ISO 22000 Certification: Requirements and Steps to Get Certified

1. What Is ISO 22000 Certification for Food Safety Management?

ISO 22000 certification is awarded by an accredited certification body to an establishment that implements a food safety management system in line with the international standard ISO 22000, published by the International Organization for Standardization. The edition currently in force is ISO 22000:2018. The certificate proves that the establishment doesn't just control food hazards, but manages them through an integrated management system with a policy, objectives, reviews and continual improvement.

The standard combines three core elements:

• HACCP principles: for hazard analysis and identifying control points.
• Prerequisite programs: such as cleaning, pest control and maintenance.
• A management system: using the same structure as other ISO standards such as ISO 9001, which makes them easier to integrate.

That's why ISO 22000 is seen as a step above applying HACCP alone: it adds top management responsibility, communication with external parties, organization-level risk management and performance measurement.

The standard is designed to suit any organization in the food chain, whatever its size or activity: from farms and food factories to central kitchens, catering companies, storage and transport, and suppliers of food-contact packaging materials.

2. What Are the Key Requirements of ISO 22000:2018?

The standard follows the common structure for management system standards, so its requirements are divided into main clauses. Here is a practical reading of what each means for a food business in the Kingdom:

• Context of the organization: identifying the internal and external issues that matter, the interested parties such as customers and regulators, and the precise scope of the system.
• Leadership: documented commitment from top management, a food safety policy, and appointing a food safety team leader.
• Planning: addressing risks and opportunities at the organization level, and setting measurable objectives.
• Support: resources, competence, awareness, internal and external communication, and control of documented information.
• Operation: prerequisite programs, traceability, emergency preparedness, hazard analysis, and the hazard control plan with critical control points and operational prerequisite programs.
• Performance evaluation: monitoring and measurement, internal audit and management review.
• Improvement: handling nonconformities, continual improvement and updating the system.

One of the standard's most distinctive features is the concept of two Plan-Do-Check-Act cycles: one at the level of managing the organization, and one at the operational level for HACCP principles, working together in an integrated way.

3. Which Food Businesses Need ISO 22000 Certification?

Getting ISO 22000 certification is usually a commercial decision, but that doesn't make it a luxury. For some establishments, it becomes a practical condition for entering certain markets:

• Central kitchens and catering companies: serving hospitals, schools, worksites or airlines, where many contracts require a recognized food safety management system certification.
• Small and medium food factories: that want to supply major retail chains.
• Ingredient and service suppliers: such as cold storage warehouses, refrigerated transport companies and manufacturers of food-contact packaging materials.
• Expanding restaurant chains: that want one unified system across dozens of branches instead of each branch doing its own thing.

On the other hand, a single café or small restaurant may not need the certificate; meeting municipal requirements and building a good HACCP system may be enough. To find out which suits your business, see our comparison of HACCP vs ISO 22000.

If your clients are global companies or exporters, they may ask for a certification recognized by the Global Food Safety Initiative (GFSI), and this is where FSSC 22000 certification, which is built on ISO 22000, comes in.

4. What Are the Steps to Get ISO 22000 Certification?

The path to certification is a project with clear stages, and establishments that treat it as a project with a timeline and an owner succeed faster than those that treat it as a side task:

• Top management decision: setting the budget and scope and appointing a food safety team leader.
• Gap assessment: comparing the current situation with the standard, clause by clause.
• Training: for the food safety team on the standard, and for workers on what concerns them.
• Building and implementing the documentation: the policy, objectives, procedures, records and hazard control plan.
• Running it long enough: to produce genuine records proving the system works.
• A full internal audit: covering all clauses and departments.
• Management review: a documented meeting in which management reviews the system's performance and the audit results.
• The certification audit: Stage 1 to review documentation and readiness, and Stage 2 for on-site verification.
• Closing nonconformities and issuing the certificate.

The total duration varies with the size of the establishment, the complexity of its operations and its starting point. Many establishments use a consultant during the build phase, but make sure the system is built by your own team rather than handed to you ready-made, because the auditor will question your employees, not the consultant.

5. What Are the Core Documents in an ISO 22000 System?

The standard uses the term "documented information" to cover both the documents the establishment maintains, such as procedures, and the records that prove implementation. Key items you're expected to have include:

• Scope of the food safety management system: the products, processes and sites covered.
• Food safety policy and objectives: approved by management and communicated to workers.
• Prerequisite programs: written and implemented, with their records.
• Product descriptions, intended use and process flow diagrams.
• Hazard analysis and the hazard control plan: including critical limits and action criteria.
• A traceability system: the ability to trace a product from the supplier to the customer.
• Emergency and product recall procedures: with evidence they've been tested.
• Competence and training records.
• Monitoring, verification and calibration records.
• Internal audit reports, management review minutes and corrective actions.

