Why ISO 22000 Matters in the Food Industry
ISO 22000 is the international standard for food safety management systems. It gives organisations across the food supply chain a structured framework for identifying and controlling food safety hazards, so that food is safe for human consumption by the time it reaches the end consumer. If you work in food manufacturing, processing, packaging, storage, distribution, or catering, ISO 22000 is the standard that is most directly relevant to your operations.
On this page
Unlike some ISO standards that apply broadly across industries, ISO 22000 was designed specifically for the food sector. It combines the principles of Hazard Analysis and Critical Control Points (HACCP) with the structure of a management system standard, which means it sits alongside ISO 9001, ISO 14001, and ISO 45001 in terms of how it is built and audited. If you already work with any of those standards, a lot of what ISO 22000 requires will feel familiar. The difference is in the food safety specific content, particularly the hazard analysis process and the control measures that flow from it.
This article explains what ISO 22000 actually requires, who needs it, how it differs from related schemes like FSSC 22000, and what it means for auditors and quality professionals working in or around the food industry.
The Structure of ISO 22000
ISO 22000:2018 is the current edition of the standard. It follows the High Level Structure (HLS) that all modern ISO management system standards share, which means it uses the same clause numbering and core requirements as ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018. This makes it much easier to integrate with other management systems if your organisation already holds one or more of those certifications.
The standard is built around four key elements that work together:
- Interactive communication across the food chain, so that hazard information flows between suppliers, manufacturers, distributors, and customers
- System management using the Plan-Do-Check-Act cycle that underpins all HLS standards
- Prerequisite programmes (PRPs) that establish the basic hygiene and operational conditions needed before hazard analysis begins
- HACCP principles as defined by the Codex Alimentarius Commission, embedded directly into the standard
The clause structure runs from Clause 4 (Context of the Organisation) through to Clause 10 (Improvement), just as it does in ISO 9001. But within that structure, Clauses 8.2 through 8.9 contain the food safety specific requirements, including PRPs, hazard analysis, the HACCP plan, and operational control. This is where ISO 22000 diverges significantly from a general quality management standard.
Exemplar Global Recognised Training ProviderRTP No. 310970
What Are PRPs and Why Do They Come First
Prerequisite programmes are the foundation of any food safety management system. They are the basic conditions and activities that are necessary to maintain a hygienic environment throughout the food chain. Think of them as the baseline controls that need to be in place before you even start identifying hazards.
PRPs cover things like:
- Cleaning and sanitation procedures
- Pest control
- Personal hygiene requirements for staff
- Supplier controls and incoming material verification
- Cross-contamination prevention
- Temperature control for storage and transport
- Maintenance of equipment and facilities
ISO 22000 does not prescribe exactly what your PRPs must look like. It requires you to select, establish, monitor, and verify them based on the nature of your operations and the food products you handle. The specific content of PRPs is often guided by sector-specific technical specifications, the most widely used being ISO/TS 22002-1 for food manufacturing, which forms the technical basis for FSSC 22000 certification.
When auditing an ISO 22000 system, one of the first things an auditor will check is whether the PRPs are appropriate for the site, whether they are documented, and whether there is evidence they are being monitored and maintained. A PRP that exists on paper but is not being followed is one of the most common findings in food safety audits.
HACCP Within ISO 22000
HACCP is not a new concept. It has been used in the food industry for decades and is required by food safety legislation in many countries, including Australia under the Food Standards Code. What ISO 22000 does is embed HACCP within a broader management system framework, which means it is not just a set of plans sitting in a folder. It is integrated into how the organisation manages its processes, its people, its documentation, and its continual improvement activities.
The hazard analysis process in ISO 22000 requires you to:
- Identify all biological, chemical, and physical hazards that could reasonably be expected to occur in your products or processes
- Conduct a hazard assessment to determine the severity of each hazard and the likelihood of its occurrence
- Determine the control measures needed to prevent, eliminate, or reduce those hazards to acceptable levels
- Categorise control measures as either operational PRPs (OPRPs) or critical control points (CCPs)
- Establish monitoring procedures, corrective actions, and verification activities for each OPRP and CCP
The distinction between OPRPs and CCPs is important. A CCP is a step in the process where a control measure can be applied and is essential to prevent or eliminate a food safety hazard. CCPs have critical limits, and if a critical limit is exceeded, a corrective action must be taken immediately. OPRPs are control measures that manage hazards but do not have the same level of criticality as CCPs. They still require monitoring and verification, but the response to a deviation may be less immediate.
