Achieving ISO 22000 certification demonstrates an organization’s commitment to food safety, effective risk management, and continuous improvement. For food manufacturers, processors, distributors, packaging companies, and food service providers, certification can help meet customer expectations, support market opportunities, and strengthen brand credibility.

However, successful certification requires more than implementing food safety controls. Organizations must establish, implement, maintain, and continually improve a Food Safety Management System (FSMS) that meets the applicable requirements of ISO 22000:2018, including Amendment 1:2024 on climate action changes where relevant to the organization’s context.

ISO 22000 certification can support business growth and demonstrate a systematic approach to food safety, but it does not replace applicable food safety laws, licences, or regulatory approvals. Certification is also not universally mandatory for every organization in the food chain.

This guide outlines the key ISO 22000 compliance requirements and practical steps organizations can take to prepare for certification.

Understanding ISO 22000 Compliance

ISO 22000:2018 is an internationally recognized standard that specifies requirements for a Food Safety Management System. It applies to organizations of different sizes involved directly or indirectly in the food chain, including primary producers, manufacturers, transport and storage providers, retailers, packaging businesses, and food service operators

The standard integrates:

• Food safety hazard identification and control
• Risk-based thinking and management-system planning
• Hazard Analysis and Critical Control Point (HACCP) principles
• Prerequisite programmes (PRPs)
• Communication throughout the food chain
• Monitoring, performance evaluation, and continual improvement

Compliance with ISO 22000 helps organizations systematically identify, evaluate, and control food safety hazards while managing processes that affect product safety.

Organizations should also consider the 2024 climate action amendment when determining relevant internal and external issues and the requirements of relevant interested parties. Climate change needs to be considered in the context of the organization and its FSMS, rather than treated as an automatic requirement for a separate climate management programme.

Amendment 1: Climate action changes

Key ISO 22000 Compliance Requirements

1. Establishing a Food Safety Management System (FSMS)

The foundation of ISO 22000 certification is an effective Food Safety Management System.

Organizations must:

• Define the scope and boundaries of the FSMS.
• Establish food safety objectives and a food safety policy.
• Identify the processes and activities that affect food safety.
• Assign responsibilities and establish appropriate procedures.
• Maintain documented information required by the standard and needed for effective FSMS operation.

The FSMS should reflect the organization’s activities, products, processes, supply chain, and food safety risks. Documentation should be appropriate to the organization’s size, complexity, and operational needs while meeting applicable standard requirements.

2. Leadership and Management Commitment

ISO 22000 emphasizes leadership involvement and accountability for food safety.

Top management must:

• Demonstrate accountability for FSMS effectiveness.
• Establish and communicate the food safety policy.
• Provide the resources needed to operate the system.
• Assign and communicate relevant roles and responsibilities.
• Support food safety objectives and continual improvement.

Management involvement helps ensure that food safety is integrated into everyday operations rather than treated solely as a documentation exercise. Auditors assess relevant evidence of leadership commitment and whether the FSMS is effectively implemented.

3. Hazard Analysis and Risk Assessment

Organizations must identify and evaluate potential food safety hazards associated with their products, processes, and activities.

The analysis should consider relevant hazards, including:

• Biological hazards: Bacteria, viruses, and other harmful microorganisms.
• Chemical hazards: Cleaning chemical residues, contaminants, and other hazardous substances.
• Physical hazards: Glass, metal fragments, and other foreign materials.
• Allergen hazards: Undeclared allergens and cross-contact risks, where applicable.

The hazard analysis helps determine which hazards require control, which control measures are appropriate, and how those measures should be managed and verified.

4. Implementation of HACCP Principles and Food Safety Control Measures

ISO 22000 incorporates HACCP principles into its food safety planning process. Organizations must conduct a hazard analysis and determine appropriate control measures based on the nature and significance of identified hazards.

These controls may be managed through:

• Prerequisite Programmes (PRPs): Basic environmental and operational conditions that support food safety.
• Operational Prerequisite Programmes (OPRPs): Control measures managed through defined operational criteria and monitoring arrangements.
• Critical Control Points (CCPs): Steps at which control is essential to prevent, eliminate, or reduce a significant food safety hazard to an acceptable level, with critical limits established where required.

The hazard analysis determines whether an identified hazard requires control through an OPRP, a CCP, or a combination of appropriate controls within the food safety control system. Not every process requires a CCP.

Organizations must establish suitable monitoring, verification, corrective action, and recordkeeping arrangements for the applicable control measures. These arrangements help demonstrate that food safety hazards are being managed effectively.

5. Prerequisite Programmes (PRPs)

Prerequisite Programmes establish the basic environmental and operational conditions needed to maintain food safety throughout relevant activities.

Common examples include:

• Cleaning and sanitation procedures
• Pest control programmes
• Equipment maintenance and calibration, where applicable
• Personnel hygiene and appropriate training
• Supplier and incoming-material controls
• Facility layout, infrastructure, and maintenance
• Waste management and prevention of cross-contamination

PRPs should be appropriate to the organization’s operations and relevant food safety risks. They support the overall FSMS and complement the OPRPs and CCPs determined through hazard analysis.

6. Emergency Preparedness and Response

Organizations must establish and maintain arrangements for responding to incidents and emergency situations that could affect food safety.

Examples include:

• Product contamination incidents
• Power, water, or other utility failures
• Equipment breakdowns affecting product safety
• Product withdrawal or recall situations
• Natural disasters and other disruptive events

Emergency procedures should define relevant responsibilities, communication arrangements, and response actions. Organizations should evaluate and update their arrangements when necessary to improve preparedness and protect consumers.

7. Traceability System Requirements

ISO 22000 requires organizations to establish a traceability system appropriate to their position in the food chain and applicable requirements.

