Full descriptions of services and products with their safety-relevant information are on hand, flow diagrams for logistical and product processes are current, updated after changes and checked on site. Every physical, chemical and biological hazard that could reasonably arise, allergens included, is analysed for likelihood and severity, with a documented risk assessment per risk class where classes are used. Control points are set and documented for safety-relevant steps that are not CCPs, critical limits are fixed for each CP and CCP, and KO requirement 3 (N/A possible): where safety depends on monitoring, every CCP has a monitoring system with records naming the person, date and result. Operators monitoring CCPs are specifically instructed, CCP records are checked during verification, CPs are monitored and recorded, and corrective action, covering affected product, is taken and documented when a limit is lost. Verification, at least annually and drawing on internal and external audits and complaint evaluation, confirms the system works and is reported to senior management; documentation fits the company's size. Plus module: treatment steps appear in flow diagrams, the expected consumer use of own brand and self-treated goods is described with vulnerable consumers in mind, and CCPs are chosen with a decision tree or similar reasoned tool.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.