ISO 22000 is what buyers ask for when HACCP alone isn't enough. It combines the HACCP food safety principles with a full management system — supplier management, infrastructure requirements, internal audit, management review. If you supply to large retail chains, hotel groups, or international buyers, ISO 22000 is increasingly the standard they require.
ISO 22000:2018
Current version — Annex SL structure
HACCP embedded
7 HACCP principles within the FSMS
NABCB
Accredits CBs in India
Your company is implementing ISO 22000 and you need to understand your role. ISO 22000 means every step of food production is documented, every critical control point is monitored, and every supplier is verified. Your job is to follow food safety procedures, record what you observe, and report any food safety concern immediately.
PRPs
Prerequisite programmes you follow every day
CCPs
Critical control points you monitor at specific stages
Traced
Every batch traceable from raw material to customer
Quick reference. ISO 22000:2018 — Annex SL structure (same HLS as ISO 9001:2015). Key clauses: 8.2 PRPs, 8.5 Hazard analysis, 8.6 HACCP plan (CCPs), 8.8 Verification. FSSC 22000 v6 = ISO 22000 + sector-specific ISO/TS + FSSC additional requirements. NABCB accredits CBs for ISO 22000 in India.
2018
Current version
Annex SL
Integrates with ISO 9001
FSSC 22000
ISO 22000 + sector PRPs + FSSC additions
ISO 22000:2018 is a Food Safety Management System standard published by ISO. The 2018 revision adopted Annex SL — the same high-level structure as ISO 9001:2015 and ISO 45001:2018 — making integrated management systems simpler. It incorporates the 7 Codex Alimentarius HACCP principles within a full management system framework.
2005
First published
2018
Current version — Annex SL
Codex HACCP
7 principles embedded within FSMS
Required by major retail chains, hotel chains, and food exportersCombines HACCP with ISO management system structureMore comprehensive than HACCP alone
What’s on this page
01 —What it isUnderstanding ISO 22000
HACCP inside a management system — proof that your food safety is systematic, not just procedural.
ISO 22000 is a Food Safety Management System (FSMS) standard. It incorporates the 7 Codex Alimentarius HACCP principles within a full management system structure — supplier management, infrastructure requirements, competence of personnel, internal audit, management review, and continual improvement.
The difference from HACCP alone: HACCP is a set of food safety principles applied to your process. ISO 22000 requires a complete documented management system that ensures those principles are consistently applied, monitored, and improved across the whole organisation.
ISO 22000:2018 uses Annex SL — the same clause structure as ISO 9001:2015 and ISO 45001:2018. Organisations that already hold ISO 9001 can integrate ISO 22000 more efficiently, often through a combined audit.
ISO 22000 vs FSSC 22000: FSSC 22000 v6 = ISO 22000:2018 + sector-specific ISO/TS technical specifications + FSSC additional requirements. FSSC 22000 is more widely demanded by global FMCG buyers and food service companies. If your buyer specifies FSSC 22000, ISO 22000 alone is not sufficient. Confirm your buyer's requirement before selecting which standard to pursue.
👥 Illustrative case — details changed for confidentiality
The business
Ready-to-drink beverage manufacturer Mysore · 80 employees, supplying modern retail and hotels
The trigger
A hotel chain asked for ISO 22000 certification before adding them to their approved supplier list. The manufacturer had FSSAI and basic food safety practices but no formal FSMS.
The challenge
Their HACCP plan was basic and undocumented. CCP monitoring records existed on paper for some batches but not all. The prerequisite programme (PRP) documentation — supplier management, pest control, cleaning — was scattered across different departments.
Where Clicarity came in
They had deployed Clicarity for production batch tracking. Every batch had a digital record: stage, operator, timestamp, quantity, and CCP parameters. Their ISO 22000 consultant confirmed that the Clicarity batch records provided the foundation for Section 8 (Operation) evidence. The PRP documentation was built alongside. Certification was achieved in 7 months.
The result
ISO 22000 certification achieved. Hotel chain approval confirmed. Two additional buyers approached them after the certificate was published.
We had more of the evidence than we realised. The Clicarity batch records covered most of what the auditor needed for the production operation section.
02 —Who needs itIs it right for you?
Do you actually need it? Honest answer.
✓ You need it
Food manufacturers supplying large retail chains or hotel groups
Food exporters whose buyers require a food safety management system standard
Businesses pursuing FSSC 22000 (ISO 22000 is the foundation)
Food processors that have already implemented HACCP and want the full management system
∼ Worth considering
Mid-size food processors with multiple products and a large supplier base
Businesses already holding ISO 9001 who want to integrate food safety
— HACCP may be sufficient
Small food manufacturers where buyers have not specifically asked for ISO 22000
Verify with your specific buyer — requirements vary
03 —What it requiresWhat is checked
What ISO 22000 requires beyond HACCP.
