Integrated programme
ISO 9001 and HACCP together: quality management with a food safety plan built in: video
A film on building the HACCP plan and its prerequisite programmes inside an ISO 9001 quality system for food businesses that need both.
Key takeaways
- Prerequisite programmes come before the HACCP plan.
- HACCP monitoring and corrective actions run through the ISO 9001 processes.
- One set of records serves quality and food safety audits.
- Check whether a HACCP certificate is accredited and accepted by your buyers.
- The same foundations support ISO 22000, FSSC 22000 or BRCGS later.
Quality and food safety in one set of records
Food manufacturers, caterers, packers and distributors often need two things: ISO 9001 for consistent quality and customer satisfaction, and HACCP to control food safety hazards. Run separately, the two produce parallel documents, training, audits and corrective actions. Built together, the HACCP plan and its prerequisite programmes sit inside the ISO 9001 system, so those activities run once.
This short film walks through how that combined system is put together, from the site walk and gap analysis to monitoring and verification records an auditor can follow.
The same foundations later support ISO 22000, FSSC 22000 or BRCGS if a buyer asks for a GFSI-recognised scheme.
HACCP is the Codex method, with its seven principles and the plan they produce on a foundation of good hygiene practices, and it fits inside the quality system rather than beside it.
Prerequisites first, then the plan and the quality system around it
The programme confirms the products, processes, sites and the scheme or certificate buyers ask for, then walks the site and reviews current practices, records and any existing certificates against ISO 9001 and HACCP. Prerequisite programmes come first: hygiene, cleaning, pest control and the other conditions every food business needs. The HACCP plan follows, with hazard analysis, critical control points, limits, monitoring and corrective actions, and the quality system wraps around both.
HACCP monitoring, verification and corrective actions then run through the ISO 9001 processes, with hygiene, monitoring, complaints and nonconformities in one place and quality and food safety evidence ready for customer and retailer audits. Whether HACCP certification is accredited depends on the country and the certification body, so that is checked against what buyers accept before anything is signed. Where a retailer asks for BRCGS or FSSC 22000, HACCP alone is usually not enough, but the same foundations support ISO 22000, FSSC 22000 or BRCGS when buyers ask for them.
A Sterling engagement team carries both parts of the programme, quality and food safety, in one Effivity workspace and for one agreed fee; the certification body, not Sterling, audits and decides.
ISO 9001 at a glance
- Purpose
- Quality management: consistent delivery of products and services, and improvement on evidence
- Relevant to
- Organisations of any size or sector, single site or multi-country
- Edition
- ISO 9001:2026; certificates to the 2015 edition transition on the timetable your certification body confirms
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Consulting with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 9001 QMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
ISO 9001: questions people ask
Can a small business implement ISO 9001?
Yes. The system should be proportionate to your activities, risks and complexity. A small team usually needs clear responsibilities and practical controls, not an unnecessarily large set of procedures.
Does ISO 9001 require us to replace our existing processes?
No. Start by understanding what already works and what evidence exists. Improve or add controls where the gap analysis shows a shortfall, rather than rebuilding everything.
Is ISO 9001 certification mandatory?
No law requires it in general, although customers, tenders and some regulated supply chains make it a condition of doing business. Many organisations implement ISO 9001 with no external demand at all, because they want consistent delivery and a disciplined way to improve.
Does Sterling issue the ISO 9001 certificate?
No. Sterling provides consulting and hands-on support. An independent, accredited certification body conducts the certification audit and makes the certification decision. A provider that offers to do both is offering paper.
Can we combine ISO 9001 with other standards?
Yes, where appropriate. Shared document control, internal audit and management review can support an integrated system with ISO 14001, ISO 45001, ISO/IEC 27001 or ISO 22000, on the harmonised structure. The specific requirements of each standard still need to be addressed.
Keep exploring
Related to this video
The complete guide
Everything on ISO 9001
Start with the ISO 9001 page · HACCP, or go straight to the guide you need.
On the ISO 9001 page
Guides
- ISO 9001:2026
- ISO 9001 audit questions
- ISO 9001 benefits
- The ISO 9001 certification process, step by step
- ISO 9001 checklist
- Choosing an ISO 9001 certification body
- ISO 9001 common mistakes
- ISO 9001 certification cost
- Do you need ISO 9001? A decision guide for owners, boards and the people who sign tenders
- ISO 9001 documentation
- Effivity for ISO 9001
- ISO 9001 gap analysis
- How to Choose an ISO Consultant in 2026
- ISO 9001 implementation plan
- Integrated management system audit
- Integrating ISO 9001 with ISO 14001 and ISO 45001
- ISO 9001 internal audit
- ISO 9001:2026 and ISO 14001:2026
- ISO Certification Scams to Avoid in 2026
- ISO 9001 management review
- ISO 9001 nonconformities
- ISO 9001 requirements explained
- ISO 9001 scope
- ISO 9001 for small businesses
- ISO 9001 Stage 1 and Stage 2 audits
- ISO 9001 surveillance and recertification
- The 2026 ISO Certification Plan
- ISO 9001 timeline
- ISO 9001 training
- How to verify an ISO 9001 certificate, and how to spot a fake or a misleading one
- ISO 9001 vs ISO 13485, IATF 16949 and AS9100
By country
By industry
Often combined with ISO 9001
More videos: Integrated programmes
- HACCP and GMP together: the prerequisites and the plan, built as oneIntegrated programme · 3 min 14 s
- ISO/IEC 27001 and PCI DSS together: one control set, two outcomesIntegrated programme · 3 min 24 s
- ISO/IEC 27001 and SOC 2 together: one control set for every marketIntegrated programme · 3 min 24 s
- ISO/IEC 27001, PCI DSS and SOC 2 together: one control set, three outcomesIntegrated programme · 3 min 24 s
- ISO/IEC 27001 and HIPAA together: a certified security system around the US health data lawIntegrated programme · 3 min 14 s
- ISO/IEC 27001, PCI DSS and HIPAA together: card data and health data under one control setIntegrated programme · 3 min 14 s
- ISO/IEC 27001, SOC 2 and HIPAA together: what US healthcare clients ask a provider to showIntegrated programme · 3 min 14 s
- ISO/IEC 27001, PCI DSS, SOC 2 and HIPAA together: four frameworks, one control setIntegrated programme · 3 min 14 s
- PCI DSS and HIPAA together: patient payments and health data, protected as oneIntegrated programme · 3 min 14 s
Talk to a consultant
Plan your ISO 9001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice