Integrating ISO 22000 with Other Management Systems

A beverage group holds separate certificates for quality and food safety. Staff sit through two audits a year that ask for the same training records, the same calibration list, and the same management review minutes in different formats. Work is duplicated, actions conflict, and neither system improves. Integration is the practical answer, and ISO 22000 was designed to allow it.

Integration means running a single management system that meets the requirements of two or more standards together. Most commonly, ISO 22000 is integrated with ISO 9001 for quality management. Some organisations add ISO 14001 for environment or ISO 45001 for occupational health and safety. Your role as a lead auditor is to judge whether integration helps control, not whether the manual uses one cover or several.

Why Annex SL Makes Integration Possible

ISO 22000:2018 follows the Annex SL high-level structure. Core clauses, common text, and shared terms align across standards. Clauses 4 to 10 carry the same headings in ISO 9001 and ISO 22000: context, leadership, planning, support, operation, performance evaluation, and improvement.

Shared elements integrate naturally:

• Context of the organisation and interested parties can be determined once, with food safety, quality, and other aspects considered together.
• Policy can be combined or aligned, provided food safety policy requirements in ISO 22000 Clause 5.2 are fully met.
• Competence, awareness, communication, and documented information under Clause 7 can use one process and one control system.
• Internal audit under Clause 9.2 and management review under Clause 9.3 can be run as combined activities, provided each standard’s inputs, criteria, and outputs are covered.
• Nonconformity and corrective action under Clause 10 can use a single workflow with consistent root cause analysis.

Operation under Clause 8 is where standards diverge most. ISO 22000 Clause 8 contains food safety-specific controls: PRPs, hazard analysis, OPRPs and CCPs, and verification. ISO 9001 Clause 8 covers operational planning, customer requirements, design where applicable, purchasing, production control, and release. Integrated operation must keep discipline-specific controls distinct and auditable.

Degrees and Models of Integration

Integration sits on a spectrum. At the lightest level, organisations align documentation and run combined internal audits while keeping separate policies and reviews. Deeper integration merges processes: one change management process covering product, process, and system changes; one supplier management process evaluating both quality and food safety criteria; one corrective action database.

Neither level is automatically better. Audit what exists. Ask how the organisation decided its model, whether responsibilities are clear, and whether staff can explain which requirements apply to their tasks. A fully merged manual that buries food safety controls inside generic quality language can be worse than aligned separate documents that staff actually use.

Combined Audits and Auditor Competence

Combined certification audits save auditee time when the audit team collectively covers all criteria. No single auditor needs every competence, but the team together must, and the lead auditor must plan time so food safety depth is not squeezed by quality sampling. Watch for a common failure: combined audits that sample generic Clause 7 and 9 processes thoroughly but shorten Clause 8 hazard control trails. Integration must never reduce technical rigour on the production floor.

Benefits, Risks, and Audit Evidence

Well-integrated systems reduce duplicate records, give leaders a single review of performance, and help staff see how a supplier failure affects both quality complaints and hazard control. Integrated risk thinking can also help: a packaging change assessed once for labelling accuracy, migration risk, and customer specification compliance is stronger than three partial assessments.

Risks are equally concrete. Generic procedures can lose food safety specificity: a combined “product release” rule that omits evaluation of potentially unsafe product under ISO 22000 Clause 8.9 is nonconforming even if quality release works. Combined objectives can dilute food safety targets. Combined management reviews can omit required ISO 22000 inputs, such as results of system verification activities and relevant communication from external interested parties, if agendas are copied from ISO 9001 alone.

Test integration with cross-cutting trails. Take one incident, such as a customer complaint about foreign material, and follow it through communication, investigation, corrective action, verification, internal audit, and management review in the integrated system. Confirm each standard’s requirement was met along the trail. Check review minutes against both standards’ input lists. Check the internal audit programme covers all clauses of both standards over its cycle with auditors who do not audit their own work.

Report integration findings precisely. If a combined process fails only a food safety requirement, raise it against ISO 22000. Avoid vague findings against “the integrated system” that the organisation cannot assign or correct.

Document architecture deserves a specific check. Integrated organisations often adopt a single manual describing common processes once, with annexes for discipline-specific controls. Audit that architecture for completeness by mapping each ISO 22000 requirement to a location in the system, then sampling the locations staff actually use at workstations. Gaps appear where a common process was written for quality language and food safety duties were assumed rather than stated: for example, a single supplier approval form that captures commercial terms but omits food safety criteria, hazard information exchange, and re-evaluation triggers required for external providers.

Key points

• Annex SL gives ISO 22000 and ISO 9001 the same Clauses 4 to 10 structure, enabling genuine integration.
• Support, internal audit, management review, and corrective action integrate most readily; Clause 8 operational controls remain discipline-specific.
• Combined audits require team competence across all criteria and must protect time for food safety technical trails.
• Test integration with end-to-end trails and check combined reviews and audit programmes against each standard’s full requirements.
• Integration succeeds when it reduces duplication without losing food safety specificity.