ISO 22000:2018 Explained: The International Standard for Food Safety Management

Every food safety scheme has its niche — retail-driven, sector-specific, region-favoured. But one standard was written to serve the entire food chain, everywhere: ISO 22000. This guide takes you through ISO 22000:2018 — what it requires, who can use it, how it relates to GFSI schemes like FSSC 22000, what a compliant management system contains, and the certification journey from stage 1 audit to a three-year cycle. It is written for quality professionals, food safety team leaders, and managers evaluating whether ISO 22000 is the right framework for their organisation.

What is ISO 22000:2018?

ISO 22000:2018 is the international standard specifying requirements for a food safety management system (FSMS). Published by the International Organization for Standardization, it enables any organisation involved in the food chain — directly or indirectly — to demonstrate its ability to control food safety hazards and consistently provide safe products and services.

The standard's intellectual foundation rests on four key elements working together:

1. Interactive communication along the food chain, so hazard information flows up and down between suppliers, customers, and regulators.
2. Systematic management-system principles, giving food safety the same structural rigour as ISO 9001 gives quality.
3. Prerequisite programmes (PRPs) — the hygiene foundations of safe production.
4. HACCP principles based on Codex Alimentarius, targeting the significant hazards.

ISO 22000:2018 follows the ISO High-Level Structure common to modern management-system standards, and operates the Plan-Do-Check-Act cycle at two levels: the overall management system and the operational HACCP processes. One important clarification: ISO 22000 is certifiable, but it is not directly recognised by GFSI. The FSSC 22000 scheme incorporates ISO 22000 — together with technical PRP specifications and additional requirements — to achieve GFSI recognition. Many organisations begin with ISO 22000 and step up to FSSC 22000 when customers require it.

Who is ISO 22000 for?

The standard's scope is deliberately, almost uniquely, broad. It applies to organisations of any size or complexity, anywhere in the chain:

• Primary producers — farms, fisheries, and growers.
• Food and feed manufacturers and processors.
• Caterers, restaurants, and food service operations.
• Retailers, and transport and storage operators.
• Indirect participants — producers of equipment, packaging materials, cleaning agents, ingredients, and additives, and providers of related services.

This breadth is a genuine differentiator: businesses that fall outside the scope rules of retail-driven schemes — service providers, equipment makers, small operators — can still certify to ISO 22000 and demonstrate credible, internationally recognised food safety management.

Key benefits of certification

• A globally recognised, risk-based framework for managing food safety, respected across markets and regulatory regimes.
• Ready integration with other ISO management systems — ISO 9001, ISO 14001, ISO 45001 — thanks to the shared High-Level Structure.
• Improved hazard control and regulatory compliance, with a documented evidence trail.
• Enhanced customer and stakeholder confidence, backed by accredited third-party certification.
• A foundation for continual improvement — and a clear upgrade path to FSSC 22000 if GFSI recognition later becomes necessary.

What's inside the management system?

An ISO 22000:2018 FSMS follows the standard's clause architecture, blending organisational and operational elements:

• Context of the organisation — understanding internal and external issues, interested parties, and defining the FSMS scope.
• Leadership — food safety policy, roles and responsibilities, and demonstrated top-management commitment.
• Planning — addressing organisational risks and opportunities, setting measurable food safety objectives, and managing change.
• Support — resources, competence, awareness, communication (internal and along the food chain), and documented information.
• Operation — the technical heart: prerequisite programmes, traceability, emergency preparedness, and the hazard control plan built through hazard analysis, distinguishing critical control points (CCPs) from operational prerequisite programmes (OPRPs), each with validated control measures, monitoring, and corrections.
• Performance evaluation — monitoring and measurement, analysis, internal audit, and management review.
• Improvement — nonconformity handling, corrective action, and continual improvement of the system's suitability and effectiveness.

The two-level PDCA design deserves emphasis: one cycle continually improves the management system itself; the other continually verifies and updates the operational hazard controls. Auditors expect to see both loops turning.

How the standard is structured

ISO 22000:2018 is organised into the High-Level Structure clauses — context, leadership, planning, support, operation, performance evaluation, and improvement — with the operational clause containing the food-safety-specific machinery (PRPs, hazard analysis, the hazard control plan, verification, and control of nonconformity). This shared architecture is what makes integration with ISO 9001 and other standards so practical: policies, document control, internal audit, and management review can genuinely be run once for multiple systems.

The road to certification

1. Gap analysis against the standard's clauses and your existing hygiene and HACCP practices.
2. System design and documentation — scope, policy, objectives, PRPs, hazard study, and supporting procedures.
3. Implementation — training, operational rollout, and record generation across at least one full monitoring-and-review cycle.
4. Stage 1 audit — the certification body assesses documentation and readiness, identifying any areas of concern.
5. Stage 2 audit — the full implementation audit; non-conformities must be addressed before certification is granted.
6. Surveillance and recertification — annual surveillance audits within a three-year certification cycle, keeping the system verified and current.

How AGS can help

The clause-by-clause completeness ISO 22000 demands is exactly where most self-built systems stumble — a strong HACCP plan wrapped in thin management-system documentation, or vice versa. The AGS ISO 22000:2018 Food Safety Management System Toolkit, a Standard-tier package of 71 files, solves both halves at once: fully editable manuals, procedures, forms, and compliance matrices mapped to the standard's structure, from context and leadership through PRPs, the hazard control plan, performance evaluation, and improvement. Each document is built for straightforward tailoring to your organisation's place in the food chain, so your team reaches stage 1 with a coherent, complete, audit-ready system — and reaches stage 2 with the records to prove it works. Wherever you sit in the food chain, the AGS toolkit turns ISO 22000 from a reading project into an implementation plan.

View the toolkit →