What is ISO 22000?
ISO 22000 is the international, certifiable standard for a food safety management system (FSMS) that lets any organisation in the food chain, from animal feed producer to caterer, systematically control food safety hazards by combining the HACCP principles with prerequisite programmes, interactive communication and a management system based on the PDCA cycle. The standard is developed by ISO committee ISO/TC 34/SC 17 and first appeared in 2005; the current second edition dates from June 2018. ISO 22000 does not tell you which temperature or critical limit to use, but it does tell you how to justify, monitor, record and improve those choices.
ISO 22000 turns HACCP into a complete management system, with policy, responsibilities, internal audits and continual improvement.
For IT/OT professionals, ISO 22000 matters because much of the control sits on the factory floor: a PLC supervising a pasteuriser, a metal detector rejecting product, a historian recording temperatures and an MES tracing batches.
🎯 What is the purpose of ISO 22000?
- Prevent hazards - control biological, chemical (including allergens) and physical hazards before they reach the product
- Work risk-based - analyse hazards as in HACCP, and also business risks and opportunities at organisational level
- One language across the chain - international harmonisation, so a supplier in Brazil and a producer in the Netherlands use the same framework
- Build trust - with customers, retailers and regulators such as the Dutch NVWA
- Traceability and recall - quickly identify which lots are affected and withdraw them from the market
🕰️ How did ISO 22000 develop and which version applies?
| Year | Event |
|---|---|
| 2005 | First edition ISO 22000:2005, based on the HACCP principles of the Codex Alimentarius |
| 2009 | ISO/TS 22002-1 describes the prerequisite programmes for food manufacturing |
| 2018 | Second edition ISO 22000:2018 with the High Level Structure (HLS) and a two-level risk approach |
| 2021 | End of the transition period, extended because of COVID-19 to the end of December 2021 |
| 2024 | Amendment ISO 22000:2018/Amd 1:2024 adds climate change to context and interested parties |
| 2025 | New ISO 22002 series: ISO 22002-100 with common requirements plus sector parts such as ISO 22002-1:2025 for food manufacturing; replaces most ISO/TS 22002 parts |
| 2026 | FSSC 22000 version 7 is published in May, aligned with the new ISO 22002 series |
The 2018 edition made the standard easier to combine with ISO 9001, ISO 14001 and ISO 45001, because all of them follow the same clause structure. It also strengthened the link with the Codex Alimentarius.
🧠 How is ISO 22000:2018 structured?
ISO 22000 follows the common structure of ISO management system standards (clauses 4 to 10). Its defining feature is two interlocking PDCA cycles: one at organisational level (policy, objectives, resources, management review) and an operational cycle inside clause 8 (hazard analysis, control measures, verification).
| Clause | Content | Practical example |
|---|---|---|
| 4 Context | Internal and external issues, interested parties, scope | Which product lines and sites are covered |
| 5 Leadership | Policy, roles, food safety team leader | Top management approves the food safety policy |
| 6 Planning | Risks and opportunities, objectives, changes | Objective: fewer rejects caused by foreign bodies |
| 7 Support | Resources, competence, communication, documented information | Operator training, document control |
| 8 Operation | PRPs, traceability, emergencies, hazard analysis, HACCP/OPRP plan, verification, recall | Pasteuriser, metal detection, recall procedure |
| 9 Performance evaluation | Monitoring, analysis, internal audits, management review | Annual audit programme |
| 10 Improvement | Nonconformities, corrective action, updating | Root cause analysis after a complaint |
🔧 What is the difference between a PRP, an OPRP and a CCP?
ISO 22000 distinguishes three layers of control measures. This distinction is the heart of the standard and differs from a classic HACCP plan, which only knows CCPs.
| Term | Meaning | Monitoring | Example |
|---|---|---|---|
| PRP (prerequisite programme) | Basic conditions for a hygienic environment, not tied to one specific hazard | Inspections, schedules | Cleaning with CIP, pest control, maintenance, personal hygiene |
| OPRP (operational PRP) | Control measure for a significant hazard with an action criterion | Measurement or observation | Sieve checks, allergen segregation, pH measurement |
| CCP (critical control point) | Control measure for a significant hazard with a measurable critical limit | Continuous or frequent measurement | Milk pasteurisation at ≥ 72 °C for 15 s, metal detection |
If a CCP exceeds its critical limit, the product is by definition potentially unsafe and is blocked. With an OPRP, the team assesses whether the product can still be released. Together, CCPs and OPRPs form the hazard control plan.
🏭 Where does ISO 22000 touch the IT/OT environment?
