ISO 22000: what it is, what it requires and how to train
The standard that turns a HACCP plan into a management system: with context, leadership, objectives, verification and improvement, and with the whole food chain inside its scope.
ISO 22000 is the international standard that specifies the requirements for a food safety management system (FSMS). It combines the high-level structure shared by ISO management system standards, the HACCP principles of the Codex Alimentarius and prerequisite programmes, and it applies to any organization in the food chain: primary production, processing, packaging, transport, storage, retail and food service, as well as suppliers of equipment, packaging materials and additives. The current edition is ISO 22000:2018.
In short
- Current edition
- ISO 22000:2018
- Structure
- 10 clauses (Annex SL)
- Distinctive concept
- Two nested PDCA cycles
- Includes
- HACCP + PRPs + operational PRPs
- Certifiable
- Yes, by an accredited body
- GFSI recognized
- Not on its own (see FSSC 22000)
This guide is written for whoever has to learn or teach ISO 22000. If what you need is for us to implement the system at your company, that work is done by Beira Consultores.
See consulting at beira.com.mxWhat ISO 22000 adds on top of HACCP
A HACCP plan controls hazards. ISO 22000 additionally requires everything that keeps that control alive over time: analyzing the organization's context and its interested parties, committing top management, setting measurable food safety objectives, ensuring the competence of personnel, managing internal and external communication, planning for emergencies and product recalls, verifying the system and improving it.
In practice, it is the difference between a HACCP binder updated whenever the audit is due and a system that produces decisions all year round. That is why a plant with a mature HACCP usually reaches ISO 22000 with half the work done, while a plant with a paper-only HACCP discovers that almost everything is still missing.
The two PDCA cycles and the three levels of control
ISO 22000:2018 organizes the system into two nested Plan-Do-Check-Act cycles: one for the management system as a whole and another, inside clause 8, for the HACCP principles. Understanding that nesting is what prevents the classic mistake of implementing the standard as two separate systems that share a cover page.
On operational control, the standard distinguishes three levels, and confusing them is a recurring source of findings: prerequisite programmes (PRPs), which create the basic hygiene conditions; operational prerequisite programmes (OPRPs), which control significant hazards without a critical limit measurable in real time; and critical control points (CCPs), with a validated critical limit and monitoring that is continuous or at a defined frequency.
- PRP: basic conditions such as cleaning and sanitation, pest control, personnel hygiene, maintenance and water.
- OPRP: control of a significant hazard through a control measure whose effectiveness is verified, rather than monitored against a critical limit.
- CCP: essential control with a validated critical limit, monitoring, correction and defined corrective action.
ISO 22000, FSSC 22000 and what the customer asks for
ISO 22000 on its own is not recognized by the Global Food Safety Initiative (GFSI). When a customer (typically a retail chain or an international brand) demands a GFSI-recognized scheme, the natural route is certification under FSSC 22000, which is built on ISO 22000 and adds the prerequisite programmes of the ISO 22002 series plus additional requirements of its own.
The practical consequence when planning a project: if certification is driven by a customer requirement, confirm from day one whether they are asking for GFSI. Implementing ISO 22000 and then finding out the customer wanted FSSC 22000 does not invalidate the work, but it forces a second implementation stretch that could have been planned from the start.
How to train in ISO 22000
The route that works starts with HACCP, because clause 8 of ISO 22000 takes it as given: whoever does not master hazard analysis cannot implement the system built around it. Then comes interpretation of the requirements and their implementation, and finally internal auditor training, which closes the verification loop the standard itself demands.
For a full team, the usual split is internal auditor training for whoever will verify, implementation for the food safety lead and the HACCP team, and interpretation for the process owners who only have to sustain their part of the system.
Who needs training in ISO 22000
Food safety manager or lead
Implement and sustain the whole FSMS and answer for it before the certification body and the customer.
Quality manager at a food plant
Integrate food safety and quality into a single system instead of running two parallel systems with the same people.
Internal food safety auditor
Audit the system with ISO 19011 judgment applied to a food safety context.
HACCP team
Connect the HACCP plan with the management requirements the standard builds around it.
Frequently asked questions about ISO 22000
What is the difference between ISO 22000 and HACCP?
HACCP is a system to identify and control food safety hazards in a food process, with seven principles defined by the Codex Alimentarius. ISO 22000 is a management system standard that includes the HACCP principles and adds everything that sustains them: context, leadership, measurable objectives, competence of personnel, communication, emergency preparedness, verification and continual improvement. In short: HACCP controls hazards, ISO 22000 manages the whole system that keeps that control in place.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the food safety management system standard. FSSC 22000 is a GFSI-recognized certification scheme built on ISO 22000 that adds the prerequisite programmes of the ISO 22002 series and additional requirements of its own. You implement ISO 22000 and certify the site under FSSC 22000 when the customer demands a GFSI-recognized scheme.
What is an OPRP and how does it differ from a CCP?
An operational prerequisite programme (OPRP) controls a significant hazard through a control measure whose effectiveness is verified, but which has no critical limit measurable in real time. A critical control point (CCP) does have a validated critical limit and monitoring that lets you detect the deviation as it happens and apply a correction to the affected product. The distinction determines what is monitored, how often, and what happens to the product when it fails.
Does ISO 22000 only apply to food plants?
No: ISO 22000 applies across the whole food chain. Beyond processing plants, it covers primary production, packaging, transport and storage, retail and food service, and also suppliers of indirect inputs such as equipment, packaging materials, additives and ingredients. Each organization defines the scope of its system according to its role in the chain.
How long does it take to implement ISO 22000?
An ISO 22000 implementation in a plant already running good manufacturing practices and a working HACCP plan takes between six and twelve months up to the certification audit. If the prerequisite programmes are not consolidated, the timeline stretches, because you cannot build a food safety management system on a hygiene base that is not yet stable.