Standard status
- Current published edition
- ISO 22000:2018 (second edition, published June 2018)
- Assessments conducted against
- The 2018 edition.
- Scheme type
- Management systems (food safety)
ISO 22000 is the international standard for a food safety management system, the way an organization anywhere in the food chain manages the safety of what it makes, handles or supplies. The system assists in ensuring that food safety hazards are identified and controlled, that products are safe for their intended use, and that food safety information moves up and down the chain rather than stopping at the organization's door. An organization certified to ISO 22000 has had that system assessed against the standard by a certification body. The current edition is ISO 22000:2018. A buyer can rely on an ISO 22000 certificate when independent accreditation of the issuing certification body stands alongside the standard itself.
What a food safety management system is
A food safety management system is the set of policies, processes and responsibilities through which an organization makes sure that what it contributes to the food chain is safe. The standard is written for the whole chain, directly or indirectly involved: growers, processors and manufacturers, but also storage and transport, packaging producers, ingredient and feed suppliers, caterers and retailers. An organization does not have to make food to need one.
The standard combines four generally recognized elements of food safety into one certifiable system: communication along the food chain that actually works in both directions; system management; prerequisite programs, the basic conditions and activities that keep the production environment hygienic; and the hazard analysis and critical control point principles, HACCP, through which specific hazards are identified, analyzed and controlled. It also rests on the same seven management principles as the other ISO management system standards, from customer focus and leadership to evidence-based decision making.
What makes ISO 22000 unusual among those standards is that it runs the plan-do-check-act cycle at two levels at once. One level is the management system as a whole, the planning, support, evaluation and improvement machinery. The other is operational, inside the food safety work itself, where hazard controls are planned, monitored, verified and improved. The standard is explicit that communication between the two levels is essential, so the hazard control work and the management system cannot drift apart.
What ISO 22000 requires
The requirements are set out across seven areas, clauses 4 to 10, using the harmonized structure ISO now applies to its management system standards. The management-system clauses frame the system; the operational clause, clause 8, carries the food safety engine.
Context, leadership and planning
The organization works out which internal and external issues affect what its food safety management system is meant to deliver, identifies the interested parties who matter and their requirements, and draws the system's boundaries. Top management demonstrates leadership and commitment, sets a food safety policy, and assigns the roles that keep the system working, including the food safety team that the operational work depends on. Planning addresses the risks and opportunities to the system, sets measurable food safety objectives, and manages changes deliberately.
Support
The resources the system needs, including the competence of the food safety team and of everyone whose work affects food safety, awareness, documented information, and communication. Communication carries unusual weight in this standard: the organization must manage it externally, with suppliers, contractors, customers and authorities, as well as internally, so that information bearing on food safety reaches the people who need it in time to act.
Operation, where the food safety work lives
Clause 8 is the longest clause in the standard and does the distinctive work. The organization:
• establishes and maintains prerequisite programs, the hygiene foundations appropriate to its place in the food chain;
• operates a traceability system that can follow materials one step back and products one step forward;
• prepares for emergencies and incidents that can affect food safety, and handles them when they occur;
• carries out the preliminary steps and the hazard analysis, identifying the hazards reasonably expected to occur in its products and processes and deciding how each is to be controlled;
• validates its control measures, then operates a hazard control plan covering both critical control points and operational prerequisite programs, with monitoring, corrections and corrective actions defined for each;
• keeps the plan and the prerequisite information current, controls its monitoring and measuring, and verifies that the whole arrangement is working as intended;
• controls nonconforming product, decides what happens to potentially unsafe product, and operates withdrawal and recall arrangements it can actually execute.
Performance evaluation and improvement
Monitoring, measurement, analysis and evaluation of the system, including the analysis of verification results from the operational level; internal audit; management review by top management; and improvement, with nonconformity and corrective action handled at system level and continual improvement required.
Certification is not the whole story
An ISO 22000 certificate shows that a certification body assessed an organization's food safety management system and judged it to meet the standard, within the certificate's scope and as found at assessment. The certificate cannot speak for its own issuer.
Accreditation does that work. ASCB assesses the bodies certifying food safety management systems against ISO/IEC 17021-1 and the sector-specific requirements that apply to a given scope, and operates to ISO/IEC 17011, the international standard for accreditation bodies, itself.
An accredited ISO 22000 certificate has been checked at the level of the organization and at the level of the certifier. An unaccredited certificate has only the first, with nothing independent behind the body that issued it.
