FOOD SAFETY AND QUALITY ASSURANCE: MANAGEMENT SYSTEMS
Diagram
One plan and one system
HACCP
A plan for one process: study the process, find the hazards at each step, and watch the few steps where control is essential.
↓
ISO 22000
A management system for the whole business: HACCP joined with leadership, planning, training, documents, communication, audit, review and improvement.
↓
The link
ISO 22000 is built on HACCP: the HACCP plan sits inside the system, and the system keeps the plan working over time and through change.
Figure 1: HACCP controls hazards in one process; ISO 22000 controls hazards across the whole business. Drawn in our own style from the FTN Food Safety and Security notes, Units 4 and 5, and from Sun, Handbook of Food Safety Engineering, Part V.
Introduction
Hazard Analysis and Critical Control Points, written HACCP, and ISO 22000 are the two food safety systems people confuse most, because ISO 22000 includes HACCP, so the two are treated as the same thing. They are not: HACCP is a plan that controls hazards in one process, while ISO 22000 is a food safety management system that controls hazards across the whole business and keeps the control working over time. Sun, Handbook of Food Safety Engineering, gives each its own chapter in Part V, on the major international food safety management systems, and the FTN Food Safety and Security notes, Units 4 and 5, describe both in turn.
This article is built from those books and notes only. It does not use scheme owners’ documents. It is distinct from the earlier articles on HACCP and HARPC, and on ISO 22000 and FSSC 22000.
Quick comparison
Table 1: HACCP compared with ISO 22000
| Aspect | HACCP | ISO 22000 |
|---|---|---|
| What it is | A plan for one process, built on seven principles | A food safety management system for the whole business, built on HACCP plus management |
| Scope | One product and one process, step by step | The whole business: every product, supplier and process, over time |
| Steps | Twelve steps in all: five preparatory steps, then the seven principles | Clauses in a loop: context, leadership, planning, support, operation, performance evaluation and improvement |
| Hazard control | Hazard analysis, critical control points, critical limits, monitoring, corrective action, verification and records | The same HACCP hazard control, plus prerequisite programmes and operational prerequisite programmes, called OPRPs |
| Management | No management clauses: the plan is the whole of it | Leadership, planning, training, documents, communication, audit, review and improvement |
| Origin | First built for food made for space travel, where a failure could not be fixed by a recall | The most used international standard for a food safety management system, in its 2018 version |
| Certification | A HACCP plan itself is not certified: it is checked as part of a system or by a customer | A business can be certified against ISO 22000 by an outside body, and the certificate tells buyers an independent auditor checked the system |
| What it proves | That the hazards in this process are controlled at the critical points | That the business has a system that keeps control working over time and through change |
| What it needs underneath | Prerequisite programmes, the GHP and GMP systems, which handle the general hazards | The same prerequisite programmes, plus the management loop that keeps them working |
| Failure mode | A plan on paper that is not followed on the line | A certificate on the wall while the system stops working between audits |
Scientific explanation
Definition
HACCP, short for Hazard Analysis and Critical Control Points, turns food safety work around: instead of testing the end product, the team studies the whole process, finds the hazards at each step, and picks the few steps where control is essential to keep the food safe. Those steps are watched all the time, with a clear limit, a clear check, and a clear action when the limit fails. ISO 22000 is the most used international standard for a food safety management system, and its 2018 version joins HACCP with management: leadership, planning, support, operation, checking and improvement, all in one loop.
