. The auditor asks: "What problems were found in the last drill? How were they improved?" No answer.

The recall drill records that can truly be presented look like this: "2024-08-15 14:00 received simulated recall notice, 14:23 emergency team activated, 14:45 completed flow confirmation of problematic batch LX-2405-018 (3 downstream customers, 1,200 boxes shipped in total), 15:10 completed customer notification, 15:30 recall initiated. Drill finding: warehouse batch number query system responded slowly, improvement measure: scan-code query system launched on 2024-09-01."

Note several details: there are specific timestamps, specific personnel, specific improvement measures, and a completion date for the improvement. The drill is not to prove "no problem", but to expose "real problems". If the drill report is full of "drill went smoothly", the auditor will instead suspect its authenticity.

What the ISO 22000 Auditor Really Cares About: 3 Things

After explaining these 3 categories of hard requirements, let's look at the auditor's mindset from the other side: what they really care about is not "whether you did it", but "did you do it for real", "can it be checked", and "when something goes wrong, can it be rescued".

Documents are complete but records are not real — not as good as fewer documents but real records;
Process monitoring exists but parameters cannot be retained — not as good as automatic records at critical workstations;
Drills exist but problems are not exposed — not as good as drills that find problems with tracked improvements.

The essence of ISO 22000 in the packaging industry is not "a qualification certificate shown to food brand customers", but "whether the packaging plant itself can control quality risks". Qualification is just a piece of paper; controlling risk is the system.

Further Reading

ISO 9001 System Audit for Packaging Companies: 3-Step Preparation + 4 Common Audit Rejection Issues

Practical Guide to GB 4806 Testing for Food Contact Packaging: 5 Common Sticking Points + 3 Remedies for Failure

GB 4806.1 to 4806.11 Explained in One Article: How to Use the 5 Core Standards for Food Contact Packaging

3 Hurdles for Packaging Exported to the U.S.: What Do FDA, Prop 65, and CPSIA Each Cover? How to Pass at Once?