ISO 22000 is the international standard for a food safety management system (FSMS). It applies to any organisation in the food chain, and it builds HACCP into a wider management system with objectives, controls, internal audit and management review. An ISO 22000 audit tests whether that whole system is designed well and works in practice.
Last reviewed: 17 October 2026. Facts checked. We searched for the structure of ISO 22000:2018 and read search summaries of BSI, SGS and consultant material. The ISO.org page returned an access error, so we did not read the standard or ISO's description directly. We did not open FSSAI pages for this post. Certification-body rules and audit durations vary, and we did not verify any of them.
What ISO 22000 is
ISO 22000:2018 follows the same high-level structure as ISO 9001 and ISO 14001. Its auditable requirements sit in clauses 4 to 10. Search summaries describe it as using the plan-do-check-act cycle at two levels: one for the management system, and one for controlling hazards in operations.
Three terms matter for auditors:
- Prerequisite programmes (PRPs): the basic hygiene conditions, such as cleaning, pest control and maintenance.
- Operational prerequisite programmes (OPRPs): controls for significant hazards that are not managed at a critical control point.
- HACCP: hazard analysis and critical control points, which sits within the operation clause.
If you are new to HACCP itself, start with our HACCP audit checklist. This guide covers the layer above it.
How an ISO 22000 audit differs from a HACCP audit
| HACCP audit | ISO 22000 audit | |
|---|---|---|
| Focus | The food safety plan and its controls | The whole management system, including HACCP |
| Questions | Are hazards controlled at the right steps? | Is the system led, resourced, monitored and improved? |
| Extras | Flow diagram, CCPs, critical limits | Context, leadership, risk, objectives, internal audit, management review |
| Outcome | Findings on the plan | Findings on the system, which may lead to a certificate |
The certification route
ISO certification by an accredited body normally runs through a stage 1 review of documents and readiness, a stage 2 audit of implementation, then surveillance and recertification audits. Our article on stage 1, stage 2, surveillance and recertification explains each stage. Before you book, run a gap assessment.
What auditors test, clause by clause
| Clauses | Theme | Evidence to prepare |
|---|---|---|
| 4 | Context and scope | Interested parties, products, scope statement |
| 5 | Leadership | Food safety policy, roles, management commitment |
| 6 | Planning | Risks and opportunities, objectives and plans to meet them |
| 7 | Support | Competence, training, awareness, communication, documented information |
| 8 | Operation | PRPs, traceability, emergency readiness, hazard analysis, hazard control plan, control of monitoring, recall or withdrawal |
| 9 | Performance evaluation | Monitoring, internal audit, management review |
| 10 | Improvement | Nonconformity, corrective action, continual improvement |
Clause 8 usually takes most of the time. Expect the auditor to follow a product from receipt to dispatch.
A practical audit sequence
- Read the documents. Scope, policy, hazard analysis, control plan, internal audit reports.
- Interview top management. Test whether the policy and objectives are real.
- Walk the process. Compare the flow diagram with what happens.
- Trace a batch. Raw material to finished goods, then test traceability and recall readiness.
- Sample records. Monitoring, calibration, training, supplier approval.
- Test the loop. Pick a past nonconformity and check the cause, action and effectiveness check.
- Close with a clear report. State each finding as requirement, evidence and gap.
The audit checklist generator can turn this into a working checklist, and our guide to running an ISO internal audit covers the interview and sampling method.
Common findings
- Hazard analysis not reviewed after a process or supplier change.
- OPRPs defined but without measurable criteria.
- Internal audit not covering all clauses or all shifts.
- Management review that records attendance but no decisions.
- Training records that show attendance but not competence.
- Recall or withdrawal procedure never tested.
For rating findings, see major and minor nonconformities.
Frequently Asked Questions
What is ISO 22000?
It is the international standard for a food safety management system, covering organisations anywhere in the food chain.
What is the difference between ISO 22000 and HACCP?
HACCP is a method for controlling hazards. ISO 22000 includes HACCP inside a wider management system with leadership, planning, internal audit and improvement.
Do we need ISO 22000 to get an FSSAI licence?
We did not verify FSSAI's requirements in this article. Licensing rules are separate from ISO certification, so check FSSAI's current regulations for your category.
What are PRPs and OPRPs?
PRPs are basic hygiene conditions. OPRPs are controls for significant hazards that are not managed at a critical control point.
How long does an ISO 22000 certificate last?
We did not verify this. Certification bodies set cycles under accreditation rules, so ask your certification body.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error