ISO 22000 : 2018 Certification

Views: 1

Introduction

Food safety is not a regulatory checkbox that a business meets once and forgets. It is a continuous operational discipline that determines whether the food a business produces, processes, stores, or distributes is consistently safe for the people who consume it. For food businesses that want to demonstrate this discipline in a way that is internationally recognised, independently verified, and commercially credible, ISO 22000:2018 is the gold standard.

ISO 22000 is the internationally recognised standard for Food Safety Management Systems published by the International Organization for Standardization. The 2018 version, which replaced the previous 2005 edition, aligns the food safety management framework with the High-Level Structure used by other major ISO management system standards such as ISO 9001 for quality management and ISO 14001 for environmental management. This alignment makes integration between multiple management system standards significantly more straightforward for businesses that operate across multiple compliance frameworks.

In India, ISO 22000:2018 certification has become increasingly important for food businesses that supply to organised retail chains, institutional buyers, hotel chains, export markets, and government procurement channels. While FSSAI registration is the legal baseline that every food business must meet, ISO 22000 certification goes beyond compliance to demonstrate a proactive, systematic, and independently audited approach to food safety that gives buyers, partners, and consumers a higher level of confidence in the safety of the food supply chain.

This guide is written for food business owners, quality managers, operations directors, compliance professionals, and founders who want to understand what ISO 22000:2018 requires, how the certification process works in India, what the business benefits of certification are, what the costs and timelines look like, and how to maintain certification once it is obtained.

For ISO 22000:2018 certification support and complete food business compliance advisory, Legal Tax works with food businesses across all sectors and states.

What ISO 22000:2018 Is and What It Covers

The Standard’s Scope

ISO 22000:2018 specifies requirements for a Food Safety Management System applicable to all organisations in the food chain, regardless of their size or position in that chain. The standard is designed to be applicable to:

• Farmers and primary producers of food crops, livestock, and aquaculture.
• Food manufacturers and processors.
• Food packaging manufacturers.
• Transport and storage operators in the food supply chain.
• Retailers and food service operators including restaurants, caterers, and institutional kitchens.
• Businesses that produce non-food items such as cleaning chemicals, equipment, and packaging that contact food.

The breadth of this scope means that ISO 22000 is relevant to virtually every business that participates in the food supply chain, from farm to fork.

The Core Framework

ISO 22000:2018 is built around four key elements that together create a systematic approach to food safety:

Interactive communication. Food safety hazards and their controls must be communicated along the entire food chain. A farm that uses a specific pesticide must communicate this to the processor who receives its produce. A manufacturer that uses a specific allergen must communicate this to customers and end consumers through appropriate labelling and disclosure.

System management. The food safety management system must be established, implemented, maintained, and continually improved within a structured management system framework that sets objectives, defines responsibilities, manages resources, and reviews performance.

Prerequisite Programmes (PRPs). PRPs are the basic conditions and activities necessary to maintain a hygienic environment throughout the food chain, appropriate to the production of safe food for human consumption. PRPs address infrastructure, equipment, personnel hygiene, cleaning and sanitation, pest control, and cross-contamination prevention. They are the foundation on which the HACCP plan rests.

HACCP principles. Hazard Analysis and Critical Control Points is the internationally recognised methodology for identifying and controlling food safety hazards. ISO 22000 incorporates the Codex Alimentarius Commission’s HACCP principles as the core technical methodology for the hazard analysis component of the standard.

The High-Level Structure of ISO 22000:2018

The 2018 revision adopted the Annex SL High-Level Structure, which organises the standard into ten clauses:

• Clause 1: Scope.
• Clause 2: Normative references.
• Clause 3: Terms and definitions.
• Clause 4: Context of the organisation.
• Clause 5: Leadership.
• Clause 6: Planning.
• Clause 7: Support.
• Clause 8: Operation.
• Clause 9: Performance evaluation.
• Clause 10: Improvement.

This structure is identical in its framework to ISO 9001:2015 and other modern ISO management system standards, making it significantly easier to integrate ISO 22000 with other management systems than the previous edition of the standard.

Key Requirements of ISO 22000:2018

Clause 4: Context of the Organisation

The organisation must determine the external and internal factors that affect its ability to achieve the intended outcomes of the food safety management system. This includes understanding:

• The food safety expectations of customers, regulatory authorities, statutory bodies, and other interested parties.
• The products and services the organisation provides.
• The processes, products, and services provided by external providers that affect food safety.
• The scope of the food safety management system, defined in terms of the products, product categories, processes, and production sites covered.

Clause 5: Leadership

Top management must demonstrate active leadership and commitment to the food safety management system. This goes beyond nominal support. ISO 22000:2018 requires management to:

• Establish, maintain, and update a food safety policy.
• Ensure that food safety objectives are established and aligned with the strategic direction of the organisation.
• Ensure the integration of the food safety management system requirements into business processes.
• Communicate the importance of effective food safety management throughout the organisation.
• Appoint a Food Safety Team Leader responsible for managing the food safety team and the FSMS.
• Ensure that the food safety team has the necessary competence and resources.

Clause 6: Planning

The organisation must plan actions to address risks and opportunities that could affect the food safety management system’s ability to achieve its intended outcomes. Food safety objectives must be established, monitored, and documented.

