Sector-specific · ISO 22000:2018
ISO 22000 certificationFood Safety Management
ISO 22000:2018 food safety management system certification for organisations across the UK food chain, with impartial audits of HACCP and PRPs.
- Structured hazard control
- Applies across the food chain
- Management system discipline
- Communication across the chain
Overview
What is ISO 22000:2018?
ISO 22000:2018 specifies requirements for a food safety management system for any organisation in the food chain, from feed and primary production through processing, storage, transport, retail and food service, as well as packaging and equipment suppliers. It combines the Harmonized Structure management system clauses with HACCP principles from Codex Alimentarius, prerequisite programmes (PRPs) and interactive communication across the food chain. The standard uses two linked Plan, Do, Check, Act cycles: one for the management system and one for operational hazard control.
Hexa Certifications Limited provides independent third-party certification audits against ISO 22000. Our auditors assess your hazard analysis, hazard control plan, prerequisite programmes, verification and traceability, and observe operations on site. Under ISO/IEC 17021-1 we do not write HACCP plans or food safety systems for clients. An optional pre-assessment is available if you want an independent view of readiness before the formal audit.
In the UK it is important to understand the difference between ISO 22000 and schemes such as BRCGS Global Standard Food Safety and FSSC 22000. BRCGS and FSSC 22000 are benchmarked by the Global Food Safety Initiative (GFSI) and are often required by major retailers. ISO 22000 on its own is not GFSI-recognised, though FSSC 22000 is built on it. ISO 22000 certification suits organisations whose customers accept it or who want a management system framework.
Who it is for
Organisations that choose ISO 22000
- Food manufacturers and processors supplying business customers
- Food storage, distribution and logistics providers
- Catering, food service and contract catering businesses
- Food packaging and food contact material manufacturers
- Ingredient suppliers, importers and traders
- Animal feed producers and primary producers
Benefits
What ISO 22000 certification does for you
Structured hazard control
The standard requires a documented hazard analysis and a hazard control plan with critical control points and operational PRPs, giving a systematic basis for controlling food safety hazards.
Applies across the food chain
ISO 22000 can be used by any organisation in the food chain, including packaging, logistics and catering, where some sector schemes may not fit as well.
Management system discipline
Leadership, objectives, internal audit and management review sit alongside HACCP, so food safety is managed as a business system rather than only a set of technical controls.
Communication across the chain
Requirements for external communication with suppliers, customers and authorities help make sure relevant food safety information is shared, including during incidents, withdrawals and recalls affecting customers.
A route towards FSSC 22000
FSSC 22000 includes ISO 22000 plus sector PRP requirements and scheme additions. A working ISO 22000 system provides a strong base if customers later require a GFSI-recognised scheme.
Integration with ISO 9001
ISO 22000 shares the Harmonized Structure with ISO 9001 and ISO 14001, allowing common processes and integrated audits where organisations manage quality and food safety together.
Requirements
What the auditor will assess
The main clauses of ISO 22000:2018 and what each one asks of your organisation.
Clause 4 to 5
Context and leadership
Determine context, interested parties and scope, including products, processes and sites, and ensure top management commitment, a food safety policy and an appointed food safety team leader.
Clause 6
Planning
Address risks and opportunities to the management system, set measurable food safety objectives and plan changes in a controlled way.
Clause 7
Support
Provide resources and competent people, control externally developed elements and externally provided processes, and manage internal and external communication and documented information.
Clause 8.2
Prerequisite programmes
Establish PRPs appropriate to the organisation, considering relevant technical specifications, covering areas such as premises, utilities, pest control, cleaning, personal hygiene and allergen management.
Clause 8.3 to 8.4
Traceability and emergencies
Operate a traceability system linking incoming materials to delivered products, and prepare for and respond to potential emergency situations and incidents.
Clause 8.5
Hazard analysis and control plan
Conduct a hazard analysis, validate control measures and establish a hazard control plan with critical control points and operational PRPs, critical limits and monitoring.
Clause 8.7 to 8.9
Verification and nonconformity
Control monitoring and measuring, verify PRPs and the hazard control plan, and control nonconforming products, including corrections, corrective actions, handling and withdrawal or recall.
Clause 9 to 10
Evaluation and improvement
Analyse verification results, carry out internal audits and management reviews, and update and continually improve the food safety management system.
Audit evidence
What we will ask to see
Auditors sample records and talk to people doing the work. Having these ready makes Stage 2 smoother and faster.
- Scope, food safety policy and food safety team records
- Product descriptions, flow diagrams and on-site verification of flow diagrams
- Hazard analysis and validation of control measures
- Hazard control plan with CCP and OPRP monitoring records
- Prerequisite programme records such as cleaning, pest control and hygiene
- Traceability test and withdrawal or recall test results
- Supplier approval and raw material specifications
- Internal audit, management review and verification analysis records
Process
Your route to ISO 22000 certification
- 1
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
ISO 22000 certification questions
Answers about scope, timing and audits for ISO 22000:2018.
