The short answer
ISO 22000 is the international standard for food safety management systems. It combines HACCP principles, prerequisite programmes and a management system built on clauses 4 to 10, and applies to any organisation in the food chain, from farms and manufacturers to packaging, storage and catering. The current edition is ISO 22000:2018, certified after an independent two-stage audit.
On this page
- What is ISO 22000?
- What does an ISO 22000 food safety management system require?
- How do HACCP and prerequisite programmes fit into ISO 22000?
- What is the difference between ISO 22000 and HACCP?
- Who needs ISO 22000?
- What is the difference between ISO 22000 and FSSC 22000?
- How do you get ISO 22000 certification?
- How long does ISO 22000 certification take?
- Can ISO 22000 run alongside ISO 9001?
- Who issues the ISO 22000 certificate?
- Why Sovereign Secure
- Get an ISO 22000 quote
ISO 22000 is the international standard for food safety management systems (FSMS). It combines HACCP principles, prerequisite programmes and a management system so that an organisation in the food chain can show, to an independent auditor, that the food it handles is safe. Sovereign Secure provides the consultancy that builds the FSMS around your existing controls; an independent certification body audits it and makes the certification decision.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy, headquartered in Accrington, Lancashire. ISO 22000 sits within our wider ISO certification service.
What is ISO 22000?
ISO 22000 sets the requirements for a food safety management system for any organisation, of any size, involved in the food chain. The current edition, ISO 22000:2018, was amended in 2024 to add climate action changes. ISO/TC 34/SC 17 agreed in November 2023 to revise it, and the next edition has reached draft international standard (ISO/DIS 22000) stage.
The 2018 edition uses the same clause 4 to 10 structure as ISO 9001 and ISO 14001, and runs two linked plan-do-check-act cycles: one for the management system as a whole, and one inside operations for hazard analysis and control. It also separates two kinds of risk: business risks and opportunities at organisational level, and food safety hazards at operational level.
The ISO/DIS 22000 draft was balloted between May and July 2026, and ISO lists the 2018 edition as due to be replaced in the coming months. A transition period will follow publication; until then, ISO 22000:2018 is the edition you certify to, and a system built to it now is the starting point for the new edition.
What does an ISO 22000 food safety management system require?
An ISO 22000 FSMS requires leadership commitment, a competent food safety team, prerequisite programmes, a hazard analysis with a hazard control plan, and the records to prove it all works.
| Clause | What it requires | Common gap |
|---|---|---|
| 4 Context | Issues, interested parties and an FSMS scope naming products, processes and sites | Scope that leaves out a site or product line customers expect to see |
| 5 Leadership | Top management commitment, a food safety policy, a food safety team leader | Team leader named but without the authority the role needs |
| 6 Planning | Risks and opportunities, measurable FSMS objectives, planned changes | Objectives copied from the policy with no measures |
| 7 Support | Resources, competence, awareness, external and internal communication, documented information | No defined route for food safety information to and from suppliers and customers |
| 8 Operation | Prerequisite programmes, traceability, emergency preparedness, hazard analysis, hazard control plan, verification, nonconforming product, withdrawal and recall | Recall procedure written but never tested |
| 9 Performance evaluation | Analysis of monitoring results, internal audit, management review | Verification results collected but never analysed |
| 10 Improvement | Nonconformity, corrective action, continual improvement, updating the FSMS | Corrections made without finding the cause |
How do HACCP and prerequisite programmes fit into ISO 22000?
HACCP and prerequisite programmes form the operational core of ISO 22000. Prerequisite programmes (PRPs) keep the basic conditions hygienic: building layout, water and air, pest control, cleaning, waste, personal hygiene, supplier approval, storage and transport, and measures against cross-contamination, including allergens. Sector specifications such as the ISO 22002 series describe what good PRPs look like in manufacturing, catering, packaging and other parts of the chain.
On top of the PRPs, the food safety team carries out a hazard analysis. It describes the products, their intended use and the process flow, identifies biological, chemical and physical hazards (including allergens) at each step, and decides which hazards are significant. Each significant hazard is then controlled either at a critical control point or by an operational prerequisite programme, recorded in a hazard control plan.
| Control | What it is | How it is monitored |
|---|---|---|
| Prerequisite programme (PRP) | Basic conditions and activities that keep the environment hygienic | Inspections, schedules, records |
| Operational PRP (OPRP) | A control measure for a significant hazard, managed against an action criterion | Measurement or observation against the action criterion |
| Critical control point (CCP) | A process step where a significant hazard is controlled against a measurable critical limit | Measurement against the critical limit; product made outside it is treated as potentially unsafe |
If you already run a working HACCP plan, the ISO 22000 work is mainly the management system around it: objectives, communication, verification, internal audit, management review and updating the plan when things change.
What is the difference between ISO 22000 and HACCP?
HACCP is a hazard control method; ISO 22000 is a complete management system that contains it. In the UK, food business operators other than primary producers must put in place procedures based on HACCP principles under Article 5 of Regulation (EC) No 852/2004 on the hygiene of foodstuffs, which still applies across the UK; the government’s guidance on food safety management systems for businesses summarises these duties. ISO 22000 is voluntary.
| Aspect | HACCP | ISO 22000 |
|---|---|---|
| What it is | Seven principles for identifying and controlling food safety hazards, set out by the Codex Alimentarius | A certifiable management system standard |
| Legal status in the UK | Procedures based on HACCP principles are required for food businesses (primary production aside) | Voluntary |
| Covers | Hazard analysis, critical control points and limits, monitoring, corrective action, verification, records | All of HACCP, plus prerequisite programmes, leadership, communication, traceability, emergency preparedness, internal audit and management review |
| Independently certified | Not on its own | Yes, by a certification body |
Who needs ISO 22000?
