RISK ASSESSMENT · ISO 22000 AND FSSC 22000 CLAUSE 4

Context, Interested Parties and Strategic Risk: The Three ISO 22000 Assessments Most Sites Fail

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

ISO 22000:2018 clause 4 asks a site to determine the external and internal issues relevant to its food safety management system and the requirements of relevant interested parties. Clause 6.1 then asks for actions to address the risks and opportunities that follow. None of this is hazard analysis, and it is where FSSC 22000 auditors write findings. The three ASC packs that cover it are R690 each.

Which three risk assessments does clause 4 actually ask for?

ISO 22000:2018 asks for two determinations at clause 4: the external and internal issues relevant to the food safety management system, and the requirements of the interested parties relevant to it. Clause 6.1 then asks the organisation to consider both and to plan actions addressing the risks and opportunities that arise. Three pieces of work, usually delivered as three documents.

Sites that certify to FSSC 22000 meet the same demand, because FSSC 22000 Version 7, published in May 2026, is ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements. The ISO 22000 half carries clause 4 unchanged. There is no route to an FSSC certificate that avoids this work, and there is no version of it that a hazard analysis can perform on your behalf.

The last of those four is the part that gets missed. The three documents form the front end of a chain that ends at management review and continual improvement, and every link in the chain is separately auditable.

Why does an auditor write a non-conformance against context of the organisation?

Because the document exists and nothing depends on it. ISO 22000:2018 requires clause 4 issues to be monitored and reviewed, and a context analysis dated at implementation, never reviewed, listing issues with no stated effect on the food safety management system, cannot be shown to have been monitored or to have fed the scope, the objectives or the management review. The auditor tests the connections rather than the file.

I audit and I implement, and the pattern is the same from both chairs. Clause 4 documents are usually written once, by the consultant or the technical manager, at three in the morning before a stage one audit. They are then filed. Three years later the plant has a new line, a new retail customer, a new owner and a new technical manager, and the context document still describes the business that existed at implementation. Nothing in it is untrue. Nothing in it is current either.

• Issues are listed with no stated consequence for the food safety management system, so the auditor cannot see why they were included
• There is no record of monitoring or review, only a creation date, so the ongoing requirement is unevidenced
• The scope statement was written independently of the context, and the two do not agree about what the site does
• The interested party register lists parties but not what each one requires
• The risks and opportunities register is the hazard analysis with different column headings
• Actions were assigned but their effectiveness was never evaluated, so the loop is open
• Food safety objectives bear no visible relationship to any issue or requirement the site determined
• Management review minutes have no agenda item for changes in external and internal issues

These are minor findings on a good day. On a bad day the certification body treats them together as a systemic breakdown and raises a major, because a system whose planning inputs are stale and whose improvement loop is open is not a functioning management system, whatever the production records look like. Our summary of the 25 most common FSSC 22000 non-conformances places clause 4 findings alongside the operational ones for exactly that reason.

How is a risk to the management system different from a product hazard?

The hazard analysis asks what can make the product unsafe at a process step. The clause 4 and clause 6.1 work asks what can stop the management system itself from working. A technical manager resigning never appears in a hazard analysis, yet it is a serious risk to a system that depends on one person to run verification, and ISO 22000 puts it in a different place, assessed by a different method.

ISO 22000:2018 uses the word risk at two levels, and that is the root of the confusion. At the organisational level, clause 6.1 deals with risks and opportunities arising from the context and the interested party requirements. At the operational level, clause 8 deals with hazards through the hazard analysis, which classifies control measures as prerequisite programmes, operational prerequisite programmes or critical control points. Same word, two jobs. Our article on risk assessment against hazard analysis works the operational half of that split in detail.

A hazard analysis protects the consumer from your product. A clause 6.1 risk assessment protects your system from your organisation.

How do you do a context analysis for a South African food business?

ISO 22000:2018 clause 4 asks for external and internal issues, so work through them in categories and apply one test to each: state the effect on the ability of the food safety management system to achieve its intended results. An issue with no stated effect is a note about the business, not a context issue. In South Africa the external half is heavily regulatory and heavily infrastructural, and both change often enough to need scheduled monitoring.

Start with the external categories. Regulatory sits first because it is the one with dates attached. Regulation 3(1) of R638 of 2018 prohibits handling food on premises without a valid Certificate of Acceptability issued by the local authority, which makes the municipal environmental health department an external issue and an interested party at the same time. R146 of 2010 governs labelling. The NRCS administers compulsory specifications for products such as canned fish under VC 8014 and processed meat products under VC 9100. Port Health inspects imported foodstuffs at points of entry and can detain a consignment. The Department of Agriculture, which separated from DALRRD on 1 April 2025 by Proclamation 199 of 2024, administers the Agricultural Product Standards Act 119 of 1990. Draft R3337, published for comment on 21 April 2023, is still a draft with no gazetted commencement date, which makes it a watch item rather than an obligation.

