ISO 22000:2018 is the international benchmark for food safety management systems. We guide food businesses through every stage, from initial gap assessment to a successful certification audit and beyond.
ISO 22000 is an international standard that specifies the requirements for a food safety management system (FSMS). It is published by the International Organization for Standardization and applies to any organisation in the food chain, from primary production through to food service and retail.
The current version, ISO 22000:2018, replaced ISO 22000:2005 and adopted the High Level Structure common to all modern ISO management standards. This makes it directly integrable with ISO 9001 (quality management) and ISO 14001 (environmental management), allowing businesses to run an integrated management system under a single audit programme.
ISO 22000 combines two well-established approaches: the hazard analysis and critical control point (HACCP) principles of Codex Alimentarius, and the plan-do-check-act management system framework of ISO. It requires organisations to identify food safety hazards, assess their significance, and implement a systematic combination of control measures to prevent those hazards from reaching consumers.
ISO 22000 certification is used by food businesses in over 180 countries as a standalone demonstration of food safety system maturity, and as the core management system standard within FSSC 22000, which adds sector-specific prerequisite programme requirements and is benchmarked by the Global Food Safety Initiative.
ISO 22000 applies to any organisation in the food chain that wants to demonstrate systematic control of food safety risks. It covers every sector and every scale of operation.
Manufacturers of any food product who need to demonstrate food safety system maturity to buyers, retailers or export markets. ISO 22000 is frequently specified in supplier codes of practice.
Suppliers to food manufacturers who are asked by their customers to demonstrate an audited food safety management system as a condition of approved supplier status.
Large-scale catering operations, contract caterers, and institutional food service providers seeking a structured food safety management framework beyond basic HACCP compliance.
Manufacturers of food-contact packaging who supply food businesses requiring ISO 22000 or FSSC 22000 certification from their packaging supply chain.
ISO 22000:2018 is the mandatory core of FSSC 22000. Any business pursuing FSSC 22000 certification must first satisfy all requirements of ISO 22000.
Food businesses entering markets in the EU, Middle East, Asia-Pacific and elsewhere where ISO 22000 certification is specified in import requirements or buyer contracts.
The trigger for most businesses is a direct customer or retailer requirement, a new export market, or a decision to formalise and systematise food safety management that has grown organically over time. If you are unsure whether ISO 22000 is the right standard for your business, request a free consultation and we will advise accordingly.
We cover the full scope of ISO 22000 consulting, from your first assessment through to ongoing post-certification support. Every service is available remotely or on-site.
A clause-by-clause review of your current food safety management system against ISO 22000:2018. Produces a prioritised written action plan identifying every gap before implementation work begins. Available remotely or on-site. See the gap assessment section for full scope.
Full design of your food safety management system to ISO 22000:2018. Includes food safety policy, scope, context and interested party analysis, HACCP plans, operational prerequisite programmes, documented procedures, control records and all supporting documentation.
Development of a site-specific hazard analysis covering biological, chemical, physical and radiological hazards. Determination of control measures, CCP and OPRP classification, critical limits, monitoring systems and verification activities.
Design and documentation of prerequisite programmes covering cleaning and disinfection, pest management, maintenance, personal hygiene, supplier management, allergen management, traceability and environmental monitoring.
Design and delivery of a scheduled internal audit programme covering all clauses of ISO 22000:2018. Includes audit scheduling, checklist development, auditor briefing, non-conformance recording and management review preparation.
A full mock audit conducted against ISO 22000:2018, structured to replicate the certification body's process. Produces a graded findings report identifying all potential major and minor non-conformances, with resolution guidance before the live audit.
Support in drafting and evidencing corrective action responses to non-conformances raised by the certification body, including root cause analysis, corrective action plans and effectiveness verification records.
A monthly retainer covering document maintenance, regulatory update alerts, management review support, surveillance audit preparation and helpline access between formal audit cycles.
For businesses holding or targeting ISO 22000 who need to progress to FSSC 22000, we provide a structured gap assessment and upgrade programme covering the additional ISO 22002 series requirements and FSSC 22000 scheme requirements.
Our ISO 22000 training courses develop internal competency in your team alongside the consulting programme. Businesses that build internal capability alongside external consulting support achieve and maintain certification faster, with less ongoing external dependency. We also offer HACCP training and internal auditor training that align directly with ISO 22000 requirements.
