It's no different than any other kind of audit other than the criteria.
What are the requirements?
Are they being met?
ISO 22000 contains within it the HAACP principles so there is no need to worry about both.
Just identify what is required, how the organization has determined how to meet the requirments, and whether or not the methods used are effective in doing so.
Now remember, we're talking Food Safety and not Quality and the management of risk (in this case Quality is part of Safety).
Read the entire ISO 22000 document and not just the shalls....here is a piece of the intro:
Introduction
Food safety is related to the presence of food-borne hazards in food at the point of consumption (intake by the consumer). As the introduction of food safety hazards can occur at any stage of the food chain, adequate control throughout the food chain is essential. Thus, food safety is ensured through the combined efforts of all the parties participating in the food chain.
Organizations within the food chain range from feed producers and primary producers through food manufacturers, transport and storage operators and subcontractors to retail and food service outlets (together with inter-related organizations such as producers of equipment, packaging material, cleaning agents, additives and ingredients). Service providers are also included.
This International Standard specifies the requirements for a food safety management system that combines the following generally recognized key elements to ensure food safety along the food chain, up to the point of final
consumption:
— interactive communication;
— system management;
— prerequisite programmes;
— HACCP principles.
