ISO 22000: what certification asks for beyond HACCP

ISO 22000 is the international standard for food safety management systems. It takes the hazard analysis approach everyone already knows from HACCP and places it inside the management-system structure common to ISO standards: context and interested parties, leadership, objectives, competence, documented information, internal audit, management review and continual improvement. Certification against it is done by an accredited body, in stages, and it is renewed rather than earned once.

The practical question is not what the standard says. It is whether anybody is asking you for it. Certification costs real money and real management time every year, and it is worth that when it opens or protects a commercial relationship — a retailer, a distributor, an export market — and not otherwise.

What ISO 22000 adds

• Two levels of planning: operational prerequisite programmes as well as critical control points, with a documented reason for classifying each control as one or the other.
• Explicit top-management responsibility, including a stated food safety policy and measurable objectives.
• Communication requirements, internal and external, including with suppliers and authorities.
• Emergency preparedness and response, beyond the recall procedure itself.
• Internal audit at planned intervals, by people independent of the area audited.
• Management review with defined inputs and outputs, minuted.
• Continual improvement, evidenced by what changed and why.
• Control of documented information: current versions available where used, obsolete ones withdrawn.

ISO 22000 or a GFSI scheme

ISO 22000 alone is not recognised by the Global Food Safety Initiative; the recognised route pairs it with a prerequisite specification as FSSC 22000, and the alternatives are BRCGS, SQF and IFS. Which one you need is decided by your customers, and asking them before starting is the cheapest step in the whole project. Businesses regularly certify to the wrong scheme, discover the retailer wanted a different one, and pay twice.

The most common audit finding is not a food safety failure. It is documented information that is out of control: two versions of a procedure in circulation, records signed in a different hand from the person who did the task, and a plan whose review date passed a year ago.

What to prepare before an audit

1. Confirm which standard your customers actually require, in writing.
2. Run a gap analysis against the clauses, honestly, and list what is missing rather than what is arguable.
3. Fix the document control first: one current version of everything, obsolete copies withdrawn, a register of what exists.
4. Run at least one full internal audit cycle and one management review before booking the certification body, so there is evidence of the system operating.
5. Close your own findings and keep the evidence — an auditor is more reassured by findings you raised and closed than by a system that never found anything.

Documented information, in practice

The clause that generates the most work is the least glamorous one: knowing which version is current, who has it, and what the records prove. Ettex Docs holds the procedures with version history so the version in force on any date is recoverable, Ettex Records keeps the audit findings, management reviews, training and supplier evidence per site, and the day-to-day monitoring behind it belongs with the food safety management system that the standard certifies.

To be clear: nothing here is certification advice and we are not an auditor. The standard is a purchasable document, the requirements are its own, and your certification body — not a blog — decides whether you meet them.