International standard for Food Safety Management Systems (FSMS).
Overview
What is ISO 22000?
ISO 22000 is an internationally recognized Food Safety Management System standard designed to help organizations identify, control, and manage food safety hazards throughout the food chain. The standard integrates food safety principles, risk-based thinking, operational controls, prerequisite programs, and Hazard Analysis and Critical Control Point (HACCP) concepts into a structured management system framework aligned with the ISO High Level Structure.
The standard requires organizations to conduct systematic hazard analysis to identify biological, chemical, physical, and radiological hazards that may occur in food products, and to determine and implement appropriate control measures to prevent, eliminate, or reduce those hazards to acceptable levels. It places particular emphasis on the role of communication within and across the food chain, recognizing that food safety risks can arise at any point from primary production through to consumption.
ISO 22000 helps organizations ensure that food products are safe for consumption while supporting regulatory compliance, customer confidence, and effective food safety governance. The standard can be implemented by organizations operating at any stage of the food chain, and can be integrated with ISO 9001 and other management system standards sharing the common ISO High Level Structure.
Key Themes
What does the standard focus on?
Food Safety Hazards
The standard requires organizations to systematically identify, evaluate, and control biological, chemical, physical, and radiological hazards that may occur in or be introduced to food products at any stage of the food chain, from primary production through to consumption.
HACCP Principles
ISO 22000 incorporates Hazard Analysis and Critical Control Point methodology, requiring organizations to conduct hazard analysis, identify critical control points, establish monitoring procedures, and define corrective actions for managing significant food safety risks.
Prerequisite Programs (PRPs)
Organizations must establish and maintain the foundational conditions and activities necessary for a hygienic food processing environment, including infrastructure, cleaning and disinfection, pest control, personal hygiene, supplier management, and allergen management.
Operational Controls
The standard addresses the specific controls required to manage food safety hazards identified through hazard analysis, including operational PRPs and HACCP plans, together with monitoring, verification, and corrective action requirements for maintaining effective hazard control.
Food Chain Communication
Effective communication within and across the food chain is a core requirement, ensuring that information about food safety hazards, product characteristics, intended use, and control requirements is shared appropriately with suppliers, customers, and other relevant parties.
Risk-Based Thinking
The standard requires organizations to apply risk-based thinking to their food safety management activities, considering the organizational context, the nature of the food chain, potential consequences of food safety failures, and the needs and expectations of interested parties.
Traceability
Organizations must establish systems to trace food products, ingredients, packaging materials, and processing aids throughout the food chain, enabling the efficient and effective identification, location, and withdrawal of affected products when a food safety issue is identified.
Continual Improvement
A permanent commitment to improving the effectiveness of the food safety management system through performance measurement, internal audit, management review, and the systematic application of lessons learned from nonconformities, incidents, and food safety events.
Applicability
Who typically implements ISO 22000?
Food Manufacturers
Industrial and artisan food production operations managing food safety hazards across raw material receipt, processing, packaging, storage, and distribution activities within a structured manufacturing environment.
Food Processors
Organizations involved in transforming raw materials into food products through thermal processing, fermentation, drying, chilling, modified atmosphere packaging, or other food processing technologies.
Food Packaging Manufacturers
Manufacturers producing primary and secondary packaging materials that come into direct or indirect contact with food products, requiring food safety controls appropriate to their specific manufacturing processes and materials.
Food Storage Facilities
Cold storage, ambient storage, and distribution center operators managing temperature control, contamination prevention, stock rotation, and product integrity during storage and pre-distribution handling.
Food Distribution Organizations
Logistics and distribution operators managing the safe transport, handling, and delivery of food products from manufacturer to retailer, food service operator, or end consumer.
Catering Services
Contract catering, event catering, and institutional food service operators managing food safety across meal preparation, cooking, chilled storage, hot holding, and service activities at scale.
Restaurants and Food Service Providers
Commercial food service operations managing food safety for prepared meals and beverages served directly to consumers, including kitchen hygiene, temperature control, allergen management, and supplier controls.
