ISO 22000 certification is often misunderstood as just an expanded HACCP system with an ISO 9001 shell wrapped around it. In practice, it is a fully integrated Food Safety Management System (FSMS) designed to align operational floor controls with strategic executive decision-making across the entire food supply chain.

Strategic Architecture: ISO 22000 vs. HACCP vs. FSSC 22000

Choosing the right food safety framework determines how audit-heavy, expensive, and operational your system will be. A common mistake among food manufacturers is seeking ISO 22000 when their target buyers actually demand a GFSI-benchmarked scheme like FSSC 22000.

Field Insight: If your primary goal is selling to global retail chains like Walmart, Tesco, or Carrefour, ISO 22000 alone usually won’t clear vendor onboarding. They require a GFSI benchmarked certificate. However, ISO 22000 is the exact foundation you build on; transitioning from ISO 22000 to FSSC 22000 requires only adding sector specific Prerequisite Programs (ISO TS 22002-1) and the FSSC additional requirements (food defense, food fraud mitigation, and equipment design).

Core Pillars: Navigating the Double Plan-Do-Check-Act (PDCA) Cycle

ISO 22000:2018 operates on two distinct PDCA cycles running simultaneously: one at the organizational management level and one at the operational level.

1. Organizational PDCA (Clauses 4, 5, 6, 7, 9, 10)

This layer covers business context, leadership accountability, resource allocation, internal audits, and management reviews. It forces executive leadership to own food safety rather than treating it as a siloed quality control function.

2. Operational PDCA (Clause 8)

This layer handles the physical processing floor. It embeds Codex HACCP principles into the operational flow, moving from basic sanitation (PRPs) to hazard categorization (OPRPs and CCPs).

Operational Triad: Distinguishing PRPs, OPRPs, and CCPs

The most frequent point of failure during certification audits is the confusion between Prerequisite Programs (PRPs), Operational Prerequisite Programs (OPRPs), and Critical Control Points (CCPs).

Improper categorization leads to either over-monitoring unnecessary control points or under-monitoring critical hazards.

Prerequisite Programs (PRPs)

• Definition: Basic environmental and operational conditions necessary to maintain a hygienic environment throughout the food chain.

• Characteristics: Facility-wide, not tied to a specific step.

• Examples: Pest control, employee handwashing stations, equipment calibration schedules, waste management.

• Validation: Verified via general hygiene inspections and environmental monitoring.

Operational Prerequisite Programs (OPRPs)

• Definition: A control measure identified by the hazard analysis as essential to control the likelihood of introducing food safety hazards and/or the contamination or proliferation of hazards in the product or processing environment.

• Characteristics: Essential, but managed via measurable or observable Action Criteria rather than strict numerical absolute limits.

• Examples: Cold storage temperature maintaining product below 4°C, conveyor belt sanitation between species shifts, wash-water chlorination levels in raw salad washing.

• When It Fails: If an OPRP breaches action criteria, the product is evaluated for potential impact, but it does not trigger an automatic statutory product recall or immediate product destruction.

Critical Control Points (CCPs)

• Definition: A step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level.

• Characteristics: Strict, scientifically validated Critical Limits (measurable parameters like time, temperature, pH, or physical aperture size).

• Examples: Metal detector set to 1.5mm Ferrous / 2.0mm Non-Ferrous / 2.5mm Stainless Steel; pasteurization at 72°C for 15 seconds; thermal processing retorts.

• When It Fails: A breach of a Critical Limit means an automatic failure of safety. Affected product is isolated, quarantined, and barred from release until a disposition assessment is completed.

The 6-Phase Implementation Roadmap

Achieving certification requires a structured implementation plan. The following phased approach outlines the workflow:

Common Implementation Pitfalls in ISO 22000 Audit Projects

Having evaluated hundreds of food safety implementations, auditor teams repeatedly flag the same fundamental operational errors:

1. Paper-Bound Hazard Analyses

Many teams purchase pre-packaged HACCP plans or copy generic models. If your hazard analysis lists generic biological hazards without specifying the exact organism (Listeria monocytogenes, Salmonella enterica, Clostridium botulinum) and its specific control parameters, auditors will issue major non-conformities during Stage 2 evaluations.

2. Over-designation of CCPs

Designating 15 CCPs in a facility often indicates poor understanding of PRPs and OPRPs. Excessive CCPs dilute operator focus, create audit risk, and lead to burnout. Most single-line processing facilities effectively operate with 2 to 4 true CCPs.

3. Conflating Monitoring with Verification

Monitoring happens continuously or in real time on the line (e.g., operator checking a pasteurization temperature gauge every hour). Verification happens after the fact by a separate person to prove monitoring is working (e.g., QA supervisor reviewing and signing off on the pasteurization log at the end of the shift). Combining these roles undermines system integrity.

4. Poor Traceability & Mass Balance Testing

During the Stage 2 audit, auditors will execute a surprise 4-hour mock recall. They pick a random raw material lot and demand tracking through production to finished goods, along with a complete mass balance reconciliation. If your inventory records show 500 kg of raw material used but you can only account for 420 kg of finished product and waste, the traceability system fails.

The Audit Journey: Stage 1 vs. Stage 2

Stage 1 Audit: Documentation & Site Readiness

The auditor reviews your documented information: hazard analysis, flow charts, OPRP/CCP determinations, validation records, and facility layout. The goal is to determine if your system is mature enough to move to Stage 2.

Crucial Requirement: You must complete at least one round of internal audits across all clauses and hold a formal Management Review before Stage 1.

Stage 2 Audit: On-Site Execution & Verification

Conducted weeks after Stage 1. The audit team verifies whether floor operations match your written procedures. They interview line operators, verify live CCP monitoring, check calibration tags, test emergency preparedness, and review corrective action logs.

Maintaining the 3-Year Certification Cycle

Once issued, an ISO 22000 certificate is valid for 3 years, subject to annual Surveillance Audits (Year 1 and Year 2) and a full Recertification Audit prior to expiry in Year 3.

Working with Global Standards

Navigating the complexities of ISO 22000 certification requires a structured approach to hazard analysis, system design, and audit preparation. Organizations looking to implement or upgrade their Food Safety Management System can partner with established technical experts like Global Standards to streamline process documentation, train internal audit teams, and conduct gap analyses ahead of accredited third-party certification audits.