What ISO 22000 is
ISO 22000:2018 is the international standard for food safety management systems. It applies to any organisation in the food chain: farms, processors, packaging makers, storage and transport, caterers and retailers. It combines hazard analysis based on HACCP principles with prerequisite programmes and a management system that plans, checks and improves food safety.
Where HACCP on its own is a method for controlling hazards in a process, ISO 22000 wraps that method in a system: leadership commitment, defined responsibilities, communication along the supply chain, internal audits and management review.
Current status of the standard
The 2018 edition is current. In 2024 ISO published Amendment 1, which adds climate change to clauses 4.1 and 4.2: an organisation must determine whether climate change is a relevant issue for its food safety system, and consider that interested parties may have climate-related requirements. Certification audits now check this.
A revision of ISO 22000 is underway. The ISO committee has been working toward a draft international standard for public enquiry, aligning the standard with the current management system structure and with Codex food hygiene principles. Until a new edition is published, ISO 22000:2018 with its 2024 amendment is the version to certify against.
Who this is for
- Food manufacturers and processors supplying retailers, brands or exporters.
- Packaging makers producing food-contact materials.
- Cold chain, storage and logistics businesses handling food.
- Caterers, central kitchens and food service groups.
- Companies moving from a basic HACCP plan to a certified system.
ISO 22000 or FSSC 22000?
Many large retailers require certification to a scheme recognised by the Global Food Safety Initiative. FSSC 22000 is one such scheme: it combines ISO 22000 with a sector-specific prerequisite programme standard, such as the ISO/TS 22002 series, and extra scheme requirements. If your customers name FSSC 22000, build to ISO 22000 and add the scheme requirements. If they accept ISO 22000 alone, the extra layer may not be needed. We check what your customers actually accept before you choose.
What BookMyLLC handles
- Gap analysis against ISO 22000:2018 and Amendment 1:2024.
- Prerequisite programmes: hygiene, cleaning, pest control, maintenance, water, allergen management and personnel practices.
- Hazard analysis and HACCP plan with critical control points and operational prerequisite programmes.
- Traceability, withdrawal and recall procedures, with a mock recall.
- Supplier approval and monitoring.
- Food safety team training, internal audit and management review.
- Certification audit support, and FSSC 22000 add-on requirements where needed.
Step-by-step process
- Scope. Define products, processes and sites.
- Prerequisites first. Basic hygiene and facility conditions have to be in place before hazard analysis makes sense.
- Hazard analysis. The food safety team identifies biological, chemical, physical and allergen hazards for each step.
- Control measures. Hazards are assigned to critical control points or operational prerequisite programmes, with limits, monitoring and corrections.
- Verification and records. Monitoring records, verification activities and validation evidence are set up.
- Run it. The system operates long enough to produce real records.
- Audit. Internal audit, management review, then a two-stage certification audit by an accredited body.
What you need to provide
- Product list, recipes or specifications, and intended consumers.
- Process flow diagrams and site layout.
- Existing HACCP plan, cleaning schedules and pest control reports.
- Supplier list and raw material specifications.
- Food safety licences and any recent inspection or customer audit reports.
Timeline
A food business with basic hygiene and a HACCP plan in place can typically reach certification readiness in a few months. Facility upgrades, new equipment or rebuilding prerequisite programmes take longer. Plan time to run the system and collect records before the audit.
What auditors look for in practice
Food safety auditors spend much of their time on the production floor. They check hand-washing and changing facilities, the condition of walls, floors and drains, pest control devices, segregation of allergens and raw and cooked products, and whether staff follow the procedures they were trained on.
They also test the paperwork behind what they see. Expect to be asked for the monitoring records for a critical control point on a specific day, the calibration record for the thermometer used, the supplier approval for a raw material in the store, and the result of your last mock recall. They will ask how the food safety team decided whether climate change is relevant to your system.
The strongest systems are the ones staff can explain in their own words. If a line operator can say what the critical limit is at their step and what to do when it is missed, the auditor will usually find the records match.
Common mistakes to avoid
- A HACCP plan copied from another site. Hazards and controls must reflect your products and your equipment.
- Weak allergen control. Cross-contact and labelling errors are a leading cause of recalls.
- Untested traceability. Run a mock recall and time it before the auditor asks you to.
- Ignoring the 2024 amendment. Auditors expect a documented decision on whether climate change is relevant.
- Records filled in at the end of the shift. Monitoring must be recorded when it happens.
- A food safety team on paper only. The team named in your documents must actually meet, review hazards when products or processes change, and keep minutes of its decisions.
This is general guidance on the standard, not legal advice; food safety laws in your country and your export markets apply alongside it. If you also manufacture supplements or pharmaceuticals, see GMP preparation. Many food businesses integrate ISO 22000 with ISO 9001 and ISO 14001. Book a call to scope your site.
ISO 22000 at a glance
| Question | Short answer |
|---|---|
| What it covers | A food safety management system covering hazards from farm to fork. |
| Core ideas | HACCP, prerequisite programmes and a management system. |
| Who certifies | An accredited certification body. |
| Validity | Three years, with surveillance audits between. |
| Who needs it | Food producers, packers, caterers and suppliers to larger buyers. |
ISO 22000 or FSSC 22000
| ISO 22000 | FSSC 22000 | |
|---|---|---|
| Basis | ISO standard alone | ISO 22000 plus sector programmes and additional requirements |
| Recognition | Widely accepted | Benchmarked by the Global Food Safety Initiative |
| Fits | Smaller or domestic buyers | Large retailers and international buyers |
Ask your key customers which they require before choosing.
The certification path
| Stage | What happens |
|---|---|
| Gap analysis | Compare what you do today with the standard |
| Build the system | Write the documents and processes the standard requires |
| Run it | Operate the system long enough to produce records |
| Internal audit and management review | Check the system yourself before the auditor does |
| Stage 1 audit | The certification body reviews your documents and readiness |
| Stage 2 audit | The certification body audits how the system works in practice |
| Certificate | Issued for three years, with surveillance audits between |
Preparing for your first audit
- Run the system for long enough to have records of each control.
- Hold an internal audit and a management review before the auditor arrives.
- Walk the site as an auditor would, from receiving to dispatch.
- Keep corrective action records for every issue found.
Auditors sample records, so having them organised saves time and shows that the system is used day to day.
Documents an auditor will ask for
| Document | Purpose |
|---|---|
| Food safety policy and scope | Sets what the system covers |
| Hazard analysis and HACCP plan | Identifies and controls hazards |
| Prerequisite programmes | Hygiene, pest control, cleaning |
| Traceability and recall procedure | Lets you trace and withdraw product |
| Internal audit and review records | Show the system checks itself |
