September 9, 2025

ISO 22000 Explained: Requirements and Certification

ISO 22000 is an international standard for Food Safety Management Systems (FSMS) that specifies requirements for identifying, controlling, and managing food safety hazards throughout the food supply chain. It provides a structured framework for establishing food safety policies, implementing operational controls, monitoring performance, and continually improving food safety management.

Published by the International Organization for Standardization (ISO), ISO 22000:2018 integrates food safety management requirements with Hazard Analysis and Critical Control Points (HACCP) principles, prerequisite programs (PRPs), risk-based thinking, and communication across the food chain.

The standard applies to organizations involved directly or indirectly in food production and distribution, including food manufacturers, processors, packaging suppliers, storage facilities, transportation providers, retailers, and food service operations.

ISO 22000 certification provides independent confirmation that an organization’s food safety management system has been assessed against the applicable standard requirements. Maintaining certification requires continued implementation, monitoring, verification, and improvement of the system.

What Is ISO 22000?

ISO 22000 specifies requirements for establishing, implementing, maintaining, and continually improving a Food Safety Management System.

The standard addresses both organizational management processes and operational food safety controls.

An ISO 22000 management system typically covers:

Food safety policies and objectives
Leadership and organizational responsibilities
Internal and external communication
Prerequisite programs
Food safety hazard analysis
Operational prerequisite programs
Critical Control Points
Monitoring and verification
Traceability and emergency preparedness
Corrective actions and continual improvement

The principal edition is ISO 22000:2018, supplemented by Amendment 1:2024 concerning climate action changes to management system standards.

The official standard is available from the International Organization for Standardization.

What Is a Food Safety Management System?

A Food Safety Management System (FSMS) is a coordinated set of policies, procedures, responsibilities, and operational controls established to manage food safety hazards.

An FSMS defines how hazards are identified, how control measures are selected, how performance is monitored, and how corrective actions are implemented.

Under ISO 22000, food safety management is integrated into organizational planning, supplier management, production activities, employee responsibilities, and performance evaluation.

This approach supports consistent food safety practices across relevant operations.

Who Can Apply ISO 22000?

ISO 22000 can be implemented by organizations of any size or complexity operating within the food chain.

Its application extends to activities that directly handle food and supporting operations that may affect food safety.

Industry	Application of ISO 22000
Food manufacturing	Production hygiene, hazard control, and process monitoring
Beverage production	Ingredient management, processing controls, and sanitation
Meat and seafood processing	Biological hazard control, temperature management, and hygiene
Dairy processing	Processing controls, sanitation, and contamination prevention
Food ingredient suppliers	Raw material safety, traceability, and supplier controls
Food packaging	Management of food safety hazards associated with packaging operations
Storage and warehousing	Environmental conditions, hygiene, and product handling
Transportation and logistics	Temperature control, handling, and contamination prevention
Catering and food service	Food preparation, storage, and sanitation controls
Retail and distribution	Product handling, traceability, and supplier management

The scope of an ISO 22000 system should reflect the organization’s actual products, services, processes, and activities.

Is ISO 22000 Mandatory?

ISO 22000 certification is generally voluntary.

However, certification may be required through customer agreements, supplier qualification programs, procurement specifications, or other contractual arrangements.

Food businesses remain responsible for complying with applicable food safety laws and regulations.

ISO 22000 certification demonstrates that a management system has been independently assessed against the standard. It does not automatically establish compliance with every product-specific legal requirement.

Key Requirements of ISO 22000

ISO 22000 follows a management system structure covering organizational context, leadership, planning, support, operation, performance evaluation, and improvement.

These requirements establish how food safety responsibilities and operational controls are managed throughout an organization.

1. Context of the Organization

Organizations must determine internal and external issues relevant to the effectiveness of their Food Safety Management System.

Relevant considerations may include:

Applicable food safety legislation
Customer and contractual requirements
Organizational activities and processes
Supply chain relationships
Interested parties and their relevant requirements
Factors affecting food safety management

The organization must also establish the scope of its FSMS.

This scope identifies the products, services, processes, and locations covered by the management system.

2. Leadership and Food Safety Policy

Top management must demonstrate leadership and commitment to food safety.

Responsibilities include:

Establishing a food safety policy
Defining food safety objectives
Assigning responsibilities and authorities
Providing adequate resources
Supporting effective communication
Promoting continual improvement

Food safety responsibilities should be clearly understood by personnel performing activities that may affect product safety.

3. Planning and Risk-Based Thinking

ISO 22000 requires organizations to identify and address risks and opportunities that may affect the effectiveness of the FSMS.

