ISO 22000 Food Safety Management

In scope terms, ISO 22000 specifies what an organisation must have in place to plan, implement, operate, maintain, and improve a food safety management system. It requires the organisation to understand its context and interested parties, to demonstrate leadership, to plan its system around identified risks, to establish and resource operational control — including prerequisite programmes and a hazard analysis on HACCP principles — and to evaluate and improve performance through monitoring, internal audit, and management review.

It shares the high-level structure common to modern ISO management-system standards, which is what allows an organisation to run it alongside quality or environmental management systems without duplicating the machinery. Two features are particular to food: the emphasis on communication both up and down the chain, since a hazard controlled at one link depends on information from another; and the explicit treatment of prerequisite programmes as the foundation on which hazard analysis is built.

ISO writes standards; it does not certify anyone, operate certification schemes, or issue certificates. Certification to ISO 22000 is carried out by independent certification bodies, which are themselves typically accredited by a national accreditation body against the international standard for bodies certifying management systems. The certificate attests that an audit found the organisation’s system conforming to the standard’s requirements at the time of assessment.

Certification is not required in order to use the standard. An organisation may implement ISO 22000 and self-declare conformity, and many do — certification exists because customers want independent evidence rather than because the standard demands it. Where a certificate is required it is almost always a buyer requirement, and buyers in some markets specify schemes benchmarked to a global food-safety benchmark instead of, or in addition to, ISO 22000 itself.

The most important boundary is between system and product. A certified organisation has demonstrated that it manages food safety systematically; it has not demonstrated that any particular batch is safe, and the standard makes no such claim. A certificate cannot be attached to a consignment as evidence about that consignment, and a food safety incident at a certified site is not, by itself, evidence that certification was fraudulent — it is what the residual risk in any system looks like when it materialises.

• Not a product certification — nothing is certified about a batch, lot, or consignment
• Not a legal permission — market access is set by law, not by a certificate
• Not a substitute for the hazard analysis — the standard requires it, it does not do it
• Not a quality standard — food safety and commercial quality are different questions
• Not continuous — an audit examines a sample of evidence at a point in time
• Not an ISO certificate — ISO neither certifies nor accredits anyone