ISO 22000 turns HACCP into a managed food safety system. The standard expects both management discipline and operational hazard control to be working together.
- The organisational loop manages leadership, resources, performance and improvement.
- The operational loop manages PRPs, hazard analysis, CCPs, OPRPs and verification.
- Traceability, recall, validation and records are central audit evidence.
ISO 22000:2018 is the international food safety management system (FSMS) standard: the framework that combines the Codex HACCP methodology with a full management system.
This is a working summary for food manufacturers: what each part of the standard actually requires of a factory, in plain terms.
The architecture: two PDCA loops
ISO 22000:2018 runs Plan-Do-Check-Act at two levels simultaneously:
- The organisational loop: planning, resourcing, evaluating and improving the FSMS itself (clauses 4–7, 9–10);
- The operational loop: the food safety machinery inside clause 8: PRPs, hazard analysis, control plan, monitoring, verification and correction.
Most implementation failures come from running only one loop: a beautiful hazard plan nobody manages (operations without system), or a document-heavy system with a copy-pasted hazard analysis (system without operations).
Clause 4: Context of the organisation
Determine the internal and external issues relevant to food safety (your supply chain risks, regulatory environment, customer expectations, workforce realities) and the needs of interested parties: customers, consumers, regulators such as the SFDA, suppliers. Then define the scope of the FSMS precisely: products, processes and sites. Auditors read the scope first; production activities quietly excluded from scope are an immediate credibility problem.
Clause 5: Leadership
Top management must demonstrate commitment: establish a food safety policy, ensure the FSMS is resourced, integrate food safety into business processes, and assign responsibilities, including a food safety team leader responsible for the FSMS and for reporting on its performance. The team leader needs genuine authority and competence, not just a title; auditors interview them at length.
Clause 6: Planning
Address risks and opportunities at the organisational level (e.g. supplier concentration, seasonal workforce turnover, regulatory change): this is separate from, and additional to, hazard analysis. Set measurable FSMS objectives (complaint rates, audit closure, verification results) with plans to achieve them. Plan changes deliberately: uncontrolled change is a classic route to food safety failure.
Clause 7: Support
- Resources: competent people, adequate facility and equipment, and defined requirements for externally provided processes, products and services.
- Competence and awareness: the food safety team must have demonstrated competence in hazard analysis; operators must understand the food safety implications of their tasks.
- Communication: both external (suppliers, customers, authorities, including what information you must give and receive about hazards) and internal (a defined flow so that changes in products, equipment, cleaning or personnel reach the food safety team).
- Documented information: controlled documents and reliable records, the evidence base for everything in clause 8.
Clause 8: Operation (the engine room)
8.2 Prerequisite programmes (PRPs)
The hygiene foundation: facility layout and zoning, water and air quality, pest control, cleaning and sanitation, personnel hygiene, waste, maintenance, supplier control, cross-contamination prevention, allergen management. ISO 22000 requires PRPs to be selected using applicable standards and guidance (food manufacturers typically use ISO/TS 22002-1 as the reference) and adapted to the actual site. PRPs must be documented, implemented and verified (e.g. hygiene inspections, swabbing programmes).
8.3 Traceability
A tested system that links incoming materials (lots, suppliers) through processing to finished product lots and their first destination: one step back, one step forward at minimum. Auditors run live traceability exercises; expect to reconstruct a lot within hours, with mass balance.
8.4 Emergency preparedness
Documented response to emergencies that can affect food safety (contamination events, utility failures, fires, supply disruptions) with periodic testing.
8.5 Hazard control (the HACCP core)
The Codex logic, formalised:
- Preliminary steps: characterise raw materials, ingredients and product-contact materials; describe end products and intended use (including vulnerable consumer groups); draw and verify flow diagrams on site.
- Hazard analysis: identify biological, chemical (including allergens) and physical hazards at each step; assess likelihood and severity; determine which require control.
- Selection and categorisation of control measures: the OPRP/CCP decision. ISO 22000's distinctive contribution:
- A CCP (critical control point) carries measurable critical limits, continuous or near-continuous monitoring capable of detecting loss of control in time, and predefined corrections, e.g. pasteurisation temperature/time, metal detection.
- An OPRP (operational prerequisite programme) is a control measure essential for hazard control but managed with action criteria that may be measurable or observable, e.g. allergen changeover cleaning, air pressure differentials.
- The categorisation must be justified by a documented assessment (consequence of failure, feasibility of monitoring).
- The hazard control plan documents, for each CCP and OPRP: the hazard, the limits/criteria, monitoring method and frequency, responsibilities, corrections and corrective actions, and records.
- Validation (8.5.3): before operation, obtain evidence that the chosen control measures are actually capable of controlling the hazard (scientific literature, regulatory limits, in-plant trials). Validation is not verification: confusing them is one of the most common audit findings in food plants.
8.6–8.8 Monitoring, verification and updating
Keep monitoring equipment calibrated (traceable to standards); run the monitoring at the defined frequency and record results in real time; execute verification activities (record reviews, sampling and testing, internal audits, PRP checks) by people other than those doing the monitored task where feasible; and analyse verification results as an input to updating the system.
8.9 Control of nonconformity
When monitoring shows a limit or criterion breached: correct the process, evaluate and control the affected product (potentially unsafe product cannot be released until evaluated), record decisions, and investigate cause. This clause also requires a withdrawal/recall procedure (with assigned authority to initiate it), tested periodically (e.g. mock recall) and evaluated for effectiveness.
Clause 9: Performance evaluation
Analyse and evaluate the FSMS using verification results, audit outcomes, complaints and monitoring trends. Run a full internal audit programme covering all FSMS elements, with impartial, competent auditors. Hold management review with the standard's required inputs, including the results of system-updating activities, emergency situations, and verification analyses, and produce decisions on resources and improvement.
Clause 10: Improvement
Correct and prevent recurrence of nonconformities (root cause, action, effectiveness check), continually improve the FSMS, and, a requirement specific to ISO 22000, update the system: the food safety team must evaluate the FSMS at planned intervals against new hazard information, regulatory changes and process changes, and revise hazard analysis and control plans accordingly. A hazard analysis dated three years ago with no review since is a finding, not a system.
What certification looks like against this standard
Certification follows the accredited two-stage model under ISO/IEC 17021 rules (with food-scheme-specific requirements applied by the certification body): stage 1 readiness review, stage 2 on-site audit during production, then annual surveillance and recertification in year three. Auditors will want to see the plant running, records at the line, a live traceability test, and evidence the two PDCA loops are both turning: management review that actually discusses verification data, and a hazard control plan that reflects this year's process, not the consultant's template.
QSI Cert is a SAAC-accredited, SFDA-approved certification body based in Riyadh and Al Khobar.
Common questions from this guide.
Certification follows the accredited two-stage model under ISO/IEC 17021 rules (with food-scheme-specific requirements applied by the certification body): stage 1 readiness review, stage 2 on-site audit during production, then annual surveillance and recertification in year three. Auditors will want to see the plant running, records at the line, a live traceability test, and evidence the two PDCA loops are both turning: management review that actually discusses verification data, and a hazard control plan that reflects this year's process, not the consultant's template. --- QSI Cert is a SAAC-accredited, SFDA-approved certification body based in Riyadh and Al Khobar.