Traceability procedures should enable organizations to:

• Identify relevant raw materials, ingredients, and suppliers.
• Link incoming materials with production or processing records.
• Identify affected batches and finished products.
• Support product withdrawal or recall when necessary.

Effective traceability helps organizations investigate food safety incidents, identify potentially affected products, and respond efficiently when corrective action is required.

8. Performance Evaluation and Monitoring

Organizations must monitor and evaluate the performance and effectiveness of their Food Safety Management System.

Key activities include:

• Internal audits against applicable FSMS requirements
• Monitoring of relevant processes and food safety controls
• Verification of control measures and product safety, as appropriate
• Management reviews
• Evaluation of nonconformities and corrective actions

The organization should determine suitable monitoring and evaluation methods based on its processes, food safety objectives, and operational risks. The results help identify weaknesses and opportunities for improvement.

9. Continual Improvement

Continual improvement is an important part of maintaining an effective ISO 22000 FSMS.

Organizations should:

• Address identified nonconformities.
• Determine and implement appropriate corrective actions.
• Review food safety risks and control measures when necessary.
• Evaluate FSMS performance against established objectives.
• Update procedures and documented information where required.
• Use audit findings, monitoring results, and management reviews to improve the system.

Continual improvement helps organizations maintain effective food safety controls as their operations, products, and business conditions change.

Documentation Required for ISO 22000 Certification

Documented information provides evidence that the Food Safety Management System has been established and is operating effectively.

Depending on the organization’s activities and applicable requirements, relevant documented information and records may include:

• Food Safety Policy
• FSMS scope and relevant context information
• Food Safety Objectives
• Hazard Analysis and Food Safety Control Plan
• PRP and OPRP documentation, where applicable
• Monitoring and verification records
• Operational procedures and work instructions, where needed
• Employee competency and training records
• Traceability and recall procedures and records
• Internal audit reports
• Management review records
• Nonconformity and corrective action records
• Emergency preparedness and response arrangements

This list is illustrative rather than a universal checklist of mandatory documents. ISO 22000 requires documented information specified by the standard, along with additional documented information the organization determines is necessary for the effectiveness of its FSMS. The scope and format of documentation should reflect the organization’s activities and complexity.

Preparing for an ISO 22000 Certification Audit

Conduct a Gap Analysis

A gap analysis compares existing food safety practices and management-system arrangements against the applicable ISO 22000 requirements. It helps identify deficiencies and prioritize actions before the certification assessment.

Train Employees

Employees should understand the food safety responsibilities relevant to their roles. Training and competency arrangements should reflect the activities they perform and the risks associated with those activities.

Implement and Verify Procedures

Documented procedures and food safety controls should be implemented in practice. Organizations should maintain appropriate records and verify that the controls are functioning as intended.

Perform Internal Audits

Internal audits help evaluate whether the FSMS conforms to applicable requirements and is effectively implemented and maintained. Findings should be addressed through appropriate corrective action.

Complete a Management Review

Management reviews allow top management to evaluate FSMS performance, relevant changes, audit findings, nonconformities, and opportunities for improvement. Decisions and actions should be recorded as appropriate.

Completing these preparation activities can improve audit readiness, but certification depends on the outcome of the assessment and fulfilment of the applicable certification requirements.

Common Challenges in ISO 22000 Implementation

Organizations may encounter challenges such as:

• Incomplete or unsuitable FSMS documentation
• Insufficient employee competency or awareness
• Inadequate hazard analysis and selection of control measures
• Weak monitoring or verification arrangements
• Inconsistent recordkeeping and traceability
• Limited management involvement
• Failure to address relevant changes in processes, risks, or organizational context

Identifying and addressing these issues early can improve the effectiveness of the FSMS and help organizations prepare for certification assessment.

Benefits of Achieving ISO 22000 Certification

Organizations that achieve ISO 22000 certification may benefit from:

• Improved food safety management and hazard control
• Greater customer confidence and stakeholder trust
• Better alignment of food safety processes with applicable requirements
• More systematic monitoring and corrective action
• Improved operational consistency
• Stronger supplier and business relationships
• Support for customer qualification and potential market opportunities

Certification demonstrates that a Food Safety Management System has been assessed against the applicable standard requirements. However, it does not guarantee that food safety incidents will never occur, ensure compliance with every legal obligation, or automatically provide access to every market.

Organizations must continue to meet applicable legislation, licences, regulatory approvals, and customer-specific requirements.

The Value of Professional ISO 22000 Support

Organizations may choose to work with experienced ISO 22000 consultants to support implementation and certification preparation. Expert Consultancy Services can help businesses develop and implement a Food Safety Management System aligned with ISO 22000 requirements while addressing relevant food safety risks and operational challenges.

Professional support may include:

• Gap assessments
• FSMS development and implementation guidance
• Hazard analysis and HACCP support
• PRP, OPRP, and CCP documentation support, as applicable
• Documentation review and preparation
• Internal audit support
• Employee training and awareness
• Certification audit readiness

Experienced consultants can help organizations identify gaps, establish suitable processes, and prepare for an independent certification assessment. However, certification decisions remain with the certification body and depend on the assessment results and fulfilment of applicable requirements.

Conclusion

Achieving ISO 22000 certification requires a structured approach to food safety management, hazard analysis, appropriate control measures, documented information, and continual improvement. Organizations must establish an effective Food Safety Management System, implement relevant PRPs and HACCP-based controls, evaluate performance, and demonstrate conformity with applicable requirements.

By understanding ISO 22000:2018, considering Amendment 1:2024 where relevant, and preparing thoroughly for the certification assessment, businesses can strengthen food safety management, respond to customer expectations, and support opportunities for growth while continuing to meet applicable legal and regulatory obligations.