If your business touches food at any point — growing it, processing it, storing it, transporting it, serving it, or even supplying packaging for it — food safety isn’t optional. It’s a legal obligation, a customer expectation, and increasingly, a condition of doing business at all. ISO 22000 is the international standard built to help organizations manage that responsibility systematically, rather than relying on inspections and good intentions alone.
This guide covers exactly what ISO 22000 is, who it applies to, how it’s structured, and what getting certified actually involves.
What Is ISO 22000?
ISO 22000 is an international standard that specifies the requirements for a Food Safety Management System (FSMS) — a structured way for organizations to consistently provide food that is safe to consume. The standard integrates the principles of the Hazard Analysis and Critical Control Point (HACCP) system developed by the Codex Alimentarius Commission, combining key elements like interactive communication, system management, and prerequisite programs to ensure food safety along the entire food chain.
Rather than treating food safety as a single inspection or a one-time checklist, ISO 22000 asks organizations to build food safety management into how they actually operate day to day — identifying hazards before they become incidents, not just reacting after something goes wrong.
The current version of the standard is ISO 22000:2018, which replaced the original ISO 22000:2005 version, revising the clause structure to align with the same High-Level Structure used across other ISO management system standards, such as ISO 9001. It specifies requirements for a food safety management system that enables an organization to plan, implement, operate, maintain, and update an FSMS that provides products and services that are safe.
ISO 22000 by the Numbers
Understanding the scale of both the problem and the standard’s adoption helps explain why food safety management has become a business priority rather than a regulatory afterthought.
The scale of the problem:
Unsafe food causes an estimated 600 million illnesses and 420,000 deaths globally every year, according to World Health Organization estimates.
More recent WHO analysis, covering 194 countries, attributed roughly 866 million illnesses and 1.5 million deaths annually to contaminated food, based on 2021 data.
Nearly a third of foodborne illness deaths occur in children under 5, despite this age group making up only about 9% of the global population.
Food contamination was estimated to cost $310 billion in lost productivity globally in 2021 alone.
The scale of the standard:
As of the 2024 ISO Survey, there were 59,521 valid ISO 22000:2018 certificates issued worldwide, across more than 75,000 certified sites.
ISO 22000 (Food Safety Management Systems) accounts for an estimated 7.6% of the global ISO certification services market, driven by international food trade growth, traceability regulation, and consumer demand for verified food safety.
Adoption is accelerating fastest in regions with expanding food export markets, particularly across Asia-Pacific, as international buyers increasingly require certified food safety systems from their suppliers.
These numbers frame the standard clearly: food safety failures carry a massive, measurable global cost, and ISO 22000 adoption — while still smaller than standards like ISO 9001 — is a meaningful and growing part of how organizations manage that risk.
Who Needs ISO 22000?
This is where ISO 22000 differs from many food safety certifications that only apply to one type of business — it’s built for the entire food chain, not just manufacturers. ISO 22000 is applicable to all organizations in the food chain, including primary producers and food manufacturers, transport and storage operators, caterers, retailers, and even subcontractors.
In practical terms, this includes:
- Primary producers — farms, fisheries, and agricultural operations
- Food manufacturers and processors — anyone converting raw ingredients into food products
- Packaging manufacturers — companies producing materials that come into direct contact with food
- Transport and storage operators — logistics providers moving or storing food and food-related materials
- Caterers and food service businesses — restaurants, catering companies, institutional kitchens
- Retailers — supermarkets, distributors, and food wholesalers
- Subcontractors and suppliers — any business providing services or materials to organizations in the food chain
If your organization touches food at any link in that chain — even indirectly, like a company manufacturing food-grade packaging — ISO 22000 is relevant to you.
Why ISO 22000 Matters?
Food safety failures are costly in every sense — financially, legally, and reputationally. A structured FSMS reduces that risk in several concrete ways:
Regulatory compliance. Food safety regulations vary by country and region, but a well-implemented FSMS built on ISO 22000 principles helps organizations meet — and demonstrate — compliance with applicable legal requirements, rather than scrambling to prove compliance after the fact.
Market access and competitiveness. Many retailers, distributors, and international buyers now require ISO 22000 certification (or an equivalent) as a condition of doing business, particularly for suppliers looking to enter new markets or work with larger commercial partners.
Consistency and risk reduction. ISO 22000 helps organizations improve their overall performance in food safety by adopting a systematic approach that identifies, prevents, and controls food safety hazards at every stage of the food chain. This shifts food safety from a reactive activity to a proactive, built-in part of operations.
