ISO 22000 certification consulting for food safety proven on every line, every shift.

What it is

What is ISO 22000 and what is it used for?

ISO 22000 is the international standard for food safety management systems. It sets out what an organisation anywhere in the food chain must do to identify the food safety hazards in its products and processes, control them at the right points and prove, with records, that they work. It combines four elements: interactive communication along the food chain, system management on the structure shared by the ISO management system standards, prerequisite programmes, and the Codex HACCP principles.

The standard works on two levels at once. Clauses 4 to 7, 9 and 10 run the management system, from context and leadership to internal audit, management review and improvement. Clause 8 runs the operation: PRPs, traceability, emergency preparedness, hazard analysis, the hazard control plan with its OPRPs and CCPs, validation, monitoring, verification and the handling of unsafe product up to recall. The certificate is only worth having when the two levels talk to each other.

Current edition. ISO 22000:2018, published in June 2018, replaced the 2005 edition and is the edition certificates are issued against. Amendment 1:2024, published in February 2024, adds a requirement to determine whether climate change is a relevant issue for the FSMS and a note that interested parties can have climate-related requirements; nothing else changes. A third edition is in preparation: the draft international standard, ISO/DIS 22000, completed its ballot in July 2026, and ISO has announced neither a publication date nor a transition arrangement. Until then, first-time implementers build to the 2018 edition with the amendment, and existing certificates are unaffected.

Who it is for

Who needs ISO 22000 certification?

ISO 22000 was written for every link in the food chain, not only for factories: from feed and farming through ingredients, manufacturing and packaging to storage, transport, catering, retail and the service suppliers around them. The certificate's scope names the products, processes and sites the system covers. Organisations come to Sterling for ISO 22000 from four situations:

• A retailer, export customer or brand owner requires certification. Many supply-chain and export requirements are written around GFSI-recognised programmes, and ISO 22000 on its own is not one of them. We confirm at the outset whether the customer accepts ISO 22000 or expects FSSC 22000, so scope, PRP standard and certification body are chosen once.
• A regulator or licensing authority expects a documented, HACCP-based system. Food business licences, export registrations and official inspections in most markets are built around HACCP and good hygiene practice. ISO 22000 organises that system so an inspector, a customer auditor and a certification body read the same evidence.
• An incident has put the brand at risk. A withdrawal, a foreign-body complaint or an allergen labelling error exposes what a paper HACCP plan was not controlling. The board wants a system that prevents the next one and shows due diligence.
• You have HACCP and want to move up. The plan exists, perhaps with a HACCP certificate, but with no management layer around it: no verification programme, no tested recall, no management review. ISO 22000 wraps the plan in a system; FSSC 22000 adds the sector PRPs and scheme requirements the largest buyers ask for.

The intended benefit is safe product and the evidence to prove it; that depends on an accurate hazard analysis and real monitoring on every shift, not on the certificate.

Business benefits

How ISO 22000 protects your customers, your brand and your licence to operate

A food safety management system is not a filing exercise; it is the set of decisions that keeps unsafe product from leaving the site. We start where a hazard is most likely to get through: a raw material accepted without a specification, a metal detector nobody challenges, a changeover after an allergen run, a temperature log completed from memory.

• Fewer incidents and recallsHazards identified from the actual flow diagram, controlled at CCPs and OPRPs with validated limits, and monitored on the line rather than reconstructed at month end.
• Access to demanding customersA certified system, extendable to FSSC 22000 when a retailer or export market asks for GFSI recognition, so supplier approval becomes a formality rather than a project.
• Inspections that go smoothlyPRPs, the hazard control plan, calibration and traceability records that answer the regulator's questions in the regulator's language, with licence evidence in one place.
• Faster, smaller recallsA traceability system that is tested, not assumed: a lot traced forwards and backwards in hours, quantities reconciled, customers and authorities contacted from a rehearsed procedure.
• Controls that hold across shifts and sitesThe same hazard control plan, monitoring forms and corrective-action rules on the night shift as on the day shift, and at the second plant as at the first.
• Suppliers and outsourced steps under controlApproved supplier lists, specifications, certificates of analysis and incoming checks matched to the hazards each material carries, co-packers included.

Measure hold-and-release volumes, CCP deviations, complaints by category, mock recall time and verification findings. If those improve, the system is working; a thicker HACCP manual is not evidence of anything.

Requirements

What are the main ISO 22000 requirements?

ISO 22000:2018 follows the harmonised structure of the ISO management system standards, clauses 4 to 10, with the food-safety-specific requirements in clause 8. The table is a plain-language map; during the programme your system is checked clause by clause against the standard.

Certification process

How do you get ISO 22000 certified?

Build and operate the system first; then an independent certification body audits it. Sterling prepares your organisation and builds the system with your team. The certification decision belongs to the certification body, and that independence gives the certificate its value with customers and regulators.

