Quality managers implementing ISO 22000 often go looking for the pest control clause and come away puzzled. There isn't one, not in the way there is for allergen management or traceability. ISO 22000 is a management-system standard: it tells you that you must control pests as part of your prerequisite programmes, and how to decide how rigorously, but it leaves the technical detail, proofing standards, device density, monitoring frequency, to the sector-specific technical specifications it references. That division is the difference between an FSMS that treats pest control as a checkbox and one that treats it as a genuine input to hazard analysis.
This guide covers where pest management sits inside ISO 22000, PRPs under clause 8.2, when a control measure becomes an operational PRP, hazard analysis, clause 9 verification, and clause 7 obligations for a contracted pest control operator (PCO).
Key takeaways
- ISO 22000 clause 8.2 requires PRPs, including pest management, to be established, implemented, maintained and updated, chosen with reference to standards such as ISO/TS 22002-1.
- ISO 22000 does not define pest-proofing detail. ISO/TS 22002-1 clause 12 supplies that detail for manufacturing sites.
- Where hazard analysis shows a standard PRP is not enough, the measure must be elevated to an operational PRP (oPRP) with its own action criteria and monitoring.
- Clause 7 requires organisations to manage externally provided processes, a contracted PCO must be evaluated, controlled and verified, not simply hired and forgotten.
- Clause 9 verification, including internal audit and trend analysis, is where most South African FSMS pest programmes fall short.
Where pest management sits in the ISO 22000 structure
ISO 22000 is built around the Plan-Do-Check-Act cycle: context (clause 4), leadership (clause 5), planning (clause 6), support (clause 7), operation (clause 8), performance evaluation (clause 9) and improvement (clause 10). Pest management is not its own clause because it is not a stand-alone activity, it is one of several prerequisite programmes sitting inside clause 8, Operation, alongside cleaning and sanitation, personnel hygiene and supplier control.
Clause 8.2 is the operative text. It requires PRPs to be established, implemented, maintained and updated, appropriate to the organisation's size, operation type and product nature, applied across the whole production system, and approved by the food safety team. It also directs organisations to reference relevant standards, for manufacturing sites, that means ISO/TS 22002-1:2009. Its clause 12, headed Pest control, is where the operational detail lives: proofing and exclusion, removal of attractants, mapped monitoring devices, inspection frequencies, and eradication using registered pesticides. See our companion article on FSSC 22000 and ISO/TS 22002-1 clause 12 for that detail, since FSSC 22000 is built on this ISO 22000 plus ISO/TS 22002 combination.
PRP or oPRP: classifying your pest management control measures
ISO 22000 draws a sharp distinction between a prerequisite programme and an operational PRP (oPRP), and getting the classification right is a consequential decision for any South African food safety team. A standard PRP, proofing, baiting, fixed-frequency monitoring, trend review, suits sites where hazard analysis shows pest pressure is a general hygiene condition, not a hazard requiring active control at a specific process step. Most well-proofed, low pest-pressure sites in urban industrial parks around Gauteng fall into this category.
The picture changes when hazard analysis (clause 8.5) identifies a control measure necessary to keep a hazard at an acceptable level, but not managed by a Critical Control Point. Typical triggers include a raw material intake bay adjoining open veld or grain storage, with a documented history of Rattus norvegicus or Mus musculus; open product lines at risk from Blattella germanica harbourage in wall cavities; stored-product pests such as Tribolium castaneum in dry stores feeding an open mixing stage; or flying insect pressure near an uncovered filling line.
Where this applies, the measure is reclassified as an oPRP. Under clause 8.5.4, every oPRP must have defined action criteria that are measurable (for example, any live rodent activity inside the production envelope), active monitoring at every service rather than a passive periodic check, a documented corrective action procedure triggered automatically when criteria are breached, and verification that the oPRP is operating as designed. This is the single most common gap our auditors find when reviewing FSMS documentation inherited from a previous, generic pest control provider: measures that should have been elevated to oPRP status, left running as an unchanged PRP.
Feeding pest data into hazard analysis
Clause 8.5.1 requires hazard identification to draw on "history and evidence available in the field, " which includes pest activity trends, not just theoretical risk. A programme producing service slips alone gives the food safety team nothing to feed back into this step; a programme producing trended data by zone, species and month, rodent hits rising in the receiving bay every April as neighbouring maize fields are harvested, for instance, gives real evidence to reassess controls. This is the loop the myASConline portal closes: every finding captured at station level becomes trend data the team can pull directly into its next hazard analysis review. See the one-click audit pack in myASConline for how that evidence is compiled.
