Overview of ISO 22000

A dairy plant passes every laboratory test for a month, then a single lot of cheese triggers a recall because a cleaning chemical was stored above an open ingredient bin. Product testing did not fail. Process control did. ISO 22000 exists to prevent exactly that kind of failure by requiring an organisation to manage food safety as a system, not as a set of isolated checks at the end of production.

ISO 22000:2018 is an international standard that sets requirements for a food safety management system, often shortened to FSMS. Any organisation in the food chain can use it, from a farm and a feed producer to a manufacturer, transporter, caterer, retailer, and suppliers of packaging, cleaning agents, and equipment. Certification is not the same as following the standard. An organisation can implement ISO 22000 without seeking certification, but if it wants a certificate, an accredited certification body must audit it against the requirements.

What ISO 22000 Is and Is Not

Think of ISO 22000 as a management framework that combines three elements that are often taught separately. First, interactive communication along the food chain ensures that hazards identified by one organisation are passed to the next. Second, system management provides the structure for policies, objectives, audits, and continual improvement. Third, hazard control applies HACCP principles and prerequisite programmes, or PRPs, to keep hazards at acceptable levels.

ISO 22000 does not list maximum limits for bacteria, chemicals, or foreign bodies in your product. Those limits come from law, customer requirements, and your own hazard analysis. What the standard does require is a disciplined method for identifying hazards, deciding how to control them, proving that controls work, and correcting them when they do not.

Distinguish ISO 22000 from FSSC 22000. ISO 22000 is the requirements standard itself. FSSC 22000 is a certification scheme built on top of it. FSSC 22000 adds detailed PRP requirements from ISO/TS 22002-1 for food manufacturing and additional scheme requirements. An auditor must know which document the organisation is being audited against, because findings must be raised against the correct criteria.

Structure Based on Annex SL

ISO 22000:2018 follows the Annex SL high-level structure shared with ISO 9001 for quality and other management system standards. That common structure is why integration is practical. After introductory clauses, the auditable requirements sit in Clauses 4 to 10.

  • Clause 4, Context of the organisation: internal and external issues, interested parties, and the scope of the FSMS.
  • Clause 5, Leadership: leadership commitment, food safety policy, and roles and responsibilities.
  • Clause 6, Planning: actions to address risks and opportunities, food safety objectives, and planning of changes.
  • Clause 7, Support: resources, competence, awareness, communication, and documented information.
  • Clause 8, Operation: PRPs, traceability, emergency preparedness, hazard analysis, the hazard control plan with operational prerequisite programmes (OPRPs) and critical control points (CCPs), monitoring, verification, and control of nonconformities.
  • Clause 9, Performance evaluation: monitoring and measurement, internal audit under Clause 9.2, and management review under Clause 9.3.
  • Clause 10, Improvement: nonconformity and corrective action, continual improvement, and updating the FSMS.

Clauses 1 to 3 cover scope, normative references, and terms and definitions. They set context but do not contain requirements you audit in the same way.

The PDCA Cycle at Two Levels

Plan-Do-Check-Act runs through the whole standard, but ISO 22000 applies it at two connected levels. At the organisational level, Clauses 4 to 7 and 9 to 10 plan, support, check, and improve the management system itself. At the operational level, Clause 8 plans and controls the actual food production processes, where hazards are prevented, eliminated, or reduced.

Keeping those two levels separate helps you audit well. A missing calibration record is an operational control failure. A pattern of missing records across shifts, with no training plan and no management review action, points to a system failure in support and performance evaluation. Strong auditors test both levels and show how they link.

Risk-Based Thinking Beyond HACCP

HACCP focuses on product and process hazards. Clause 6 adds organisational risk: risks and opportunities that could affect the FSMS achieving its intended results. Examples include loss of a key supplier, new regulation, staff turnover in critical roles, or an emerging hazard in raw materials. Your audit should test whether the organisation has identified such risks in a way proportionate to its context, not whether it has produced a long register for its own sake.

What This Means for a Lead Auditor

Your job as a lead auditor is to determine conformity and effectiveness, not to redesign the system during the audit. You gather objective evidence through observation, interviews, and review of documented information, and you compare that evidence against ISO 22000 requirements and the organisation’s own arrangements.

Three habits matter from the start. Trace forwards and backwards: follow a hazard from raw material receipt through controls to dispatch, and trace a finished lot back to its inputs. Sample across time: include night shifts, changeovers, and maintenance periods, not just the cleanest hour of the day. Separate fact from opinion: record what you saw, who said what, and which document and version you checked, so findings can stand without relying on memory.

ISO 22000 rewards auditors who understand both management systems and food operations. Knowing the clause numbers is necessary, but it is not enough. You also need to recognise when a PRP is poorly designed, when monitoring cannot detect a deviation in time, and when a corrective action treats only a symptom.

Key points

  • ISO 22000:2018 sets requirements for a food safety management system for any organisation in the food chain.
  • Auditable requirements are in Clauses 4 to 10, following the Annex SL structure shared with ISO 9001.
  • Clause 8 holds operational control: PRPs, hazard analysis, OPRPs and CCPs, monitoring, verification, and handling of nonconformities.
  • FSSC 22000 is a separate certification scheme that adds ISO/TS 22002-1 PRPs and scheme requirements on top of ISO 22000.
  • Effective auditing tests both the management system level and the operational control level, using objective evidence.
Next