A common mistake is building huge binders of procedures copied from ready-made templates that look nothing like the establishment's reality. A professional auditor notices this quickly when they ask an employee about a written procedure and the employee doesn't know it. A good document is short, reflects what actually happens, and is known by the people who carry it out.

6. How Long Is ISO 22000 Certification Valid, and What Are Surveillance Audits?

Accredited management system certifications usually run on a three-year certification cycle, with periodic surveillance audits by the certification body in between, followed by a recertification audit before the cycle ends. Confirm the program details and dates with the certification body itself, as they're set in your contract with it.

What does that mean in practice?

• Surveillance audits: shorter than the initial certification audit, focusing on a sample of clauses, on closing previous findings, and on any changes in the establishment.
• Recertification audit: a comprehensive review of the system before the cycle ends, to issue a new certificate.
• Significant changes: such as adding a site or a new production line, may require notifying the certification body and amending the certificate's scope.

Put the audit dates and the certificate's expiry date in your establishment's certificate register, and start preparing for each surveillance audit well ahead of time, as if it were the first audit. Establishments that treat a surveillance audit as an easy routine visit are the most exposed to surprise nonconformities, especially after food safety team members change or new products are introduced without updating the hazard analysis.

To understand the audit stages and types of nonconformity in detail, read our guide to the food safety certification audit.

7. What Mistakes Delay ISO 22000 Certification?

From supporting food businesses on their certification journey, we see specific mistakes recur that delay certification or lead to major findings in the audit:

• Absent top management: when the project is left to the quality officer alone, resources aren't provided and decisions aren't made.
• An inaccurate scope: one too broad that overwhelms the team, or too narrow and excludes processes the customer requires.
• Copied documents: that don't reflect the reality of the kitchen or production line.
• Patchy records: missing days in monitoring records, or records written retrospectively.
• A box-ticking internal audit: carried out with a superficial checklist that finds nothing, so the certification body discovers what should have been found internally.
• Neglecting traceability and recall: not actually testing the ability to trace a product batch before the audit.
• Rushing to book the audit: before the system has run long enough to produce evidence.

The common cure for these mistakes is to treat the system as a daily way of working, not a file prepared for the audit. When checks are recorded daily and corrective actions are followed through to closure, the audit simply becomes a showcase of what you already do.

Conclusion

ISO 22000 certification takes your establishment from controlling hazards to managing them through an integrated system led by top management, which measures its performance and keeps improving. Start with a clear management decision and a precise scope, then assess the gaps, train the team, build documents that reflect reality, run the system until it produces genuine records, and carry out an internal audit and management review before welcoming the certification body. After certification, prepare for every surveillance audit with the same seriousness. LAEQ365 helps you keep daily checklists consistent and follow corrective actions through to closure, while storing the certificate and its audit dates in one place.

Frequently asked questions

What is ISO 22000 certification?

ISO 22000 certification is awarded by an accredited certification body to an establishment that implements a food safety management system in line with the international standard ISO 22000:2018. The standard combines HACCP principles, prerequisite programs and an integrated management system covering leadership commitment, objectives, internal audit, management review and continual improvement.

What is the difference between ISO 22000 and ISO 9001?

ISO 9001 is a general quality management standard focused on customer satisfaction and process quality in any sector, while ISO 22000 is dedicated to food safety and includes hazard analysis, prerequisite programs and critical control points. Both share the same management structure, which makes them easy to integrate into a single system.

Does a restaurant need ISO 22000 certification?

Not as a general condition for operating a restaurant; what's legally required is compliance with municipal requirements and those of the competent authorities. But it's useful for central kitchens, restaurant chains and catering companies that contract with clients requiring a recognized food safety management system, or that want to standardize practices across their branches.

How long is ISO 22000 certification valid?

Accredited management system certifications usually run on a three-year cycle, with periodic surveillance audits during it and a recertification audit before the cycle ends. The exact dates are set in the establishment's contract with the certification body, so confirm them and record them in your establishment's certificate register.

Can you get ISO 22000 certification without a consultant?

Yes, if the establishment has a team that understands the standard well and has enough time to build and implement the system. Many establishments still use a consultant to speed up the gap assessment and training. Either way, the system must be built with the internal team's involvement, because the auditor assesses what workers actually do.