.png)
ISO 22000 is the international standard that sets out requirements for a food safety management system (FSMS), covering any organization in the food chain regardless of size or position — growers, processors, manufacturers, packagers, and distributors alike. The current edition is ISO 22000:2018, published by the International Organization for Standardization in June 2018 and amended in 2024 (Amendment 1, climate action changes). Certification to it is optional; an organization can use the standard to structure its food safety management without ever pursuing third-party certification.
ISO 22000 at a glance
| Question | Short answer |
|---|---|
| What is it? | A food safety management system (FSMS) standard that combines management-system requirements, prerequisite programmes and HACCP principles |
| Current edition | ISO 22000:2018 (Edition 2), with Amendment 1:2024 on climate action |
| Who can use it? | Any organization in the food chain, of any size |
| Is certification mandatory? | No. It is voluntary, and ISO itself does not certify |
| Is it GFSI-recognized? | Not on its own. FSSC 22000, which is built on ISO 22000, is |
| Who audits it? | An accredited third-party certification body |
What ISO 22000 requires
The standard is built around four core elements: interactive communication of hazard information up and down the supply chain, system management through policy, objectives, documentation, and continual improvement, prerequisite programmes covering the baseline operating conditions like sanitation and pest control, and HACCP principles applied to identify and control hazards specific to the organization's products and processes. On top of those four, ISO 22000 also requires defined traceability and emergency-preparedness procedures, so an organization can respond quickly and control affected product if a food safety incident occurs.
ISO 22000 clause structure: what clauses 4 to 10 ask of a food plant
ISO 22000:2018 follows the same High Level Structure as ISO 9001, which is why the two can be run as one integrated system. The requirements sit in clauses 4 to 10. In a food plant they translate roughly like this:
| Clause | Topic | What it means in practice |
|---|---|---|
| 4 | Context of the organization | Define the FSMS scope, the interested parties (customers, regulators, suppliers) and what they require of you |
| 5 | Leadership | Top management owns the food safety policy, assigns roles and a food safety team leader, and provides resources |
| 6 | Planning | Address risks and opportunities to the FSMS, set food safety objectives, plan changes to the system |
| 7 | Support | Competence and training, infrastructure, communication (internal and external), and documented information |
| 8 | Operation | The operational core: prerequisite programmes, traceability, emergency preparedness, hazard analysis, the hazard control plan, verification and handling of nonconforming product |
| 9 | Performance evaluation | Monitoring and measurement, internal audits and management review |
| 10 | Improvement | Nonconformity and corrective action, continual improvement and updating of the FSMS |
Clause 8 is where most of a food manufacturer's day-to-day evidence lives. The standard also works on two linked Plan-Do-Check-Act cycles: one for the management system as a whole, and one for the operational controls that apply HACCP principles.
PRPs, OPRPs and CCPs: how ISO 22000 classifies controls
One of the most searched and most confused parts of ISO 22000 is how it sorts hazard controls. After the hazard analysis, each control measure is managed in one of three ways.
| PRP | OPRP | CCP | |
|---|---|---|---|
| Scope | Facility-wide basic conditions and activities | A specific control at a defined step | A specific step where control is essential |
| Examples | Sanitation, pest control, water quality, personal hygiene, supplier approval | Allergen changeover control, a cleaning step that controls cross-contact | Cook or pasteurization step, metal detection |
| Basis | Good practice | Hazard analysis, where a significant hazard needs more than the general PRPs | Hazard analysis, where the step is essential to prevent, eliminate or reduce the hazard |
| Measure of control | General conditions and checks | Action criteria | Critical limits |
| If it fails | Rarely an immediate safety issue on its own | Investigate and handle the affected product | Product may be unsafe, so it is controlled and its disposition is evaluated |
The practical difference between an OPRP and a CCP is that a CCP has a measurable critical limit and usually continuous or per-batch monitoring, while an OPRP is managed with action criteria. If you are new to the CCP side, see our guide to critical control points with definitions and examples, and our step-by-step guide to building a HACCP plan.
What changed in ISO 22000:2018
The 2018 edition replaced the 2005 edition. The main changes were adopting the High Level Structure used by other ISO management system standards, making the two PDCA cycles explicit, bringing in risk-based thinking at both the organizational and operational level, and clarifying the difference between CCPs, OPRPs and PRPs. The 2024 amendment adds climate action considerations without changing the structure.