For auditors, the hazard analysis process is one of the most technically demanding areas to audit. You need to understand whether the hazard identification is thorough, whether the risk assessment methodology is sound, and whether the resulting control measures are proportionate and effective. This is covered in depth in the article The Hazard Analysis Process in ISO 22000: A Step by Step Walkthrough.
Who Needs ISO 22000
ISO 22000 applies to any organisation in the food chain, regardless of size or the type of food product involved. The standard is explicit about this. It covers:
- Primary producers such as farmers, growers, and aquaculture operators
- Food processors and manufacturers producing any type of food product for human consumption
- Food packaging manufacturers where the packaging comes into direct contact with food
- Storage and distribution operators including cold chain logistics providers
- Retailers and food service operators including restaurants, catering companies, and institutional food providers
- Ingredient and additive suppliers whose products are used in food production
- Cleaning chemical and equipment suppliers whose products are used in food environments
In practice, the most common reason organisations pursue ISO 22000 certification is customer or regulatory pressure. Major retailers, food service companies, and export markets increasingly require their suppliers to hold food safety certification. If you supply to a major supermarket chain in Australia, the chances are high that your customer has specified a food safety management system as a condition of supply.
Export markets add another layer of pressure. Many countries require food safety certification as a condition of market access, particularly for processed foods. ISO 22000 certification, or certification to a scheme built on it like FSSC 22000, is widely recognised internationally and can open doors to markets that would otherwise require lengthy regulatory assessments.
ISO 22000 vs FSSC 22000 vs HACCP
This is a question that comes up constantly in the food industry, and the confusion is understandable. Here is a plain English explanation of how the three relate to each other.
HACCP
HACCP is a food safety methodology, not a management system standard. It is a systematic approach to identifying and controlling food safety hazards. HACCP plans are required by food safety legislation in many jurisdictions, including the Australian Food Standards Code. Having a HACCP plan does not mean you have a certified management system. It means you have a documented hazard analysis process.
ISO 22000
ISO 22000 is a management system standard that incorporates HACCP principles. It goes beyond a HACCP plan by requiring an organisation to build a full management system around food safety, including leadership commitment, documented information, internal audits, management review, corrective action, and continual improvement. Certification to ISO 22000 is conducted by an accredited third party certification body.
FSSC 22000
FSSC 22000 is a certification scheme that builds on ISO 22000. It adds sector-specific PRPs from the ISO/TS 22002 series and additional requirements developed by the Foundation FSSC. FSSC 22000 is recognised by the Global Food Safety Initiative (GFSI), which makes it the preferred scheme for many major retailers and food service companies. If your customer requires GFSI-recognised certification, you will need FSSC 22000 rather than ISO 22000 alone.
The practical difference is that ISO 22000 gives you a solid, internationally recognised food safety management system. FSSC 22000 gives you that plus GFSI recognition, which is what most large retail and food service customers will specify. The article FSSC 22000 vs ISO 22000: Which Food Safety Certification Do You Need? goes into more detail on how to choose between them.
ISO 22000 and the High Level Structure
Because ISO 22000:2018 follows the High Level Structure, it shares a common framework with ISO 9001, ISO 14001, and ISO 45001. This matters for several reasons.
First, it means organisations that already hold one of those certifications will find the management system requirements of ISO 22000 largely familiar. The requirements for context of the organisation, leadership, planning, support, performance evaluation, and improvement are structured in the same way across all HLS standards. The food safety specific content is concentrated in Clause 8.
Second, it makes integrated management systems more practical. A food manufacturer that holds ISO 9001 and ISO 22000 can run a single management system that satisfies both standards, with a combined internal audit programme, a single management review process, and a unified documented information structure. This reduces duplication and makes the system easier to maintain.
Third, it means auditors who are already qualified in ISO 9001 have a strong foundation for moving into food safety auditing. The audit methodology is the same. What changes is the technical knowledge required to audit the food safety specific elements, particularly the hazard analysis process and the control measures that flow from it.