ISO 22000 certification follows a structured sequence. Our part of the process typically takes a few weeks. The certification body audit timeline is outside our control and depends on their availability and scheduling.
| Stage | What happens | Our role | Duration |
|---|---|---|---|
| 1. Gap assessment | Your current food safety system is reviewed clause by clause against ISO 22000:2018. Every gap is identified and prioritised. | We conduct the assessment remotely or on-site and deliver a written action plan. | 2 to 3 days |
| 2. System design | The food safety management system is designed and documented, including food safety policy, scope, context analysis and all required procedures. | We write all documentation in collaboration with your food safety team. | 1 to 2 weeks |
| 3. Hazard analysis and HACCP | A site-specific hazard analysis is conducted. CCPs and OPRPs are determined. Monitoring systems and critical limits are established. | We lead the hazard analysis process and document all outputs to ISO 22000 requirements. | 1 to 2 weeks |
| 4. Implementation | The documented system is put into practice. Staff are briefed. Records are generated. The system runs for a minimum period before audit. | We provide ongoing implementation support, review emerging records and advise on corrective action. | 2 to 4 weeks |
| 5. Internal audit | A full internal audit of the management system is conducted, covering all clauses of ISO 22000:2018. Non-conformances are recorded and closed. | We conduct the internal audit and prepare the non-conformance register and management review inputs. | 2 to 3 days |
| 6. Management review | Top management reviews the performance of the food safety management system. Outputs include decisions on improvement and resource allocation. | We prepare the management review pack and facilitate the meeting if required. | 2 to 3 days |
| 7. Mock audit | A full mock certification audit is conducted against ISO 22000:2018, structured to replicate the certification body's approach. | We conduct the mock audit, issue a graded findings report and close all identified non-conformances. | 2 to 3 days |
| 8. Certification audit | The certification body conducts a Stage 1 (document review) and Stage 2 (on-site audit). Non-conformances must be closed for certification to be issued. | We provide standby support during the audit and draft corrective action responses for any findings. | Up to the certification body |
| 9. Ongoing surveillance | Surveillance audits are conducted annually by the certification body. Recertification occurs every three years. | We provide a retainer covering document maintenance, surveillance audit preparation and ongoing helpline access. | Ongoing |
A gap assessment is the correct starting point for every ISO 22000 project. It establishes your current position before any implementation work begins, preventing wasted effort and ensuring the programme is scoped accurately.
Our ISO 22000 gap assessment reviews your current food safety practices against every clause of ISO 22000:2018. It covers your management system documentation, hazard analysis and HACCP plans, prerequisite programmes, internal audit records, management review outputs, and the day-to-day evidence your team generates.
The assessment can be conducted entirely remotely through document review and structured interviews, or on-site where the nature of the operation requires a physical review of processes and facilities. Most single-site businesses complete the gap assessment within one to two weeks.
We review your existing food safety documentation against each clause of ISO 22000:2018, noting what is in place, what is partially met and what is absent.
We review a sample of operational records, HACCP plans, PRP monitoring logs and corrective action records to assess implementation maturity.
We interview key personnel and, where relevant, review the physical site or production environment to check that documented procedures reflect actual practice.
We produce a written gap assessment report with a prioritised action plan, realistic timeline and resource estimate for achieving certification.
The gap assessment report forms the basis for our written consulting proposal. Clients who proceed to a full consulting engagement have the cost of the gap assessment credited against the programme fee.
ISO 22000:2018 is structured around 10 clauses. Clauses 4 to 10 contain the requirements that your organisation must satisfy. Below is a summary of each area and what auditors look for.
You must identify internal and external issues that affect food safety, determine the relevant interested parties and their requirements, and define the scope of your FSMS. Auditors look for a documented scope that accurately reflects what your organisation does and a genuine analysis of external factors affecting food safety.
Top management must demonstrate active involvement in the food safety management system, not delegation. This includes establishing a food safety policy, assigning a food safety team leader and ensuring the FSMS is integrated into business operations. Auditors interview senior management directly.
Risks and opportunities must be identified and addressed. Food safety objectives must be established, measurable and monitored. Auditors check that objectives are specific, tracked and driving genuine improvement, not generic statements written once and forgotten.
Adequate resources must be provided, including infrastructure, process environment and monitoring equipment. Personnel competence must be evaluated and evidenced. Internal and external communication procedures must be documented and followed.
PRPs establish the baseline hygiene and operational conditions required before hazard analysis can be effective. They must be documented, implemented and monitored. Common PRP areas include cleaning and disinfection, pest management, personal hygiene, maintenance, allergen management and supplier control.
A systematic hazard analysis must be conducted for all products and processes. Hazards must be classified, control measures selected and each control measure categorised as a CCP or OPRP with documented rationale. Critical limits, monitoring systems and corrective action procedures must be established for every CCP.
