ISO 22000: How to Implement a Food Safety Management System
What does ISO 22000:2018 require, and what does this guide cover?
ISO 22000:2018 (the international standard for food safety management systems) specifies requirements for a food safety management system (FSMS) applicable to any organisation in the food chain, regardless of size or complexity. It combines interactive communication along the food chain, system management, the HACCP principles of the Codex Alimentarius, and prerequisite programmes.
The standard follows the High Level Structure shared by all recent ISO management system standards, so its clauses for context, planning, support, performance evaluation, and improvement mirror those of ISO 9001 and ISO 14001. This makes integration with an existing quality or environmental management system straightforward.
Building an FSMS starts with establishing prerequisite programmes (PRPs) to control the basic conditions for food safety, then conducting a hazard analysis to identify hazards that require control through operational PRPs or HACCP plans. Critical control points (CCPs) are defined, monitored at specified critical limits, and verified. Traceability and withdrawal management close the loop when a food safety problem is detected.
This guide covers the four main implementation steps and explains how FSMS software addresses each clause.
How do prerequisite programmes and hazard analysis work under ISO 22000?
ISO 22000:2018 clause 8.2 requires the organisation to establish, implement, maintain, and update prerequisite programmes (PRPs) to prevent or reduce the likelihood of contamination. PRPs cover areas such as infrastructure, cleaning and disinfection, pest control, personnel hygiene, and supplier management. They are distinct from HACCP controls: PRPs manage the environment; HACCP manages specific hazards within the process.
Clause 8.5 requires a hazard analysis: the organisation must identify all biological, chemical, and physical hazards that may be reasonably expected in its food products and processes, assess their severity and likelihood, and determine the appropriate control measure combination for each significant hazard. Hazards controlled by PRPs alone use operational PRPs; hazards that require monitoring at critical limits use a HACCP plan.
FSMS software structures the PRP register and the hazard analysis table in linked records. When a PRP is updated because a supplier changes, the software traces which hazard assessments reference that PRP and flags them for review. For compliance monitoring to maintain the FSMS prerequisite programmes, the software keeps legal and regulatory obligations visible alongside the operational controls that address them.
How do HACCP plans and critical control points work under ISO 22000?
ISO 22000:2018 clause 8.5.4 requires the organisation to construct a HACCP plan for each significant hazard that cannot be adequately controlled by operational PRPs alone. The HACCP plan specifies for each CCP: the controlled hazard, the critical limits, monitoring procedure, corrections and corrective actions when limits are exceeded, responsibilities, and records.
Critical limits must be measurable and based on scientific justification. Monitoring must be designed to detect loss of control in time to correct the process before an out-of-limit product reaches the consumer. Verification activities (additional to monitoring) confirm that the HACCP plan is operating effectively.
FSMS software links each CCP record to its HACCP plan, its monitoring measurements, its control chart or trend data, and any corrections taken. When a critical limit is breached, the software generates an alert and opens a correction record automatically. This traceability from measurement to corrective action is one of the most frequently inspected areas in food safety certification audits.
How do traceability and withdrawal management work under ISO 22000?
ISO 22000:2018 clause 8.3 requires the organisation to establish a traceability system capable of identifying product lots, their relationship to raw material lots and processing and delivery records, and identifying their current location in the supply chain. The traceability system must allow both trace-back (from finished product to raw materials) and trace-forward (from raw material to finished product in the market).
Clause 8.9.5 requires a documented withdrawal and recall procedure, tested at planned intervals, capable of retrieving all affected product from the market when a food safety hazard is identified. The procedure must define roles, communication channels, and the conditions under which a withdrawal is triggered.
FSMS software maintains lot-level traceability records linking incoming raw materials to work-in-progress batches and to outgoing finished product lots. When a withdrawal is required, the system identifies affected lots in seconds rather than hours. The same record set serves as evidence during a certification audit that traceability is maintained as required.
How does FSMS software cover ISO 22000:2018 requirements?
An FSMS software tool structured around ISO 22000:2018 provides dedicated modules for: PRP register and verification records, hazard analysis and control measure selection, HACCP plans and CCP monitoring, operational PRP management, traceability and lot management, withdrawal and recall procedures, internal audit management, nonconformity and corrective action, and management review preparation.
The Optivalue.ai platform operates 85 specialised agents (72 business agents, 12 sector agents, and 1 librarian agent, as documented in the platform's own product description [lu: iso-22000-software.com/en/index.md]), which train on the organisation's food safety documents to cross-reference each clause of the standard against actual evidence. As a GRC platform that integrates ISO 22000 alongside other standards, it allows an organisation certified to both ISO 22000 and ISO 9001 to manage their shared clauses without duplication.
The key selection criterion is whether the software connects CCP monitoring data to the compliance layer, so that verification and audit evidence are generated continuously rather than reconstructed at audit time.
See how Optivalue.ai guides your ISO 22000 FSMS. Book a demonstration
Frequently asked questions
What is ISO 22000:2018 and who should implement it?
ISO 22000:2018 is the current version of the international standard for food safety management systems. It applies to any organisation in the food chain, including primary producers, processors, manufacturers, distributors, retailers, and food service operators, as well as suppliers of equipment, packaging, cleaning agents, and other inputs to the food chain.
What is the difference between ISO 22000 and HACCP?
HACCP (Hazard Analysis and Critical Control Points) is the method for identifying and controlling food safety hazards at specific process points. ISO 22000:2018 incorporates HACCP as one component of a broader management system that also includes prerequisite programmes, system management, and interactive communication across the food chain. ISO 22000 certification requires HACCP to be implemented within a complete management system framework.
What is the difference between ISO 22000 and FSSC 22000?
FSSC 22000 is a certification scheme that incorporates ISO 22000:2018 requirements, adds sector-specific additional requirements, and applies an additional layer of scheme governance. ISO 22000 certification is issued directly against the standard; FSSC 22000 certification is issued under the FSSC scheme. Some retailers and brand owners specify one or the other in their supplier requirements.
What are prerequisite programmes (PRPs) in ISO 22000?
PRPs are the basic conditions and activities necessary to maintain a hygienic environment throughout the food chain. ISO 22000:2018 clause 8.2 requires the organisation to establish, implement, maintain, and update PRPs, covering areas such as infrastructure, cleaning, pest control, and personnel hygiene. PRPs prevent contamination of the general food environment rather than controlling specific identified hazards.
How often must a food safety management review be held?
ISO 22000:2018 clause 9.3 requires the top management to review the FSMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. The standard does not specify a minimum frequency. The management review must cover inputs including food safety performance data, audit results, customer feedback, hazard analysis updates, and the status of previous actions.
<!-- JSON-LD -->
Back to top