What is ISO 22000? Benefits and alignment with FSSC 22000

ISO 22000 is an international standard for Food Safety Management Systems (FSMS) that applies to any organization throughout the food chain. ISO, or the International Organization for Standardization, is an independent, non-governmental international organization that develops and publishes globally recognized standards. ISO brings together national standards bodies from 176 countries around the world to develop standards through expert consensus.

ISO 22000:2018 is the current version of the standard, and helps organizations effectively manage and control identified food safety hazards, and benefits multiple stakeholders including producers, manufacturers, regulators, retailers, and consumers.

The standard provides a framework for organizations to plan, implement, operate, maintain, update and continually improve their FSMS, considering their overall business risks. To comply with the standard, businesses must also meet all applicable food safety-related regulatory requirements as well as mutually agreed customer food safety requirements, in addition to the requirements of the standard.

While ISO 22000 can stand alone as a certification, it also serves as the foundation for FSSC 22000, which is benchmarked by the Global Food Safety Initiative (GFSI). Organizations seeking certification to GFSI-recognized certification programs often start with ISO 22000, which is not GFSI-recognized, and then work towards transitioning to FSSC 22000, which is GFSI-recognized.

What are the Requirements of ISO 22000?

ISO 22000:2018 refers to the 2018 edition of the ISO 22000 standard and is the latest published version of the standard. It replaced ISO 22000:2005.

ISO 22000:2018 outlines comprehensive requirements for a Food Safety Management System (FSMS) that organizations in the food chain must fulfill to achieve certification. These are arranged into 10 clauses, with clauses 4 – 10 detailing the core FSMS requirements.

Context of the organization (Clause 4)

This clause requires the organization to determine external and internal issues relevant to their organization, identify interested parties/stakeholders and their relevant requirements, define the scope of the FSMS, and establish the system including the processes needed and their interactions.

Leadership (Clause 5)

This clause requires top management to demonstrate commitment, which includes but is not limited to, creating a food safety policy – a brief document outlining the organization’s overall intentions, commitment, and direction regarding food safety.

This clause requires appointing a food safety team leader and the food safety team, made up of qualified, competent individuals with clear roles, responsibilities, and authorities for developing and maintaining the FSMS. Top management must ensure these roles and authorities are properly assigned and understood by all employees.

Planning (Clause 6)

Organizations are expected to take actions to address risks and opportunities that have been determined based on the internal and external issues identified, and requirements of relevant interested parties or stakeholders.

This clause requires setting measurable food safety objectives and developing plans to achieve them. The action plan needs to specify what actions are needed, the resources required, the personnel responsible, the due date for each action, and the method for evaluating the results.

A requirement on planning for changes is also included.

Support (Clause 7)

This clause addresses the resource provision, competence, awareness, communication, and documented information of a FSMS. The requirements support a FSMS and ensure it operates effectively.

Support requirements cover:

• Resources, including competent personnel, infrastructure, work environment, externally developed elements of the FSMS, and externally provided processes, products or services.
• Competence and awareness
• Communication for internal and external interested parties/stakeholders
• Documented information and its control

Operation (Clause 8)

The operational clause is the heart of a FSMS. It defines how an organization plans, implements, and controls the processes needed to ensure food safety. The establishment and maintenance of Pre-Requisite Programs (PRPs) is required to create a hygienic operating environment, as well as traceability systems and procedures for emergency preparedness and response. These elements provide the foundation for preventing contamination, maintaining control throughout the food chain, and ensuring the organization can respond effectively to food safety incidents.

Clause 8 is also where the HACCP (Hazard Analysis Critical Control Point) principles are incorporated. Organizations are required to identify food safety hazards, assess their significance, determine appropriate control measures, and manage the significant hazards through Critical Control Points (CCPs) and Operational Prerequisite Programs (OPRPs) within a documented hazard control plan. The clause further requires validation of control measure(s) and combinations of control measures, monitoring and verification activities, updating of food safety information, control of monitoring and measuring, control of nonconforming products and processes, and processes in place to effectively undertake product withdrawal/recall when necessary. Together, these requirements assist in ensuring that food safety hazards are effectively controlled and that safe products are consistently delivered to customers.

Performance Evaluation (Clause 9)

There are three main aspects to the performance evaluation of a FSMS: monitoring and measurement, internal audits, and management review.

Monitoring & Measurement

• Determine which processes shall be monitored and measured to verify they are functioning as intended.
• Establish the frequency of monitoring and measurement activities.
• Determine the methods to be used to ensure results are valid.
• Specify how results will be documented, analyzed, and evaluated.
• Assign responsibility for conducting these analyses and evaluations.
• Retain documented information as proof of performance evaluation results.
• Use findings as input for management reviews and FSMS updates.

