ISO 22000 gives food businesses a way to prove that they have identified and controlled the food safety hazards at every production step. That proof helps manufacturers, caterers, hotels, and restaurants show buyers that product safety is managed systematically.
The risk is real. The World Health Organization (WHO) estimates that about 866 million people worldwide fall ill after eating contaminated food, and 1.52 million die every year.
This article covers what ISO 22000 is, its purpose, its structure and requirements, who can implement it, its benefits, an implementation example, and whether certification is mandatory.
What Is ISO 22000?
ISO 22000 is an international standard that sets requirements for a food safety management system (FSMS) in organizations across the food chain. The International Organization for Standardization (ISO) publishes the standard, and organizations can choose certification from an independent certification body.
The current version is ISO 22000:2018, the second edition, published in June 2018. Amendment 1 followed in 2024 with changes on climate action.
ISO reviewed and confirmed this version in 2023, but its web page says the draft ISO/DIS 22000 is expected to replace it in the coming months. Businesses that start now should still implement ISO 22000:2018, then watch for certification body announcements about the transition to the new edition.
Purpose of Implementing ISO 22000
The purpose of implementing ISO 22000 is to make sure food is safe for its intended use by identifying hazards and controlling their risks consistently along the food chain.
In practice, businesses that implement the standard work to:
- Identify hazards at every process step and control their risks consistently.
- Meet the food safety requirements in applicable regulations and in agreements with customers, and demonstrate conformity.
- Communicate food safety issues effectively to partners along the food chain, including suppliers and customers.
- Make sure every part of the business follows the food safety policy it has set.
- Maintain and update the system in a controlled way when processes or ingredients change.
Businesses turn this purpose into a food safety policy and objectives, then track progress through internal audits and management reviews.
Structure and Key Requirements of ISO 22000
ISO 22000:2018 follows the same ten-clause structure as other ISO management system standards. Its requirements rest on four key elements: interactive communication, system management, prerequisite programs, and the principles of Hazard Analysis and Critical Control Point (HACCP).
- Interactive communication means exchanging food safety information between departments inside the business and with suppliers, customers, regulators, and other parties in the food chain.
- System management covers the policy, objectives, assigned responsibilities, and management review that keep the system running.
- Prerequisite programs are the basic conditions and activities that protect food safety, such as sanitation, pest control, equipment maintenance, and employee hygiene.
- HACCP principles are used to analyze hazards and set critical control points (CCPs) at the process steps with the highest risk.
Two Plan-Do-Check-Act (PDCA) cycles run at the same time, one at the management system level and one at the operational level, where the HACCP principles sit. Because the structure matches ISO 9001, businesses that already use that standard can combine the two more easily.
The auditable requirements of ISO 22000:2018 sit in clauses 4 to 10, while clauses 1 to 3 cover the scope, normative references, and terms and definitions.
| Clause | What the clause requires of a food business |
|---|---|
| 4. Context of the organization | Understand the business context and the needs of interested parties such as buyers and regulators, then define the products, processes, and production sites inside the scope of the system |
| 5. Leadership | Top management shows commitment, sets the food safety policy, appoints the food safety team leader, and assigns roles and responsibilities |
| 6. Planning | Identify risks and opportunities, then set food safety objectives and plan changes to the system in a controlled way |
| 7. Support | Provide resources, train employees for their roles, arrange communication, and control documents and records |
| 8. Operation | Implement prerequisite programs, traceability of materials and products, emergency preparedness, hazard analysis, the hazard control plan, and product withdrawal and recall procedures |
| 9. Performance evaluation | Monitor, measure, analyze, and evaluate system performance, then carry out internal audits and management reviews |
| 10. Improvement | Handle nonconformities with corrective action, and update and improve the system continually |
Clause 8 is the technical core because it holds the prerequisite programs, traceability, hazard analysis, and the hazard control plan built on the HACCP principles.
ISO 22000 does not detail what each prerequisite program contains, so your food safety team designs them to fit your products and risks.
Also read: HACCP vs ISO 22000: The Key Differences Every Food Industry Professional Should Know
Who Can Implement ISO 22000?
Any organization in the food chain can implement ISO 22000, whatever its size or position, including food manufacturers, distributors, caterers, and suppliers of packaging and equipment. Micro, small, and medium-sized food businesses and hotel and restaurant kitchens can apply it as well.
Benefits of ISO 22000 for Food Businesses
The main benefit of ISO 22000 is that it turns food safety from a matter of individual habits into a documented system you can prove.