Planning also includes establishing measurable food safety objectives and determining how those objectives will be achieved.

The standard addresses risk at two levels:

Organizational risk management considers issues that may affect the management system’s ability to achieve its intended results.

Operational hazard analysis evaluates food safety hazards associated with products, processes, and operating conditions.

Both are necessary for maintaining an effective FSMS.

4. Resources and Competence

Organizations must provide appropriate resources for implementing and maintaining food safety controls.

These may include:

Qualified personnel
Suitable facilities and infrastructure
Appropriate equipment
Monitoring and measuring resources
Technical knowledge
Documented procedures
Training and competence evaluation

Personnel responsible for food safety activities must have the competence necessary to perform their assigned tasks.

5. Internal and External Communication

ISO 22000 emphasizes communication throughout the food chain.

Organizations must establish arrangements for communicating relevant food safety information with suppliers, customers, contractors, employees, and regulatory authorities where applicable.

Communication may concern changes in raw materials, product specifications, processing conditions, intended use, or identified hazards.

Effective communication helps ensure that relevant food safety information is considered when establishing and updating operational controls.

6. Operational Planning and Control

Operational requirements address the activities necessary to identify and manage food safety hazards.

These include:

Prerequisite programs
Traceability
Emergency preparedness
Hazard analysis
Selection and categorization of control measures
Hazard control plans
Monitoring and verification
Control of nonconforming products

Operational controls must reflect the organization’s processes and identified food safety hazards.

7. Performance Evaluation

Organizations must evaluate whether their FSMS is functioning effectively.

Performance evaluation activities include monitoring, measurement, analysis, internal audits, and management reviews.

Findings should be documented and used to identify areas requiring corrective action or improvement.

8. Continual Improvement

ISO 22000 requires organizations to address nonconformities, determine appropriate corrective actions, and evaluate their effectiveness.

The FSMS must be updated when relevant changes affect food safety hazards, control measures, or management system requirements.

Prerequisite Programs (PRPs) in ISO 22000

Prerequisite programs (PRPs) establish the basic environmental and operational conditions necessary to maintain food safety throughout the food chain.

They provide foundational controls for managing hygiene, contamination risks, and operating conditions.

Typical PRPs include:

Cleaning and sanitation
Personnel hygiene
Pest control
Facility design and maintenance
Equipment cleaning and maintenance
Waste management
Water quality management
Prevention of cross-contamination
Storage and transportation conditions
Supplier and raw material management

PRPs should be established according to the organization’s activities, products, and applicable requirements.

How Are PRPs Implemented?

Organizations should identify the environmental and operational conditions necessary for maintaining food safety.

For example, a food processing facility may establish cleaning schedules, equipment maintenance procedures, pest control arrangements, and hygiene requirements.

The effectiveness of these programs should be monitored and verified as appropriate.

Relevant sector-specific technical specifications may support the development of PRPs.

Operational Prerequisite Programs (OPRPs)

Operational prerequisite programs (OPRPs) are control measures or combinations of control measures applied to prevent or reduce significant food safety hazards to an acceptable level.

OPRPs are identified through the hazard analysis and control measure categorization process.

They are managed through a documented hazard control plan.

An OPRP requires:

Defined action criteria
Monitoring procedures
Assigned responsibilities
Records of monitoring results
Actions when criteria are not met
Verification activities

Examples of OPRPs

Depending on the product, process, and hazard analysis, OPRPs may include:

Allergen cross-contact prevention controls
Specific sanitation procedures
Raw material screening
Certain temperature management controls
Contamination prevention during processing

The classification of a control measure depends on the documented hazard analysis.

A particular control may be categorized differently under different operating conditions.

Critical Control Points (CCPs) in ISO 22000

A Critical Control Point (CCP) is a step at which a control measure or combination of control measures is applied to prevent or reduce a significant food safety hazard to an acceptable level, with defined critical limits and measurement enabling the application of corrections.

CCPs are identified through the hazard analysis process.

For example, a validated heat treatment process may be classified as a CCP when it is essential for controlling a significant biological hazard.

Each CCP requires appropriate critical limits, monitoring procedures, and defined responses to deviations.

OPRP vs CCP

Feature	OPRP	CCP
Purpose	Control significant food safety hazards	Control significant food safety hazards
Control criteria	Action criteria	Critical limits
Monitoring	Detects failure to meet action criteria	Detects failure to meet critical limits
Response to deviations	Corrections and corrective actions as applicable	Corrections and corrective actions as applicable
Identification	Hazard analysis and control measure categorization	Hazard analysis and control measure categorization

Both OPRPs and CCPs form part of the operational hazard control framework where identified by the organization’s hazard analysis.

