ISO 22000: Food Safety Management System Guide

ISO 22000 is the international standard specifying requirements for a Food Safety Management System (FSMS), as described on the official page on 2026-11-10. Published by the International Organization for Standardization (ISO), it provides a framework for organizations across the food supply chain to identify, prevent, and control food safety hazards. The current edition, ISO 22000:2018 (including Amendment 1:2024 climate action requirements), aligns the Hazard Analysis and Critical Control Point (HACCP) principles defined by Codex Alimentarius with the standardized Annex SL High-Level Structure common to ISO management systems.

What it is and who runs it

ISO 22000 is a voluntary international standard developed by Technical Committee ISO/TC 34, Subcommittee SC 17 (Management systems for food safety), as described on the official page on 2026-11-10. While ISO publishes the standard, certification is performed by independent third-party certification bodies accredited under ISO/IEC 17021-1 and ISO/TS 22003 by national accreditation bodies belonging to the International Accreditation Forum (IAF). Certificate validity can be verified through registries like an ISO certificate lookup.

Unlike mandatory regulatory frameworks such as FDA food facility registration or federal FSMA requirements in the United States, ISO 22000 is not a government body. It establishes a structured management architecture that demonstrates due diligence, standardizes supplier quality across international supply chains, and controls biological, chemical, and physical food safety hazards.

Eligibility (summary, with the official source)

According to Clause 1 of ISO 22000:2018, as described on the official page on 2026-11-10, the standard applies to any organization directly or indirectly involved in the food chain, regardless of size or complexity. Eligible entities include:

• Direct actors: Primary producers (farms, fisheries, aquaculture), food and beverage processors, commercial caterers, food service operators, retail grocers, and storage or transport providers.
• Indirect suppliers: Manufacturers of food processing equipment, food-contact packaging, sanitizing chemicals, and food additives.

Prior certification to ISO 9001 is not required. Any facility with operational control over baseline hygiene and the resources to maintain documented hazard controls is eligible.

What it funds or requires

ISO 22000 is an audit standard rather than a funding program; it provides no financial subsidies or equipment grants. Facilities fund their own implementation, testing, and audits. The standard requires two simultaneous Plan-Do-Check-Act (PDCA) cycles: one covering organizational system management (Clauses 4–7 and 9–10) and one covering operational hazard control (Clause 8).

Operational hazard control requires managing three distinct tiers:

• Prerequisite Programs (PRPs): Baseline environmental and sanitary conditions across the facility (e.g., pest control, layout, waste management). Processing plants frequently implement programs such as listeria environmental monitoring to verify sanitation efficacy.
• Operational Prerequisite Programs (oPRPs): Control measures identified by hazard analysis to manage specific food safety hazards, monitored using action criteria.
• Critical Control Points (CCPs): Processing steps where control is essential to prevent, eliminate, or reduce a hazard to an acceptable level, governed by measurable critical limits (e.g., thermal hold times, metal detector limits).

Clause 8.3 requires a bidirectional product traceability system utilizing an auditable lot code structure. Clause 8.8 mandates verification activities, including internal audits, equipment calibration, and product screening via methods like HPLC testing services for food safety.

Application or compliance steps

Achieving compliance and accredited certification follows eight structured steps, as described on the official page on 2026-11-10:

1. Establish Leadership and Team: Appoint a Food Safety Team Leader, form a multidisciplinary team, and define the Food Safety Policy.
2. Determine Context and Scope: Define physical and product boundaries, evaluating stakeholder expectations and regulatory mandates.
3. Implement Prerequisite Programs: Establish basic hygiene and facility controls adhering to industry best practices and ISO/TS 22002 specifications.
4. Execute Preliminary Hazard Steps: Detail raw materials, product formulations, end uses, and construct verified process flow diagrams.
5. Conduct Hazard Analysis: Identify biological, chemical, radiological, and physical hazards; evaluate risk significance; and categorize controls as PRPs, oPRPs, or CCPs.
6. Draft the Hazard Control Plan: Set critical limits for CCPs and action criteria for oPRPs, defining monitoring routines and corrective actions.
7. Implement Procedures and Traceability: Train operators, log monitoring records, test emergency procedures, and execute mock recall drills.
8. Audit and Review: Conduct internal audits, convene executive reviews, resolve nonconformities, and undergo Stage 1 and Stage 2 certification audits.

Typical timeline phases (no calendar dates as facts)

Achieving accredited certification generally spans twelve to eighteen months across six operational phases:

• Diagnostic Phase: Conducting a gap analysis against ISO 22000:2018, assembling the food safety team, and completing core standard training.
• Prerequisite Alignment Phase: Upgrading facility sanitation, pest control, equipment hygiene, and supplier qualification protocols.
• Hazard Analysis Phase: Building flow diagrams, conducting hazard evaluations, and establishing CCP critical limits and oPRP action criteria.
• Implementation Phase: Enforcing standard operating procedures, logging shift monitoring data, and running mock recall exercises.
• Internal Audit Phase: Conducting internal audits across production lines and shifts, investigating nonconformities, and completing the management review.
• Certification Audit Phase: Undergoing the Stage 1 documentation audit, closing preliminary findings, and completing the Stage 2 on-site audit.