ISO 22000 suits any organisation that wants independent proof of its food safety controls, wherever it sits in the chain:
- Food and drink manufacturers and processors, including ingredient producers.
- Primary producers and feed manufacturers.
- Packaging and food contact material manufacturers.
- Storage, distribution and logistics firms handling food.
- Caterers, food service and retailers.
- Indirect suppliers such as equipment, cleaning chemical and pest control providers.
Check what your customers ask for before you choose. Some buyers, particularly large retailers and manufacturers, require a scheme recognised by the Global Food Safety Initiative (GFSI) rather than ISO 22000 on its own. FSSC 22000 is one such scheme, explained below. Other GFSI-recognised schemes, such as BRCGS Food Safety, are also common in UK supply chains, so confirm which one your buyers name before you start.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the standard; FSSC 22000 is a certification scheme built on it. FSSC 22000, owned by the not-for-profit Foundation FSSC, takes the full ISO 22000 requirements, adds a sector specification for prerequisite programmes (such as the ISO 22002 series) and its own additional requirements, and is recognised by GFSI. That recognition is why many large retailers and brand owners accept FSSC 22000 but not ISO 22000 on its own.
| Aspect | ISO 22000 | FSSC 22000 |
|---|---|---|
| What it is | International standard for a food safety management system | Certification scheme built on ISO 22000 |
| Requirements | ISO 22000, with prerequisite programmes you select and justify | ISO 22000, plus a sector prerequisite programme specification and FSSC additional requirements |
| GFSI recognised | No | Yes |
| Who certifies | An independent certification body | Certification bodies licensed by Foundation FSSC |
| Typical reason to choose it | Independent proof of food safety controls for any part of the food chain | A customer requires a GFSI-recognised certificate |
Because FSSC 22000 contains ISO 22000 in full, building to ISO 22000 first loses nothing: the management system, hazard analysis and hazard control plan carry straight across if a customer later asks for FSSC 22000.
How do you get ISO 22000 certification?
You get ISO 22000 certification by building and running an FSMS, then passing a two-stage audit by an independent certification body.
- Agree scope. The products, processes and sites the certificate must cover, and the customer or market requirements behind it.
- Gap analysis. Compare your current HACCP plan, PRPs and records with every clause of ISO 22000.
- Build the system. Food safety policy and objectives, food safety team, communication routes, and an updated hazard analysis and hazard control plan.
- Run it. Produce the records auditors sample: monitoring and verification results, supplier approvals, training, traceability and recall tests.
- Internal audit and management review. Both must be complete before Stage 2.
- Stage 1 audit. The certification body reviews your documentation and readiness.
- Stage 2 audit. Site observation, interviews and record sampling to confirm the FSMS works. The certificate follows once any major nonconformities are closed.
The certificate lasts three years, with surveillance audits in years two and three and a recertification audit before expiry.
How long does ISO 22000 certification take?
A small or medium-sized site with a working HACCP plan and documented PRPs is typically ready for certification in three to six months. The deciding factor is your starting point. A site with reliable monitoring records already has the operational core, so the work is the management system around it. A business building HACCP and PRPs from scratch needs longer, because the system must run long enough to produce verification records before Stage 2.
Can ISO 22000 run alongside ISO 9001?
Yes. ISO 22000 and ISO 9001 quality management share the clause 4 to 10 structure, so they can run as one integrated system with one document control process, one internal audit programme and one management review. Manufacturers often add ISO 14001 environmental management to the same system because waste, packaging and energy sit alongside food safety on the factory floor. Whether certification audits can be combined is a decision for the certification body, so we confirm it for your scope before you commit.
Who issues the ISO 22000 certificate?
An independent certification body issues the certificate, never the consultant. ISO/IEC 17021-1 requires certification bodies to stay impartial, so a certification body cannot audit a management system it helped design. We build the FSMS with you; the certification body audits it, observes your hygiene controls and CCP monitoring on site, and makes its own decision. No consultant can guarantee the outcome.
Why Sovereign Secure
- We hold ISO 27001 ourselves, so we go through the same kind of surveillance audits we prepare clients for.
- Built on what you already do. We start from your existing HACCP plan and PRPs rather than replacing them with a template pack.
- Consultancy and certification kept separate. Our partner certification body is MQA International, an independent body that makes its own certification decisions; we confirm which certification body will audit your ISO 22000 scope before you commit.
- Food businesses run on IT too. Production lines, ordering systems and card payments carry their own risks; we are also an IASME-licensed Cyber Essentials certification body, and support manufacturers with cyber security.
Get an ISO 22000 quote
Tell us which products, processes and sites the certificate should cover, whether you already have a HACCP plan and documented PRPs, any certificates you already hold and what your customers have asked for. We will send a fixed quote for the consultancy and explain the certification audit stages for your scope. Request your ISO 22000 quote or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
