ISO 22000: What the Standard Covers and What to Watch Out For
ISO 22000 sounds like one of those standard titles that make people's eyes glaze over. In reality, though, it is a practical roadmap. It describes how to build a food safety management system that holds up from goods-in to delivery. Moreover, you do not have to be a large group to benefit from it. The standard works for small producers just as well as for caterers, packaging manufacturers and logistics companies along the food chain.
What ISO 22000 describes
ISO 22000 sets out the requirements for a food safety management system, often shortened to FSMS. Its full title is "Food safety management systems – Requirements for any organization in the food chain". The aim is simple: your business should deliver safe food consistently, in line with customer requirements and legal rules.
The standard thinks along the whole chain. It addresses not only classic food manufacturers but every organisation that is directly or indirectly involved. That includes cleaning contractors, packaging manufacturers and suppliers of equipment that comes into contact with food.
You will find the official description on the ISO page for ISO 22000:2018 food safety management systems. It also lists the related documents in the standard family.
The four key elements
According to ISO, the standard combines four generally recognised key elements. They work together, so none of them stands alone.
Interactive communication. Information has to flow along the supply chain, upstream, downstream and within your own organisation.
System management. Food safety is organised as a controllable process instead of being left to chance.
Prerequisite programmes (PRPs). Basic conditions such as hygiene, pest control and maintenance, on which everything else builds.
HACCP principles. A systematic hazard analysis and the control of critical points, based on the Codex Alimentarius.
Together, these elements make sure that risks do not only become visible when a customer complains.
A structure you may already know
Since the 2018 edition, ISO 22000 has used the High-Level Structure. This is the common framework that other ISO management standards such as ISO 9001 also use. As a result, food safety fits much more easily into an existing quality management system.
In addition, the standard works consistently with the PDCA cycle: plan, do, check and act. Behind it lies the idea of continual improvement. So you do not set up your system once and put it on a shelf. Instead, you keep developing it.
Risk-based thinking instead of gut feeling
A central point of the current edition is risk-based thinking. The standard distinguishes between operational risk at product level, which HACCP controls, and strategic risk at the level of the whole management system. Therefore, you need to keep an eye on both.
In practice, this means looking in two directions. First, you check what can go wrong with a product on a specific line. Second, you check what could weaken your system as a whole, for example a key person leaving or a new supplier.
Leadership carries the responsibility
Top management has a stronger role than in earlier editions. Food safety is a leadership task, not a job you quietly hand over to one person. A clear policy, defined objectives and enough resources are part of it.
Auditors notice quickly whether management actually lives this commitment. For example, they look at management reviews, at how decisions on resources are made and at how leaders react to deviations.
Which edition applies
The current edition is ISO 22000:2018. In 2024, ISO added an amendment on climate action changes. Moreover, ISO lists a revision of the standard under development as a draft international standard.
For that reason, check with your certification body which edition and which amendment apply to your audit. This avoids surprises during certification.
ISO 22000 or FSSC 22000
ISO 22000 on its own is a standard you can certify against. However, many retailers ask for a certificate recognised by the Global Food Safety Initiative (GFSI). This is where FSSC 22000 comes in.
The FSSC 22000 certification scheme from Foundation FSSC builds on ISO 22000. It adds sector-specific prerequisite programmes such as ISO/TS 22002-1 for food manufacturing and further scheme requirements. FSSC 22000 is GFSI-recognised.
So if your customers require GFSI recognition, ISO 22000 is a strong foundation, but FSSC 22000 is usually the certificate they mean. Food manufacturers supplying retail also often face a choice between FSSC 22000 and IFS Food and its requirements.
Why ISO 22000 pays off for your business
Certification is not required by law. Nevertheless, many retail chains and larger buyers expect it as a condition for doing business. If you can show it, you signal reliability.
The internal benefit is at least as valuable. You get fewer complaints, clearer processes, documented responsibilities and a noticeably lower risk of expensive recalls. For manufacturers, a large part of this happens on the line, as our article on hygiene in food manufacturing shows.
What you need to document
Food safety policy and objectives. Approved by top management and reviewed regularly.
Hazard analysis and HACCP plan. Hazards, control measures and critical limits for each product or process.
Prerequisite programmes. Cleaning, pest control and maintenance as digital checklists and inspection plans.
Competence and training. Who has which qualification, with records in the QMSpot training and instructions module.
Internal audits. Audit programme, findings and follow-up, for example in the QMSpot audit management module.
Corrections and corrective actions. Every deviation with cause and fix, tracked in the QMSpot defect management module.
Management review. Results, decisions and resources from the regular review by top management.
Frequently asked questions
Is ISO 22000 the same as HACCP?
No. HACCP is a central part of the standard, but ISO 22000 goes further. It links HACCP with a complete management system, including leadership, communication and continual improvement.
Does ISO 22000 replace ISO 9001?
No. ISO 22000 focuses only on food safety, while ISO 9001 covers quality management in general. However, both combine well because they share the same basic structure.
Who is the standard suitable for?
For any organisation in the food chain, regardless of size or sector. That ranges from manufacturers and caterers to packaging suppliers and logistics companies.
Is ISO 22000 recognised by GFSI?
Not on its own. GFSI recognises FSSC 22000, which builds on ISO 22000 and adds further requirements.
How to get started
This week, take your existing HACCP plan and hold it against the four key elements. Note where communication, system management or prerequisite programmes are still missing or only exist on paper.
These gaps are your first tasks. For each one, set an owner, a deadline and a record. To see how this comes together in one system, take a look at QMSpot quality management software.
Thinking about introducing ISO 22000 in your business?
Then let's talk briefly about your requirements and see how you can manage HACCP, prerequisite programmes and internal audits with QMSpot in one clear system.