ISO 22000:2018 · clause 7.1.6
A recall almost never starts in your own plant.
ISO 22000 requires defined criteria for evaluating and selecting external providers – and continuous monitoring of those able to affect food safety.
The food safety management standard combines HACCP methodology with the Annex SL structure. Clause 7.1.6 covers externally provided processes, products and services: raw materials, packaging, cleaning, pest control, transport, laboratory services.
In practice the standard is often embedded in a certification scheme such as FSSC 22000, demanded by retail chains. Supplier requirements there tend to be even more concrete – specifications, releases and traceability in both directions.
Who is affected
- Producers, processors and packers of food and feed.
- Packaging manufacturers whose material contacts the product.
- Transport and storage providers handling temperature-controlled goods.
- Cleaning and pest control services in production areas.
What the standard requires
- 7.1.6
- Define criteria for evaluation, selection, performance monitoring and re-evaluation.
- 7.1.6
- Retain documented information on those activities.
- 8.2
- Prerequisite programmes covering services and supplies too.
- 8.5.1
- Raw and contact materials with specification and hazard assessment.
- 8.9.5
- Traceability and recall procedures, tested across the stages.
How SCRM covers it
Providers by influence
Raw material, packaging and services classified separately, with matching scrutiny.
Specifications and releases
Held on the supplier, with validity and version.
Analyses and certificates
With expiry and reminders instead of a binder.
Recall contacts
Reachability recorded and confirmed regularly – the test is part of it.
Frequently asked
Does the cleaning service count as an external provider?
Once its work can affect food safety, yes. You must define and justify the boundary.
How does FSSC 22000 differ from ISO 22000?
FSSC 22000 is a certification scheme adding technical specifications and additional requirements to ISO 22000. Its supplier section is usually more detailed.
How often should a recall be exercised?
The standard requires verification of the procedure. Annual practice is common – and the test typically fails on outdated contact data.