How ISO 22000 Incorporates HACCP Principles

HACCP (Hazard Analysis and Critical Control Points) is a systematic approach to identifying, evaluating, and controlling significant food safety hazards.

ISO 22000 incorporates HACCP principles into its operational food safety management requirements.

The seven HACCP principles are:

Conduct a hazard analysis.
Determine Critical Control Points.
Establish validated critical limits.
Establish monitoring procedures.
Establish corrective actions.
Validate the HACCP plan and establish verification procedures.
Establish documentation and record-keeping procedures.

These principles are described in the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969).

ISO 22000 integrates these principles with management system requirements, communication, prerequisite programs, performance evaluation, and continual improvement.

For a detailed explanation of hazard analysis and the seven principles, see our HACCP Food Safety Guide.

Hazard Analysis and Food Safety Controls

Hazard analysis is a central operational requirement of ISO 22000.

Organizations must identify food safety hazards reasonably expected to occur in relation to their products, processes, and operating environment.

Biological Hazards

Biological hazards include microorganisms and other biological agents capable of causing foodborne illness.

Examples include pathogenic bacteria, viruses, and parasites.

Chemical Hazards

Chemical hazards may include:

Cleaning chemical residues
Pesticide residues
Allergens
Naturally occurring toxins
Chemical contaminants
Substances migrating from food contact materials

Physical Hazards

Physical hazards include foreign materials capable of causing injury.

Examples include glass fragments, metal particles, and hard plastic pieces.

Selection of Control Measures

After identifying and evaluating hazards, organizations must determine appropriate control measures.

The measures are assessed and categorized according to the applicable ISO 22000 requirements.

The resulting hazard control plan identifies monitoring procedures, responsibilities, acceptance criteria, and actions required when deviations occur.

Validation, Monitoring and Verification

ISO 22000 distinguishes between validation, monitoring, and verification.

These activities serve different functions within the FSMS.

Activity	Purpose	Example
Validation	Establishes that a control measure is capable of achieving the intended hazard control	Evaluating evidence that a specified heat treatment achieves the required hazard reduction
Monitoring	Determines whether a process or control measure is operating within defined criteria	Recording processing temperatures
Verification	Confirms that specified requirements have been fulfilled	Reviewing monitoring records, conducting audits, or performing appropriate testing

Validation of Control Measures

Control measures must be validated before implementation and following relevant changes where required.

Validation establishes whether the selected measures are capable of controlling identified significant food safety hazards.

Monitoring of Operational Controls

Monitoring provides information about the operating status of control measures.

For CCPs, monitoring must support timely detection of deviations from critical limits.

For OPRPs, monitoring determines whether action criteria are being met.

Verification of Food Safety Controls

Verification evaluates whether food safety controls and system arrangements are operating as specified.

Activities may include:

Reviewing monitoring records
Conducting internal inspections
Performing food safety audits
Environmental monitoring
Product testing
Evaluating corrective actions

Verification results should be analyzed and used to support continual improvement.

ISO 22000 vs HACCP

ISO 22000 incorporates HACCP principles within a broader Food Safety Management System.

Both address food safety hazards and the implementation of appropriate controls.

Feature	ISO 22000	HACCP
Primary focus	Food Safety Management System	Food safety hazard analysis and control
Hazard analysis	Required	Core principle
Critical Control Points	Included where identified	Core principle
Prerequisite programs	Explicit operational requirement	Foundational to effective HACCP implementation
Leadership requirements	Formal management system requirements	Depends on the broader system or program
Internal audits and management review	Explicit management system requirements	May be included under applicable programs or regulations
Certification	Third-party certification available against ISO 22000	HACCP-based certification schemes may be available

The appropriate framework depends on regulatory obligations, customer requirements, and the organization’s food safety management objectives.

ISO 22000 vs FSSC 22000

FSSC 22000 is a food safety certification scheme built around ISO 22000, applicable sector-specific prerequisite program requirements, and additional scheme requirements.

Feature	ISO 22000	FSSC 22000
Framework	International management system standard	Food safety certification scheme
Core FSMS requirements	ISO 22000	ISO 22000
Prerequisite programs	Required	Applicable sector-specific PRP specifications form part of scheme requirements
Additional scheme requirements	ISO 22000 requirements	Additional FSSC requirements
Certification	ISO 22000 certification	FSSC 22000 certification
GFSI recognition	ISO 22000 certification alone is not GFSI-recognized	FSSC 22000 has GFSI-recognized scopes under applicable scheme arrangements

FSSC 22000 eligibility and requirements depend on the applicable scheme version and food chain category.

