Prerequisite programs, or PRPs, are the baseline hygiene and operating conditions a food facility must have in place before a HACCP plan can function correctly. They cover things like sanitation, pest control, and personnel hygiene, and they exist specifically to prevent the kind of facility-wide contamination that no single critical control point downstream could catch.
A HACCP plan built on top of a weak PRP program is a common failure pattern, and it's one auditors catch quickly. A single missed maintenance check on a water system, or a supplier delivering under conditions nobody verified, can introduce a hazard no downstream critical control point is designed to catch. This guide covers what a complete prerequisite program actually includes, how it differs from a HACCP plan itself, and how the specific ISO 22002 series applies depending on your sector. It is written by Maria Falbo, a Lead Auditor with decades of experience auditing food safety management systems.
Prerequisite programs are the baseline operating conditions a food facility needs in place before hazard analysis can be completed. The word "prerequisite" is literal here — these programs exist prior to, and independent of, the specific hazard analysis a HACCP plan performs for a given product or process.
Without a functioning prerequisite program, a HACCP plan has nothing solid to stand on. A hazard analysis assumes the facility itself is already reasonably clean and properly maintained. When that assumption doesn't hold, no amount of precision at a specific critical control point downstream can compensate for it. For the fundamentals of how HACCP itself works, see our What Is HACCP? guide.
A complete prerequisite program covers several distinct categories, each addressing a different source of facility-wide risk.
Good Manufacturing Practices (GMPs) cover the broadest category: facility design, equipment placement, lighting, and construction standards that keep the physical environment itself from introducing contamination.
Sanitation procedures, often documented as Sanitation Standard Operating Procedures or SSOPs, specify exactly what gets cleaned, how, how often, and who verifies it. Sanitation failures are among the most common root causes behind serious nonconformances, even in facilities with an otherwise well-developed HACCP plan.
Pest control addresses prevention, monitoring, and response — keeping pests out of the facility in the first place, rather than only reacting once evidence of an infestation appears.
Personnel hygiene and training cover handwashing, protective clothing, and the behavioral side of contamination control. A facility can have excellent physical infrastructure and still fail here if staff don't really understand why a specific practice matters.
Water, ice, and steam quality, along with the broader utilities supporting production, need their own documented controls, since contaminated water or ice can introduce a hazard.
The category I see underestimated most often is sanitation documentation specifically. A facility can be genuinely clean on any given day and still fail an audit, because "clean" isn't the actual requirement — a documented, followed, and verified sanitation procedure is. I've walked into visibly spotless facilities that couldn't produce a single completed sanitation record, and the absence of that record is the actual finding, regardless of how the floor looked that morning.
Our ISO 22002-1:2025 Prerequisite Programs course covers the current standard for food manufacturing facilities.
The sequencing here isn't arbitrary. A hazard analysis, the first of HACCP's seven principles, identifies hazards specific to a particular product and process. It isn't designed to catch facility-wide risks like a leaking roof, a supplier who skipped a required certificate of analysis, or a maintenance gap on equipment, because those risks aren't specific to any one product. They can be introduced at any point.
This is why a strong prerequisite program actually makes hazard analysis easier and more reliable. Once the baseline environment is under control, the HACCP team can focus its attention on the hazards that are specific to the product, rather than trying to account for facility-wide gaps within a product-specific plan. For the full twelve-step sequence this groundwork supports, see our 12 Steps of Applying HACCP guide.
Standalone HACCP treats prerequisite programs as a single category: the baseline conditions that need to be in place. Organizations working toward ISO 22000 specifically encounter a further refinement — the distinction between general PRPs and operational PRPs, often shortened to oPRPs.
General PRPs maintain baseline hygiene across the whole facility, regardless of what specific product is being made. Operational PRPs are different: they control a specific hazard at a specific point the organization has identified through its hazard analysis, without meeting the stricter criteria that would make that point a full critical control point instead. This distinction is specific to ISO 22000's structure rather than something standalone HACCP requires. For the full comparison between the two frameworks, see our HACCP vs ISO 22000 guide.
The oPRP distinction trips up more experienced HACCP practitioners than newcomers, in my experience, precisely because it sounds like it should map cleanly onto the CCP concept they already know well. It doesn't. An oPRP exists because a hazard needs control at a specific point, but the criteria for calling that point a true CCP aren't met, usually because the control isn't precise or measurable enough to function as a critical limit. Getting this distinction right matters for accurately building out an ISO 22000-aligned plan, not just for passing an audit.
The specific requirements a prerequisite program needs to cover depend heavily on the sector. Food manufacturing, catering, and food packaging each face different risks, and the ISO 22002 series addresses each sector with its own dedicated part rather than a single generic document. Our ISO 22002-1:2025 Food Manufacturing course, ISO 22002-2:2025 Catering course, and ISO 22002-4:2025 Food Packaging course each cover the specific requirements for that sector.
A food manufacturing facility's prerequisite program looks meaningfully different from a catering operation's, since the physical facility, the equipment, and the specific hazards each one faces differ. Building a program that reflects your actual sector, rather than adapting generic guidance, is going to help the effectiveness of the practical application.
In many jurisdictions, baseline hygiene requirements exist in food safety law independent of HACCP specifically. HACCP then requires that these baseline conditions concretely be in place and documented before a hazard analysis can be considered valid.
The specific documentation can scale to the size and complexity of the operation, but the underlying categories still need to be fully addressed regardless of facility size.
At minimum whenever something in the facility changes meaningfully — new equipment, a new process, a facility layout change — and as part of any scheduled internal audit or verification review.
They need to be documented. An auditor can't verify an informal practice the same way they can verify a written procedure with completed, dated records behind it.
Maria Falbo has over 25 years of experience working as a Lead Auditor for certification bodies worldwide. She founded Logix ISO with the mission of making expert-level ISO training accessible to organizations of all sizes. Her work spans Quality, Environmental, Occupational Health and Safety, Food Safety, Automotive, and Energy management systems.
Learn more about Maria →Self-paced · 365-day access · Training certificate included