Agricultural Producers
Primary producers growing, harvesting, and supplying fresh produce, grains, livestock, and other agricultural commodities to the food chain, where primary production controls directly affect downstream food safety.
Ingredient Suppliers
Suppliers of food ingredients, additives, flavourings, processing aids, and other materials used in food production, where effective food safety controls throughout the supply chain are required by customers and regulators.
Food Retailers
Supermarket chains, specialty food retailers, and online food businesses managing food safety during the storage, handling, preparation, and sale of food products to consumers.
Benefits
Why organizations pursue certification
Improved Food Safety Performance
A structured food safety management system with defined hazard controls, monitoring requirements, and corrective action processes reduces the risk of food safety incidents, product recalls, and consumer harm.
Enhanced Consumer Confidence
Independent certification demonstrates that food safety management practices have been assessed against an internationally recognized standard, supporting consumer and market confidence in product safety and quality.
Improved Regulatory Confidence
A systematic approach to identifying and managing food safety hazards supports compliance with applicable food safety legislation and regulatory requirements across all relevant markets and jurisdictions.
Better Hazard Control
Formal hazard analysis and the implementation of prerequisite programs and HACCP-based operational controls ensure that significant food safety risks are identified and managed through appropriate, verified, and documented control measures.
Improved Traceability
Documented traceability systems enable organizations to locate and withdraw affected products from the market efficiently and effectively when a food safety issue is identified, reducing consumer exposure and liability.
More Consistent Food Safety Practices
Documented processes, training requirements, and monitoring procedures ensure that food safety controls are applied consistently across operations, sites, shifts, and changes in personnel.
Enhanced Supplier and Customer Trust
Certification provides independent verification that the organization’s food safety management system meets internationally recognized requirements, strengthening relationships with customers, retailers, and supply chain partners.
Improved Operational Governance
The standard establishes clear accountability for food safety management, planning, and management review at leadership level, embedding food safety into organizational governance and operational decision-making.
Continual Improvement
Systematic performance measurement, management review, and corrective action processes ensure that the food safety management system evolves in response to new hazards, changing operations, regulatory updates, and emerging risks.
Regulatory Context
Is ISO 22000 certification required?
ISO 22000 certification is generally voluntary. However, food safety regulations, customer requirements, retailer expectations, export requirements, procurement requirements, and supply chain expectations frequently encourage or require organizations to implement structured food safety management systems. In many sectors and markets, ISO 22000 certification is recognized as evidence of an organization’s commitment to systematic food safety management.
Food safety legislation in most jurisdictions imposes requirements on food businesses to identify and manage hazards, maintain hygienic conditions, and keep records demonstrating the effectiveness of food safety controls. ISO 22000 provides a management system framework aligned with these regulatory obligations and widely accepted by food safety authorities as a credible demonstration of structured hazard management capability.
Many food manufacturers, processors, distributors, and suppliers pursue ISO 22000 certification to strengthen customer confidence, support market access, satisfy retailer qualification requirements, and demonstrate an organization’s commitment to food safety, regulatory compliance, and effective control of food safety hazards throughout the supply chain.
Certification Journey
How certification works
01
Application
The organization submits an application and scope information for certification. Exelera reviews the scope of activities, product categories, sites, applicable standard, and certification requirements.
02
Application Review
Exelera reviews the application, confirms scope boundaries, assesses the organization’s food chain activities and product profile, identifies any specific requirements, and prepares the certification proposal and audit program.
03
Stage 1 Audit
Evaluation of food safety management system documentation, scope definition, hazard analysis outputs, prerequisite program documentation, and organizational readiness for Stage 2 conformance assessment.
04
Stage 2 Audit
On-site evaluation of the implementation and effectiveness of the FSMS, including hazard control measures, prerequisite programs, HACCP-related processes, monitoring and verification activities, and conformity with all applicable standard requirements.
05
Certification Decision
Independent review of the audit report and findings by a Certification Decision Maker not involved in the audit, followed by a formal certification decision.
06
Certificate Issuance
Following a positive certification decision, Exelera issues the certificate and publishes the organization on the public certification register.
