Food safety
ISO 22000: HACCP placed inside a working system
HACCP is a legal requirement for anyone handling food. ISO 22000 adds what most systems lack — management, prerequisite programmes, communication along the chain and proof that the controls actually work. We build it without unnecessary bureaucracy.
4–7 mo.typical implementation
7 principlesof HACCP at the core
2 levelsof risk management
FSSCGFSI-recognised upgrade
In short
What ISO 22000 is
Short answer
ISO 22000 is the international standard for a food safety management system. It brings together three things: the principles of HACCP, prerequisite programmes (hygiene, maintenance, pest control) and the ten-clause management structure shared by all modern ISO standards.
The standard introduces a distinction classic HACCP lacks — two separate cycles of risk management. One is organisational: risks to the business itself, objectives, resources, competence. The other is operational: hazards in the process, critical control points and operational prerequisite programmes.
Who must have HACCP. European food hygiene legislation requires a system based on HACCP principles from every food business operator, from manufacturer to restaurant. ISO 22000 does not replace that obligation — it fulfils it in a fuller and more demonstrable form that also stands up to a customer audit.
Distinctions
HACCP, ISO 22000 and FSSC 22000
The three are constantly confused. The difference lies in scope and in who recognises them.
| HACCP | ISO 22000 | FSSC 22000 | |
|---|---|---|---|
| What it is | A hazard analysis methodology | A management system standard | A certification scheme |
| Mandatory | Yes, by law | No, voluntary | No, voluntary |
| Covers management | No | Yes — objectives, audit, review | Yes |
| Prerequisite programmes | Separate, informal | Yes, required | Yes, to a sector specification |
| GFSI recognition | No | No | Yes |
| Typical trigger | Legal requirement | Customer or inspection | International retail chains |
FSSC 22000 is ISO 22000 plus two things: a sector specification for prerequisite programmes and additional scheme requirements. If your customers are international retailers they will most likely ask for FSSC — and ISO 22000 is the natural first step towards it.
Applicability
Who the standard is for
The chain is long and the standard covers its full length — including those who never touch food.
Food production
From primary processing to finished products, including dairy, meat and canning plants.
Transport and storage
Cold chains, warehouses and logistics where temperature control is critical.
Packaging and materials
Producers of food-contact packaging, who also face the new EU packaging regime.
Catering and food service
Restaurants, catering, hospital and school meals — high-risk environments with high staff turnover.
What the standard contains
What the system is made of
| Element | What it covers | What you show at the audit |
|---|---|---|
| Prerequisite programmes | Hygiene, cleaning and disinfection, pest control, maintenance, personal hygiene, allergen management | Schedules, cleaning records, pest control contract and reports |
| Food safety team | A cross-functional team with defined competence and a leader | Appointment record, training records |
| Product and process description | Specifications, intended use, flow diagrams confirmed on site | Current flow diagrams with a verification date |
| Hazard analysis | Biological, chemical, physical and allergen hazards by step | Assessment table with justification of acceptable levels |
| CCPs and OPRPs | Critical control points with critical limits, and operational prerequisite programmes | Control plan, monitoring records |
| Traceability and recall | One step forward and one step back, plus a withdrawal and recall plan | Record of a completed mock recall |
| Verification and validation | Proving the controls work and checking they are applied | Laboratory testing, internal audits, sampling results |
Two areas where auditors almost always find gaps: mock recalls, which are either not performed or not documented; and allergen management, where cross-contamination is rarely assessed against the real production sequence.
How we work
The route to the certificate
- 1
Gap analysis and site walk
We review the existing HACCP documentation and compare it with what actually happens in production.
2–4 working days - 2
Prerequisite programmes
We put hygiene, maintenance, pest control and allergen management in order. Without working PRPs the hazard analysis has no foundation.
3–5 weeks - 3
Hazard analysis and control plan
We draw up the flow diagrams, confirm them on site and define CCPs and OPRPs with critical limits and monitoring.
3–4 weeks - 4
Traceability and recall readiness
We build the traceability system and run a real mock recall with measured time.
1–2 weeks - 5
Training, internal audit and review
We train staff and internal auditors, run the audit and prepare the management review.
2–3 weeks - 6
Certification audit
Preparation and attendance at the two-stage audit, including the on-site production check.
4–8 weeks to certificate
Questions and answers
Frequently asked questions
What is the difference between ISO 22000 and HACCP?
HACCP is a methodology for hazard analysis and identification of critical control points, and is legally required of every food business operator. ISO 22000 is a standard for a complete management system that includes the HACCP principles but adds prerequisite programmes, a management structure, objectives, internal audit, management review and communication along the chain.
Is ISO 22000 certification mandatory?
No. What is mandatory is a system based on HACCP principles. ISO 22000 certification is voluntary, but in practice becomes necessary when a customer, a retail chain or a public procurement authority requires it as a condition of doing business.
What is FSSC 22000 and how does it relate?
FSSC 22000 is a certification scheme comprising ISO 22000, a sector specification for prerequisite programmes and a set of additional requirements. Unlike ISO 22000 it is recognised by the Global Food Safety Initiative, which makes it the preference of international retail chains. ISO 22000 is the natural first step towards it.
How long does implementation take?
For a single-site operation the typical timeline is four to seven months. The longest part is usually the prerequisite programmes, because they require real changes to hygiene practice and maintenance rather than documents alone. For catering and food service the timeline is shorter.
We have ISO 9001 — will it be easier?
Yes, significantly. ISO 22000 uses the same ten-clause structure, so context, leadership, competence, documented information, internal audit and management review are already in place. What remains is the specific part — prerequisite programmes, hazard analysis, the control plan and traceability.
What are operational prerequisite programmes?
Operational prerequisite programmes, or OPRPs, are control measures for a significant hazard that do not meet the criteria for a critical control point but still require monitoring and proof of effectiveness. An example is allergen control at a product changeover. ISO 22000 requires them to be defined, monitored and verified just like CCPs.
How often should we run a mock recall?
The standard requires the ability to withdraw and recall to be verified without setting a frequency. Accepted practice is at least annually, with a documented record, measured time to trace a batch and analysis of the weaknesses found. It is also one of the first things checked at a customer audit.
Does the auditor inspect production on site?
Yes, always. A large part of an ISO 22000 audit takes place in the production areas — hygiene practice, separation of flows, temperature regimes, equipment condition and whether monitoring records match what is observed. Documentation that does not match reality on the floor results in a finding.
Let’s see what your HACCP system is missing
In most cases the foundation already exists. A review shows what is documentation without practice and what is practice without documentation — and how far you are from certification.