• Regulatory and enforcement: local authority and the Certificate of Acceptability, R146 labelling, NRCS compulsory specifications, Legal Metrology Act 9 of 2014 and SANS 289:2022 net quantity, Port Health, the Department of Agriculture, section 61 of the Consumer Protection Act 68 of 2008
• Customer and scheme: which retail groups you supply, which scheme each requires, whether any customer is moving between BRCGS, FSSC 22000 and IFS, and any customer specific technical standard layered on top
• Infrastructure and utilities: electricity supply interruptions and their effect on cold chain and cleaning, municipal water reliability and quality, borehole or stored water use, effluent capacity, road and port lead times
• Supply chain: single sourced ingredients, imported material lead times, exchange rate exposure on inputs, the certification status of your own suppliers
• People and competence: availability of qualified food technologists in your province, turnover in the technical team, shift patterns, dependence on one person for verification or internal audit
• Internal: plant age and hygienic design limits, capacity against demand, product portfolio changes, the state of your records and traceability system, ownership and capital availability, food safety culture maturity

Then score. For each issue record the direction, whether it threatens the system or offers it an opportunity, the current state, the effect on the intended results, who monitors it, how they monitor it and when it is next reviewed. That final column is the one auditors read first, because the requirement to monitor and review information about these issues is separate from the requirement to determine them.

What did Amendment 1:2024 add about climate change?

ISO 22000:2018 remains the current edition, confirmed in 2023, and Amendment 1:2024 added climate action into the context and interested party clauses. Paraphrased: you must consider whether climate change is a relevant issue when determining your context, and recognise that relevant interested parties can have climate related requirements. It does not require a carbon programme and it does not replace the standard.

For a South African manufacturer this is a short piece of work with a real answer. Water availability and quality, temperature extremes affecting cold chain and storage conditions, agricultural raw material availability and seasonality, and the resilience of your utilities are all climate linked and all already sit in the context categories above. The amendment asks you to make the consideration visible rather than to invent a new programme. A site that records the consideration, states which climate linked issues are relevant and which are not, and dates it, has met the requirement.

How do you build an interested party register that is useful rather than decorative?

ISO 22000:2018 clause 4 needs each party named specifically rather than by category, with what that party actually requires of you, whether you have adopted the requirement as an obligation, the evidence that you meet it, the person who owns the relationship, how you learn when the requirement changes, and a review date. A register that stops at the party names is a contact list with a clause number on it.

The decorative version is easy to spot. It has fifteen rows reading customers, suppliers, employees, regulators, shareholders, the community, the certification body, and a second column reading safe food, on all fifteen rows. Nothing in the system changes if that document is deleted. The useful version is longer, more specific and immediately obviously connected to work the site already does.

Two design rules make the difference. First, only include parties relevant to the food safety management system. A pension fund administrator is an interested party of the business and not of the system. Second, every requirement in column two should be traceable to something in your system: a specification, a procedure, a monitoring activity, a customer agreement, an objective. If a requirement leads nowhere, either it is not really a requirement or you have found a gap, and both are useful answers.

Which interested party requirements become obligations you have to meet?

Statutory and regulatory requirements, R638 of 2018 among them, are obligations whether you like them or not. Contractual requirements become obligations when you sign. Everything else is a decision: you consider the requirement, you decide whether to adopt it, and you record the decision. That recorded decision is what separates a register that governs the system from a register that describes the world.

The distinction matters at audit because an auditor will select a row and follow it. If a named retail customer requires a five year record retention period and your procedure says three years, one of two things is true: you did not adopt the requirement and did not say so, or you adopted it and did not implement it. The first is a documentation gap. The second is a breach of a customer agreement, which is a larger conversation.

Sites with export customers carry the heaviest version of this. An importing country requirement, a customer specific standard, a private label technical manual and the certification scheme can all apply to one production line, and they do not always agree. Recording the most onerous requirement as the one adopted, and saying so, is a defensible position. Leaving the conflict undocumented is not. Our guide to South African food legislation is the reference we point clients to when they are building the statutory half of this register.

How do you assess risks and opportunities to the food safety management system?

Clause 6.1 takes the context issues and the adopted interested party requirements as inputs, adds audit results, verification results, incident history and planned changes, then asks one question of each: what could stop the food safety management system achieving its intended results. Score it, decide an action, name an owner and a date, integrate the action into a system process, and evaluate whether it worked.

1. Set the inputs explicitlyList the sources feeding the register: the context analysis by document number, the interested party register, the last internal and external audit reports, verification and validation results, complaints and incidents, and any change planned in the next twelve months. An auditor should be able to see where each risk came from.
2. Write the risk at system levelNot microbiological contamination of product. Instead: verification of the environmental monitoring programme depends on one qualified person, whose absence would leave results unreviewed for weeks. That is a risk to the system, and it has an action.
3. Score consistently with your other registersUse the same likelihood and consequence scale you use elsewhere so the numbers mean the same thing. Define what each consequence level means for the system: a delayed decision, a lapsed certificate, an unretrievable record, a customer delisting.
4. Choose a response and say which oneAvoid, reduce, share, accept, or pursue as an opportunity. Acceptance is a legitimate answer when it is a recorded decision with a named accepter, and an illegitimate one when it is silence.
5. Integrate the action into a process, not a spreadsheetIf the action is to train and authorise a second verifier, it belongs in the training matrix and the authorisation list, not only in the risk register. The register tracks it. The system carries it.
6. Evaluate effectiveness and close the loopSix months later, did the risk reduce. Evidence, not opinion: the second verifier reviewed results during the first verifier’s leave, and the review turnaround stayed inside the target. This step is the one most often missing at audit.