Accreditation is a periodic, risk-based assessment of a certification body against the requirements of the relevant standard, carried out by sampling and reflecting what was found at the time of assessment. It is not a continuous or exhaustive check, and it is not a guarantee of any individual certification decision or of any certified organization's products, services or outcomes. What it provides is independent, repeated assessment of the body issuing certificates against the requirements of ISO/IEC 17021-1, including its impartiality and the consistency of its decisions.
Why an accredited ISO 22000 certificate carries more weight
Food safety is a field where certificates are relied on by people who will never see the site: retailers qualifying suppliers, manufacturers qualifying ingredient sources, importers answering to authorities. An ISO 22000 certificate is a claim about how an organization controls hazards in food, and the certificate is only as credible as the body that issued it. With accreditation, what the buyer can verify no longer depends on visiting anything: the certificate’s current status is on IRQAO, the independent register and validation service recording certificates issued by ASCB-accredited bodies, and the certifier’s accreditation, with its scope, is on ASCB’s verify page.
Retailers and manufacturers writing supplier approval criteria get that benefit by specifying accredited certification rather than certification alone, a credential whose checks they can confirm for themselves, both the certified site’s and the certifier’s.
Is ISO 22000 certification the same as accreditation?
No, and the two words are often used as if they mean the same thing. Certification applies to the organization: a certification body certifies that an organization's food safety management system meets ISO 22000. Accreditation applies to the certification body: an accreditation body assesses the certification body against ISO/IEC 17021-1 and ISO 22003-1. An organization is certified to ISO 22000. A certification body is accredited against those standards. Accreditation is the check above the certifier: accreditation bodies are not themselves accredited by a higher body, and what stands behind an accreditation body is the standard it works to. ASCB works to ISO/IEC 17011, the international standard setting the requirements for accreditation bodies.
How to check an ISO 22000 certificate
There are two separate checks, and they answer different questions. To confirm a specific certificate, verify it on the register on which the issuing body records its certificates; for ISO 22000 certificates issued by ASCB-accredited bodies, that is IRQAO. To confirm that the certification body itself is accredited, and to see the full scope of its accreditation, use ASCB's verify page. The two checks together are stronger than either alone: the first confirms the certificate is current, the second confirms the body that issued it was independently assessed and for what.
Where ISO 22000 sits among the standards
ISO 22000 is the certifiable requirements standard for food safety management:
• ISO/IEC 17021-1: the standard a certification body is assessed against to certify management systems, and part of the accreditation behind an accredited ISO 22000 certificate.
• ISO 22003-1: the requirements for bodies providing audit and certification of food safety management systems, applied alongside ISO/IEC 17021-1.
• The ISO 22002 series: sector-by-sector specifications of prerequisite programs, from food manufacturing to catering, packaging and farming, which give the hygiene foundations of an ISO 22000 system their detail.
• ISO 22005: traceability in the feed and food chain.
• ISO 9001, ISO 14001 and ISO 45001: other widely held management system standards that share the same high-level structure, so an organization can run them as one integrated system.
Common questions
What is ISO 22000?
ISO 22000 is the international standard for a food safety management system. It sets out what an organization's system for managing food safety must address, combining communication along the food chain, system management, prerequisite programs and the HACCP principles in one certifiable system.
Who is ISO 22000 for?
Any organization in the food chain, directly or indirectly: growers, processors, manufacturers, storage and transport, packaging producers, ingredient and feed suppliers, caterers and retailers. An organization does not have to make food to need one.
What does ISO 22000 certification mean?
It means a certification body has assessed an organization's food safety management system and judged it to meet the requirements of ISO 22000, at the scope stated on the certificate and at the time of assessment.
What is the latest version of ISO 22000?
ISO 22000:2018, the second edition, published in June 2018.
Does ISO 22000 include HACCP?
Yes. The hazard analysis and critical control point principles are one of the standard's four key elements, carried in the operational clause: hazard analysis, validated control measures, and a hazard control plan covering critical control points and operational prerequisite programs.
Does ISO 22000 certification guarantee safe food?
No. Certification concerns the organization's management system, assessed against the standard at a point in time. It is evidence that a system meeting the standard's requirements was in place and operating, not a guarantee about any individual product.
What is the difference between ISO 22000 certification and accreditation?
Certification is of the organization against ISO 22000. Accreditation is of the certification body against ISO/IEC 17021-1 and ISO 22003-1. Accreditation is the independent check on the certifier behind the certificate.
How do I check an ISO 22000 certificate is genuine?
Verify the certificate on the register on which the issuing body records it, and separately confirm on
ASCB's verify page that the certification body is accredited and for what scope.
How to apply
How to apply for accreditation to certify other organizations against ISO 22000, under ISO/IEC 17021-1 and ISO 22003-1, including the process, the fees and the application documents, is set out on Become Accredited.