Internal Audits 

The organization must conduct internal audits at planned intervals to determine whether the Food Safety Management System (FSMS) conforms to both the organization’s own requirements and the requirements of ISO 22000, and whether it is effectively implemented and maintained.

To achieve this, the organization must establish and maintain an audit program that defines the audit frequency, methods, responsibilities, planning requirements, and reporting arrangements. The program shall consider the importance of processes, changes in the FSMS, monitoring and measurement results, and previous audit results. For each audit, the organization must define the audit criteria and scope, use competent and impartial auditors, report results to the food safety team and relevant management, retain documented evidence, implement corrections and corrective actions within agreed timeframes, and verify the effectiveness of those actions. Internal audits must also determine whether the FSMS continues to meet the intent of the food safety policy and food safety objectives.

Management review

Management Review is the formal process whereby top management evaluates the performance, suitability, adequacy, and effectiveness of the FSMS, using performance data and audit results to make decisions on improvements and related actions needed, and any need for updates and changes to the FSMS, including the need for resources, and the revision of the food safety policy and food safety objectives.

Improvement (Clause 10)

This clause relates to the continual improvement of the FSMS. When a nonconformity occurs, the organization must take appropriate corrections, determine the root cause of the nonconformity, implement corrective actions, evaluate their effectiveness, and make changes to the FSMS where necessary. Records of nonconformities and corrective actions must be maintained as documented information.

The organization is required to continually improve the suitability, adequacy, and effectiveness of the FSMS. Top management is responsible for this improvement through activities such as communication, management review, internal audits, verification activities, etc.

The food safety team must periodically evaluate and update the FSMS, including, when necessary, the hazard analysis, hazard control plan, and Pre-Requisite Programs (PRPs).

Who uses ISO 22000:2018

• Organizations within the food chain such as feed and animal food producers, farmers, ingredient and food manufacturers, packaging/packaging material manufacturers, retailers, and catering and food service operators. It also covers service and supply organizations such as transportation, warehousing, cleaning and sanitation providers, and equipment suppliers.
• Small or medium organizations: the standard allows the use of externally developed elements of the FSMS to meet requirements (refer to clause 7.1.5 of ISO 22000:2018).
• Regulatory and Certification Bodies: to evaluate conformity, facilitate audits, and assist in ensuring food safety performance.

What is the Difference between ISO 22000 and FSSC 22000?

ISO 22000 and FSSC 22000 are both international standards that address key elements to assist in ensuring food safety.

FSSC 22000 contains a complete Certification Scheme for Food Safety Management systems aligned with the ISO Management System approach and the ISO Harmonized Structure.

The auditable requirements of the FSSC 22000 Certification Scheme comprise of:

• ISO 22000:2018
• Sector-specific standards for Pre-Requisite Programs (PRPs) (Version 6 utilizes the ISO/TS 22002 series and PAS 221, whilst Version 7 uses the new ISO 22002-X:2025 series), and
• The FSSC 22000 Additional Requirements, refer to Part 2 of the Scheme (including the BoS Decision List, and Scheme Interpretation Articles).

The main difference between the two certifications is that the FSSC 22000 Certification Scheme is recognized by the Global Food Safety Initiative (GFSI). GFSI benchmarking recognition indicates that the Scheme meets the highest international food safety standards, leading to increased acceptance within the global food industry.

What are the benefits of ISO 22000 and its alignment with FSSC 22000 Certification Scheme

ISO 22000 is a good starting point for organizations to become FSSC 22000 certified. It helps organizations minimize food safety risks and improve their performance. It provides a structured framework for creating a FSMS, a systematic approach to managing food safety hazards. Conforming to ISO 22000 provides benefits such as:

• Improved customer satisfaction: A FSMS assists in ensuring you deliver products that meet customer food safety expectations consistently.
• Help meet regulatory requirements: Compliance with regulatory requirements is required to achieve ISO 22000 certification. Implementing a FSMS can help companies fulfill these requirements and understand their impact on the organization and its customers.
• Enhanced transparency: ISO 22000 helps organizations improve product traceability and increase transparency in their operations.
• Enhanced risk response: Implementing a FSMS allows organizations to respond more quickly and effectively to food safety incidents, helping them prevent potential contamination before it occurs.
• Reduced investigation time: If contamination occurs, a FSMS enables organizations to shorten the time needed to investigate, allowing for quicker resolution.
• Consistent structure: The structure of ISO 22000 resembles that of other international standards. It is designed to integrate seamlessly with other ISO management systems, such as ISO 9001, ISO 45001, and ISO 14001.

Organizations seek certification for their FSMS to showcase these advantages externally. Since FSSC 22000 is based on ISO 22000, it offers all the previously mentioned benefits and gains additional credibility by being a GFSI-recognized certification program.