Working principle
HACCP runs in twelve steps. Before the seven principles are applied, a HACCP team follows five preparatory steps: assemble the team, describe the product, state its intended use and who will eat it, draw the process flow diagram, and walk the floor to verify the diagram against the real process. Only then comes the hazard analysis, the critical control points, the critical limits, monitoring, corrective action, verification and records. The order matters: a hazard analysis done on a wrong flow diagram judges a process that does not exist. Prerequisite programmes, the GHP and GMP systems, sit under all twelve steps: they handle the general hazards, such as pests, water and staff hygiene, so that HACCP can focus on the hazards that are specific to this product and this process. Some control measures are managed by prerequisite programmes, and others as operational prerequisite programmes, called OPRPs in ISO 22000: control measures that are essential but are not critical control points, such as a washing step for vegetables that reduces germs but does not fully remove them. ISO 22000 adds the management loop around the plan: context, leadership, planning, support, operation, performance evaluation by monitoring, audit and management review, and improvement. The loop never ends, because the business, its suppliers and its risks keep changing.
Apparatus
The books used here name no laboratory apparatus for telling the two apart, so no apparatus list is given.
Measurement procedure
HACCP is measured by monitoring at each critical control point, against its critical limit, with a corrective action when the limit fails, and records to prove it. ISO 22000 is measured by the performance evaluation clause: the business watches its own results, runs internal audits, and holds management reviews, and an outside body can certify the business against the standard. A certificate is not a promise that every pack is safe: it is evidence that a system was checked on a given day and met the standard.
Factors affecting readings
For HACCP, the flow diagram decides everything: a wrong diagram gives a wrong hazard analysis, and a critical limit set before the product is described may protect the wrong eater. For ISO 22000, leadership and food safety culture decide whether the system lives: a factory can hold a certificate, run a HACCP plan, and still sell unsafe food, because a system on paper is not the same as a system in practice. Culture is what people in the business actually do when no one is watching, and auditors now ask workers questions instead of only reading files, because a line worker who knows what to do when a critical limit fails shows the culture is alive.
Formulas and calculations
The books used here give no formula for this comparison, so no formula or worked calculation is given.
Industrial applications
- HACCP: controlling hazards in one process, such as the cooking step for a ready meal, watched at its critical limit.
- HACCP: the base of food law in most of the world, and the base of ISO 22000.
- HACCP: the plan a customer checks when it audits a supplier.
- ISO 22000: running food safety across a whole business, with leadership, planning, training, documents and communication.
- ISO 22000: certification by an outside body, so buyers can see an independent auditor checked the system.
- ISO 22000: keeping the HACCP plan working over time and through change, by audit, review and improvement.
Advantages and limitations
- HACCP, advantage: it focuses control on the few steps where it is essential, with a clear limit, a clear check and a clear action.
- HACCP, limitation: it is only a plan for one process, with no management loop to keep it working over time.
- ISO 22000, advantage: it joins HACCP with management across the whole business, so the plan keeps working through change.
- ISO 22000, limitation: a certificate proves the system was checked on one day, not that every pack is safe, and the system must keep working between audits.
FAQ
What is the main difference between HACCP and ISO 22000?
HACCP is a plan that controls hazards in one process, while ISO 22000 is a management system for the whole business that contains the HACCP plan and adds leadership, planning, training, audit, review and improvement.
Is ISO 22000 the same as HACCP?
No: ISO 22000 is built on HACCP, so the HACCP plan sits inside it, but the system adds the management loop around the plan.
How many steps are in HACCP?
Twelve in all: five preparatory steps, then the seven principles, from hazard analysis to records.
What is an OPRP?
An operational prerequisite programme, a control measure in ISO 22000 that is essential for safety but is not a critical control point, such as washing vegetables to reduce germs.
Does an ISO 22000 certificate mean every pack is safe?
No: it is evidence that a system was checked on a given day and met the standard, and the system must keep working between audits.
References and further reading
- FTN subject: Food Safety and Security, Unit 4: HACCP and Prerequisite Programmes; Unit 5: Food Safety Management Systems and Food Law.
- Da-Wen Sun (ed.), Handbook of Food Safety Engineering, Wiley, 2011 (Google Books page read)
- Emmanuel Ohene Afoakwa, Chocolate Science and Technology, Wiley, 2016, chapters 18 and 19 on HACCP and ISO 22000.