Customer and stakeholder trust. Certification to ISO 22000 is one way to demonstrate to stakeholders and customers that an organization’s food safety management system meets internationally recognized requirements.
How ISO 22000 Is Structured?
ISO 22000:2018 follows the same core structure as other modern ISO management system standards, built around the Plan-Do-Check-Act (PDCA) cycle — a continuous loop of planning, implementing, checking results, and improving. The PDCA cycle enables an organization to ensure its processes are adequately resourced and managed, and that opportunities for improvement are determined and acted on.
The standard combines several core elements:
Interactive communication — across the organization and with suppliers, customers, and regulators
System management — food safety embedded into the organization’s broader management approach, not siloed separately
Prerequisite Programs (PRPs) — the basic hygiene and operational conditions needed before hazard control measures can work effectively
HACCP principles — hazard analysis and critical control point methodology, used to identify and control specific food safety hazards
Risk-based thinking — identifying what could cause processes to deviate from planned outcomes, and building in controls to prevent it
ISO 22000 is also part of a broader family of related standards — including the ISO/TS 22002 series, which covers detailed prerequisite programs for specific sectors (like food manufacturing or catering), and the ISO 22003 series, which sets requirements for the certification bodies that audit against ISO 22000 itself.
ISO 22000 and HACCP
ISO 22000 incorporates HACCP principles within a larger management system — but they’re not the same thing, and it’s one of the most common points of confusion for anyone researching food safety certification.
Getting Certified
Certification follows a structured path — from an initial gap analysis through internal audits to the external certification audit itself, typically taking several months depending on the organization’s size and current food safety maturity.
Common Challenges Organizations Face
A few patterns show up repeatedly for organizations working toward ISO 22000 certification:
- Treating prerequisite programs as an afterthought. PRPs (things like pest control, cleaning schedules, and staff hygiene practices) are foundational — without them functioning properly, HACCP controls built on top of them won’t hold up under audit.
- Documentation that doesn’t match practice. A hazard control plan that looks complete on paper but isn’t actually followed on the floor is one of the most common gaps auditors find.
- Underestimating internal audit training. Organizations sometimes assume anyone familiar with food operations can conduct an internal audit — but auditing is a distinct skill, and untrained internal auditors tend to miss exactly the gaps that matter most.
- Inconsistent supplier communication. Since ISO 22000 emphasizes communication across the food chain, gaps in how hazard information is shared with suppliers or customers are a frequent audit finding.
Frequently Asked Questions
Is ISO 22000 mandatory?
ISO 22000 certification itself isn’t legally mandatory in most jurisdictions, but the underlying food safety practices it’s built on often overlap with legal requirements. Certification is typically driven by market demand — buyers, retailers, and regulators increasingly expect it.
How long does ISO 22000 certification take?
This varies significantly based on the organization’s size and current food safety maturity, but building the system, implementing it, and completing the certification audit process typically takes several months.
Do I need HACCP before pursuing ISO 22000?
Not necessarily as a separate certification, but HACCP principles are built directly into ISO 22000’s requirements, so organizations need to develop HACCP-based hazard analysis regardless of whether they pursue HACCP certification separately.
What’s the difference between ISO 22000 and BRC or FSSC 22000?
BRC and FSSC 22000 are other widely used food safety certification schemes. FSSC 22000, in particular, is built directly on top of ISO 22000, adding sector-specific prerequisite program requirements. Which one applies often depends on your specific market, customer requirements, and region.
Who conducts the certification audit?
Certification audits must be conducted by an accredited, independent certification body — internal audits (even well-trained ones) prepare you for this but cannot replace it.
Final Thoughts
SO 22000 exists because food safety failures don’t just cost money — they cost trust, and in the food industry, trust is the entire business. Whether you’re a primary producer, a manufacturer, a logistics provider, or a food service business, the standard gives you a structured, internationally recognized way to manage that responsibility systematically rather than reactively.
Understanding the standard is the first step. Building the internal capability to implement and audit it is what makes certification achievable and sustainable. That starts with having people who know how to apply the requirements in real situations.
Verger Academy helps professionals build that practical understanding through structured ISO 22000 training, giving them the knowledge and confidence to contribute effectively to food safety management and continual improvement.
Because a stronger food safety system starts with people who know how to make it work.