Clause 7 and clause 9: managing your PCO and verifying the programme
Very few South African food manufacturers run pest control in-house, it is almost universally outsourced to a specialist PCO. Clause 7.1.6 requires the organisation to ensure any outsourced process is still controlled, and clause 8.4 sets criteria for evaluating, selecting, monitoring and re-evaluating external providers. Your FSMS documentation must show how the PCO was selected and judged competent; evidence that technicians are registered pest control operators under Act 36 of 1947; a scope aligned to SANS 10133, the national code of practice for pesticide application on sensitive premises; and an ongoing review of contractor performance, not just accepted service reports. A well-drafted pest control contract gives you the SLA, scope and review mechanism clause 7.1.6 expects.
Clause 9 is where the programme is proven to be working, not just present. Internal audits (9.2) must treat the pest PRP/oPRP as an auditable process, checking the documented programme against what is physically happening on site. Monitoring review (9.1) requires service records to be reviewed, not simply filed. Management review input (9.3) treats pest activity trends by zone, species and month as performance data; a rising trend that never reaches management review is a verification failure, regardless of whether the pest problem itself was serious.
Documented information ISO 22000 expects you to hold
Clause 7.5 applies to pest management like any other PRP/oPRP. The file an auditor expects to see includes:
| Document | ISO 22000 reference |
|---|---|
| Pest risk assessment and PRP/oPRP classification rationale | Clause 8.2, 8.5.4 |
| Station and monitoring device map | Clause 8.2 (ISO/TS 22002-1 clause 12.5) |
| PCO contract, scope and evaluation records | Clause 7.1.6, 8.4 |
| Service records, minimum 12 months, with trend analysis | Clause 9.1, 8.5.1, 9.3 |
| Approved pesticide register with Act 36 of 1947 L-numbers | Clause 8.2 (legal compliance) |
| PCO registration certificates (Department of Agriculture) | Clause 7.1.6, 8.4 |
| Corrective action and close-out records for oPRP breaches | Clause 8.5.4, 10.1 |
Every one of these documents is generated automatically inside myASConline as part of the one-click audit pack, built by a parent group that audits FSMS documentation for a living.
How ISO 22000 relates to FSSC 22000, BRCGS and HACCP
HACCP is the hazard analysis methodology embedded inside ISO 22000's clause 8, see what HACCP-compliant pest control looks like. FSSC 22000 is a certification scheme built on ISO 22000 plus the ISO/TS 22002 series plus additional requirements, see FSSC 22000 pest control requirements. BRCGS is a separate, retailer-driven standard with its own, often more prescriptive, clause, see BRCGS pest control requirements. A manufacturer certifying to FSSC 22000 is, in effect, audited against ISO 22000's clause 9, with ISO/TS 22002-1 clause 12 supplying the pest-specific detail.
Frequently asked questions
Does ISO 22000 tell you exactly how to do pest control?
No. ISO 22000 clause 8.2 requires prerequisite programmes, including pest management, to be established, implemented, maintained and updated and appropriate to the organisation and its food safety risks, but it does not prescribe proofing details, monitoring frequencies or device layouts. That detail comes from ISO/TS 22002-1:2009 clause 12, which clause 8.2 directs organisations to reference.
When does pest management become an operational PRP (oPRP) under ISO 22000?
When hazard analysis under clause 8.5 shows a standard PRP is not sufficient to keep an identified hazard at an acceptable level, for example high rodent or stored-product insect pressure beside an open product line. The oPRP then needs defined action criteria, active monitoring at every service, and documented verification and corrective action.
How is ISO 22000 different from FSSC 22000 for pest control?
ISO 22000 is the base food safety management system standard. FSSC 22000 is a certification scheme built on ISO 22000 plus the ISO/TS 22002 sector PRP standards plus additional requirements. For pest control, ISO 22000 sets the management-system obligation under clause 8.2, ISO/TS 22002-1 clause 12 supplies the manufacturing detail, and FSSC 22000 audits both against ISO 22000's clause 9 verification requirements.
