ISO 22000 Explained: The Clauses, the Prerequisite Programmes and What Certification Really Involves

Home / Guides / ISO 22000 explained

Food safety management systems · ISO 22000

By Mthokozisi Nkosi, food scientist, registered Lead Auditor with Exemplar Global and IRCA, and one of four SAATCA registered R638:2018 Lead Implementers. Founder of ASC Food Safety Consultants. Last updated 9 September 2026.

What is ISO 22000?

ISO 22000:2018 will not get you onto a retailer’s approved supplier list on its own, because it is the one major food safety standard that GFSI does not recognise by itself. That single fact decides more ISO 22000 budgets than anything in the text of the standard, and it is the first thing I tell a client who has been quoted for certification without being asked who their customers are. The standard itself is the international management system standard for food safety, published by the International Organization for Standardization, applicable to any organisation in the food chain and certifiable by an accredited certification body. It is not a hygiene regulation, not a HACCP course, and not a GFSI recognised scheme. In South Africa it sits alongside Regulation R638 of 2018, which is the law for food premises.

The standard combines four things that used to live in separate documents: the management system machinery that ISO applies to every discipline, prerequisite programmes, the HACCP principles as set out in Codex CXC 1-1969, and interactive communication up and down the supply chain. Because it is written for the whole chain, it is used by primary producers, feed and food manufacturers, transport and storage operators, caterers, retailers and their packaging and chemical suppliers.

Where it costs organisations money is in what ISO 22000 is not.

It is not the law. Nothing in South African food premises law requires ISO 22000. The legal duty is a valid certificate of acceptability and adequate training under Regulation R638 of 2018, made under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972. If your question is a legal one, start with our R638 and certificate of acceptability guide instead.

It is not a hygiene code. ISO 22000 tells you to establish prerequisite programmes appropriate to your operation. It does not tell you the specification for a hand wash basin, the frequency of a pest inspection or the layout of a changing room. That level of detail lives in the ISO 22002 series, which is the reason those documents exist.

It is not a HACCP qualification. Clause 8.5 assumes the food safety team already knows how to run a hazard analysis. The standard tells you what the output must contain, not how to reason your way to it. Our HACCP master guide covers the seven principles and twelve steps in full, and this article does not repeat them.

It is not a product certificate. The certificate says a management system met the standard at the time of audit. It says nothing about a specific batch, and no certification body will let you print it on a pack.

What do ISO 22000 clauses 4 to 10 require?

ISO 22000:2018 follows the Annex SL high level structure, so clauses 1 to 3 are scope, normative references and terms and definitions, and every auditable requirement sits in clauses 4 to 10. Clause 8, operation, is by far the largest, and it carries prerequisite programmes, traceability, emergency preparedness, hazard analysis, the hazard control plan, verification and the handling of nonconforming product.

Clause 8 carries its own plan, do, check, act loop inside it, which is why the operation improves on its own rhythm rather than waiting for the annual management review. Clause 10.3, update of the food safety management system, is the other one people read past. It is a distinct requirement from corrective action, and it asks whether the system as designed still fits the operation as it now runs.

Clause 6.3, planning of changes, and the finding I write most often

Clause 6.3 requires that changes to the food safety management system be carried out in a planned manner. It is the clause I raise more often than any other, and the finding reads the same way every time: the change happened first and the system caught up afterwards, if it caught up at all. Procurement approves a supplier on price, engineering lifts line speed to clear a backlog, marketing launches a variant carrying a new allergen, and the flow diagram, the hazard analysis and the verification schedule are still describing last month.

On a site I audited, a sauce had moved from a rigid tub to a flow wrap three months before I arrived. The change file was thorough on the engineering side: trial runs, seal integrity results, a costing, sign off from production and from procurement. The food safety team leader found out when she saw the new packs coming off the line. Nobody had asked whether the new film supplier had been approved and specified, whether the seal parameters had been validated rather than trialled, or whether the allergen statement on the old sleeve had carried across to the new artwork. We spent the rest of that morning working through the artwork instead of auditing the plan, which is nobody’s idea of a good use of an audit day.

