20 certification schemes

ISO 22000:2018

ISO 22000 Certification

ISO 22000 sets the requirements for a food safety management system built on HACCP principles and prerequisite programmes.

Standard
ISO 22000:2018
Indicative timeline
10-16 weeks, depending on scope and readiness
Discipline
ISO Standards
Assessment type
Independent third-party assessment

The standard

Overview

ISO 22000:2018 is the international standard for food safety management systems. It combines the common ISO clause structure with HACCP principles and prerequisite programmes, and applies to any organisation in the food chain: growers, processors, packers, storage and transport operators, caterers, retailers, and suppliers of ingredients, packaging and equipment. Hazards are controlled through prerequisite programmes, operational prerequisite programmes and critical control points, each with defined limits, monitoring and action when control is lost.

Certification shows that a food safety team, a hazard analysis, verified controls, traceability and withdrawal arrangements exist and are in use. Retail and foodservice buyers often ask for evidence of this kind before listing a supplier. It also provides documented evidence for local authority inspection, alongside the legal duty to have procedures based on HACCP principles.

UKCert reviews your hazard analysis, prerequisite programmes and validation evidence, then audits the site during production and tests traceability by exercise.

Who this is for

  • Food and drink manufacturers and processors
  • Bakeries, dairies, meat and produce packers
  • Cold storage, distribution and food transport operators
  • Contract caterers and central production kitchens
  • Ingredient, packaging and equipment suppliers to the food chain

What it gives you

Why organisations certify

What a certified ISO 22000:2018 assessment gives you once the certificate is issued.

Structured hazard control

Hazard analysis separates prerequisite programmes, operational PRPs and critical control points, so monitoring effort is concentrated where loss of control causes harm.

Customer audit readiness

Buyers ask consistent questions about traceability, allergens and corrective action. A certified system holds those answers as records rather than recollection.

Traceability tested

One step back and one step forward traceability is documented and exercised, so withdrawal and recall decisions can be made quickly and with defensible records.

Allergen and contamination control

Segregation, cleaning validation, labelling checks and foreign body controls are specified and verified, which is where a large share of product withdrawals begins.

Regulatory evidence

Food law requires HACCP-based procedures. The system documents hazard analysis, monitoring and verification in a form that inspectors and enforcement officers recognise.

Fewer duplicate audits

One assessed system covers ground that customers otherwise audit separately, which can reduce the number of second-party visits a site has to host each year.

Scope

What the assessment covers

The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.

  • Food safety team and defined scope
  • Prerequisite programmes (PRPs)
  • Process flow diagrams and hazard analysis
  • Critical control points with critical limits
  • Operational prerequisite programmes (OPRPs)
  • Validation, verification and monitoring records
  • Traceability, withdrawal and recall procedures
  • Emergency preparedness and product release control

How it runs

The assessment, stage by stage

From first enquiry to certificate. Each stage is agreed with you before it starts.

  1. Scope and quotation

    We confirm product categories, processes, sites, shift patterns and seasonality. Audit duration follows from the number of HACCP studies and the processes in scope, and the quotation follows from that.

  2. Documentation and PRP review

    An optional review of your hazard analysis, prerequisite programmes, flow diagrams and validation evidence before formal assessment, identifying gaps in monitoring, verification or traceability records.

  3. Stage 1 assessment

    We examine scope, flow diagrams, hazard analysis, the hazard control plan, prerequisite programmes and mandatory records, and confirm that internal audit and management review are complete.

  4. Stage 2 assessment

    An on-site audit during production. We follow product through the process, check CCP and OPRP monitoring records, calibration, cleaning and allergen controls, and run a traceability exercise.

  5. Certification decision

    Findings are closed with corrective action, evidence and root cause where food safety is affected. An independent reviewer then decides on certification for a three-year cycle.

  6. Surveillance and renewal

    Surveillance audits are carried out while production is running and cover changes to the hazard analysis, verification results and complaints. Recertification takes place before the certificate expires.

Questions

ISO 22000:2018 — frequently asked

Anything here that does not cover your situation, put it to an assessor rather than guessing at it.

Ask a question

Typically 10 to 16 weeks for a single site with a working HACCP-based system, and longer where the hazard analysis needs rebuilding or several product categories are in scope. Stage 2 has to be carried out while production is running, so the date depends on your production schedule as well as your readiness.

Three years from the certification decision, with surveillance audits during the cycle and recertification before expiry. Surveillance is scheduled while the relevant processes are operating. Significant changes, such as new products, new processes, a new site or a changed hazard profile, should be notified because they can affect the scope stated on the certificate.

Certification is voluntary. Having procedures based on HACCP principles is not: UK food law, in the assimilated version of Regulation (EC) 852/2004, requires food business operators to put such procedures in place and keep them up to date, and premises must be registered with the local authority. ISO 22000 is one recognised way of organising and demonstrating that.

Surveillance visits are scheduled while relevant processes are running. We examine CCP and OPRP monitoring records, verification results, calibration, complaints, withdrawals, corrective actions, changes to the hazard analysis, internal audit and management review, and normally repeat a traceability exercise. The full scope is covered across the three-year cycle.

No. ISO 22000 is the ISO management system standard. FSSC 22000 is a scheme built on ISO 22000 with sector-specific prerequisite programmes from the ISO/TS 22002 series plus additional requirements, and it is recognised by GFSI. BRCGS is a separate standard with its own grading. Some retailers specify a GFSI-recognised scheme, so check customer requirements before choosing.

Certifying against more than one standard?

Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what ISO 22000:2018 should sit alongside.