Incident and Recall Risks Are Easier to Control
A traceability system and recall procedures help a business find the source of a problem faster and pull only the affected products. A kitchen that records batch numbers for ingredients and products, for example, can trace a complaint back to the ingredient used.
Proof of Food Safety for Buyers
A certificate from an independent body gives buyers third-party proof that your food safety system meets the requirements of the standard. That proof helps buyers in the food industry and food service select suppliers.
Regulatory Compliance Is Easier to Demonstrate
ISO 22000 requires a business to identify the food safety requirements that apply to it and to demonstrate that it can meet them consistently. Well-organized records let you show that compliance when an auditor or buyer reviews your business.
Employees Follow Clear Procedures
Clause 7 requires a business to train employees for their roles and make sure they understand how their work affects food safety. As a result, new hires in production or the warehouse can follow the same procedures as long-time employees.
Example of ISO 22000 Implementation in a Production Kitchen
Implementing ISO 22000 in a production kitchen means mapping the hazards at five steps (receiving ingredients, storage, processing, packaging, and distribution), then setting controls and records for each.
| Step | Example hazards | Example controls |
|---|---|---|
| Receiving ingredients | Eggs or milk contaminated with bacteria, chemical residues, foreign objects, and allergens missing from the supplier’s label | Supplier selection and evaluation, plus checks of condition and documents when goods arrive |
| Storage | Bacterial growth at improper temperatures, cross-contamination between ingredients | Daily temperature logs, stock rotation with the FIFO (first in, first out) method, separation of raw and cooked ingredients, and date labels on containers |
| Processing | Pathogenic bacteria surviving because of insufficient heating | Critical limits for temperature and time at the critical control point (CCP), with corrective action |
| Packaging and labeling | Allergens missing from the label, contamination from packaging | Matching labels to recipes and inspecting packaging before the line starts |
| Distribution | Problem products reaching the market with no way to trace them | Batch codes, shipping records, a list of receiving customers, and a recall procedure that has been tested in a simulation |
This example shows how clause 8 divides the work, since prerequisite programs maintain the kitchen’s basic conditions while critical control points contain the high-risk hazards.
Each row needs records an auditor can check, so start with simple forms that your production team actually fills in.
Is ISO 22000 Certification Mandatory?
No. ISO states that ISO 22000 certification is voluntary, and independent certification bodies issue the certificates, not ISO.
A business can also implement ISO 22000 without a certificate, because the scope of the standard allows a self-assessment or self-declaration of conformity. That route is enough to build the system, but it gives buyers no independent proof.
Certification becomes a practical need when buyers or contracts ask for it. Some buyers accept only a derived scheme such as Food Safety System Certification (FSSC) 22000, which adds requirements on top of ISO 22000.
Check which scheme your buyers require before you start. If no buyer has asked yet, build the system first and apply for certification once it runs stably.
Also read: International Certification Challenges: HACCP, ISO, Halal
Conclusion
ISO 22000:2018 is a food safety management system standard that aims to keep products safe through hazard control, and any organization in the food chain can implement it. Its requirements sit in clauses 4 to 10, with clause 8 as the core of hazard control.
Certification is voluntary and becomes a need only when buyers or contracts ask for it.
A practical first step is to map the hazards at every production step and ask your main buyers about their supplier requirements. Because ISO is preparing a revision, watch for certification body announcements before you apply for an audit.
FAQ
How Long Is an ISO 22000 Certificate Valid?
An ISO 22000 certificate is typically valid for three years, with one surveillance audit every year and a recertification audit before it expires.
How Much Does ISO 22000 Certification Cost?
There is no single price, because certification bodies prepare quotes based on your scope and business conditions. Ask for a written quote that lists the number of audit days and the annual surveillance audit fees.
Do You Need to Implement HACCP Before ISO 22000?
No, HACCP is not a separate requirement, because its principles are already part of ISO 22000. Any hazard analysis you have already documented can serve as the basis for building the system.
Is ISO 22000 the Same as a Halal Certificate?
No. ISO 22000 assesses an organization’s food safety management system, while a halal certificate from the Halal Product Assurance Organizing Agency (BPJPH) confirms that a product is halal.
Does an ISO 22000 Certificate Guarantee That a Product Is Safe?
No, not absolutely, because a certificate shows that your system met the requirements of the standard at the time of the audit. The safety of each batch still depends on your team following procedures and completing records every day.
