ISO 22000 — Food Safety

What does ISO 22000:2018 require from a food business?

ISO 22000:2018 follows the same high-level structure as ISO 9001:2015, so context, leadership, planning, support, performance evaluation and improvement will look familiar to anyone who has run a quality system. The food-specific work sits in clause 8, Operation, and that is where most of the build effort goes.

Auditors look for a clear line from each hazard to the control that manages it and the record that proves the control worked. The requirements below are the ones that take the most time to get right on a plant floor.

ISO 22000, FSSC 22000 or HACCP: which one will your customers accept?

These three are often confused. HACCP is a method, not a management system. It is the seven-principle approach to hazard analysis and critical control points set out by the Codex Alimentarius, and it sits inside both ISO 22000 and FSSC 22000.

ISO 22000 is a certifiable management system standard, but ISO 22000 on its own is not recognized by the Global Food Safety Initiative (GFSI). FSSC 22000 is. It is built on ISO 22000, adds sector-specific prerequisite programs from the ISO 22002 series, and adds its own scheme requirements. FSSC 22000 Version 7 was released on 1 May 2026, and audits against Version 6 are permitted until 30 April 2027.

The deciding question is what your customers write into their supplier requirements. If a retailer or brand owner asks for a GFSI-recognized certificate, ISO 22000 alone will not meet that requirement. If customers ask for a certified food safety management system without naming GFSI, ISO 22000 is often enough.

How does ISO 22000 fit with the Safe Food for Canadians Regulations?

Under the SFCR, a business that holds a Safe Food for Canadians license to manufacture, process or package food for interprovincial trade, or to import food, generally must prepare, keep and implement a written preventive control plan (PCP). Some small businesses are exempt, and the CFIA publishes an interactive tool for checking which requirements apply.

ISO 22000 certification does not replace your SFCR license or your preventive control plan. The CFIA inspects against the regulations, not against a certificate. What ISO 22000 does is give the PCP a management system around it: internal audits, management review, competence records and corrective action that keep the plan accurate as products and lines change.

The overlap is large. A PCP covers hazards, control measures, critical control points with critical limits, monitoring, corrective action, verification and records kept for two years. Those are the same building blocks as the ISO 22000 hazard control plan, so one set of documents can serve both, provided it is written to meet the stricter wording of each.

Supplier control is shared too: in the compliance software, Supplier Quality holds supplier approval gates and compliance documents with expiry dates. The food and beverage industry page shows how this fits across the sector.

How long does ISO 22000 certification take, and what drives the cost?

For a single-site processor that already runs a working PCP, certification typically takes six to twelve months from gap analysis to certificate. A site starting with informal prerequisite programs, or one that needs facility repairs before sanitation and pest control can be signed off, should plan for longer.

Certification bodies want to see the system operating, not just written. Before the stage 2 audit you need monitoring records, at least one full internal audit cycle and a management review, which sets a floor on how fast any project can move.

The main factors that move the timeline and the budget are the number of products and process lines in scope, how many sites are included, the state of the existing prerequisite programs, how much validation evidence exists for critical limits, and the time your own team can give the project each week. A free readiness check gives a first view of where your site stands before you commit to a plan.