Overview of ISO 22000 Standards

A supplier delivers raw chicken with a temperature record that looks perfect, yet nobody in receiving can explain what happens when a delivery arrives too warm. Paper says one thing, practice does another. ISO 22000 exists to close that gap. Published by the International Organization for Standardization, ISO 22000 sets requirements for a food safety management system that any organisation in the food chain can use, from farms and ingredient makers to manufacturers, transporters, caterers, and retailers.

Version in force today is ISO 22000:2018. Certification to it shows customers, regulators, and trading partners that you have a system for identifying food safety hazards, controlling them, and improving that system over time. Certification is not a guarantee that every product is safe, and the standard never claims that. What it does provide is a disciplined way of working so hazards are less likely to reach the consumer and problems are found earlier when they do occur.

What ISO 22000 covers

Scope matters more than slogans. ISO 22000 applies to the whole food chain because contamination can enter at any point: water used on crops, feed given to animals, packaging that touches food, or a delivery vehicle that carried chemicals before food. An organisation defines its own scope, naming the products, processes, and sites its system covers. Everything inside that scope must meet the requirements. Anything outside must not be implied to be covered.

Inside the system, you are expected to know your context, your interested parties, and the risks and opportunities that affect food safety. You must set food safety objectives, provide competent people and suitable infrastructure, control documents and records, and plan for emergencies such as power loss, flooding, or a product recall. Those management requirements sit alongside operational controls, not above them. A well-written policy that never reaches the production floor has no value under this standard.

Who uses the standard

Small bakeries and multinational processors use the same standard, but their systems look different. Size and complexity change the form, not the obligation. A small site may combine roles and keep simpler records. A large site may need separate teams and more formal procedures. Auditors, internal and external alike, judge whether controls fit the hazards and the scale of operation, not whether documentation looks impressive.

How the standard is built

ISO 22000:2018 follows the high-level structure shared by other ISO management system standards, organised in clauses 4 to 10. Clause 4 deals with context and scope. Clause 5 covers leadership and the food safety policy. Clause 6 covers planning, objectives, and managing change. Clause 7 covers support: people, infrastructure, work environment, competence, awareness, communication, and documented information.

Clause 8 is the operational heart. It covers prerequisite programmes, traceability, emergency preparedness, and the full hazard control sequence in clause 8.5: preliminary steps such as product descriptions and flow diagrams, hazard identification and assessment, selection and categorisation of control measures, validation, and the hazard control plan that sets critical limits for critical control points and action criteria for operational prerequisite programmes. Clause 9 covers performance evaluation, including monitoring, internal audit, and management review. Clause 10 covers improvement, nonconformity, corrective action, and continual improvement.

Two cycles working together

One idea explains much of the standard: two Plan-Do-Check-Act cycles operating at different levels. One cycle runs the management system as a whole, from policy and planning through evaluation to improvement. Another cycle runs operations, from planning and implementing controls through monitoring and verification to acting on deviations. They connect. Operational results feed management review, and management decisions change resources, objectives, and controls on the floor.

Hazard control in ISO 22000 builds on Codex HACCP principles and steps, but goes wider than a HACCP plan alone. HACCP focuses on significant hazards and critical control points. ISO 22000 adds prerequisite programmes that keep the production environment hygienic, operational prerequisite programmes for significant hazards that do not need a critical control point, and the management system that keeps all of it maintained, verified, and updated when products, suppliers, or processes change.

What certification does and does not do

Certification involves an external audit by a certification body, which checks conformity against the standard and issues a certificate for a defined scope and site. Customers often require it as a condition of supply, and schemes such as FSSC 22000 build on ISO 22000 by adding extra requirements. Internal audits remain your own responsibility. External auditors sample your system for a few days. Your internal auditors should know it in depth, all year round.

Legal compliance stays separate. Meeting ISO 22000 does not replace food law in your country, and following the law alone does not satisfy the standard. You need both. The standard requires you to identify applicable statutory, regulatory, and customer requirements and build them into your specifications, controls, and updates. When law changes, your system must change with it.

For an internal auditor, this overview is a working map rather than background reading. Every finding you raise will cite one of these clauses, every audit programme you build will need to cover them over time, and every conversation with a manager will go better when you can explain where a requirement sits and why it exists. Keep returning to the structure: context and leadership set direction, planning and support provide means, operation controls hazards, evaluation checks results, and improvement keeps the whole system current as products, people, and risks change around it.

Key points

• ISO 22000:2018 sets requirements for a food safety management system for any organisation in the food chain.
• Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation, and improvement.
• Clause 8 contains the operational controls, including prerequisite programmes and hazard control in clause 8.5.
• Two Plan-Do-Check-Act cycles link management decisions with operational control on the floor.
• Certification demonstrates a working system for a defined scope; it does not guarantee safe product or replace food law.