An ISO 22000 crisis management plan is what separates a controlled response from a scramble when a food safety incident hits. Clause 8 requires your FSMS to have emergency preparedness and response arrangements in place — but “in place” only means something if the plan has been written, assigned, and rehearsed before the day you actually need it.
Most food businesses discover the gaps in their crisis plan during the crisis itself. Here is how to build one that holds up.
WHY YOUR ISO 22000 CRISIS MANAGEMENT PLAN DIFFERS FROM A CAPA
A corrective action fixes a process failure after the fact, on your own timeline. A crisis — a contamination event, an allergen mislabel, a supplier recall that hits your supply chain — moves on a timeline set by regulators, retailers, and the public. Your CAPA process handles the “why did this happen.” Your crisis management plan handles the first 24 hours, when speed and accuracy both matter and there is no time to figure out who’s in charge.
STEP 1 — DEFINE WHAT TRIGGERS THE PLAN
Not every deviation is a crisis. Set clear activation criteria in advance: a confirmed pathogen result, an allergen found in an unlabelled product, a credible customer illness complaint linked to your product, or a recall notice from a supplier. Ambiguity here costs you your most valuable resource in a crisis — time.
STEP 2 — BUILD THE CRISIS TEAM BEFORE YOU NEED IT
Name the team by role, not just by department: incident commander, technical/QA lead, traceability lead, communications lead, and a regulatory liaison. Each role needs a named primary and a backup — a crisis rarely waits for the right person to be back from leave.
STEP 3 — MAP YOUR TRACEABILITY IN ADVANCE
When a recall is triggered, you need to answer two questions fast: what else does this batch touch, and where did it go? Your traceability system should let you trace one step back and one step forward within hours, not days. Run a mock trace exercise on a random batch code today — if it takes longer than half a day to get a clean answer, that is your first fix.
STEP 4 — PRE-DRAFT YOUR NOTIFICATION TEMPLATES
Do not write your regulator notification letter or your customer recall notice during the incident. Pre-draft the templates now, with placeholders for batch numbers, dates, and affected product lines. Include the mandatory notification timelines and contact points for your specific GCC jurisdiction — these differ by country and by product category.
STEP 5 — SET YOUR INTERNAL AND EXTERNAL COMMUNICATION PROTOCOL
Define who talks to whom: who briefs top management, who contacts the regulator, who responds to media or social media enquiries, and — critically — who is authorised to speak publicly. A single unauthorised comment from an untrained staff member can do more damage than the original incident.
STEP 6 — RUN A MOCK RECALL AT LEAST ONCE A YEAR
A crisis plan that has never been tested is a document, not a capability. Run a mock recall on a real batch code, time every step, and record where the plan broke down. This exercise itself becomes objective evidence for your certification auditor that emergency preparedness is genuinely implemented, not just written.
STEP 7 — REVIEW AND CLOSE THE LOOP AFTERWARD
After any real incident or mock drill, hold a structured debrief: what worked, what didn’t, what needs to change in the plan. Feed this into your next management review alongside your internal audit results — Clause 9.3 expects incident and emergency response performance to be reviewed at the top level, not left in a folder.
WHAT THIS LOOKS LIKE UNDER ISO 22000:2026
The shift to the 2026 revision keeps emergency preparedness firmly in scope, with sharpened expectations around objective evidence that the plan has actually been exercised — not just documented. A crisis plan sitting untouched since certification is exactly the kind of gap the revised standard is designed to surface. See our ISO 22000:2018 vs 2026 comparison guide for the full picture of what else has changed.
GET THE FREE TEMPLATE
We’ve built a ready-to-use ISO 22000 crisis management plan template — activation criteria, team roles, traceability checklist, and notification letter placeholders included.
👉 [Download the free ISO 22000 Crisis Management Plan Template]