What Is ISO 22000? Food Safety Management Systems Explained

Why Food Safety Needs Its Own Management System Standard

If you work in the food industry, or you audit organisations that do, you have almost certainly encountered ISO 22000. It is the international standard for food safety management systems, and it applies to every organisation in the food chain, from primary producers and ingredient suppliers through to processors, packagers, distributors, retailers, and catering operations.

ISO 22000 exists because food safety failures carry consequences that most other quality failures do not. A nonconforming product in a manufacturing context might result in a customer complaint or a warranty claim. A food safety failure can send people to hospital. That reality shapes everything about how the standard is written and how auditors approach it.

This article explains what ISO 22000 is, how it works, who needs it, and what makes it different from other management system standards. Whether you are a quality manager implementing the system, an auditor preparing to assess one, or a professional considering adding food safety to your auditor credentials, this is where to start.

What ISO 22000 Actually Is

ISO 22000 is a management system standard published by the International Organisation for Standardisation. The current edition is ISO 22000:2018. It specifies requirements for a food safety management system that enables an organisation to demonstrate its ability to control food safety hazards and ensure that food is safe for human consumption at the point of intended use.

The standard combines two well established approaches to food safety control: management system principles drawn from the ISO family of standards, and the Hazard Analysis and Critical Control Points methodology, more commonly known as HACCP. HACCP has been a cornerstone of food safety practice since the 1960s and is embedded in food safety legislation in Australia, the European Union, the United States, and most other developed economies.

What ISO 22000 does is take HACCP and wrap a full management system framework around it. That means you get hazard analysis and critical control points, but you also get leadership requirements, planning, support, performance evaluation, and continual improvement. The result is a system that not only controls hazards but also manages the organisational conditions that determine whether hazard control stays effective over time.

The Scope of ISO 22000: Who Needs It

ISO 22000 is designed for any organisation involved in the food chain. The standard is explicit that this includes:

• Producers of animal feed and primary food ingredients
• Crop growers, fishers, and livestock producers
• Food manufacturers and processors
• Food packaging manufacturers
• Transport and storage operators handling food products
• Retailers and food service operators
• Organisations that supply cleaning chemicals, equipment, and other inputs to food businesses

This broad scope reflects a fundamental principle of food safety: contamination and hazard introduction can occur at any point in the chain, not just during manufacturing. A cold storage operator who allows temperature excursions can compromise a product that was perfectly safe when it arrived. A packaging supplier whose materials contain a chemical contaminant can cause a recall for a manufacturer who had no idea the risk existed.

In Australia, many food businesses pursue ISO 22000 certification because it aligns with and often exceeds the requirements of the Food Standards Australia New Zealand Code. It is also increasingly requested by major retailers and food service customers as part of their supplier approval processes.

The Structure of ISO 22000:2018

ISO 22000:2018 uses the Harmonised Structure, which is the same clause numbering framework used by ISO 9001, ISO 14001, ISO 45001, and other modern ISO management system standards. This makes it easier to integrate with other systems and means that auditors familiar with the Harmonised Structure will find the layout familiar.

The standard runs from Clause 1 through to Clause 10, with the operational requirements sitting primarily in Clause 8. Here is a plain English summary of what each section covers.

Clauses 1 to 3: Scope, References and Definitions

These opening clauses define the scope of the standard, reference the normative documents that support it, and provide the terms and definitions used throughout. Clause 3 is worth reading carefully because food safety has its own specific vocabulary, including terms like food safety hazard, critical control point, operational prerequisite programme, and prerequisite programme, all of which have precise meanings that differ from everyday usage.

Clause 4: Context of the Organisation

This clause requires the organisation to understand its internal and external context, identify interested parties and their requirements, and define the scope of its food safety management system. For food businesses, interested parties typically include regulators, customers, consumers, suppliers, and employees. The scope definition is important because it determines which parts of the operation the food safety management system covers and which hazards fall within its boundary.

Clause 5: Leadership

Top management must demonstrate commitment to the food safety management system and establish a food safety policy. A key requirement here is the appointment of a food safety team leader. This person is responsible for organising and managing the food safety team, ensuring relevant training, and reporting to top management on the performance of the system. In practice, this role is often held by the quality manager or a dedicated food safety manager, but the standard requires it to be formally assigned.