What an auditor is looking for is short and specific. A record showing that the food safety consequence of the change was evaluated before the change was made, the food safety team’s involvement in that evaluation, the resources and responsibilities assigned, and then the downstream updates under clause 8.6. If your change control form has a signature block for engineering, quality and production but no line for the food safety team leader, you have already written the nonconformity for the auditor.

PRP, OPRP and CCP in ISO 22000: what is the difference?

ISO 22000:2018 controls hazards through three types of control measure, prerequisite programmes, operational prerequisite programmes and critical control points, and records the latter two, OPRPs and CCPs, in a fourth document, the hazard control plan required by clause 8.5.4. PRPs manage the general conditions of the operation. OPRPs and CCPs manage the significant hazards identified by the hazard analysis in clause 8.5.2.

The decision that separates an OPRP from a CCP is made under clause 8.5.2.4, and the standard expects a systematic approach, not a hunch. It turns on the likelihood of failure of the control measure, the severity of the consequence if it fails, whether the measure exists specifically to reduce the hazard to an acceptable level, whether it stands alone or works with others, and whether it can be monitored in a way that allows timely correction.

I have argued this one across a table more than once. The case I remember best was a metal detector the site had classed as an OPRP, on the reasoning that a magnet upstream shared the load and the risk was therefore low. I asked what they would do with the last hour of production if the test piece failed at the end of a run. The quality manager said they would hold everything back to the last good check and re-inspect it. That answer is a critical limit and a disposition decision described in different words, and the team changed the categorisation themselves that afternoon. It is the test I use now. If losing control forces you to isolate product, you are describing a CCP, whatever the plan calls it.

The opposite failure is just as common. A site calls everything a CCP, ends up with fourteen critical limits and monitors none of them properly. Either way, write down the reasoning. A categorisation you cannot explain is a categorisation you will lose in an audit.

What is the ISO 22002 prerequisite programme series and what changed in July 2025?

The ISO 22002 series gives the sector specific prerequisite programme requirements that ISO 22000 clause 8.2 expects an organisation to consider when it selects and establishes its PRPs. In July 2025 the series was restructured. Most parts moved from Technical Specification to full International Standard, and a new common baseline part, ISO 22002-100:2025, was published on 29 July 2025. ISO/TS 22002-3:2011 for farming was not revised. The ISO catalogue shows it reviewed and confirmed in 2025, so it remains a Technical Specification.

The farming exception is the part most summaries get wrong. Several published overviews state that the whole series became International Standards in 2025. Farming is the exception, and if your system is a primary production system you are still working to a 2011 Technical Specification.

The change of designation is not cosmetic. A Technical Specification is a provisional ISO deliverable, published where the subject is still developing or where full consensus was not yet available. An International Standard carries full consensus and the expectation of periodic systematic review. Certification schemes that normatively reference a prerequisite programme standard now point at documents with a different status, and your internal references have to follow.

The work this creates is practical. Every place your system quotes a PRP standard needs its designation corrected, which is usually the PRP manual index, the internal audit checklist and the FSMS manual. The new part 100 has to be read, because it holds the common requirements that used to be repeated in each sector part, and your PRP manual now has two parents rather than one. Then run the gap check clause by clause instead of assuming a renumbering exercise, particularly in retail and wholesale, which now has a sector part where it previously had none.

This article covers the standards themselves. If your question is which prerequisite programmes a manufacturer actually has to build, and what each one has to contain on the floor, that is the subject of our guide to prerequisite programmes and GMP in food manufacturing.

Is ISO 22000 GFSI recognised, and what does that mean for your customers?

No. ISO 22000 on its own is not GFSI recognised. GFSI is hosted by The Consumer Goods Forum, and it benchmarks certification schemes rather than certifying organisations, so there is no such thing as a GFSI certificate. The recognised schemes include BRCGS, FSSC 22000, GLOBALG.A.P., SQF, IFS, Freshcare, Global Red Meat Standard, Global Seafood Alliance, GRMA, PrimusGFS, CanadaGAP and JFSM.