07
Surveillance Audit — Year 1
Scheduled surveillance visit conducted no later than 12 months after the certification decision to verify continued conformance, system effectiveness, and ongoing food safety control performance.
08
Surveillance Audit — Year 2
Continued verification of management system implementation, hazard control effectiveness, traceability systems, and the application of corrective actions from prior audits.
09
Recertification Audit
Comprehensive reassessment of the full food safety management system scope conducted prior to renewal of the certification cycle at the end of year three.
10
Certification Renewal
Following a successful recertification audit and positive certification decision, a new three-year certification cycle commences.
FAQ
Common questions
HACCP (Hazard Analysis and Critical Control Point) is a systematic food safety methodology for identifying, evaluating, and controlling food safety hazards. ISO 22000 is a management system standard that incorporates HACCP principles alongside prerequisite programs, risk-based thinking, and broader management system requirements aligned with the ISO High Level Structure. An organization implementing ISO 22000 will implement HACCP as a core component of its food safety management system, but ISO 22000 encompasses a wider set of management, planning, and improvement requirements that HACCP alone does not address.
ISO 22000 can be implemented by any organization operating at any point in the food chain — from primary production and agricultural processing through to food manufacturing, storage, distribution, retail, food service, and catering. It is also applicable to organizations that provide equipment, services, cleaning products, or packaging materials to the food industry where those activities may affect food safety. The standard is designed to accommodate the full range of food chain activities and is scalable to organizations of different sizes and operating contexts.
Yes. ISO 22000 is applicable to organizations of any size. The standard is designed to be scalable, and Exelera adapts the audit program to reflect the scope and complexity of the organization being assessed. Small food businesses should not expect a proportionally lighter burden in meeting the substantive requirements of the standard, but audit duration and documentation expectations are calibrated to reflect their size and operational context.
No. ISO 22000 certification does not replace or substitute for compliance with applicable food safety legislation and regulations. Organizations remain responsible for identifying and complying with all relevant legal and regulatory requirements governing food safety in their jurisdiction and markets. The standard is designed to support, complement, and work alongside regulatory requirements rather than replace them. Certification may be recognized by some regulators as evidence of a structured approach to food safety management, but it does not confer regulatory approval for specific products or processes.
The time required depends on the size of the organization, the complexity of its food safety operations, and the maturity of its existing food safety management practices. For a small to medium-sized organization with established food safety controls and documented systems, the process from initial application to certificate issuance typically takes between three and six months. Larger organizations with multiple sites, complex supply chains, diverse product ranges, or significant regulatory considerations may require a longer program.
Following initial certification, surveillance audits are conducted annually — with the first surveillance no later than 12 months after the certification decision and the second no later than 24 months. A full recertification audit is required at the end of the three-year certification cycle before the certificate can be renewed.
ISO 22000 certificates are valid for three years from the date of the certification decision, subject to satisfactory completion of annual surveillance audits. Certification lapses if surveillance audits are not completed within the required timeframe, or if the certificate is suspended or withdrawn due to nonconformity or other grounds.
Certification transfers are possible in most cases. Exelera will review the existing certification, audit history, and current conformance status as part of the transfer assessment. Transfer audits are typically shorter than initial certification audits, reflecting the documented history of conformance. Contact Exelera for specific guidance on the transfer process and the information required to initiate a transfer review.
Remote audit activities are possible for certain elements of the assessment, including documentation review, interviews, and process walkthroughs where the nature of the activity permits. Exelera’s standard approach requires on-site audit activities for key elements, particularly for Stage 2 and recertification audits. On-site assessment is especially important for food safety management systems where the physical environment, production conditions, and implementation of prerequisite programs require direct observation. Remote auditing options are discussed and agreed as part of audit planning.
Applications can be submitted through the Exelera website or by contacting the certification team directly. The application process involves providing information about the organization’s scope of activities, product categories, food chain position, number of sites, employee headcount, and existing food safety management documentation. Exelera will review the application and prepare a certification proposal for consideration.
Related Standards
Standards commonly implemented alongside ISO 22000
