ISO 22000 prerequisite programs are the foundational hygiene and operating conditions that keep the wider food safety management system (FSMS) stable, and getting them right is one of the most practical steps toward certification. In ISO 22000:2018, prerequisite programs (PRPs) sit alongside HACCP principles, operational PRPs, interactive communication and system management to form a complete approach to food safety. This guide explains what PRPs are, how they differ from operational PRPs and critical control points, and how to document and verify them.
What are ISO 22000 prerequisite programs?
Prerequisite programs are the basic conditions and activities necessary to maintain a hygienic environment throughout the food chain. They are not aimed at controlling a specific identified hazard at a specific step; instead, they create the clean, well-managed baseline on which hazard analysis and the rest of the FSMS depend. Think of them as the everyday good practices that make targeted controls meaningful.
ISO 22000:2018 requires an organisation to establish, implement, maintain and update PRPs to help prevent and reduce contamination. The standard expects PRPs to be appropriate to the organisation and its context, agreed by the food safety team, and applied across the whole production system rather than a single line or product.
PRPs vs operational PRPs vs CCPs
One of the most common points of confusion is the difference between general PRPs, operational PRPs (OPRPs) and critical control points (CCPs). ISO 22000:2018 treats these as distinct control measures selected through hazard analysis. The table below summarises the practical distinctions.
| Element | Purpose | Selected by | Monitoring emphasis |
|---|---|---|---|
| Prerequisite programs (PRPs) | Maintain general hygiene and a safe operating baseline | Good practice, legal and customer requirements | Routine verification and inspection |
| Operational PRPs (OPRPs) | Control a significant hazard identified in the hazard analysis, where a measurable critical limit is not applied | Hazard analysis | Monitored against action criteria; corrections defined |
| Critical control points (CCPs) | Control a significant hazard at a step with measurable critical limits | Hazard analysis | Monitored against critical limits in real time |
In short, PRPs are broad and preventive, while OPRPs and CCPs are targeted control measures chosen because hazard analysis flagged a significant hazard. Verify the current version of the standard for the exact wording used to distinguish these categories.
Common categories of ISO 22000 prerequisite programs
The standard does not force a single fixed list, because PRPs must fit your operation, product and location. However, ISO 22000:2018 points organisations toward relevant technical specifications and sector guidance, and most food businesses cover a recognisable set of themes. The following are widely used categories.
- Construction, layout and suitability of buildings and utilities
- Layout of premises, including workspace and employee facilities
- Supplies of air, water, energy and other utilities
- Supporting services, including waste and sewage disposal
- Suitability, cleaning and maintenance of equipment
- Management of purchased materials and supplier controls
- Measures for the prevention of cross-contamination
- Cleaning and sanitising programmes
- Pest control
- Personnel hygiene and facilities
- Product information, labelling and consumer awareness where relevant
Sector-specific technical documents (for example, those referenced by ISO/TS 22002 series for particular parts of the food chain) provide more detailed PRP requirements. Confirm which specification applies to your sector before finalising your programme.
How PRPs connect to hazard analysis
PRPs should be established before you carry out hazard analysis, because a strong hygiene baseline reduces the number and severity of hazards you must control at OPRPs or CCPs. During hazard analysis the food safety team assesses whether existing PRPs adequately manage each hazard, or whether a specific OPRP or CCP is needed. This ordering keeps the FSMS proportionate and evidence-based.
Documenting and verifying ISO 22000 prerequisite programs
ISO 22000:2018 uses a Harmonized Structure and emphasises documented information rather than long lists of mandatory records. For PRPs, keep enough documented information to show what each programme covers, who is responsible, how it is carried out and how you confirm it is working. Verification is essential: a PRP that is written but not checked provides little assurance.
- Define the scope and responsibilities for each PRP.
- Describe the activities, frequencies and acceptance criteria in practical terms.
- Verify effectiveness through inspections, monitoring records, internal audits and results such as environmental or hygiene checks.
- Update PRPs when processes, layout, suppliers or legal requirements change.
Because ISO 22000 is designed to integrate with HACCP and can underpin GFSI-recognised schemes, disciplined PRP documentation also supports later certification steps. For the authoritative overview of the standard, consult the official page from the International Organization for Standardization.
ISO 22000 prerequisite programs and FSSC 22000
FSSC 22000 is a separate, GFSI-recognised certification scheme built on ISO 22000 together with sector-specific PRP requirements and additional scheme requirements. If your customers ask for GFSI recognition, well-designed PRPs are more than an ISO 22000 requirement; they are the specific area where FSSC 22000 adds detailed, sector-based expectations. Building robust prerequisite programs now makes any future move to FSSC 22000 far smoother.
Frequently asked questions
Are prerequisite programs mandatory in ISO 22000:2018?
Yes. The standard requires organisations to establish, implement, maintain and update PRPs appropriate to their context. The exact PRPs depend on your sector, product and premises, so there is no universal fixed list, but having documented, effective PRPs is a core expectation.
What is the difference between a PRP and an OPRP?
A PRP maintains general hygienic conditions across the operation, while an OPRP is a control measure selected through hazard analysis to manage a specific significant hazard where a measurable critical limit is not applied. OPRPs are monitored against defined action criteria, and corrections are planned in advance.
How many prerequisite programs do I need?
There is no required number. You need enough PRPs to cover the hygiene themes relevant to your operation, such as cleaning, maintenance, pest control and personnel hygiene. Use hazard analysis and any applicable sector technical specification to confirm coverage rather than aiming for a target count.
Do PRPs replace HACCP?
No. PRPs support HACCP by creating a stable baseline, but they do not replace the hazard analysis, OPRPs and CCPs that control significant hazards. ISO 22000:2018 integrates PRPs with HACCP principles so the two work together within one FSMS.
Related guides
- ISO 22000 food safety management: a complete guide
- ISO 22000 requirements checklist for implementation
- The ISO 22000 certification process explained step by step
Ready to build compliant prerequisite programs faster? Our editable ISO 22000:2018 toolkit gives you ready-to-use PRP procedures, hazard analysis templates and audit-ready documentation you can adapt to your operation. Explore the ISO 22000 toolkit and start strengthening your food safety management system today.