Audits & Certifications

ISO 22000: what it is and who must certify

By Claudia · · 6 min read

ISO 22000: what it is and who must certify

ISO 22000: what it is and who must certify

ISO 22000 is the international reference standard for food safety management. If you work in quality within the food industry, you've probably already heard this term, but you may not be entirely clear on what it means in practice, who needs to apply it, and how it differs from other schemes like FSSC 22000. In this article we explain it clearly and directly, so you can make informed decisions for your organization.

What the ISO 22000 standard is, and why it's the foundation schemes like FSSC 22000 are built on

The ISO 22000 standard (ISO, n.d.) is a standard published by the International Organization for Standardization that sets out the requirements for a food safety management system applicable to any organization in the food chain, regardless of its size or the type of product it makes. From primary producers and manufacturers to distribution, logistics or packaging companies — all of them can adopt this standard.

The current version, ISO 22000:2018, incorporates the high-level structure (HLS) shared with other ISO standards such as ISO 9001, making it easier to integrate into existing management systems. This shared architecture lets you align processes, documentation and internal audits without duplicating effort.

Why does this matter so much? Because ISO 22000 doesn't just define what needs to be done — it also defines how to prove it. It combines the principles of hazard analysis and critical control points (HACCP) with the requirements of a structured management system, creating a robust, auditable framework. It also serves as the technical foundation on which more specific schemes, such as FSSC 22000, are built, adding extra layers of requirements to achieve GFSI recognition.

In practical terms, ISO 22000 certification isn't a legal requirement in most European countries, but it's a frequent demand from customers, distributors and large retail chains. In many sectors, having it is a condition for market access.

To go deeper into the concept, you can check our glossary entry on ISO 22000 or read the article on key ISO standards in the food industry.

The key requirements of ISO 22000: the food safety management system, HACCP, and communication across the food chain

ISO 22000's requirements are built around four major elements that work together:

1. Interactive communication across the food chain. The standard requires a two-way flow of information with suppliers, customers and other interested parties. Any hazard or change that affects food safety must be communicated promptly throughout the chain. This requires defined channels and records that document it.

2. System management. The organization must establish, implement, maintain and update a food safety management system. This includes defining roles and responsibilities, resource management, planning and continuous improvement. Top management plays an active role: leadership commitment is an explicit requirement, not just a statement of intent.

3. Prerequisite programs (PRPs). Before getting to hazard analysis, the standard requires the company to establish and maintain basic hygiene and operating conditions. Known as prerequisite programs, these cover things like pest control, cleaning and disinfection, water management and facility maintenance.

4. HACCP principles. The technical heart of the standard is the HACCP system. ISO 22000 requires identifying the biological, chemical and physical hazards associated with each stage of the process, assessing their risk and establishing appropriate control measures. Critical control points (CCPs) must be monitored against defined critical limits and documented verification procedures.

All of this must be backed by solid documentation: a safety policy, measurable objectives, procedures, work instructions and evidence records. This is where many companies run into the biggest operational difficulties, especially when they're still working with paper systems or scattered spreadsheets.

ISO 22000 vs. FSSC 22000: what the GFSI-recognized certifiable scheme adds

One of the most common questions among quality managers is exactly this: if we already have ISO 22000, do we also need FSSC 22000?

The answer depends on your company's context, but it's worth understanding the difference clearly. ISO 22000 is an international standard that can be certified through any accredited certification body. However, this certificate isn't directly recognized by the Global Food Safety Initiative (GFSI) (GFSI, n.d.).

FSSC 22000, on the other hand, is a certification scheme that takes ISO 22000 as its base and adds sector-specific requirements (such as PRPs based on ISO/TS standards depending on the product category) as well as FSSC's own requirements. Because it's recognized by the GFSI, FSSC 22000 certification is accepted by major manufacturers and distributors worldwide as a guarantee of food safety.

In practical terms:

  • If your customer requires a GFSI-recognized standard, you'll need FSSC 22000 (or BRC, IFS, etc.), not just ISO 22000.
  • If your goal is to improve your internal food safety management system or prepare to move up to a GFSI scheme, ISO 22000 is an excellent starting point.
  • Moving from ISO 22000 to FSSC 22000 is relatively straightforward if the base system is well implemented, since the additional requirements are limited in scope.

If you want to learn in detail how FSSC 22000 works and what its specific requirements are, we recommend our article on how to obtain FSSC 22000 certification.

How to prepare the required documentation and records without relying on paper

One of the biggest challenges quality teams face when implementing or maintaining ISO 22000 is document management. The standard requires a significant volume of controlled documentation: procedures, HACCP plans, monitoring records, internal audit reports, training records, corrective actions… the list is long and constantly being updated.

Working with paper documents or unstructured shared folders creates several problems: outdated versions on the plant floor, incomplete records that invalidate control evidence, and difficulty consolidating data ahead of an audit or spotting trends in safety indicators.

In this context, digitizing document management and operational records is a natural, necessary step. Food industry quality software lets you centralize all documentation, control versions, assign periodic review tasks and capture records directly from the plant floor, eliminating manual transcription and reducing human error.

What's more, when an audit comes around, being able to retrieve any record in seconds, filtered by date, product or process, makes a real difference. Auditors value immediate traceability and consistency between what's documented and what's actually practiced.

At Solved, this is exactly what we work on: helping food industry quality teams digitize their food safety management system, aligned with standards like ISO 22000 or FSSC 22000, so they can spend less time on paperwork and more time genuinely improving their processes.

References

  • Global Food Safety Initiative. (n.d.). Global Food Safety Initiative (GFSI). https://mygfsi.com/
  • International Organization for Standardization. (n.d.). ISO 22000 and ISO 9001. https://www.iso.org/