ISO 22000:2018 Food Safety Management (FSMS) compliance software
Assess and evidence your food safety management system — the standard's clauses, the HACCP plan, the prerequisite programmes and the food legislation of every market you supply — per branch, rolled up to the group.
- Issuing bodyISO, current edition 2018; ISO/TS 22002-1:2009 for manufacturing PRPs
- Assessable items251 assessable items (124 standard and PRP items + 127 legislation obligations), 115 of them critical
- DomainsClauses 4–10 with HACCP (8.5) as its own domain, 14 PRP topics, and a legislation overlay for 16 countries
- AnswersImplemented, Partially Implemented, Not Implemented, Not Applicable — a critical item answered Not Implemented is a major nonconformity
- ScopeEnterprise / group, or a branch by type: manufacturing plant, warehouse / cold store, retail / food service, primary production
- CertifiableYes, via accredited certification bodies; GRCLens prepares the assessment and does not issue certificates
What ISO 22000 requires
Who it applies to
- Food and beverage manufacturers and processors pursuing or holding ISO 22000 or FSSC 22000 certification
- Food groups with several plants, cold stores, distribution centres, outlets or farms that need one posture per branch and one view of the group
- Exporters supplying markets across the Gulf, South and South-East Asia and Oceania, each with its own food law and regulator
- Retail, food service and catering operators asked by customers, insurers or regulators to evidence a working FSMS and HACCP plan
ISO 22000:2018 specifies the requirements for a food safety management system (FSMS): the context, leadership, planning, support, operation, performance evaluation and improvement clauses (4–10) that any organisation in the food chain — primary production, processing, storage and distribution, retail, food service — must operate to deliver safe food. Its operational core, clause 8, carries the HACCP hazard control plan (hazard analysis, CCPs and OPRPs, critical limits, monitoring, corrective action, verification) alongside traceability, emergency preparedness and withdrawal/recall.
The standard assumes prerequisite programmes underneath it and points to ISO/TS 22002-1 for the manufacturing ones: construction and layout, utilities, waste, equipment, purchased materials, cross-contamination and allergens, cleaning, pest control, personnel hygiene, rework, recall, warehousing, food defence and product information. GRCLens assesses those as a domain of their own, because an auditor walks them separately from the clauses.
Food safety is also the law, and the law is national. GRCLens overlays the primary food statute of 16 countries — Australia, New Zealand, Fiji, Tonga, Indonesia, Malaysia, Singapore, Oman, the UAE, Saudi Arabia, Kuwait, Qatar, Bahrain, Pakistan, Bangladesh and India — as licensing, registration, hygiene, labelling, recall and notification obligations, asked only for the markets a branch actually supplies. The requirements are paraphrased for assessment; ISO's text is not reproduced.
How GRCLens supports ISO 22000
ISO 22000 runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Enterprise and branch assessment with roll-up
The group answers the management-system clauses once; each plant, cold store, outlet or farm answers the operational items and its own country's law. The enterprise view leads with the weakest branch, not the average, and adds a heat map of eleven food-safety risk areas — biological, allergen, physical, hygiene, supplier, traceability, legal, food defence and more — so a board sees which kind of risk a weak site carries.
16-country legislation overlay
Tick the markets a branch supplies and that country's food-law obligations join the questionnaire, each traced to the statute and regulator. The dashboard reports legal conformity per jurisdiction with the open gaps listed.
Major and minor nonconformities, not just a percentage
115 critical controls — CCP monitoring, recall, allergen control, potable water, licensing — are marked in the catalogue. A site can score 88% with one open; the band says 'Major nonconformity open' and the dashboard lists exactly which.
Seven food-safety connectors validate the answers
Cold-chain loggers, LIMS results, pest control, calibration, supplier approval, training records and recall exercises are read against the questionnaire. A failing check whose requirement was answered Implemented is flagged as a contradiction and can be recorded straight into the assurance register with an owned, dated action.
Word and PDF reports, branch and enterprise
A branch report with the score by clause, the risk map, every answer, the legislation position and the open nonconformities; an enterprise report across all sites. Both as Word and as PDF.
Bilingual operation
The catalogue and the dashboards operate in English and Arabic with right-to-left layout, for Gulf food businesses whose regulators and auditors work in Arabic.
ISO 22000 frequently asked questions
Is ISO 22000 certifiable?
Yes. ISO 22000 is a requirements standard and organisations are audited and certified against it by accredited certification bodies; FSSC 22000 builds on it with sector PRPs and additional requirements. GRCLens prepares and organises the assessment and evidence; it does not issue certifications.
How does GRCLens handle a food group with many sites?
Each branch is assessed on its own with a site type (manufacturing, warehouse or cold store, retail or food service, primary production), which decides which operational items it is asked. The enterprise assessment covers the management-system clauses. Every branch rolls up into one enterprise view with a per-risk-area heat map and an enterprise report.
Which countries' food law does the overlay cover?
Australia, New Zealand, Fiji, Tonga, Indonesia, Malaysia, Singapore, Oman, the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain, Pakistan, Bangladesh and India — 127 obligations in total, each citing the primary statute and its regulator. A branch answers only the countries selected for it.
Does GRCLens reproduce the text of ISO 22000?
No. The requirements are paraphrased for assessment and each item cites the clause it derives from; the standard itself must be obtained from ISO or a national member body.
What are the food-safety connectors?
Seven evidence feeds — cold-chain temperature loggers, LIMS laboratory results, pest-control service records, calibration, supplier approval, training records and recall exercises — whose checks are linked to the catalogue items they validate. A check that fails while its item was answered Implemented is surfaced as a contradiction.
Talk to us about ISO 22000
Security Solution Consultants provides Food safety management advisory services alongside the platform, so you can combine tooling with hands-on expertise.