Procedures for handling potentially unsafe product, product withdrawals and recalls must be established and tested. Corrective and preventive actions must be systematically managed with evidence of root cause analysis and effectiveness verification.
The organisation must monitor and measure the performance of the FSMS. Internal audits must be conducted at planned intervals across all clauses. Management reviews must be held and must include all inputs specified by the standard, with documented outputs and follow-up actions.
Nonconformities must be addressed through a structured corrective action process including root cause analysis, action implementation and effectiveness verification. The organisation must demonstrate continual improvement of the FSMS, supported by trend data from monitoring and audits.
Most ISO 22000 certification audit failures are predictable. The same non-conformances appear in the same areas across businesses of every size and sector. Knowing them in advance is the most effective form of audit preparation.
Copying a template HACCP plan without adapting it to your specific products, processes, equipment and suppliers is one of the most common major non-conformances. Auditors walk the production line and compare every CCP, critical limit and monitoring activity against what they observe. Any mismatch is immediately cited.
Lead auditors compare documented procedures against shop-floor reality by questioning staff and observing activities directly. When what people do does not match what the procedure says, every procedure in the system is called into question. Bridging the gap between documentation and practice is core to our mock audit process.
Internal audits conducted without sufficient depth, covering fewer clauses than required, or resulting in findings that were never closed are a consistent non-conformance area. Auditors review your full internal audit programme and corrective action records. Too few findings in an internal audit is itself a red flag.
ISO 22000:2018 specifies precisely what must be covered in the management review. Missing even one of the required inputs is a non-conformance. Records must show that all inputs were reviewed, discussed and that outputs and follow-up actions were assigned and tracked.
Raising a corrective action and closing it without evidence of root cause analysis, a systematic fix, and verification that the fix worked is a non-conformance. Auditors test the quality of your corrective action process by reviewing a sample of closed actions in detail.
A defined process for supplier selection, approval and ongoing monitoring must be documented and applied consistently. Missing supplier questionnaires, unapproved suppliers in use, or no evidence of periodic re-evaluation are all regularly cited non-conformances.
When senior management cannot answer questions about the food safety policy, food safety objectives or recent FSMS performance, auditors conclude that the system is not genuinely embedded. Leadership involvement must be evidenced in records and in demonstrated behaviour, not stated in a policy document alone.
Auditors test the robustness of your hazard analysis by asking why each hazard was included or excluded and how you determined that a given step is a CCP and not an OPRP. Decisions must be documented with specific, site-based justification, not generic statements.
The two most frequently confused food safety standards. The distinction matters significantly for businesses supplying major retailers or operating internationally.
| ISO 22000:2018 | FSSC 22000 (current: v6, v7 expected 2026) | |
|---|---|---|
| What it is | An ISO management system standard specifying FSMS requirements | A certification scheme built on ISO 22000 plus sector PRPs and additional requirements |
| GFSI recognition | No | Yes, widely accepted by major food retailers globally |
| Who publishes it | International Organization for Standardization | Foundation FSSC (independent, non-profit) |
| Additional requirements | None beyond the standard itself | ISO 22002 sector PRP standards plus FSSC scheme-specific requirements |
| Retailer acceptance | Accepted by some buyers. Not universally required | Required by most major food retailers worldwide |
| Best for | Businesses demonstrating FSMS maturity to specific buyers. Stepping stone to FSSC 22000 | Manufacturers and suppliers to major retailers requiring GFSI-recognised certification |
| Our consulting | ISO 22000 consulting | FSSC 22000 consulting |
If your customers or target markets require GFSI-recognised certification, FSSC 22000 is the appropriate standard. If you are seeking to build and demonstrate food safety management system maturity without a specific GFSI requirement, ISO 22000 is a viable standalone option and provides a clear upgrade pathway to FSSC 22000 later. We can advise on the right choice for your situation during an initial consultation.
Two of the most common questions before starting an ISO 22000 project. Below is an honest picture of what drives both.
Timeline
How long our consulting work takes
Cost factors
What drives the consulting fee
No existing HACCP documentation or formal food safety management system. Our consulting work typically takes 4 to 6 weeks. Certification body scheduling is separate and outside our control.
A single-site business with one product range requires less consulting time than a multi-site manufacturer with multiple product categories and complex processes.
HACCP documentation exists but the management system structure and audit programme need to be built. Our consulting work typically takes 2 to 4 weeks.
The closer your current systems are to ISO 22000 requirements, the less work is required. The gap assessment establishes this precisely before the fee is quoted.
