ISO 22000:2018
ISO 22000 Food Safety Management Systems
HACCP discipline and management rigor in one certifiable food-safety system.
Supplier
Approved source
Goods in
Intake control
CCP 1
Temperature limit
Processing
Validated controls
Packing
Lot coding
Lot trace
CCP 2
Metal detection
Dispatch
Chain of custody
Mock recall returns to Supplier
Safe food
Protected brand
SYS/08 · Traceability chain
Product moves from supplier to dispatch through hygiene prerequisites and CCP gates, with a tested recall loop back.
What ISO 22000 is
ISO 22000 combines interactive communication, system management, prerequisite programmes and HACCP principles into a certifiable food safety management system for any organization in the food chain, from primary production to packaging, logistics and retail. Certification to it demonstrates that the hazard controls have been examined by a third party against the process as it runs.
CORE audits ISO 22000 on the floor as well as in the file. Your auditor verifies the flow diagrams against the line, tests the hazard analysis against what the process actually does, and examines the validation evidence behind every control at a critical control point or operational prerequisite programme. Monitoring records and the corrective action taken after a deviation, prerequisite programme verification, cleaning and allergen controls, supplier approval, and traceability and withdrawal exercises are sampled at source. The findings raised most often concern flow diagrams that no longer match the plant, control limits that were never validated, and traceability exercises run on paper without a mass balance.
Who it is for
- Food and beverage manufacturers and processors whose customers require a certificate of registration to ISO 22000
- Packaging, storage and distribution operators brought into scope by a customer's food-safety requirements
- Ingredient suppliers whose customer audits or tenders specify certification by a third-party body
- Certified organizations transferring an active ISO 22000 certificate from another certification body
Business outcomes
What leadership should expect the system to change, in operational terms.
Hazards under control
A validated hazard-control plan across CCPs and operational prerequisite programmes.
Audit performance
Customer and third-party audits met with structured evidence rather than heroics.
Recall-risk reduction
Traceability and withdrawal capability tested before they are needed.
Chain communication
Hazard information flowing to and from suppliers and customers as the standard requires.
Benefits beyond the certificate
One food-safety language
HACCP, PRPs and management-system elements unified instead of parallel.
Regulatory confidence
A systematic base for compliance with food law across your markets.
Customer acceptance
Recognized internationally as evidence of serious food-safety management.
Path to GFSI schemes
A foundation that can be extended toward FSSC 22000 where customers demand a GFSI-recognized scheme.
Culture on the floor
Competence and awareness requirements reach the people handling product.
The main requirements
The themes your auditor will examine, in plain language. The full clause detail is worked through at Stage 2.
01
Context and scope (Clause 4)
Products, processes and sites inside the FSMS.
02
Leadership and policy (Clause 5)
Food safety policy, responsibilities and a named food safety team leader.
03
Planning (Clause 6)
Risks, opportunities and measurable FSMS objectives.
04
Support (Clause 7)
Resources, competence, communication and documented information, including external communication duties.
05
Operation and HACCP (Clause 8)
PRPs, traceability, emergency preparedness, hazard analysis, validation, the hazard control plan and control of nonconformity.
06
Evaluation and improvement (Clauses 9 and 10)
Verification, internal audit, management review and system updating.
What each requirement buys you
Select a requirement theme to see the business outcomes it chiefly drives. The mapping reflects where audit sampling concentrates, not a normative ISO table.
Requirement themes
Context and scope (Clause 4) chiefly drives 2 of 4 ISO 22000 outcomes.
Outcomes it drives
Hazards under control
A validated hazard-control plan across CCPs and operational prerequisite programmes.
Audit performance
Customer and third-party audits met with structured evidence rather than heroics.
Recall-risk reduction
Traceability and withdrawal capability tested before they are needed.
Chain communication
Hazard information flowing to and from suppliers and customers as the standard requires.
How CORE audits ISO 22000
Step 1
Stage 1 reviews scope, PRPs and the hazard control plan
Your auditor confirms the scope names the products, processes and sites to be certified, reads the prerequisite programmes, the flow diagrams, the hazard analysis and the hazard control plan, and checks that verification activities, internal audit and management review have taken place. Stage 1 for a food operation usually includes time on site, because a document review alone cannot confirm readiness. Findings here are raised as improvement requests.
Step 2
Stage 2 examines control on the line
The audit walks the process: flow diagrams verified against the plant, hazard analysis tested against what the line actually does, and each control at a CCP or operational PRP examined for validation evidence, monitoring records, control limits and the corrective action taken when a limit was breached. Prerequisite programmes, cleaning and allergen management, supplier approval, product release and the control of nonconforming product are sampled where the records are created.
Step 3
Surveillance samples verification and change
Year 1 and Year 2 audits sample verification results since the last visit, new products, processes, equipment or suppliers, recalls, withdrawals and customer complaints, traceability and mass-balance exercises, changes to the hazard analysis, external communication with the chain, and the closure of previous findings.
Step 4
Recertification revisits the whole cycle
In Year 3 the audit reviews the food safety system across three years: whether the hazard analysis has been updated as the operation changed, whether validation still supports the control measures in use, whether verification has been carried out as planned rather than retrospectively, whether the food safety team has stayed competent and resourced, and whether the scope still matches what is produced.
What your auditor expects to see
Before Stage 2 can proceed, the system needs to have run long enough to have produced its own evidence.
01Verification programme executed
Scheduled verification activities carried out and their results evaluated, including product and environmental testing where the hazard analysis calls for it, with records available to your auditor.
02Internal audit completed
A full internal audit of the FSMS against ISO 22000:2018, including floor observation as well as record sampling, run by auditors independent of the areas they audit.
03Management review held
A minuted management review covering the Clause 9.3 inputs, including verification results, audits, emergencies and complaints, with system-updating decisions and owners recorded.
04Validation, traceability and scope in place
Validation evidence for each control measure, a traceability and withdrawal exercise completed with a mass balance, corrective actions from your own findings closed, and a written scope naming the products, processes and sites to be certified.
Certification decision
With that evidence in place, Stage 1 and Stage 2 can run. The decision that follows is taken by a reviewer who was not on your audit team.
CORE is the certification body. We assess and certify management systems. We do not build them — that separation is what makes the certificate worth holding. We do not design, document or implement the systems we audit, and we do not run your internal audits. If you need that work done, our directory of independent consultants is a starting point, and engaging one has no bearing on the decision. More on how we keep the audit and the decision separate.
The optional pre-assessment
Before Stage 1 you can ask for an optional pre-assessment: an audit-style review of prerequisite programmes, flow diagrams, hazard analysis, validation, monitoring and traceability against ISO 22000:2018, conducted with a site walk rather than a document review alone. It samples the way a certification audit does and returns a written report of findings.
The report states where the evidence would not yet satisfy an auditor, including how the operation would read to a customer audit in the meantime. It does not write your hazard analysis, set your control limits, design your prerequisite programmes or produce your validation: that work would make CORE the author of a system it must later audit, which ISO/IEC 17021-1 prohibits. Organizations that want help acting on the report can use the directory of independent consultants at /resources/find-a-consultant.
What you receive
- Findings against each clause of the standard
- Where the evidence is missing or incomplete
- Whether Stage 2 could proceed on today's records
- The same sampling method a certification audit uses
Training for ISO 22000
Courses that teach how the standard is written and how it is audited.
ISO 22000 questions, answered straight
Related standards
Ready to certify to ISO 22000?
Tell us your standards, scope, effective headcount and sites. You will get a scope statement and a fixed quotation, with audit duration calculated from the accreditation body's mandatory formula.