FOOD SAFETY AND QUALITY ASSURANCE: FOOD SAFETY MANAGEMENT SYSTEMS
Diagram
ISO 22000:2018
The base: a food safety management system standard for any business in the food chain
+
Sector PRPs: ISO/TS 22002 series
Detailed prerequisite programmes for each part of the food chain
+
FSSC 22000 additional requirements
Scheme rules, including food fraud prevention, food defence, food safety culture, and allergen management
=
FSSC 22000 certification scheme
GFSI recognised, built on ISO 22000 plus PRPs plus additional requirements
Figure 1: FSSC 22000 is built in layers: ISO 22000 at the base, sector PRPs in the middle, and FSSC additional requirements on top.
Introduction
ISO 22000 and FSSC 22000 are often mixed up because FSSC 22000 is built on ISO 22000. ISO 22000:2018 is an international standard that sets the requirements for a food safety management system for any business in the food chain, joining HACCP with management in one loop. FSSC 22000 is a certification scheme owned by Foundation FSSC: it takes ISO 22000, adds sector specific prerequisite programmes from the ISO/TS 22002 series, and adds its own additional requirements. The main difference buyers care about is recognition: FSSC 22000 is recognised by the Global Food Safety Initiative (GFSI), while ISO 22000 on its own is not.
Table 1: Quick comparison of ISO 22000 and FSSC 22000
| Aspect | ISO 22000 | FSSC 22000 |
|---|---|---|
| What it is | An international standard for food safety management systems | A certification scheme built on ISO 22000 |
| Owner | International Organization for Standardization (ISO) | Foundation FSSC, the Netherlands |
| Current version | ISO 22000:2018 | Scheme versions change over time: Version 6 was published in April 2023, and a newer version follows on the scheme transition plan, so check the current version with the scheme owner before an audit |
| Parts | Management system clauses 4 to 10, plus HACCP principles and PRPs | ISO 22000 plus sector PRPs (ISO/TS 22002 series) plus FSSC additional requirements |
| PRPs | The business considers the applicable PRP guidance | A named sector PRP standard must be used, matched to the food chain category |
| Extra requirements | None beyond the standard | Food fraud prevention, food defence, food safety culture, allergen management, and other scheme rules |
| GFSI recognition | Not GFSI recognised on its own | GFSI recognised |
| Certificate | Certification to ISO 22000 by an independent body | Certification to the FSSC 22000 scheme; three year certificate with annual surveillance audits |
| Audit stages | Certification audit by the chosen body | Two stage audit: document review first, then the facility audit |
| Best fit | A business that needs a world recognised food safety management system | A business whose buyers ask for a GFSI recognised certificate |
Scientific explanation
Definition
ISO 22000:2018 sets requirements for a food safety management system (FSMS) for any organisation in the food chain. It joins HACCP with management: leadership, planning, support, operation, checking, and improvement, all in one loop. FSSC 22000 is a certification scheme, not a separate standard. Its auditable requirements are ISO 22000:2018, the sector specific PRP standard for the food chain category, and the FSSC additional requirements.
Working principle
ISO 22000 works through its clauses: context, leadership, planning, support, operation, performance evaluation, and improvement. Operation is the largest clause: it asks for PRPs, traceability, emergency readiness, and hazard control, which is the hazard analysis, the validation of control measures, and the hazard control plan, meaning the HACCP plan and the OPRP plan together. FSSC 22000 works by adding the sector PRP detail that ISO 22000 leaves open, plus scheme rules that GFSI benchmarking asks for, and then certifying the whole against the scheme.
Apparatus
Neither is a test, so no apparatus applies. At the control points the system names, the instruments are the tools of the step itself, such as calibrated thermometers.
Measurement procedure
There is no laboratory measurement procedure for either. Measurement happens at the monitoring and measuring points the system names, and the results feed the audit, the management review, and the improvement loop.
Factors affecting readings
The result of either system changes with leadership, training, suppliers, and change control. A new supplier, an ageing machine, or a changed recipe can make a fine plan drift, which is why management review and internal audit run every year, not only before the external audit.
Formulas and calculations
This topic has no standard formula in the books used for this article, so no worked example is given here. Do not use a made up formula for this topic.
Industrial applications
- ISO 22000: food manufacturers, processors, packers, storage and transport firms, and any business in the food chain that wants one management system for food safety.
- FSSC 22000: suppliers to large retailers and brand owners that ask for a GFSI recognised certificate, including food manufacturing, packaging, and storage and distribution.
- Both: a business often starts with ISO 22000 and then moves to FSSC 22000 when buyers ask for GFSI recognition.
Advantages and limitations
ISO 22000 advantages: one world standard for the whole food chain, flexible, and it joins HACCP with management. Limitations: not GFSI recognised on its own, so some large buyers will not accept it alone, and its PRP detail is left open.
FSSC 22000 advantages: GFSI recognised, with detailed PRPs and extra controls for fraud, defence, and culture, so large buyers accept it widely. Limitations: more rules to meet, a two stage audit, and the scheme version must be tracked, since the scheme changes over time.
FAQ
If my factory has ISO 22000, does it have FSSC 22000?
No. FSSC 22000 needs ISO 22000 plus the sector PRPs and the FSSC additional requirements, and a scheme audit.
Why do buyers ask for GFSI recognition?
GFSI benchmarking means the scheme meets a shared set of world requirements, so buyers accept the certificate as proof without running their own full audit.
Is a certificate a promise that every pack is safe?
No. A certificate is evidence that a system was checked on given days and met the standard. The system must keep working between audits.
Do scheme versions matter?
Yes. Each scheme publishes new versions, and a business must keep up with the version its buyers require.
References and further reading
- FTN subject Food Safety and Security, Unit 5: Food Safety Management Systems and Food Law, sections on ISO 22000 clauses and private standards.
- Book on disk: Food Quality Assurance: Principles and Practices.
- Scheme owner publication: Foundation FSSC, FSSC 22000 scheme documents and the Foundation FSSC page What is ISO 22000, which set out the three parts of the scheme and its GFSI recognition.
- Certification body comparison: GFSI Standards comparison table, which sets out audit stages, certificate validity, and scheme owners for FSSC 22000, BRCGS, and SQF.