1
Prerequisite Programmes (PRPs)
Written procedures for the operational conditions that support safe food production: facility hygiene, pest control, supplier management, equipment maintenance, personal hygiene.
E.g. Written PRP for pest control: contractor details, treatment frequency, map of bait stations, inspection records.Most common gap: PRPs documented but not implemented consistently. Auditors verify PRPs by observation and records — not just the written document.
2
Hazard analysis and HACCP plan
Full hazard analysis identifying biological, chemical, and physical hazards at every process step. CCPs identified and critical limits set.
E.g. Pasteurisation CCP: critical limit defined, monitoring frequency set, corrective action procedure for when limit is not met.
3
Operational PRPs (OPRPs) for significant hazards without CCPs
Hazard control measures that are not CCPs but require operational procedures and monitoring — the category between a PRP and a CCP.
E.g. Allergen control procedure for a production line with both allergenic and non-allergenic products.
4
Traceability system — one step back, one step forward
Ability to trace any finished product batch to its raw material lots and to identify all customers who received it within a defined timeframe.
E.g. Batch number traces to: supplier lot numbers of all ingredients, production date and shift, finished product dispatch records.
5
Supplier evaluation and management
Written procedure for evaluating, approving, and monitoring food ingredient suppliers. Records of evaluations.
E.g. Approved supplier list with annual review. New supplier questionnaire and on-site audit for critical ingredients.
6
Internal audit and management review
Annual internal FSMS audit covering all clauses. Formal management review with documented decisions and resource commitments.
Most common gap: Internal audit covers production but not the management system clauses (context, leadership, performance evaluation).
7
Verification and validation
Verification that the FSMS is working (testing finished products, reviewing monitoring records). Validation that control measures are effective.
E.g. Quarterly finished product microbiological testing. Process validation studies for new products.
What inspectors really check
They will check PRPs by observation (is the pest control actually in place?) and records (is it documented?). Then: "Show me the HACCP plan and show me CCP monitoring records for the last month." Traceability is often tested: they name a batch and ask you to trace it forward and backward within 4 hours.
Gap analysis checklist — tick what you already have
PRPs written and implemented for all areas (hygiene, pest, supplier, maintenance)
Verified by records and observation.
Full hazard analysis completed for all process steps
Biological, chemical, physical, and allergen hazards assessed.
HACCP plan with CCPs, critical limits, and monitoring procedures
Daily CCP monitoring records being maintained.
Traceability system tested — forward and backward within 4 hours
Batch trace exercise conducted and documented.
Approved supplier list maintained with annual review
Critical ingredient suppliers evaluated.
Corrective action records for any CCP deviation
Every deviation investigated, root cause, and corrective action documented.
Internal FSMS audit covering all clauses completed in last 12 months
Including management system clauses, not just production.
Management review documented with decisions and resources assigned
Not just a meeting — documented outputs.
0 of 8 complete
04 —Official bodyWho certifies in India
Who issues this in India — and how to verify it.
ISO 22000 is certified by NABCB-accredited certification bodies in India. For FSSC 22000, the CB must also be licensed by FSSC (Food Safety System Certification).
If your buyer asks for FSSC 22000: Confirm with them before engaging a CB. FSSC 22000 requires an additional FSSC-licensed CB and the sector-specific ISO/TS. It is more rigorous than ISO 22000 alone.
NABCB — Find accredited food safety CBs
Verify CB accreditation for ISO 22000. Check food safety scope.
Cover all clauses including management system, not just production.
Step 5
Management review
Formal, documented, with resource decisions.
Certification
CB audit
With required records period. Select NABCB-accredited CB.
▶Where to begin: Use the checklist in Section 3 to assess your readiness before contacting any CB.
Timeline
Confirm with your CB
Varies by existing HACCP maturity and organisation size.
Certificate validity
3 years (confirm with CB)
Annual surveillance audits.
With ISO 9001
Integrated audit possible
Both use Annex SL. Combined audits often more efficient.
FSSC 22000 vs ISO 22000
Confirm buyer requirement
FSSC 22000 more rigorous and more widely demanded by FMCG buyers.
PRPs are the most underestimated part of ISO 22000. Many food businesses have HACCP documented but PRPs are informal or inconsistent. Auditors find PRP implementation gaps more often than HACCP gaps because PRPs are verified by observation, not just documents.
06 —Find certified companiesHow to verify
How to find and verify certified organisations.
ISO 22000 is held by food manufacturers, processors, and distributors across India. To verify whether a specific organisation is currently certified, use the IAF global register or contact the NABCB-accredited CB that issued their certificate.
How to verify: To confirm whether any organisation holds a current ISO 22000 certification, use the official register. Verify the issuing CB's accreditation at nabcb.qci.org.in.