Transitioning from the previous version of the standard to ISO 22000:2018. Our consulting work typically takes 1 to 2 weeks depending on the gap between old and new requirements.
A gap assessment only is a smaller investment than a full implementation programme. We offer both, and every scope of work is defined in writing before work begins.
Certification body scheduling is entirely outside our control. We recommend selecting and engaging your certification body early so their availability does not create delays after our work is complete.
Certification body audit fees are separate from our consulting fees and are paid directly to your chosen certification body. We can advise on certification body selection and typical fee ranges during the initial consultation.
Answers to the questions we hear most often from businesses starting an ISO 22000 project.
ISO 22000 is an international standard that specifies the requirements for a food safety management system. It is published by the International Organization for Standardization and applies to any organisation in the food chain, from primary production through to food service and retail. The current version is ISO 22000:2018. It combines the principles of HACCP with a plan-do-check-act management system structure and is used by food businesses worldwide to demonstrate control of food safety hazards.
ISO 22000 certification is relevant to any organisation in the food chain that wants to demonstrate systematic control of food safety risks. It is used by food manufacturers, ingredient suppliers, packaging companies, catering operations, retailers, logistics providers and primary producers. It is often required by international buyers and export market customers, and is a prerequisite for FSSC 22000 certification, which is recognised by the Global Food Safety Initiative.
ISO 22000 is the core management system standard. FSSC 22000 is a certification scheme built on top of ISO 22000 that adds sector-specific prerequisite programme requirements (from the ISO 22002 series) and additional scheme requirements published by the Foundation FSSC. FSSC 22000 is benchmarked by the Global Food Safety Initiative and is widely required by major food retailers. ISO 22000 alone is not GFSI-recognised. Businesses supplying retailers typically need FSSC 22000 and not ISO 22000 standalone.
Our consulting work moves fast. From gap assessment to mock audit ready, most businesses are there in a few weeks, not months. The total time to certificate depends on how quickly the certification body can schedule your audit, which is outside our control. We make sure our part never holds you up.
An ISO 22000 gap assessment is a clause-by-clause review of your current food safety management system measured against the requirements of ISO 22000:2018. It identifies every area where your current practices fall short of the standard, prioritises the gaps by severity, and produces a written action plan with a realistic timeline to certification. It is the correct starting point for any ISO 22000 project because it prevents wasted effort by establishing exactly what needs to change before implementation begins.
The most common failures in ISO 22000 certification audits are: HACCP plans that do not reflect the actual process or site conditions. Generic procedures not adapted to the specific operation. Internal audit programmes that are not completed or not acted upon. Management review records that are incomplete or missing required inputs. Corrective action processes that lack follow-up evidence. Prerequisite programmes with incomplete records. A gap between documented procedures and actual shop-floor practice. Our mock audit process is designed to identify and close all of these before the certification audit.
A Critical Control Point (CCP) is a step in the process where a control measure is essential to prevent or reduce a food safety hazard to an acceptable level, and where failure would directly result in an unsafe product. An Operational Prerequisite Programme (OPRP) is a control measure that manages a food safety hazard but where the critical limits and monitoring are less precise than a CCP. ISO 22000:2018 requires organisations to formally distinguish between CCPs and OPRPs through a structured decision process during hazard analysis.
Yes. Gap assessments, FSMS design, documentation, internal audit support and certification preparation are all available remotely. We work with clients in any country. On-site visits are available for mock certification audits and where the nature of the operation makes remote review impractical.
ISO 22000 consulting fees depend on the size and complexity of your operation, the maturity of your existing food safety systems, and the scope of work required. A focused gap assessment for a single-site food business is a fixed-scope project. Full FSMS design and implementation support for a multi-site manufacturer is a larger engagement. We provide a detailed written proposal after an initial consultation. Request a consultation to receive a scoped quote for your situation.
The current version is ISO 22000:2018, published in June 2018. It replaced ISO 22000:2005. The 2018 revision adopted the High Level Structure common to all ISO management system standards, making it easier to integrate with ISO 9001 and ISO 14001. All certification audits are conducted against ISO 22000:2018.
You can commission any of these on their own, with an agreed scope and a written quote, without taking on ongoing consulting. See all food safety services.
To establish the real size of the project before an audit date is booked.
Read about A gap assessment →Where no plan exists yet.
Read about HACCP plan development →Where the programmes underneath the plan are carrying the load.
Read about A prerequisite programme review →To establish whether your controls were ever proven capable.
Read about A verification and validation review →Tell us where you are now. We will tell you exactly what needs to happen, how long it will take and what it will cost.