In a modern food plant, many control measures are automated. That makes OT part of the food safety system:
- Monitoring CCPs - a PLC or SCADA system measures the pasteurisation temperature with a PT100 and switches a divert valve as soon as the temperature falls below the critical limit
- Records - the historian and LIMS provide the evidence for verification; data integrity decides whether an auditor can trust those records
- Measuring equipment - ISO 22000 requires control of monitoring and measuring equipment, so periodic calibration of temperature, pressure and pH sensors
- Inspection - machine vision and X-ray or metal detection act as an OPRP or CCP on the line
- Traceability - tracking and tracing via batch numbers, GS1 codes, the MES and the ERP system
- Change control - a modified recipe or PLC program is a change that must be assessed for food safety beforehand (change management)
Cybersecurity therefore becomes food safety too. A manipulated critical limit in a pasteuriser or a failed historian directly undermines the HACCP plan. Medium-sized and large food producers and processors also fall under NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet). Standards such as IEC 62443 and ISO 27001 therefore complement ISO 22000; ISO 22000 itself contains no cybersecurity requirements.
🧭 How do you implement ISO 22000 step by step?
- Define scope and context - which products, sites and processes, and which legal requirements apply (in the EU, Regulation (EC) 178/2002, whose Article 18 requires traceability one step back and one step forward in the chain, and Regulation (EC) 852/2004)
- Form a multidisciplinary food safety team - including maintenance and, where control systems monitor CCPs, OT expertise
- Document the PRPs - based on the ISO 22002 part for your sector
- Carry out the hazard analysis - describe products, draw process flow diagrams and verify them on the floor
- Select control measures - categorise them as OPRP or CCP and set action criteria and critical limits
- Set up monitoring and records - connect sensors, alarms and the historian to the plan and safeguard data integrity
- Test traceability and recall - run a mock recall and measure how quickly you can identify every affected lot
- Audit and improve - internal audits, management review and then a certification audit by an accredited body
In the Netherlands, the NVWA expects a working HACCP system, but certification to ISO 22000 is voluntary. Since Regulation (EU) 2021/382, EU law also requires a demonstrable food safety culture and allergen management as prerequisites, which fits well with the leadership requirements of clause 5. In practice, retailers often ask for a GFSI-recognised scheme such as FSSC 22000 or BRCGS, which makes certification a commercial necessity rather than a legal compliance obligation.
🔄 How does ISO 22000 relate to other standards?
| Standard or scheme | Focus | Relationship to ISO 22000 |
|---|---|---|
| HACCP | Seven principles for hazard control | Fully incorporated in clause 8 |
| FSSC 22000 | Certification scheme, GFSI-recognised | ISO 22000 + ISO 22002 PRPs + additional FSSC requirements such as food defence and food fraud |
| BRCGS Food Safety | Retailer standard, GFSI-recognised | Independent scheme with its own requirements, not an ISO management system |
| ISO 9001 | Quality management | Same structure; often combined in one QMS |
| GMP | Good manufacturing practice | Reflected in the PRPs |
| ISO 22301 | Business continuity | Supports the requirement for emergency preparedness (8.4) |
ISO 22000 on its own is not GFSI-recognised, which is why FSSC 22000 exists. An organisation certified to ISO 22000 can move on to FSSC 22000 relatively easily by adding the extra requirements.
❓ Frequently asked questions
Is ISO 22000 certification mandatory?
ISO 22000 certification is not a legal requirement. In the EU, a system based on HACCP is mandatory for food businesses beyond primary production under Regulation (EC) 852/2004, and ISO 22000 is one way to meet that obligation in a structured and demonstrable way. Customers and retailers often make certification a contractual requirement.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the international management system standard for food safety. FSSC 22000 is a certification scheme that combines ISO 22000 with the sector-specific PRP standards of the ISO 22002 series and additional requirements. FSSC 22000 is recognised by the Global Food Safety Initiative, whereas ISO 22000 alone is not.
Which version of ISO 22000 is current?
The current version is ISO 22000:2018, supplemented by the climate amendment ISO 22000:2018/Amd 1:2024. Certificates to the 2005 edition have no longer been valid since the end of 2021. The related PRP standards were renewed in 2025 as ISO 22002-100 with sector parts.
What is an OPRP in ISO 22000?
An OPRP (operational prerequisite programme) is a control measure in ISO 22000 for a significant food safety hazard that is monitored against an action criterion instead of a critical limit. Examples are allergen segregation or sieve checks. A CCP, by contrast, has a measurable critical limit.
Which organisations is ISO 22000 intended for?
ISO 22000 is intended for any organisation in the food chain, regardless of size: farmers, feed producers, food manufacturers, packaging producers, transport and storage, retail and catering. Suppliers of cleaning agents or equipment can also use the standard. It scales with the complexity of the organisation.
Does ISO 22000 contain requirements for IT and OT systems?
ISO 22000 contains no specific cybersecurity requirements, but it does require reliable monitoring, calibrated measuring equipment, controlled documented information and assessed changes. As soon as a PLC or SCADA system monitors a CCP, those systems therefore become part of the food safety system in practice. For security itself, you complement ISO 22000 with IEC 62443 or ISO 27001.
📌 In summary
ISO 22000 is the international management system standard that safeguards food safety across the entire chain by combining HACCP with prerequisite programmes, OPRPs, traceability and continual improvement. The 2018 edition with its 2024 amendment is current, FSSC 22000 builds on it for GFSI recognition, and because CCPs are increasingly monitored by PLCs, sensors and historians, reliable and secure OT is a precondition for a working food safety system.