You cannot implement ISO 22000 without a documented HACCP plan. Start with hazard analysis, CCP identification, and daily CCP monitoring records.
2
Write your Prerequisite Programmes — one per area
Facility hygiene, pest control, supplier management, equipment maintenance, personal hygiene. Each as a separate documented procedure with implementation records.
3
Confirm with your buyer whether they need ISO 22000 or FSSC 22000
Before engaging a CB, confirm the exact standard your buyer requires. If FSSC 22000 is required, your CB must be FSSC-licensed — a subset of NABCB-accredited CBs.
Good records are the foundation. A process tracker builds them automatically.
Clicarity — Live Job Process Tracker & Bottleneck Identifier
Clicarity doesn't implement your FSMS. It tracks your production batches — and when your HACCP stages are mapped to Clicarity stages, the monitoring records are built as part of daily work.
ISO 22000 requires evidence that the food safety management system is operational — not just documented. The auditor wants to see batch-level records showing that PRPs were applied, CCPs were monitored, and corrective actions were taken when limits were breached. In Clicarity, every production batch is a job. Each stage captures the monitoring data your HACCP plan requires. When a batch splits into pack formats, each format is tracked through filling and QC independently. When they rejoin at final release, the complete monitoring record of every format is preserved.
Supplier verification captured at receipt: supplier name, FSSAI number, lot number, condition — the PRP supplier management evidence ISO 22000 Section 8.4 requires.
CCP stage fields: temperature, hold time, pass/fail, corrective action — monitoring record created as part of daily production, not assembled for the audit.
When a batch splits into pack formats, each format tracked through its own filling and QC checks independently. Complete trace from raw material to each format preserved.
Clicarity shows batch-wise yield — quantity in vs quantity out vs losses by stage — which is the production monitoring data ISO 22000 expects for traceability and verification.
📄 Job tracked in Clicarity
#WO-5540 — Fruit juice production batch — 5,000 litres
Job created
✎Product name
#Batch size (L)
📅Production date
✎Customer order ref.
▼Authorised by
→
Raw material receipt & verification
▼Supplier
✎Lot no.
#Qty received (L)
▼FSSAI no. of supplier
▼Condition verified by
→
Washing & sorting
#Qty in (kg)
#Qty passed (kg)
#Qty rejected (kg)
▼Rejection reason
▼Operator
→
Extraction & blending
#Qty in (kg)
#Juice yield (L)
#Brix reading
▼Operator
▼Equipment no.
▼ Job splits — each component tracked independently
#WO-5540-A
1L pack — 3,000 units
#Qty to filling
▼Operator
▼Machine no.
#WO-5540-B
500ml pack — 4,000 units
#Qty to filling
▼Operator
▼Machine no.
▲
Components rejoin as #WO-5540 — complete record of every branch, every data point, every sign-off preserved.
CCP
Pasteurisation ⚠ CCP
#Temp reached (°C)
#Hold time (sec)
▼Operator
▼Critical limit met
✎Corrective action if no
→
Filling & sealing
#Qty filled
▼Seal integrity check
✎Batch code on pack
📅Best before date
▼Operator
→
Final QC & release
▼QC analyst
#Sample size
▼Pass / Fail
✎COA ref.
▼Released by
Wastage tracked:▰ Sorting: rejected fruit quantity and reason recorded▰ Pasteurisation CCP: temp + hold time captured — corrective action if limit breached▰ Each pack format tracked through filling and QC independently
ⓘ Fields and stage names are fully customisable. This illustrates a typical food manufacturer / ISO 22000 FSMS setup.
👥 Illustrative case — details changed for confidentiality
The business
Ready-to-drink beverage manufacturer Mysore · 80 employees, supplying modern retail and hotels
The trigger
A hotel chain asked for ISO 22000 certification before adding them to their approved supplier list. The manufacturer had FSSAI and basic food safety practices but no formal FSMS.
The challenge
Their HACCP plan was basic and undocumented. CCP monitoring records existed on paper for some batches but not all. The prerequisite programme (PRP) documentation — supplier management, pest control, cleaning — was scattered across different departments.
Where Clicarity came in
They had deployed Clicarity for production batch tracking. Every batch had a digital record: stage, operator, timestamp, quantity, and CCP parameters. Their ISO 22000 consultant confirmed that the Clicarity batch records provided the foundation for Section 8 (Operation) evidence. The PRP documentation was built alongside. Certification was achieved in 7 months.
The result
ISO 22000 certification achieved. Hotel chain approval confirmed. Two additional buyers approached them after the certificate was published.
We had more of the evidence than we realised. The Clicarity batch records covered most of what the auditor needed for the production operation section.
Clicarity is a process tracking tool. It does not provide certification, consulting, or audit services.