ISO 22000: An Introduction to Food Safety Management

ISO 22000 sets out the requirements for a food safety management system (FSMS) for any organisation in the food chain — from farms and ingredient suppliers to processors, caterers, restaurants, storage and transport providers, and makers of food packaging and equipment.

Its aim is simple: to make sure food is safe at the point of consumption by controlling food safety hazards throughout the chain.

Current status

• The current edition is ISO 22000:2018, with Amendment 1:2024 adding climate change considerations to the context clauses.
• A revision is in progress (ISO/DIS 22000, edition 3). The draft ballot closed in July 2026; ISO has not announced a publication date. Certification continues against the 2018 edition until a new edition is published and transition rules are set.

What makes up an ISO 22000 system

ISO 22000 combines three building blocks:

1. Management system requirements in the familiar Harmonized Structure (clauses 4–10): context, leadership, planning, support, operation, performance evaluation and improvement — which makes it easy to integrate with ISO 9001.
2. Prerequisite programmes (PRPs) — the basic conditions and activities needed to maintain a hygienic environment: building and layout, cleaning and sanitation, pest control, personal hygiene, water and air quality, waste management, supplier control, storage and transport. Sector-specific technical specifications (the ISO/TS 22002 series) give more detail.
3. Hazard analysis based on HACCP principles from the Codex Alimentarius — identifying biological, chemical (including allergens) and physical hazards, and controlling them through critical control points (CCPs) or operational prerequisite programmes (OPRPs), each with defined limits or action criteria, monitoring and corrective actions.

The standard uses two Plan–Do–Check–Act cycles: one for the management system as a whole and one inside the operational processes for hazard control.

ISO 22000, HACCP, FSSC 22000 and FSSAI — how they relate

If you are not sure which route fits, look at what your customers require. We discuss this in How to Choose the Right ISO Standard.

Implementation steps

1. Form a food safety team with the right mix of knowledge (production, quality, maintenance, procurement).
2. Define the scope, products and processes, and describe raw materials and end products.
3. Put PRPs in place and verify that they work.
4. Draw and verify flow diagrams on the shop floor.
5. Carry out the hazard analysis, decide control measures and categorise them as CCPs or OPRPs.
6. Establish the hazard control plan — limits, monitoring, corrections and responsibilities.
7. Set up traceability, a recall/withdrawal procedure and emergency preparedness — and test them.
8. Validate control measures, verify the system, and keep records.
9. Conduct internal audits and a management review, then the certification audit.

Benefits

• Fewer food safety incidents, complaints and rejections
• Better control of suppliers and traceability
• Stronger standing with retailers, export buyers and institutional customers
• A management framework that supports, but does not replace, regulatory compliance

Key takeaways

• ISO 22000:2018 (with Amd 1:2024) is current; a revision is in draft with no published date yet.
• An effective FSMS rests on solid prerequisite programmes and a well-founded hazard analysis.
• ISO 22000 certification complements — but never replaces — FSSAI licensing and legal obligations.