What Auditors Need to Know About ISO 22000
If you are an internal auditor in a food business, or an ISO consultant working with food clients, ISO 22000 requires some specific technical knowledge that goes beyond what you need for ISO 9001 or ISO 14001.
The key areas where auditors need to be well prepared include:
Hazard Analysis
You need to be able to assess whether the hazard identification process is thorough and whether the risk assessment methodology is defensible. This means understanding the types of hazards relevant to the products and processes being audited, and being able to ask questions that test whether the food safety team has genuinely considered all reasonably foreseeable hazards.
PRP Verification
PRPs are only effective if they are being followed consistently. Auditors need to spend time on the floor, observing practices, checking records, and interviewing workers to verify that the documented PRPs reflect what is actually happening. A gap between the documented procedure and the actual practice is a very common finding.
CCP Monitoring Records
Every CCP must have monitoring records that demonstrate the critical limits are being maintained. Auditors need to sample these records and verify that deviations are being recorded and that corrective actions are being taken when critical limits are exceeded. Missing records or records that show no variation whatsoever are both red flags.
Validation and Verification
ISO 22000 distinguishes between validation (confirming that control measures are capable of achieving their intended purpose) and verification (confirming that the system is working as planned). Many organisations confuse these two concepts. Auditors need to check that both activities are being carried out and that the results are being used to drive improvement.
For those looking to develop these skills formally, Running Effective Food Safety Internal Audits: A Practical Guide provides a detailed walkthrough of the internal audit process in a food safety context.
Food Safety Culture and ISO 22000
One of the more significant additions in the 2018 revision of ISO 22000 is the explicit requirement for food safety culture. The standard requires top management to establish, maintain, and improve a food safety culture within the organisation. This is not just about having policies and procedures. It is about whether the people who work in your facility actually understand why food safety matters, whether they feel comfortable raising concerns, and whether leadership visibly demonstrates commitment to food safety.
For auditors, food safety culture is one of the harder things to assess. You cannot verify it by checking a document. You need to talk to workers at all levels of the organisation, observe how people behave when they think no one is watching, and look for evidence that food safety concerns are taken seriously and acted on. This is where the interpersonal skills of an auditor matter as much as technical knowledge.
The article Auditing Food Safety Culture: What Auditors Should Look For provides practical guidance on how to approach this area during an audit.
Exemplar Global Recognised Training ProviderRTP No. 310970Preparing for ISO 22000 Certification
If your organisation is considering ISO 22000 certification for the first time, here is a realistic picture of what the process involves.
The first step is a gap analysis to understand where your current practices stand against the requirements of the standard. For most food businesses, the HACCP plan and the basic hygiene controls are already in place because they are required by law. The gaps are usually in the management system elements: documented information, internal audit, management review, corrective action processes, and the formal hazard analysis methodology required by the standard.
From there, you build or update your food safety management system to address the gaps. This typically takes three to twelve months depending on the size and complexity of your operations and how mature your existing systems are.
Before the certification audit, you need to run your system for a period of time and generate evidence of its operation. This includes internal audit records, management review minutes, corrective action records, and CCP monitoring records. A certification body will conduct a Stage 1 audit (document review) followed by a Stage 2 audit (on-site assessment). The article Preparing for Your First ISO 22000 Certification Audit covers what to expect in detail.
How ISO 22000 Fits Into an Auditing Career
For auditors and quality professionals, ISO 22000 represents a genuine career differentiator. The food industry is large, heavily regulated, and has a consistent demand for competent food safety auditors. Adding ISO 22000 to your auditing skill set opens up opportunities in food manufacturing, cold chain logistics, food packaging, catering, and export-focused agribusiness.
Because ISO 22000 follows the High Level Structure, auditors who are already qualified in ISO 9001 have a strong foundation to build on. The additional learning is concentrated in the food safety specific elements: PRPs, hazard analysis, HACCP, and food safety culture. This makes the transition from general quality auditing to food safety auditing more manageable than it might initially appear.
At Audit Workshop, our training courses are built for practitioners who want to develop real auditing skills, not just pass an exam. If you are working in the food industry or looking to expand into food safety auditing, our ISO 9001 internal auditor and lead auditor courses provide the management system foundation that underpins ISO 22000. We are also developing food safety specific training content for those who want to go further in this specialisation. Check our current course offerings at auditworkshop.com to see what is available.
