ISO 22000 — Food safety management systems
ISO 22000 brings together three things that used to stand apart: HACCP as the method of hazard analysis, prerequisite programmes that form the hygiene foundation, and a management system that holds it all together and asks for evidence.
What is ISO 22000?
ISO 22000 is the international standard for food safety management systems. It applies to the whole food chain — from primary production and processing, through packaging and transport, to catering and retail.
It includes the HACCP principles, but adds management responsibility, communication along the chain, prerequisite programmes, internal audits and continual improvement. The standard is voluntary; the obligation to set up a system based on HACCP principles comes from the law and applies whether or not you use the standard. A new edition is in preparation; the 2018 edition remains current, and we will explain the transition when it is published.
How it relates to HACCP
These are easily confused. HACCP isn’t a standard but a method — hazard analysis and the identification of critical control points. ISO 22000 doesn’t replace that method; it builds it into a management system with a policy, objectives, responsibilities, internal audits and management review.
In Serbia, setting up a HACCP system is a legal requirement for food business operators under the Law on Food Safety (Zakon o bezbednosti hrane). ISO 22000 isn’t a legal requirement — it is a way of organising that obligation, demonstrating it and improving on it, and of having it recognised outside the country.
Who it is for
The standard covers the whole food chain, not just production:
- primary production — crop and livestock farming
- processing and production of food and drink
- transport and storage under controlled conditions
- hospitality, catering and meal preparation
- retail and distribution
- manufacturers of packaging that comes into contact with food
- manufacturers of equipment, cleaning agents, additives and animal feed
The last two groups aren’t what you would expect on this list — they don’t produce food, but they are part of the chain, and their failures end up in the food.
What the standard is built on
- Interactive communication along the whole chain — upstream to suppliers, downstream to customers, and with the authorities. A hazard that one link doesn’t control must be communicated to the next.
- Prerequisite programmes (PRPs) — hygiene, maintenance, pest control, the movement of people and materials. They are the foundation without which HACCP has nothing to stand on.
- The HACCP principles — hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification, documentation.
- A management system — the same structure as ISO 9001, so the two systems can be combined without duplication.
Two levels of risk
The standard requires risk to be looked at in two ways. Operational risk is a hazard in the product — microbiological, chemical, physical or allergenic. Organisational risk is anything that could undermine the system itself: the only trained person leaving, a change of supplier, a new product introduced without analysis.
The distinction is practical because a hazard in the product and a weakness in the system need different measures: the first is controlled through critical control points and OPRPs, the second is prevented through training, cover and review at every change.
What implementation looks like
- Listing products and processes, with flow diagrams checked on the floor rather than drawn for the file.
- Checking the prerequisite programmes — hygiene, maintenance, water, pests, training. This is where most of the quick fixes are found.
- Hazard analysis for each process step, and deciding on control measures.
- Critical limits and monitoring — who measures, with what, how often, and what they do when a value goes outside the limits.
- Verification and traceability, including a mock product recall.
- Internal audit and management review, followed by the certification audit if certification is the goal.
ISO 22000 or FSSC 22000
An important question before you start. Large retail chains often ask not for ISO 22000 but for FSSC 22000 — a certification scheme recognised by the Global Food Safety Initiative (GFSI) that consists of ISO 22000, sector-specific prerequisite programmes and additional requirements.
If your goal is to supply an international retail chain, check exactly what the customer requires before you start. Moving from ISO 22000 to FSSC 22000 is feasible, but it is cheaper to aim for the right scheme from the outset.
What changes in daily work
- Hazards are managed separately from weaknesses in the system, so each gets its own measure.
- Traceability is set up in advance, so in an incident you know which batches went where.
- Prerequisite programmes have records, so hygiene is demonstrated rather than claimed.
- Communication along the chain is organised — suppliers and customers know what to report and to whom.
- Evidence for inspectors and customers is produced in everyday work, not before a visit.
Climate change in the organisation’s context
Since February 2024, ISO 22000 has had an amendment (ISO 22000:2018/Amd 1:2024), one of the climate amendments ISO made to its management system standards. It requires the organisation to determine whether climate change is a relevant issue, and adds a note that relevant interested parties can have requirements related to climate change.
This isn’t a separate system or new documentation. What is required is that the consideration takes place and can be seen — in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your food safety management system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO 22000 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Is ISO 22000 mandatory?
The standard itself is voluntary. The obligation to set up a system based on HACCP principles comes from food safety law and applies to food business operators. ISO 22000 is a way of organising that obligation more broadly and having it certified, but it doesn’t replace it.
What if we have several plants or lines?
The organisation defines the scope of the system, and it is stated on the certificate. It can cover one plant or all of them — what matters is that the boundary is clear and that no step affecting product safety is left out.
Does it also apply to packaging and transport?
Yes. The standard covers the whole food chain, so it also applies to manufacturers of packaging that comes into contact with food, hauliers, warehouses, and cleaning and disinfection service providers.
What is the difference between a critical control point and an OPRP?
A critical control point is a step at which a hazard is prevented or reduced to an acceptable level, with a measurable critical limit and monitoring that detects any deviation in time. An operational prerequisite programme (OPRP) also controls a significant hazard, but through an action criterion — which can be measured or observed — rather than a critical limit. The standard requires you to justify which group each measure belongs to.
What are prerequisite programmes?
The basic conditions and activities that maintain a hygienic environment — cleaning and disinfection, maintenance, pest control, personal hygiene, water, waste, incoming inspection. They are the foundation without which hazard analysis makes no sense, because every step would become critical.
Do we need a product recall plan?
Yes. The standard requires an established withdrawal and recall procedure with named responsible people, and requires that procedure to be verified — with a mock recall, for example — and a record of that verification.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- HACCP — the system on which ISO 22000 rests; a legal requirement for food business operators.
- ISO 9001 — quality management systems, with a shared structure and documentation.
- ISO 45001 — occupational health and safety; a complement in food production.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
- Chemicals and biocides — the cleaning and disinfection agents used in prerequisite programmes are subject to these regulations too.
How STANDARDISO can help
We guide you through the whole process — from flow diagrams and checking the prerequisite programmes, through hazard analysis and identifying critical control points, to the internal audit and preparation for certification. If you already have ISO 9001, the shared parts of the system aren’t done again. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.