Official scheme information is available from FSSC.

ISO 22000 Documentation Requirements

ISO 22000 requires organizations to maintain and retain documented information necessary for the effectiveness of the FSMS.

Documentation should reflect the organization’s activities, operational complexity, and applicable requirements.

Typical records include:

FSMS scope
Food safety policy and objectives
Food safety team responsibilities
Product descriptions
Process flow diagrams
Hazard analysis records
Prerequisite program procedures
Hazard control plans
Monitoring records
Validation and verification results
Traceability records
Corrective action reports
Internal audit reports
Management review records

The standard allows organizations to determine suitable documentation arrangements within its requirements.

Documented information must be appropriately controlled and maintained.

Food Safety Audits and ISO 22000 Verification

Food safety audits evaluate whether management system requirements and operational controls are implemented effectively.

Audits may be conducted internally, by customers, or by independent third parties.

Internal Food Safety Audits

Internal audits evaluate whether the FSMS conforms to planned arrangements and ISO 22000 requirements.

Auditors review procedures, operational practices, monitoring records, and corrective actions.

Findings support management review and continual improvement.

Supplier Food Safety Audits

Supplier audits evaluate whether suppliers maintain suitable food safety controls and meet agreed requirements.

Assessment areas may include:

Facility hygiene
Raw material handling
Pest control
Sanitation procedures
Equipment maintenance
Storage conditions
Traceability
Hazard control practices

The audit scope should reflect the supplier’s activities, products, and associated food safety risks.

Food Safety Testing

Laboratory testing can support verification of selected food safety controls.

Depending on the product and hazard assessment, testing may include:

Microbiological analysis
Chemical contaminant testing
Allergen testing
Water quality testing
Other product-specific examinations

Testing requirements should be determined according to applicable hazards, regulations, specifications, and control objectives.

Product testing provides evidence concerning the tested samples and defined parameters.

Common Challenges in ISO 22000 Implementation

Effective ISO 22000 implementation requires coordination between management, operational personnel, suppliers, and food safety specialists.

Several challenges may affect system performance.

Incomplete Hazard Analysis

Hazard analysis may overlook relevant risks when product descriptions, process flow diagrams, or operating conditions are incomplete.

Assessments should reflect actual operations and reasonably expected hazards.

Incorrect Classification of Control Measures

PRPs, OPRPs, and CCPs serve different functions.

Incorrect categorization may lead to unsuitable monitoring arrangements or inadequate control of significant hazards.

Control measures should be categorized using the applicable ISO 22000 methodology.

Insufficient Monitoring Records

Incomplete records make it difficult to demonstrate that operational controls have been implemented.

Monitoring procedures should identify responsibilities, methods, frequencies, and required actions.

Weak Supplier Management

Raw materials, ingredients, packaging, and outsourced activities may introduce food safety hazards.

Supplier evaluation and communication should reflect the risks associated with supplied products and services.

Inadequate Verification

Documented procedures require supporting evidence that operational controls remain effective.

Verification activities should be planned, implemented, reviewed, and used to identify improvements.

Failure to Update the FSMS

Changes in products, ingredients, equipment, processes, suppliers, or legal requirements may affect food safety controls.

Relevant FSMS elements must be reviewed and updated when necessary.

Benefits of ISO 22000 Certification

ISO 22000 certification can provide operational and commercial benefits when the underlying management system is effectively implemented.

Structured Food Safety Risk Management

The standard establishes a systematic approach to identifying hazards and implementing appropriate controls.

Improved Operational Consistency

Documented procedures, defined responsibilities, and monitoring activities support consistent food safety practices.

Stronger Supply Chain Communication

ISO 22000 emphasizes communication with suppliers, customers, service providers, and relevant authorities concerning food safety matters.

Support for Customer and Supplier Requirements

Certification may help organizations demonstrate that their FSMS has been independently assessed against an internationally recognized standard.

Continual Improvement

Internal audits, verification results, corrective actions, and management reviews provide information for improving system performance.

Certification does not eliminate food safety risks. Effective implementation and ongoing maintenance remain essential.

ISO 22000 establishes a comprehensive framework for managing food safety hazards across the food supply chain. Effective implementation requires appropriate prerequisite programs, validated hazard controls, reliable monitoring, and ongoing verification. Organizations should assess their existing food safety systems against the applicable ISO 22000 requirements and address identified gaps before pursuing certification.