Recognition is a scheme level decision, which is why no certification body can issue you a GFSI recognised ISO 22000 certificate however good your system is. A scheme owner has to submit the scheme against the GFSI benchmarking requirements and be recognised for a defined scope, and ISO does not own or run certification schemes. FSSC 22000 exists for that reason: ISO 22000 needed a scheme owner, a mandatory sector prerequisite programme standard and a set of additional requirements before it could be benchmarked at all.

The commercial consequence deserves an honest answer rather than a sales one. An ISO 22000 certificate is a credible international management system certificate issued by an accredited certification body. It carries weight in a tender, it satisfies a customer who asks for a documented food safety management system, and it is a sound foundation for an exporter building a system for the first time. What it will not do is satisfy a retailer or brand owner specification that states a GFSI recognised certificate as a condition of supply. In that situation the certificate is rejected at desk review, before anyone visits your site, and no amount of explaining that ISO 22000 is an International Standard will move it.

So the question to ask before you commit budget is not which standard is better. It is who your customers are and what their supplier specification says. If nobody in your customer base demands a GFSI recognised certificate, ISO 22000 certification is a reasonable and cheaper destination. If one significant customer does, or if you expect to chase listings with national retailers or export buyers, plan for FSSC 22000 from the start, because you will build the same system either way.

How does ISO 22000 relate to FSSC 22000?

FSSC 22000 is a certification scheme built on top of ISO 22000. It has three components: ISO 22000:2018 as the management system, a sector prerequisite programme standard from the ISO 22002 series, and the FSSC additional requirements. That package is what GFSI recognises. Version 7 of FSSC 22000 was published in May 2026, replacing Version 6.

For a site already certified to ISO 22000, the gap to FSSC is the additional requirements and the formal adoption of a sector PRP standard, not a rebuild, which is why we teach them as one pathway. What changed at Version 7 and the transition dates are covered in our FSSC 22000 Version 7 changes guide and the Version 7 transition guide, and the course route starts with Introduction to FSSC 22000 at R1,750 or the FSSC 22000 training hub.

What does an ISO 22000 certification audit involve?

ISO 22000 certification is a third party audit carried out by a certification body working to ISO/IEC 17021-1:2015. The initial audit runs in two stages, a readiness and documentation review followed by an implementation audit at your site. Certification then runs on a three year cycle with surveillance at least once a calendar year, the first of which must fall within twelve months of the certification decision.

The initial certification audit of a management system shall be conducted in two stages: stage 1 and stage 2. … The first three-year certification cycle begins with the certification decision.ISO/IEC 17021-1:2015, clause 9, process requirements

Stage 1 is where the certification body decides whether auditing you is worth anyone’s time. The auditor reviews the documented system, confirms the scope, checks that the hazard analysis and hazard control plan exist and are internally consistent, checks your understanding of applicable statutory and regulatory requirements, and confirms that you have completed at least one internal audit and one management review. Stage 1 findings are usually recorded as areas of concern rather than nonconformities, and they are a gift. They tell you what stage 2 will test.

Stage 2 is on site and it tests implementation. The auditor follows product through the process, samples monitoring records against the hazard control plan, interviews operators about what they do when a limit is exceeded, examines calibration, traces a batch in both directions, and looks for the evidence trail behind every claim in your documentation. The most common reason a stage 2 is extended or repeated is not a missing procedure. It is a procedure that exists and is not followed.

On timing, the honest answer is a range. A site that already runs documented prerequisite programmes and a working HACCP study usually reaches stage 2 in six to twelve months. A site starting from informal hygiene practice takes longer, because the programmes have to be built and then left running long enough to generate the records that prove they work. A certification body is auditing a system in operation, not a folder of new documents.

Who in a business needs which level of ISO 22000 training?

Clause 7.2 of ISO 22000 asks you to determine the competence needed for people whose work affects food safety, ensure they are competent, and retain documented information as evidence. South Africa adds a separate legal duty for food premises under Regulation R638 of 2018, which states a competence outcome and names no course. It is quoted at people far more often than it is read.