Clause 6: Planning

The planning clause requires the organisation to address risks and opportunities, set food safety objectives, and plan how to achieve them. Food safety objectives should be measurable and linked to the food safety policy. Examples might include maintaining critical control point monitoring compliance above a defined threshold, achieving a specific reduction in customer complaints related to food safety, or completing all prerequisite programme verification activities on schedule.

Clause 7: Support

This section covers resources, competence, awareness, communication, and documented information. Competence is particularly important in food safety. The people who manage, monitor, and verify the food safety management system need to have the knowledge and skills to do so effectively. Auditors will look for evidence that competence has been assessed, not just that training has been delivered.

Clause 8: Operation

This is the heart of the standard and where ISO 22000 differs most significantly from other management system standards. Clause 8 covers the planning and control of operational processes, and it is where the food safety technical requirements live. It is worth understanding the key concepts in detail.

Clause 9: Performance Evaluation

This clause covers monitoring, measurement, analysis, and evaluation, including internal audits and management review. Internal audits of the food safety management system are a specific requirement, and they need to cover both the management system elements and the operational controls including prerequisite programmes and HACCP plans.

Clause 10: Improvement

The improvement clause requires the organisation to address nonconformities, take corrective action, and drive continual improvement. In a food safety context, nonconformities can range from a documentation gap in a procedure to a critical control point monitoring failure, and the response needs to be proportionate to the food safety risk involved.

The Technical Core: PRPs, OPRPs and CCPs

The operational requirements in Clause 8 introduce three categories of control that are central to how ISO 22000 works. Understanding these is essential for anyone implementing or auditing the standard.

Prerequisite Programmes

Prerequisite programmes, commonly abbreviated as PRPs, are the basic conditions and activities that are necessary to maintain a hygienic environment throughout the food chain. They address the foundational conditions for food safety rather than specific identified hazards. PRPs include things like:

• Cleaning and sanitation programmes
• Pest control
• Personal hygiene requirements for food handlers
• Control of allergens in the facility
• Maintenance of equipment and buildings
• Control of purchased materials
• Waste management

PRPs are not directly linked to specific hazard analysis outcomes. They are the baseline that the organisation must have in place before hazard analysis can be meaningful. If your cleaning programme is ineffective or your pest control is not working, the hazard analysis will not save you.

Operational Prerequisite Programmes

Operational prerequisite programmes, or OPRPs, sit between PRPs and critical control points. They are identified through the hazard analysis process as being necessary to control a specific significant food safety hazard, but where the control measure is not managed at a critical control point.

The distinction between an OPRP and a CCP is one of the areas that trips up many food safety practitioners and auditors alike. The key difference is the nature of the monitoring. At a CCP, you can define a critical limit, monitor it in real time, and take immediate corrective action when it is breached. For an OPRP, the monitoring may be less immediate, or the control measure may not be amenable to the kind of precise measurement that a CCP requires.

An example might help. Allergen cleaning between production runs might be managed as an OPRP. You have a cleaning procedure, you verify it through swabbing, but the verification result may not be available in time to make a real time release decision in the way a temperature reading at a pasteurisation step would be.

Critical Control Points

A critical control point, or CCP, is a step in the process where a control measure is applied and is essential to prevent or reduce a food safety hazard to an acceptable level. Each CCP has a critical limit, a monitoring procedure, corrective actions for when the limit is exceeded, and verification activities to confirm the monitoring is working.

Classic examples of CCPs include the pasteurisation step in dairy processing, the cooking step in ready to eat meat products, and the metal detection step at the end of a production line. The critical limit for pasteurisation might be a minimum temperature and time combination. If the product does not reach that temperature for that duration, the CCP is breached and corrective action must be taken immediately.

The HACCP plan documents all of this for each CCP. It is one of the most scrutinised documents in any food safety audit, and rightly so. If the HACCP plan is not current, not validated, or not being followed in practice, that is a serious finding.

Hazard Analysis: The Engine of the System

The hazard analysis process is what connects the operational controls to the actual food safety risks in the business. ISO 22000 requires the organisation to identify all food safety hazards that may reasonably be expected to occur in relation to the product type, process type, and facilities, assess the significance of each hazard, and select appropriate control measures.

Hazards are categorised as biological, chemical, or physical. Biological hazards include pathogens such as Salmonella, Listeria, and E. coli. Chemical hazards include allergens, pesticide residues, cleaning chemical residues, and naturally occurring toxins. Physical hazards include glass, metal, bone, and other foreign material.

