ISO 22000 certification in 2026: what a food safety management system has to show, site by site

What ISO 22000:2018 requires

ISO 22000 follows the same high-level structure as ISO 9001 and ISO 27001: context of the organisation (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). The management-system clauses ask the questions any certification body asks: is there a food safety policy, are there measurable objectives, is a food safety team leader appointed, are people competent and aware, are documents and records controlled, is the system audited internally and reviewed by top management.

Clause 8 is where food safety lives. It requires prerequisite programmes (8.2), a traceability system that works one step back and one step forward (8.3), emergency preparedness (8.4), the hazard analysis and hazard control plan (8.5), calibration of monitoring equipment (8.7), verification (8.8) and the control of nonconforming product, including withdrawal and recall (8.9). Certification auditors spend most of their time here, and so should you.

HACCP and the prerequisite programmes: two layers, one plan

ISO 22000 does not replace HACCP; it contains it. Clause 8.5 is the Codex sequence — describe the product and its intended use, draw and confirm the flow diagram, identify every reasonably expected biological, chemical (including allergen) and physical hazard, assess it, and select control measures — with one ISO addition: each significant hazard is managed either at a critical control point (CCP) with a measurable critical limit, or by an operational prerequisite programme (OPRP) with an action criterion. Both must be validated before use and monitored with calibrated devices at a frequency that can catch a failure before product leaves.

Underneath sit the prerequisite programmes. ISO/TS 22002-1 lists them for food manufacturing: site and layout, utilities, waste, equipment, purchased materials, cross-contamination (including allergens and foreign bodies), cleaning and sanitising, pest control, personnel hygiene, rework, warehousing and transport, product information, and food defence and food fraud. A plant that scores well on its HACCP plan and poorly on its PRPs is the most common surveillance-audit failure we see, because PRPs are run by maintenance, hygiene and warehouse teams who were never told they own part of the certificate.

The national food law sits on top of the certificate

ISO 22000 asks you to identify and meet the statutory and regulatory food-safety requirements of every jurisdiction you make or sell in, and it does not tell you what they are. That is where most multi-market groups are exposed. The obligations differ in kind, not just in wording: who licenses the business, whether HACCP is compulsory and for whom, who must hold a food-handler certificate or a medical clearance, how fast a recall is notified and to whom, what the label must declare and in which language, and whether halal certification is mandatory.

The other eight — Fiji, Tonga, Oman, Kuwait, Qatar, Bahrain, Pakistan and Bangladesh — have the same pattern: a licence before operating, a health or medical requirement on handlers, recall cooperation with the authority, labelling rules, and halal or import certificates where they apply. In GRCLens each country is an overlay of five to eight obligations, sourced from the regulator, that a site switches on by selecting the markets it sells into.

Why multi-site groups fail, and what an enterprise view has to show

A certificate can be issued to a group with a single FSMS covering several sites, and that is where the trouble starts. Head office answers the governance clauses well. The plant in one country, the distribution centre in another and the central kitchens in a third each run the operational clauses, the PRPs and their own national law — and their results are averaged into a number the board never questions. The group's food safety risk is not the average of its sites. It is the weakest site's, because a recall starts at one plant.

• Enterprise view: weakest site first, a heat map by hazard area across sites, open major nonconformities counted once per site, and failing connector checks.
• Branch view: conformity and band, major and minor nonconformities, critical-control conformity, PRP and HACCP scores, and the legislation panel for the markets that site sells into.
• Operational view: every clause and programme with its owner, effectiveness and open tasks, validated continuously by the plant's own data — temperature loggers, LIMS, supplier certificates, the LMS, pest and sanitation logs, the CMMS and the ERP's mock-recall results.

A control the questionnaire says is implemented while the data says it failed is the finding an audit cannot produce from paper, and it is the one that predicts the next recall. Treat a critical control — CCP monitoring, recall, allergen management, potable water, the operating licence — answered as not implemented as a major nonconformity whatever the overall percentage says; certification bodies do.

An ISO 22000 audit checklist you can actually run

1. Legal register names the regulator and instrument for every market, with an owner and review date.
2. Flow diagrams confirmed on site, signed and dated by the food safety team.
3. Every CCP and OPRP has a validation study, a documented critical limit or action criterion, and complete monitoring records for the last shift.
4. Calibration register current for every CCP instrument; out-of-calibration incidents assessed for product impact.
5. Last mock recall reconciled 100 percent of a lot inside the target time, forward and backward.
6. Approved supplier list matches actual purchases; GFSI or HACCP certificates not expired.
7. Food-handler certificates and medical clearances current where the jurisdiction requires them.
8. Environmental monitoring positives investigated, with corrective action closed and verified.
9. Management review covered regulator and customer inspections, complaints, incidents and recalls.

GRCLens carries ISO 22000:2018 as an assessment per enterprise or per branch, with the HACCP plan, the ISO/TS 22002-1 programmes and the sixteen-country legislation overlay, the three-level dashboards described above, seven food-safety connectors for continuous control validation, and Word and PDF reports for a site and for the group. The requirements are written in our own words for assessment; the standard itself is licensed from ISO. For how the same continuous-assurance approach works in cyber and privacy, see continuous compliance: collect evidence once and our GRC platform requirements checklist.

Primary sources

ISO 22000:2018 Food safety management systems — Requirements for any organization in the food chain. ISO/TS 22002-1 Prerequisite programmes on food safety — Part 1: Food manufacturing. Codex Alimentarius CXC 1-1969, General Principles of Food Hygiene (rev. 2020). FSANZ, Standard 3.2.2A Food Safety Management Tools. MPI, Food Act 2014. Singapore Food Agency, Food Safety and Security Act 2025 commencement notices. BPJPH, halal certification deadlines. SFDA, Food Law and technical regulations. FSSAI, FSS Act 2006 and regulations. BFSA, Food Safety (Registration and Licensing) Regulations 2026.

This article is general information, not legal advice. Confirm current requirements with the regulator before relying on them.