Krolda
Early access

ISO 22000: ISO 22000, Food safety management systems

ISO 22000 is an international food safety management system standard, and the single most useful thing to know about it commercially is that certification to ISO 22000 alone is not recognised by the Global Food Safety Initiative: the recognised scheme built on it is FSSC 22000.

What it is
Certification scheme
Published by
International Organization for Standardization
GFSI recognised
No
When it started
First published 2005, revised 2018
Where it is used
Worldwide, most often as the management system inside FSSC 22000
Issue Krolda maps
ISO 22000:2018

What ISO 22000 is

ISO 22000 is published by the International Organization for Standardization. It follows the harmonised structure common to ISO management system standards, which means it shares its top-level clause numbering with ISO 9001 and others, and a site running several ISO systems can integrate them.

The standard combines a management system with HACCP principles and prerequisite programmes, and it applies the plan-do-check-act cycle at two levels: to the management system as a whole, and to the operational processes within it.

What it deliberately does not do is specify prerequisite programmes in sector detail. That is left to the ISO/TS 22002 series, and it is the gap FSSC 22000 fills by requiring a specific ISO/TS 22002 document alongside the standard. It is the main reason a GFSI benchmarking exercise did not recognise ISO 22000 on its own.

ISO sells the standard, at a price in the region of a hundred and sixty Swiss francs, and the text may not be redistributed. That is why Krolda maps ISO 22000 by clause identifier and its own summaries only.

What the 2018 revision changed

The 2018 revision restructured ISO 22000 onto the high level structure that ISO now uses across its management system standards, the same clause numbering as ISO 9001 and ISO 14001. For an organisation running several, that alignment is the point: context, leadership, planning, support, operation, performance evaluation and improvement appear in the same places in each, and an integrated management system stops being a mapping exercise.

The substantive change was the separation of two plan-do-check-act cycles. One runs at the level of the management system, and one runs inside it at the level of operational food safety, covering the prerequisite programmes and the hazard control plan. The 2005 edition blurred them, and the practical effect was that organisational risk and food safety hazard were handled with the same machinery when they need different machinery.

The revision also made the distinction between organisational risk and food safety hazard explicit, and added requirements around understanding the context of the organisation and the needs of interested parties. Those are management system concepts rather than food science ones, and they are the clauses a technical manager coming from HACCP finds least familiar.

Why it is not recognised on its own

ISO 22000 requires an organisation to establish prerequisite programmes appropriate to its operation, without specifying what they must contain. That generality is a strength for a standard intended to cover the whole food chain from farming to packaging, and it is precisely what stops it being benchmarkable.

GFSI benchmarking requires prerequisite programmes to be specified, so that two certified sites can be assumed to have implemented comparable controls. Adding a sector-specific ISO/TS 22002 prerequisite specification plus a set of additional requirements is what turns ISO 22000 into a recognised scheme, and that assembly is FSSC 22000.

A site holding ISO 22000 and being told by a customer that it is not enough is usually not being told its system is inadequate. It is being told the certificate does not answer the question the customer is required to ask.

ISO 22000 against ISO 9001

ISO 9001 is a quality management system standard: it asks whether the organisation consistently delivers what it says it will and improves. ISO 22000 asks whether food safety hazards are identified and controlled. They share a structure and almost nothing else in subject matter.

A site certified to ISO 9001 has the management system habits already: document control, internal audit, management review, corrective action, competence records. Those transfer directly. What does not transfer is the hazard analysis, the prerequisite programmes and the hazard control plan, which have no equivalent in ISO 9001 and are the bulk of the food safety work.

How certification works

A site is certified by a certification body accredited to ISO/IEC 17021 for ISO 22000, through an initial audit in two stages followed by surveillance audits across a three-year cycle.

A site that needs a GFSI-recognised certificate should look at FSSC 22000 instead, which uses ISO 22000 as its management system component and adds what GFSI requires.

GFSI recognition

ISO 22000 on its own is NOT a GFSI-recognised certification programme. FSSC 22000, which is built on it, is.

GFSI does not certify anybody and there is no GFSI certificate. What GFSI recognition actually means.

Where this meets United States regulation

A site selling into the United States is held to 21 CFR whether or not it holds a certification. These are the parts that bear on ISO 22000, reproduced in full on this site because title 21 is United States public domain.

What goes wrong in practice

Certification is a statement about a system on the day it was audited. FDA recall records are what happened afterwards, across the whole industry, and these are the hazards that appear most often in the records a plan built to ISO 22000 is meant to control.

What Krolda does with ISO 22000

ISO sells the standard and its text may not be redistributed, so Krolda maps ISO 22000 by clause identifier and its own summaries only.

Krolda maps ISO 22000:2018, checked against the owner’s own publication on 2026-09-13. Issues and editions change and this page does not claim to know which is current: International Organization for Standardization publishes that.

Questions

Is ISO 22000 GFSI recognised?
No. Certification to ISO 22000 on its own is not recognised by the Global Food Safety Initiative. FSSC 22000 is the recognised scheme built on it, adding a sector-specific prerequisite programme specification from the ISO/TS 22002 series and a set of additional requirements. A customer requiring GFSI recognition will not accept an ISO 22000 certificate.
What is the difference between ISO 22000 and HACCP?
HACCP is a method for identifying and controlling hazards, set out by the Codex Alimentarius Commission. ISO 22000 is a management system standard that incorporates HACCP principles and prerequisite programmes and wraps them in the management system structure common to ISO standards: context, leadership, planning, support, operation, performance evaluation and improvement. A HACCP plan is one component of an ISO 22000 system.
How much does ISO 22000 cost?
The standard document is sold by ISO, at a price in the region of a hundred and sixty Swiss francs at the time of writing, and its text may not be redistributed. That cost is separate from the cost of certification, which is charged by a certification body and depends on the site.

The other standards

A ISO 22000 audit asks for the evidence behind each clause, and finding it is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.