Industries · Food & Drink
ISO certification for food & drink
ISO 22000 food safety certification, with ISO 9001, 14001 and 45001, for UK food and drink producers, packers, distributors and caterers.
- ISO 22000 food safety
- ISO 9001 quality
- ISO 14001 environmental
- ISO 45001 occupational health and safety
Overview
ISO 22000 and wider certification for food businesses
Food and drink businesses must protect consumers, satisfy retailers and comply with food law. ISO 22000 sets requirements for a food safety management system that combines HACCP principles, prerequisite programmes and the management system structure shared with other ISO standards. It can be applied by any organisation in the food chain, from primary producers to caterers and packaging suppliers. It also suits storage and distribution businesses handling food.
Many retailers and brand owners require certification to a scheme recognised by the Global Food Safety Initiative, such as BRCGS Food Safety or FSSC 22000. FSSC 22000 is built on ISO 22000 with additional sector prerequisite programmes and scheme requirements. Hexa Certifications certifies to ISO 22000 only, and does not issue BRCGS or FSSC 22000 certificates. Checking customer requirements first helps avoid investing in the wrong certification route.
Certification complements, but does not replace, regulatory oversight. Local authorities enforce food hygiene law and the Food Standards Agency, or Food Standards Scotland in Scotland, sets policy and guidance. A food safety management system helps organise the evidence that controls are in place, while legal responsibility remains with the food business operator. Auditors will look at how food law requirements are identified and met within the system.
Recommended
- ISO 22000
- ISO 9001
- ISO 14001
Sector challenges
Where certification makes the difference
The pressures organisations in food & drink face most often, and how a certified management system helps answer them.
Customer scheme requirements
Major retailers often specify GFSI-recognised schemes, so businesses need to understand where ISO 22000 fits and where another scheme may be required.
Hazard control
Biological, chemical, physical and allergen hazards must be identified and controlled through HACCP-based plans and prerequisite programmes.
Traceability and recall
Businesses must be able to trace materials and products and act quickly when withdrawal or recall is needed.
Supplier approval
Ingredients, packaging and services must be sourced from approved suppliers, with controls proportionate to risk.
Workplace and environmental risks
Food sites face risks from machinery, refrigeration, cleaning chemicals, waste and effluent, which ISO 45001 and ISO 14001 help address.
Recommended standards
Standards most requested in food & drink
Choose a standard to see what it covers. Several can be combined into one integrated audit.
Sector-specific
ISO 22000:2018Food Safety Management
ISO 22000:2018 specifies requirements for a food safety management system for any organisation in the food chain, from feed and primary production through processing, storage, transport, retail and food service, as well as packaging and equipment suppliers. It combines the Harmonized Structure management system clauses with HACCP principles from Codex Alimentarius, prerequisite programmes (PRPs) and interactive communication across the food chain. The standard uses two linked Plan, Do, Check, Act cycles: one for the management system and one for operational hazard control.
- Structured hazard control
- Applies across the food chain
- Management system discipline
- Communication across the chain
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Environment & Energy
ISO 14001:2026Environmental Management
ISO 14001:2026, published in April 2026 to replace the 2015 edition, specifies the requirements for an environmental management system. It helps an organisation identify the environmental aspects of its activities, products and services, understand its compliance obligations, and manage significant impacts through planning, operational control and evaluation. The standard takes a life cycle perspective, so organisations consider stages they can control or influence, such as purchasing, transport, use and end-of-life treatment, as well as their own sites.
- Supply chain and tender credibility
- Structured legal compliance
- Control of significant impacts
- Resource and waste efficiency
Health & Safety
ISO 45001:2018Occupational Health and Safety Management
ISO 45001:2018 sets out requirements for an occupational health and safety management system. Its aim is to prevent work-related injury and ill health and to provide safe and healthy workplaces. The standard places strong emphasis on leadership, the consultation and participation of workers, hazard identification and the hierarchy of controls. It replaced OHSAS 18001 and follows the Harmonized Structure, so it integrates readily with ISO 9001 and ISO 14001.
- Prequalification and tenders
- Worker involvement
- Systematic hazard control
- Clear legal oversight
How it works
Your route to certification
- 1
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
Food & Drink: certification questions
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the international standard for food safety management systems. FSSC 22000 is a certification scheme that uses ISO 22000 together with sector-specific prerequisite programme requirements and additional scheme rules, and it is recognised by the Global Food Safety Initiative. Hexa Certifications certifies to ISO 22000 but does not certify to FSSC 22000.
Will retailers accept ISO 22000?
It depends on the customer. Some retailers and brand owners specify a GFSI-recognised scheme such as BRCGS Food Safety or FSSC 22000, and ISO 22000 on its own is not GFSI-recognised. Other customers, including many food service, ingredient and export buyers, accept ISO 22000. Always check your customer's supplier requirements before choosing a standard.
How does BRCGS relate to ISO 22000?
BRCGS Food Safety is a separate standard with its own requirements and certification rules. It is not based on ISO 22000, although both include HACCP and prerequisite controls. Some businesses hold both where different customers require different schemes. Hexa Certifications does not issue BRCGS certificates.
Does ISO 22000 replace our food hygiene inspections?
No. Local authority inspections and the Food Hygiene Rating Scheme, or the Food Hygiene Information Scheme in Scotland, are part of statutory enforcement. Certification is voluntary and does not replace official controls. A well-maintained system can, however, help you demonstrate controls to inspectors.
Is HACCP included in ISO 22000?
Yes. ISO 22000 incorporates HACCP principles through hazard analysis and hazard control plans, which may include critical control points and operational prerequisite programmes. It adds management system requirements such as leadership, risk-based planning, internal audit and management review, together with communication along the food chain.
Can packaging and logistics companies use ISO 22000?
Yes. ISO 22000 applies to any organisation in the food chain, including manufacturers of food contact packaging, storage and distribution providers and caterers. The scope and prerequisite programmes will reflect the nature of your activities and the hazards relevant to them.
Are food safety audits announced?
ISO 22000 audits by Hexa Certifications are normally planned and announced in advance. Some customer schemes include unannounced audits under their own rules, but those are set by the scheme owner. Audits should take place when production or the relevant activities are running so that controls can be observed.
Can we combine ISO 22000 with ISO 9001?
Yes. Both standards share a common management system structure, so many businesses run them as one integrated system. An integrated audit can cover both standards together, with audit time determined according to the level of integration and the competence of the audit team.
Other industries we audit
All industries
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.