Is ISO 22000 the same as FSSC 22000?
No. FSSC 22000 is a certification scheme that combines ISO 22000 with sector-specific prerequisite programme requirements, such as ISO/TS 22002-1 for food manufacturing, plus additional scheme requirements. FSSC 22000 is GFSI-recognised and certificates must be issued by certification bodies licensed by the scheme owner. Hexa audits against ISO 22000 as a standalone standard.
Will UK retailers accept ISO 22000 instead of BRCGS?
Often not. Many UK retailers and brand owners require a GFSI-benchmarked scheme, such as BRCGS or FSSC 22000, for direct suppliers of own-label products. ISO 22000 is more commonly accepted by food service, packaging, logistics and business-to-business customers. Check your customers' requirements before choosing which certification to pursue.
How does ISO 22000 relate to HACCP?
ISO 22000 incorporates the HACCP principles from Codex Alimentarius within a management system. It adds the distinction between critical control points and operational prerequisite programmes, validation of control measures, management of PRPs, and the leadership, objectives, audit and review requirements of the Harmonized Structure. A legally required HACCP-based system can form the core of an ISO 22000 system.
What is an operational prerequisite programme?
An operational PRP (OPRP) is a control measure applied to prevent or reduce a significant food safety hazard to an acceptable level, where an action criterion and measurement or observation enable effective control. It differs from a CCP, which has a measurable critical limit separating acceptable from unacceptable product. Both are documented in the hazard control plan.
Does ISO 22000 certification replace food hygiene inspections?
No. Local authority food hygiene inspections and any official controls continue regardless of certification. ISO 22000 certification is a voluntary assessment of your management system by an independent body. A well-run system should help you meet legal food hygiene requirements, but the two processes are entirely separate.
Can Hexa write our HACCP plan?
No. Under ISO/IEC 17021-1, a certification body must not design or implement the systems it certifies. Your food safety team must develop the hazard analysis and hazard control plan, possibly with help from an independent consultant. We can offer an optional pre-assessment to give an impartial view of readiness.
How long does ISO 22000 certification take?
You need a system that has been operating long enough to produce monitoring and verification records, plus an internal audit and management review. At that point, most organisations complete Stage 1 and Stage 2 within six to twelve weeks of booking. Stage 2 is carried out on site while production or relevant operations are running.
Can we include several sites or product types?
Yes. The scope can cover multiple sites and product categories, provided each is covered by the hazard analysis and controls. Audit duration depends on the number of HACCP studies, sites and employees. Where sites have very different processes, each will normally need to be visited during the certification cycle.
ISO 22000 certification near you
We audit ISO 22000 systems on site across the UK, including:
- ISO 22000 London
- ISO 22000 Birmingham
- ISO 22000 Manchester
- ISO 22000 Leeds
- ISO 22000 Glasgow
- ISO 22000 Edinburgh
- ISO 22000 Cardiff
- ISO 22000 Belfast
- ISO 22000 Bristol
- ISO 22000 Liverpool
- ISO 22000 Newcastle upon Tyne
- ISO 22000 Sheffield
- ISO 22000 Nottingham
- ISO 22000 Southampton
- ISO 22000 Cambridge
- ISO 22000 Aberdeen
Integrated audits
Standards often combined with ISO 22000
Organisations frequently certify these together in one integrated audit, with one plan and fewer days on site.
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Environment & Energy
ISO 14001:2026Environmental Management
ISO 14001:2026, published in April 2026 to replace the 2015 edition, specifies the requirements for an environmental management system. It helps an organisation identify the environmental aspects of its activities, products and services, understand its compliance obligations, and manage significant impacts through planning, operational control and evaluation. The standard takes a life cycle perspective, so organisations consider stages they can control or influence, such as purchasing, transport, use and end-of-life treatment, as well as their own sites.
- Supply chain and tender credibility
- Structured legal compliance
- Control of significant impacts
- Resource and waste efficiency
Health & Safety
ISO 45001:2018Occupational Health and Safety Management
ISO 45001:2018 sets out requirements for an occupational health and safety management system. Its aim is to prevent work-related injury and ill health and to provide safe and healthy workplaces. The standard places strong emphasis on leadership, the consultation and participation of workers, hazard identification and the hierarchy of controls. It replaced OHSAS 18001 and follows the Harmonized Structure, so it integrates readily with ISO 9001 and ISO 14001.
- Prequalification and tenders
- Worker involvement
- Systematic hazard control
- Clear legal oversight
Start your certification
Get your ISO 22000 certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.
