ISO 22000 – the cornerstone of food safety management worldwide

Among all food safety management systems, ISO 22000 holds a special place – as the only standard with a truly global scope, developed by the International Organisation for Standardisation, it covers the entire food chain from raw material producers to distributors. It is not required by any specific retail chain or country – instead, it lays the foundation upon which more detailed standards, such as FSSC 22000, BRC or IFS, are based.

Background and scope of the standard

ISO 22000 was first published in 2005 as the standardisation community’s response to the growing demand for a uniform, globally recognised standard for food safety management. Previously, the market had been dominated by national and industry-specific standards – the Danish DS 3027, Dutch guidelines for the assessment of HACCP systems, and various retail chain standards. ISO 22000 brought these approaches together for the first time into a single, coherent, certifiable system.

The current version – ISO 22000:2018 – replaced the 2005 edition and is the only one in force today. It was developed in accordance with the so-called High Level Structure (HLS) – a standardised chapter structure common to all modern ISO standards, such as ISO 9001 (quality) and ISO 14001 (environment). As a result, ISO 22000 is easy to integrate with other management system standards, and organisations holding ISO 9001 certification can extend their system without having to build it from scratch.

The standard is aimed at all organisations within the food chain – regardless of their size, type of business or stage in the chain. It covers food and feed manufacturers, processors, logistics operators, packaging manufacturers, suppliers of additives and ingredients, catering companies, catering outlets, as well as service providers to the food industry (e.g. disinfection and pest control companies). This scope is significantly broader than that of BRCGS Food Safety or IFS Food, which focus on food manufacturers and their direct suppliers.

Structure of the standard and its relationship to HACCP i relacja do HACCP

ISO 22000:2018 is based on four key elements that complement one another:

1. Interactive communication throughout the food chain – the standard requires the organisation to maintain an active exchange of information with suppliers, customers and regulatory authorities on all matters relating to food safety. Communication must be documented and two-way.
2. System management – ISO 22000 applies a process-based approach based on the PDCA (Plan-Do-Check-Act) cycle at two levels: the entire management system and individual operational processes. The organisation must define processes, their interrelationships and manage them in a way that ensures food safety objectives are achieved.
3. Prerequisite programmes (PRPs) – basic hygiene and operational conditions necessary to ensure a safe food production or processing environment. ISO 22000 distinguishes between general PRPs (e.g. pest control, staff hygiene, waste management) and operational PRPs (OPRPs) – process-specific hazard control measures that are not critical control points but significantly reduce risk.
4. HACCP system – the standard fully integrates HACCP principles in accordance with the Codex Alimentarius. The 2018 version establishes a closer link with the Codex stages, precisely defines the differences between CCPs (critical control points), OPRP and standard PRPs, and applies a dual PDCA cycle – separately for the management system and for the operational hazard analysis. This is a significant change from the 2005 version, which was criticised for a lack of clarity on this issue.

A key feature distinguishing ISO 22000 from HACCP itself is its two-tiered approach to risk: hazard analysis at the operational level (carried out by HACCP and OPRP) is complemented by risk management at the organisational – strategic – level, covering the organisation’s context, the needs of interested parties, and the opportunities and threats to the entire management system.

ISO 22000 and FSSC 22000 – the foundation and the extension

ISO 22000 does not in itself have GFSI (Global Food Safety Initiative) benchmark status, which means that ISO 22000 certification is not automatically accepted by retail chains requiring GFSI standards, such as BRCGS Food Safety or IFS Food. This is the most common source of misunderstanding among companies considering certification.

The solution to this gap is FSSC 22000 (Food Safety System Certification 22000) – a standard built on the foundation of ISO 22000, supplemented by additional sector-specific requirements (ISO/TS 22002) and the scheme owner’s requirements. FSSC 22000 is a fully GFSI-benchmarked standard and is recognised by retail chains on a par with BRCGS and IFS Food.

This means that ISO 22000 is a natural starting point for organisations planning FSSC 22000 certification – a company that has implemented and been certified to ISO 22000 already has a solid foundation for the system and needs to supplement it with sector-specific requirements to obtain a certificate recognised by retail chains. Conversely, for organisations that are not suppliers to retail chains but wish to systematise their food safety management and document it for business partners or regulatory bodies – ISO 22000 is a fully adequate and globally recognised tool.