1. 01
   Define the scope and the target.Products, process lines, sites, shifts and headcount; ISO 22000 or FSSC 22000; the food chain category and the ISO 22002 part that applies.
2. 02
   Gap analysis: review the current system against the requirements.PRPs, the existing HACCP plan, records and infrastructure are reviewed against the standard, and the actions, owners, dates and resources are agreed.
3. 03
   Implement and generate evidence.Establish the PRPs, appoint the food safety team, complete the hazard analysis, validate the control measures and run the monitoring, traceability and calibration records in daily work.
4. 04
   Verify, audit and review.Verification activities, a mock recall, internal audit and management review test the system; findings are raised by us first and closed with evidence.
5. 05
   Complete the certification body's assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit on site; respond to any findings and await its decision.
6. 06
   Keep the system running after certification.Monitoring, verification, internal audits and reviews continue, with surveillance audits each year and recertification in the third year.

Check the credibility of the route as carefully as the price. Ask which certification body will audit, which accreditation body accredits it for food safety management systems and whether the audit follows the ISO 22003-1 rules on audit time and food chain categories, then verify it with those bodies. Be cautious of offers that skip implementation: a certificate that fails a retailer's supplier check leaves the hazards uncontrolled and the fee spent. How to choose a credible ISO 22000 provider · The certification buyer's checklist

Cost

How much does ISO 22000 certification cost?

No single price fits every food business. A single-line beverage plant with a sound HACCP plan and a multi-site group building PRPs from the ground up are different projects. Every Sterling proposal gives you an all-inclusive proposal with every component in view.

Timeline

How long does ISO 22000 certification take?

A food safety management system has to run before it can be audited, and in food the running takes time. Control measures have to be validated before they are relied on, PRPs have to be in place, and monitoring, verification, calibration and traceability records have to accumulate over enough production to show a pattern. That is why the realistic range is four to nine months: the short end for a plant with a validated HACCP plan and sound PRPs, the long end where the PRPs need works or the hazard analysis is new. We build the plan around that evidence, with milestones your food safety team tracks in Effivity.

If a customer audit, an export shipment or a licence renewal fixes the date, tell us on day one. We will say what is achievable and which decisions cannot wait. A certificate date promised before anyone has walked your line is a sales pitch, not a plan.

Challenges

Common ISO 22000 implementation challenges

Food safety programmes stall for reasons that repeat from plant to plant; each has a practical answer.

Your engagement

What your ISO 22000 engagement includes

A Sterling engagement covers the whole journey, from the first walk of the line to the certificate and beyond, under one all-inclusive proposal and one accountable team, rather than a HACCP manual and a list of other vendors to find.

• Scope, gap analysis and implementation plan

  PRPs, the existing HACCP plan, records and infrastructure reviewed; actions, owners and dates agreed before work starts.

• Food safety system development and documentation

  Food safety team, product descriptions, flow diagrams, hazard analysis, hazard control plan, PRPs, traceability and recall procedures, built with your people on Sterling's template sets.

• Effivity ISO & GRC software

  Your FSMS runs in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Verification, internal audit and management review

  Verification activities and a mock recall, then internal audit and management review, conducted or facilitated as agreed, with findings closed before the certification body arrives.

• Certification readiness and support

  Preparation for Stage 1 and Stage 2, presence during the audit as agreed, and support until the certificate is issued.

Certification decisions remain with the independent certification body.

How we deliver

How Sterling supports your ISO 22000 implementation

Every ISO 22000 engagement runs on Sterling OS™, our delivery operating system: five phases, each with defined deliverables, decision owners and the evidence it must produce. You choose how much of the work your team carries; the method, software and accountability do not change.

1. 01
   Design™Guided implementation: your food safety team does the work with Sterling's structure, templates, workshops and coaching.
2. 02
   Drive™Fully managed consulting: Sterling consultants carry the agreed consulting and documentation work with your food safety team and line supervisors.
3. 03
   Sustain™After certification: verification reviews, internal audits, mock recalls, refresher and new-hire training, and surveillance readiness every year.
4. 04
   Automate™The FSMS in Effivity: PRPs, the hazard control plan, monitoring, calibration, traceability, recall, audits and management review in one workspace.
5. 05
   Revise™Moving from ISO 22000 to FSSC 22000, scheme version upgrades, the coming third edition of ISO 22000, and changes to products, lines, sites or regulation.

At the start we agree the engagement team, the weekly working session, the deliverables and who decides what. Progress is reviewed against those commitments weekly, so a slipping PRP or an unstarted validation study is visible in month two, not at Stage 1.

Often combined with

Standards organisations pair with ISO 22000

• FSSC 22000FSSC 22000 certification consulting for GFSI-recognised food safety: ISO 22000, sector PRPs and FSSC requirements, ready for a licensed body's audit.
• HACCPHACCP certification consulting: hazards analysed, CCPs determined and limits validated and monitored, on good hygiene practices, ready for independent audit.
• BRCGS Packaging MaterialsBRCGS Packaging Materials certification explained: Issue 7, GFSI recognition, who asks for it and how Sterling prepares packaging sites for the audit.
• BRCGS Food SafetyBRCGS Food Safety certification consulting for food manufacturers: HACCP plan, site standards and controls ready for a graded audit, announced or unannounced.
• BRCGS Storage and Distribution · Agents and BrokersBRCGS Storage and Distribution certification and Agents and Brokers: Issue 4 and Issue 3 requirements, scopes, audits and cost factors, with Sterling's support.
• FairtradeFairtrade certification and requirements: which Fairtrade International standards apply, FLOCERT's audit, cost and timing, and how Sterling prepares you.