A person in charge of food premises must ensure that he or she is suitably qualified or otherwise adequately trained in the principles and practices of food safety and hygiene, as appropriate, and that the training is accredited or conducted by an inspector, where applicable.Regulation 10(1)(a), R638 of 2018, Government Notice R.638, Government Gazette 41730, 22 June 2018

R638 names no course, no provider, no unit standard and no renewal period. What an environmental health practitioner assesses is evidence: the training content, the assessment record, the certificate and the training records kept under regulation 10(1)(d). The same logic applies to an ISO 22000 auditor looking at clause 7.2.

If you are staffing a food safety team from scratch, the three ISO 22000 courses are cheaper together. The Introduction to ISO 22000 Bundle at R4,543 combines Introduction to ISO 22000, The ISO 22000 Standard and ISO 22002 Prerequisite Programme Requirements, and saves R1,136 against buying them individually. If you are unsure which HACCP level your team leader needs, this comparison settles it.

Why do sites fail an ISO 22000 audit?

Across the ISO 22000 and FSSC 22000 audits I conduct, the same findings repeat. None of them is exotic and almost none is about a missing document. They are about a system that describes an operation nobody actually runs.

Changes made without going through the system. The clause 6.3 pattern described earlier, and the single most common finding I write.

A management review that produced no decisions. I have read minutes running to nine pages that cover every input in clause 9.3.2 and contain not one decision. Attendance, apologies, last year’s complaint summary, a table of internal audit findings, then the meeting closes. When I ask what changed because of it, the answer is usually that the meeting itself was the improvement. Clause 9.3.3 asks for outputs, decisions and actions, and clause 10.3 asks for evidence that the system was updated as a result. A review with no decisions leaves clause 10 with nothing to point at, so the finding lands against improvement rather than against the meeting.

A hazard analysis with no visible reasoning. Clause 8.5.2.4 wants a systematic categorisation of control measures. A table where the CCP column is filled in with no record of why is the finding, not the conclusion itself.

Validation confused with verification. Validation asks whether the control measure is capable of achieving the intended control, and is done before you rely on it. Verification asks whether it is being applied as planned, and is done continuously. Sites routinely present a year of temperature records as validation of a thermal process. It is verification, and the validation is missing.

Prerequisite programmes written against nothing. If your PRP manual is not mapped to the applicable ISO 22002 part, neither you nor the auditor has a reference point for whether it is complete. Since July 2025 that mapping includes the new part 100.

Traceability and recall never tested. Clause 8.3 requires the traceability system to be verified and tested, and clause 8.4 requires emergency preparedness. An unexercised procedure is an untested assumption, and mass balance is where most exercises fail.

Corrections and corrective actions treated as the same thing. Isolating the affected product is a correction. Finding out why the limit was exceeded and stopping it recurring is corrective action. Records that stop at the correction produce a repeat finding at the next surveillance audit, and our root cause analysis guide covers the method properly.

Externally provided processes left uncontrolled. Contract manufacturing, external laboratories, outsourced cleaning, external pest control and third party storage all sit inside your system boundary under clause 7.1.6. The supplier file, the specification and the verification of their performance all have to exist.

Objectives that cannot be measured. Clause 6.2 requires objectives that are measurable, monitored and communicated. Improve food safety culture is not an objective. It becomes one when it has a measure, an owner and a date, and this guide explains how sites do that. Internal auditing is where most of these are caught before the certification body arrives, which is covered in our internal and supplier auditing guide.

Frequently asked questions

ASC Food Safety Training · Leading with Science. Ensuring Food Safety. · Fully online, serving all of South Africa and beyond · info@ascfoodsafety.com · WhatsApp +27 61 483 0381 · SAATCA registered training centre (TC No. 065) · FoodBev SETA accredited provider No. 587/00337/1900 · B-BBEE Level 1 · Registered Lead Auditor (Exemplar Global and IRCA) · Consulting and document toolkits at ascfoodsafety.com