The hazard analysis must be conducted by a food safety team, not by a single individual. The team brings together knowledge of the raw materials, the process, the equipment, the end use of the product, and the likely consumer. That combination of perspectives is what makes the analysis robust.

For more on how the hazard analysis process works step by step, see our article on The Hazard Analysis Process in ISO 22000: A Step by Step Walkthrough.

How ISO 22000 Differs From ISO 9001

A common question from quality managers moving into food safety is how ISO 22000 compares to ISO 9001. The short answer is that ISO 22000 is more technically prescriptive in the operational area, and for good reason.

ISO 9001 is a generic quality management standard. It does not tell you how to control your processes in detail because the appropriate controls depend entirely on what you make or do. ISO 22000, by contrast, requires specific technical methodologies. You must conduct a hazard analysis. You must establish and validate CCPs. You must have a HACCP plan. These are not optional approaches that the organisation can substitute with equivalent alternatives.

The management system framework around those technical requirements is similar to ISO 9001. The context analysis, leadership requirements, planning, support, and improvement clauses will feel familiar to anyone who has worked with ISO 9001. But the operational core is a different discipline that requires specific food safety knowledge.

For those interested in how ISO 9001 applies to food manufacturing businesses specifically, our article on ISO 9001 for Food Manufacturers: Where Quality Management Meets Food Safety covers how the two standards can work alongside each other.

ISO 22000 and FSSC 22000

You will often see ISO 22000 mentioned alongside FSSC 22000. FSSC 22000 is a certification scheme that uses ISO 22000 as its foundation but adds additional requirements through sector specific prerequisite programme standards and scheme specific requirements. It is recognised by the Global Food Safety Initiative, which means it is accepted by many major retailers and food service operators as a condition of supply.

ISO 22000 certification on its own is a legitimate and recognised achievement, but FSSC 22000 certification carries additional weight in certain markets and supply chains. If you are advising a food business on which path to take, the decision depends on their customer requirements and target markets.

Auditing a Food Safety Management System

Auditing ISO 22000 requires a combination of management system auditing skills and food safety technical knowledge. The management system elements can be audited using the same techniques you would apply to ISO 9001 or ISO 14001. The operational elements require you to understand what a HACCP plan should contain, how to verify that CCPs are being monitored correctly, and how to assess whether the hazard analysis is current and credible.

Some of the most common findings in ISO 22000 audits include:

• HACCP plans that have not been updated following changes to products, processes, or raw materials
• Critical limits that have not been validated through scientific or technical evidence
• CCP monitoring records that show perfect results every time, which often indicates the monitoring is not being done properly rather than that the process is perfectly controlled
• Prerequisite programmes that exist on paper but are not being implemented consistently on the floor
• Food safety teams that exist in name only, with no evidence of regular meetings or documented hazard analysis reviews
• Corrective action records that address the immediate deviation but do not investigate or address the root cause

For a practical guide to conducting food safety internal audits, see our article on Running Effective Food Safety Internal Audits: A Practical Guide.

Adding ISO 22000 to Your Auditor Skill Set

For quality managers, HSE managers, and auditors working in or around the food industry, ISO 22000 knowledge is increasingly valuable. The food industry is one of the largest sectors in Australia and globally, and the demand for competent food safety auditors is consistent.

Adding food safety auditing to your credentials requires both the management system auditing foundation and the technical knowledge of food safety hazards, HACCP methodology, and food science principles. The management system foundation is transferable from ISO 9001 or other standards. The food safety technical knowledge needs to be built specifically.

If you are considering this career direction, our article on Adding ISO 22000 to Your Auditor Skill Set: Why Food Safety Is a Smart Move provides a practical overview of what is involved and how to get started.

Getting Started With ISO 22000 Training

Whether you are implementing a food safety management system, managing one, or auditing one, structured training makes a significant difference. The concepts in ISO 22000 are not difficult to grasp individually, but the way they interact, particularly the relationship between the hazard analysis, the PRPs, OPRPs, and CCPs, takes time and practical application to understand properly.

At Audit Workshop, our training programmes are built for practitioners who need to understand how standards work in practice, not just what the clauses say. If you are working toward ISO 22000 auditor credentials or looking to build your food safety management system knowledge, our courses provide the practical grounding you need from trainers who have conducted hundreds of real certification audits across diverse industries.