Integrating ISO 22000 with ISO 9001 and ISO 14001: one food safety, quality and environmental system

Can ISO 22000 run as one system with ISO 9001 and ISO 14001?

Yes, and in most food plants it already half does: the same supervisors sign off hygiene checks, release batches and log waste. Three separate systems over one set of people means three registers, three audit calendars and three meetings about the same complaints.

ISO states that ISO 22000:2018 follows the high-level structure used by other ISO management system standards, now called the harmonised structure, so that it can be built into existing management processes or used on its own. The clause titles from 4 to 10 line up, and much of the wording on context, leadership and review is near-identical.

The editions matter. The current texts are ISO 22000:2018 with its 2024 climate amendment, ISO 9001:2026 and ISO 14001:2026. The two 2026 editions follow the latest version of the harmonised structure, while ISO 22000:2018 keeps an older clause 10 order. Build processes, not a clause-numbered manual, and renumbering costs no rework.

Which clauses the three standards share

Six of the seven requirement clauses serve the same purpose in all three standards and can each run as one process:

• Context of the organisation (4): one analysis of internal and external issues, interested parties and scope. ISO 22000 now requires, through its 2024 amendment, whether climate change is a relevant issue; one analysis can answer that for all three.
• Leadership (5): one top management commitment and, if you choose, one policy, provided it keeps every commitment each standard demands. ISO 22000 adds the appointment of a food safety team leader with defined authority.
• Planning (6): one method for risks and opportunities to the system, objectives with owners, and planned changes.
• Support (7): resources, competence, awareness, communication and documented information run once. ISO 22000 adds communication along the food chain.
• Performance evaluation (9): monitoring and analysis, internal audit and management review.
• Improvement (10): nonconformity, corrective action and continual improvement, with ISO 22000 also requiring the FSMS itself to be updated as knowledge changes.

Clause 8, Operation, is where the three standards part company, and where integration should stop trying to merge content.

What only ISO 22000 requires

ISO 22000 manages the risk that food harms the person who eats it, with a method an integrated system must leave intact. Its specific requirements sit mainly in clause 8:

• 8.2 Prerequisite programmes: the hygiene, pest control, cleaning and maintenance basics. See our prerequisite programmes guide.
• 8.3 Traceability system: lots identified from supplier to customer, tested, with quantities that reconcile.
• 8.4 Emergency preparedness and response: incidents that could affect food safety.
• 8.5 Hazard control: preliminary steps, hazard analysis, validation of control measures and the hazard control plan with its CCPs and OPRPs, explained in our hazard control plan guide.
• 8.7 to 8.9: control of monitoring and measuring, verification of the PRPs and the plan, and the handling of potentially unsafe product up to withdrawal or recall.

ISO 9001 and ISO 14001 bring their own operational content, and it meets food safety at three points on the floor: supplier approval, product release and emergency response. Design one procedure for each, with separate decision criteria, rather than two that contradict each other.

Mapping table: ISO 22000, ISO 9001 and ISO 14001

Each row is one process; the columns show what each standard needs from it.

One document set, one internal audit, one management review

The document set

Write the common processes once: document control, training and competence, communication, supplier approval, change control, corrective action, internal audit and management review. Keep separate only what has a different subject: the hazard analysis and hazard control plan, the PRP set, the environmental aspects register and the legal register. A recipe or line change then passes one change procedure that asks all three sets of questions. Our documentation guide sets out what ISO 22000 itself requires.

The internal audit

Audit by process and by area of the plant rather than by standard. One audit of goods receipt can test supplier approval, the allergen check, the temperature record and waste segregation. The programme must still cover every clause of every standard; our internal audit guide covers how.

The management review

One meeting, one agenda from all three input lists: verification results, customer satisfaction, compliance evaluation, audit results and actions. Our management review guide sets out what auditors look for in it.

How a combined certification audit works, and where the days are saved

One accredited certification body can audit all three standards in the same visit, provided its accreditation covers each of them, and for ISO 22000 the relevant food chain category. Its accreditation body should be recognised through the Global ACI arrangement (see choosing a certification body).

Audit time is first calculated for each standard under its own rules (ISO 22003-1 for food safety), and the totals are added. The body may then reduce that figure where the system really is integrated, where the people interviewed can answer for more than one standard and where its auditors are competent in more than one; it may also increase it for complexity. The reduction is capped and has to be justified on file. These rules are in IAF MD 11, the mandatory document on integrated audits (current issue 2023), which accreditation bodies continue to apply during the move to Global ACI.

• The team: taken together, the auditors must cover each standard and each technical area; the team leader must be competent in at least one standard.
• The report: integrated or separate, but every finding traceable to the standard it breaches. A weakness in a shared process, such as document control, can count against all three.
• The cycle: a standard added later needs its own Stage 1 and Stage 2 audits; then align the cycles (see surveillance and recertification).

The auditor-day saving is real but limited; the larger saving is one set of evidence, kept once.

Integrating ISO 22000 with ISO 9001: questions buyers ask