Opportunities deserve real entries rather than a column of blanks. Adopting the restructured prerequisite programme standards is one: the ISO 22002 series was restructured in July 2025, with ISO 22002-100:2025 published on 29 July 2025 as a common baseline and ISO 22002-1:2025 covering food manufacturing, while ISO/TS 22002-3:2011 for farming remained a Technical Specification after review in 2025. Others are ordinary and valuable: digitising a paper check that is chronically late, consolidating two suppliers into one with better controls, moving a cleaning task off the end of a shift where it is always rushed.

Worked example: how does one context issue travel through a KwaZulu-Natal dairy?

Take a 180 person dairy processor in KwaZulu-Natal producing UHT milk and set yoghurt, supplying two national retail groups and exporting into Botswana and Namibia, and work it through ISO 22000:2018 clause 4 and clause 6.1. This is an illustrative example built to show the structure, not a client, and the figures are illustrative. One external context issue is followed from determination through to continual improvement.

Read down the right hand column. Six documents, one thread, and any auditor who picks up any one of them can walk to the other five. That is what a clause 4 system looks like when it is working, and it is also why the three assessments are worth doing properly rather than quickly. The same site could have written a context analysis saying that water supply in South Africa is unreliable, and it would have been true, and it would have produced nothing.

How do context and risk turn into food safety objectives?

Food safety objectives under ISO 22000:2018 must be consistent with the policy, measurable, take account of applicable food safety requirements including customer and statutory requirements, be monitored, verified and communicated, and be maintained and updated. The practical test an auditor applies is simpler: can you show which context issue or interested party requirement produced each objective.

Objectives fail for two reasons. The first is that they measure an outcome the site does not control day to day. Zero recalls is a hope. Zero customer complaints is a hope with a phone number attached. Neither tells anyone what to do on a Tuesday. The second is that they are recycled year on year with the target moved by a percentage point, which produces the honest but damaging answer at audit that nobody remembers why the objective exists.

• Each objective names the context issue or interested party requirement it comes from, by document reference
• Each has a plan attached: what will be done, what resources are required, who is responsible, when it is due, how the result will be evaluated
• Leading indicators sit alongside lagging ones, so the objective can be managed rather than only reported
• Objectives are communicated to the people whose work moves them, in language they use
• An objective that is achieved is retired and replaced rather than carried forward with a new number
• An objective that is missed produces an analysis of why, not a restated target

What does management review have to do with clause 4?

Management review is where the clause 4 loop closes. ISO 22000:2018 lists changes in external and internal issues relevant to the food safety management system among the review inputs, alongside system performance, verification results, resource adequacy, emergency situations and the status of actions from previous reviews. If the context register was never reviewed, the review cannot evidence that input.

The fix is a change to the agenda, not a new document. Put an item on the standing agenda called changes in external and internal issues and interested party requirements. Take the context register and the interested party register into the meeting. For each, state what changed since the last review, what it means for the system, and what will be done. Where nothing changed, minute that the registers were reviewed, that no change was identified, and the date. A negative finding recorded is evidence. A gap in the minutes is a finding.

Outputs matter as much as inputs. Decisions on improvement, resource needs, revision of the policy and objectives, and changes to the system all come out of the review, and each one should be traceable back to something that went in. A review that produces no decisions has not reviewed anything, and an auditor reading twelve months of minutes with no decisions in them will start looking for the reason.

What does the auditor ask for on the day?

On the day, clause 4 evidence means the context analysis and the interested party register, the date each was last reviewed and the evidence of that review, the scope statement, the risks and opportunities register, the actions taken and the evidence that their effectiveness was evaluated, the food safety objectives with their monitoring results, and the management review minutes. Then the auditor picks one row and follows it end to end.

• Both registers, with version control, an author, an approval and a review history rather than only a creation date
• A scope statement that matches what the context says the business does, including any outsourced process or co-packed line
• The risks and opportunities register showing the input source for each entry
• Closed actions with effectiveness evidence attached, not just a tick and a date
• Objectives cross referenced to the issues and requirements that produced them
• Management review minutes with the clause 4 inputs visible as their own agenda item
• An internal audit report that actually audited clause 4 rather than skipping to the production floor
• Someone in the room who can explain the reasoning without reading it off the page

Sites take one of two routes to that position. Some build it themselves from templates, which is the cheaper route and works where there is a competent technical person with the time to think. Others have ASC facilitate the context and risk workshop with the leadership team and write it up, which is scoped and quoted as one figure rather than billed by the hour, with consultation available from R480 an hour where only advice is needed. ASC is willing to audit sites it has supplied documents to. If you are still deciding which scheme you are building towards, the training site guide to ISO 22000 clauses, prerequisite programmes and certification and our complete 2026 guide to FSSC 22000 Version 7 in South Africa set out both routes and the transition dates.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.