Common mistakes

Facilities seeking certification often encounter common implementation errors:

• Confusing oPRPs and CCPs: Designating general hygiene tasks as CCPs overburdens staff with excessive critical limit checks, while omitting action criteria for oPRPs leaves intermediate hazards uncontrolled.
• Inadequate Prerequisite Hygiene: Attempting to manage food safety through CCPs while operating with defective facility infrastructure or inconsistent sanitation.
• Static Hazard Plans: Failing to re-evaluate hazard analyses when recipes, suppliers, packaging, or equipment lines change.
• Incomplete Lot Traceability: Inability to trace batch records through blending tanks and rework back to raw ingredient lots within targeted recall limits.
• Departmental Siloing: Treating ISO 22000 as solely a QA task without active involvement from operations, maintenance, and senior management.
• Assuming GFSI Equivalency: Mistaking ISO 22000 for a GFSI-benchmarked certification, which may fail to satisfy retailer mandates requiring schemes like FSSC 22000.

Related programs (table)

The table below summarizes related food safety standards and frameworks, as described on the official page on 2026-11-10:

Standard / Framework	Governing Body	Primary Scope & Focus	GFSI Recognized?	Typical Application Setting
ISO 22000:2018	ISO (ISO/TC 34/SC 17)	Global management system combining Codex HACCP, PRPs, and oPRPs	No	Multi-tier food supply chains seeking standardized international management systems
FSSC 22000 (v6.0)	Foundation FSSC	ISO 22000 plus sector PRPs (ISO/TS 22002) and FSSC additional requirements	Yes	Food and packaging manufacturers supplying major multinational retailers
BRCGS Food Safety (Issue 9)	BRCGS	Prescriptive process and hygiene standards for food processing	Yes	Food manufacturers supplying European and global retail chains
SQF Code (Edition 9)	Safe Quality Food Institute	Modular safety and quality codes spanning primary production through processing	Yes	Processors, packers, and distributors across North American retail networks
FDA FSMA (21 CFR 117)	U.S. FDA	Mandatory federal preventive controls for human food facilities	Statutory (Not GFSI)	Commercial facilities producing food products distributed within the United States
Codex CXC 1-1969	Codex Alimentarius (FAO/WHO)	International code on General Principles of Food Hygiene and HACCP	Foundational Reference	Global baseline referenced by national regulators and voluntary standards

FAQ

Is ISO 22000 mandatory for all food businesses?

No. ISO 22000 is a voluntary international standard. However, commercial buyers, export contracts, or corporate retailers may mandate certification contractually.

What is the primary difference between ISO 22000 and HACCP?

HACCP is an operational hazard control technique. ISO 22000 integrates Codex HACCP within an overarching management framework addressing leadership, resources, internal audits, and continual improvement.

Why is ISO 22000 not benchmarked by the Global Food Safety Initiative (GFSI)?

GFSI requires standards to mandate prescriptive, sector-specific prerequisite programs. Standalone ISO 22000 offers flexibility in PRP design, so it lacks GFSI recognition. FSSC 22000 combines ISO 22000 with mandatory ISO/TS 22002 PRPs to achieve GFSI benchmarking.

What distinguishes an oPRP from a CCP in ISO 22000?

A Critical Control Point (CCP) manages hazards using strict numerical critical limits where deviations indicate potential adulteration. An Operational Prerequisite Program (oPRP) manages hazards via action criteria focused on essential hygienic control.

How does ISO 22000 align with ISO 9001?

Both standards use the Annex SL High-Level Structure, sharing identical clause numbering, document control rules, and corrective action workflows, enabling unified management system integration.

How long is an ISO 22000 certificate valid?

Certificates are valid for three years, requiring successful annual surveillance audits in years one and two, followed by a recertification audit prior to expiration.

Sources

• International Organization for Standardization (ISO). ISO 22000:2018 — Food safety management systems — Requirements for any organization in the food chain (with Amendment 1:2024 Climate action changes). Technical Committee ISO/TC 34/SC 17. Accessed November 10, 2026. https://www.iso.org/standard/65464.html
• Codex Alimentarius Commission (FAO/WHO). General Principles of Food Hygiene (CXC 1-1969, Revised 2020). Accessed November 10, 2026. https://www.fao.org/fao-who-codexalimentarius/codex-texts/codes-of-practice/en/
• Foundation FSSC. FSSC 22000 Scheme Version 6.0. Published April 2023, Mandatory April 2024. Accessed November 10, 2026. https://www.fssc.com/schemes/fssc-22000/
• U.S. Food and Drug Administration (FDA). FSMA Final Rule for Preventive Controls for Human Food (21 CFR Part 117). Accessed November 10, 2026. https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-rules-guidance-industry
• International Accreditation Forum (IAF). IAF CertSearch Global Accreditation Database. Accessed November 10, 2026. https://www.iafcertsearch.org/