ISO 22000 vs. FSSC 22000 vs. a general QMS
These three terms get mixed up often, so it's worth being precise. ISO 22000 is the base international FSMS standard on its own — it is not, by itself, a GFSI-recognized certification. Our guide to FSSC 22000 certification covers a related but different thing: FSSC 22000 takes ISO 22000 as its foundation and adds sector-specific prerequisite programmes and additional requirements, which is what makes it a GFSI-recognized scheme that retailers and buyers actually ask for. A general quality management system, like ISO 9001, is a different, broader concept again — it covers quality processes across any industry and isn't food-safety-specific at all. Our guide to what a QMS is covers how that broader concept relates to food-specific standards like ISO 22000 in more detail.
ISO 22000 and the other food safety standards
| Standard | What it is | Relationship to ISO 22000 |
|---|---|---|
| HACCP | A hazard-control method (Codex principles) | Built into ISO 22000 as one of its four core elements |
| FSSC 22000 | GFSI-recognized certification scheme | Uses ISO 22000 as its base, plus sector PRPs and scheme requirements |
| SQF and BRCGS | Separate GFSI-recognized certification schemes | Independent standards with their own codes, not built on ISO 22000 |
| FSMA (US law) | US regulation | A legal requirement that certification does not replace |
If you are comparing schemes, our guide to BRCGS certification covers the BRCGS route, and our overview of the FSMA rules explains the US regulatory side that sits alongside any certificate.
Is ISO 22000 certification required?
No single body performs ISO certification — ISO writes the standard, and an organization that wants third-party certification engages an accredited certification body to audit against it. Because ISO 22000 alone isn't GFSI-recognized, most manufacturers selling to retailers that require GFSI certification pursue FSSC 22000 instead, which is built on ISO 22000 but satisfies that retailer requirement directly. Manufacturers not facing a specific GFSI mandate sometimes still adopt ISO 22000's structure internally without seeking certification, simply because it's a well-documented, internationally recognized framework. If you're choosing tools to run that system, our food safety management system software buyer's guide covers what to look for.
How ISO 22000 certification works
The exact process depends on the certification body you choose, but it generally runs in this order:
- Gap analysis. Compare your current system with clauses 4 to 10 and note what is missing.
- Build and implement the FSMS. Write the food safety policy and objectives, set up prerequisite programmes, complete the hazard analysis and hazard control plan, and start keeping records.
- Internal audit and management review. Both are required before the certification audit, and both need documented evidence.
- Stage 1 and stage 2 audits. The certification body reviews your documentation and readiness, then audits whether the system is implemented in practice.
- Certification and surveillance. Certification is typically on a multi-year cycle with periodic surveillance audits in between, set by the certification body.
Records are the common failure point. Auditors expect to see monitoring and verification evidence over a meaningful period, not a folder assembled the week before.
Where IONI fits
Whether a facility is structuring its FSMS around ISO 22000 directly or working toward FSSC 22000 certification, the underlying documentation — hazard analysis, prerequisite programme records, traceability data — is what auditors actually check. See how IONI helps food manufacturers keep that documentation audit-ready.
Frequently asked questions
Is ISO 22000 the same as FSSC 22000?
No. ISO 22000 is the base international food safety management system standard. FSSC 22000 is a separate, GFSI-recognized certification scheme built on top of ISO 22000, adding sector-specific prerequisite programmes and additional requirements.
Do I need ISO 22000 certification to sell to major retailers?
Most retailers that require GFSI certification will accept FSSC 22000, BRCGS, or SQF rather than asking for ISO 22000 certification specifically, since ISO 22000 alone isn't GFSI-recognized.
What's the current version of ISO 22000?
ISO 22000:2018 is the current edition, published by the International Organization for Standardization in June 2018. It has been amended once, with Amendment 1:2024 on climate action changes.
Who certifies a company to ISO 22000?
ISO itself does not perform certification. An organization seeking certification engages an accredited third-party certification body to audit its food safety management system against the standard.
What is the difference between ISO 22000 and HACCP?
HACCP is a method for identifying and controlling food safety hazards. ISO 22000 is a full management system standard that includes HACCP principles alongside leadership, communication, prerequisite programmes, internal audit and continual improvement.
What is the difference between a PRP, an OPRP and a CCP?
A PRP is a facility-wide basic condition or activity, such as sanitation or pest control. An OPRP is a specific control identified in the hazard analysis and managed with action criteria. A CCP is a step where control is essential and is managed with measurable critical limits.
Does ISO 22000 certification satisfy FSMA?
No. ISO 22000 certification is voluntary and does not replace legal requirements. A US facility subject to FSMA still needs to meet the regulation, although much of the same documentation can serve both.