Clause 7: Support

This clause addresses the resources required to implement and maintain the food safety management system:

Competence. Persons performing work under the organisation’s control that affects food safety must be competent based on education, training, and experience. Competence gaps must be identified and addressed.

Awareness. All relevant personnel must be aware of the food safety policy, the food safety objectives, and their own contribution to the effectiveness of the food safety management system.

Communication. The organisation must establish both internal and external communication processes relevant to food safety.

Documentation. The FSMS must be maintained and controlled through documented information. This includes the scope of the FSMS, the food safety policy, the food safety objectives, the Prerequisite Programmes, the hazard analysis results, the HACCP plan, and records of monitoring and verification activities.

Clause 8: Operation

This is the most technically detailed clause and covers the operational implementation of the food safety management system.

Prerequisite Programmes. The organisation must establish, implement, maintain, monitor, and verify PRPs appropriate to the organisation and its products. ISO 22000 itself does not specify what the PRPs must include in detail; sector-specific technical specifications (ISO/TS 22002 series) provide detailed PRP requirements for specific food industry sectors.

Traceability. The organisation must be able to identify and trace all batches of materials used, the processing history of each batch of finished product, and the distribution of the product. Traceability is essential for effective recall management.

Emergency preparedness and response. The organisation must be prepared to respond to potential emergency situations that could affect food safety, including product withdrawal and recall.

Hazard analysis. The food safety team must conduct a systematic hazard analysis to identify and assess all food safety hazards that could reasonably be expected to occur in relation to the product type, process type, and production facilities. The hazard analysis evaluates each identified hazard for its likelihood of occurrence and severity of adverse health effects before and after the implementation of controls.

Control measures. Based on the hazard analysis, the food safety team selects appropriate combinations of control measures. Control measures are categorised as:

• Those managed through Operational Prerequisite Programmes (OPRPs) for significant hazards not controlled at Critical Control Points.
• Those managed through the HACCP plan at Critical Control Points.

Critical Control Points. For each identified CCP, the HACCP plan must specify the critical limits, the monitoring system, the corrective actions to be taken when monitoring indicates a CCP is not under control, the verification procedures, and the documentation and record-keeping requirements.

Validation. Before implementing control measures for significant hazards, the organisation must validate that the selected control measures are capable of achieving the intended control of the hazard.

Verification. The organisation must establish, implement, and maintain verification activities to confirm that the food safety management system is being effectively implemented and updated as needed.

Clause 9: Performance Evaluation

The organisation must monitor, measure, analyse, and evaluate the food safety management system. This includes:

Internal audits. The organisation must conduct internal audits at planned intervals to determine whether the FSMS conforms to the requirements and is effectively implemented.

Management review. Top management must review the FSMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. The management review must consider the results of internal audits, customer feedback, verification activities, and external developments affecting food safety.

Clause 10: Improvement

The organisation must continually improve the suitability, adequacy, and effectiveness of the FSMS. Nonconformities must be addressed through corrective actions that eliminate the root cause of the nonconformity and prevent recurrence.

The ISO 22000:2018 Certification Process in India

Step 1: Gap Analysis

Before beginning formal implementation, the food business should conduct a gap analysis comparing its current food safety management practices against the requirements of ISO 22000:2018. The gap analysis identifies what is already in place, what is partially in place, and what needs to be developed from scratch. This assessment provides the foundation for the implementation plan.

Step 2: Management Commitment and Food Safety Team Formation

Obtaining genuine, active commitment from top management is essential before the certification process begins. Without management support for the investment of time, money, and operational change required, FSMS implementation cannot succeed.

The food safety team should be established: a multidisciplinary group with the knowledge and experience necessary to develop and implement the FSMS. The team typically includes the food safety team leader (usually the quality manager or food safety manager), production staff with knowledge of the specific processes and hazards, and where needed, external technical experts.

Step 3: FSMS Documentation Development

The documentation required by ISO 22000:2018 must be developed:

• Food safety policy.
• FSMS scope document.
• Food safety objectives.
• Procedures for all required process controls.
• Prerequisite Programmes documentation.
• Hazard analysis documentation.
• HACCP plan.
• Monitoring, verification, and validation records.
• Corrective action procedures.
• Internal audit procedure and records.
• Management review records.

Documentation development is typically the most time-consuming phase of FSMS implementation, particularly the hazard analysis and HACCP plan, which require systematic technical analysis of every stage of the food production process.

Step 4: Implementation

The documented FSMS is implemented across all relevant operations. This involves:

• Training all affected personnel on the new procedures and their roles in the FSMS.
• Implementing the Prerequisite Programmes.
• Implementing the monitoring procedures for all CCPs and OPRPs.
• Recording monitoring results, calibration records, and corrective actions.
• Maintaining traceability records.

The implementation phase typically runs for at least three months before the certification audit to allow sufficient evidence of the FSMS in operation to be generated and to allow any implementation issues to be identified and resolved.

Step 5: Internal Audit

Before the certification audit, an internal audit of the complete FSMS must be conducted to verify that all requirements of ISO 22000:2018 are being met and that the system is operating effectively. Internal auditors must be competent and impartial (not auditing their own work). Nonconformities identified in the internal audit must be addressed through corrective actions before the certification audit.

Step 6: Management Review

A management review meeting must be conducted and documented before the certification audit. The management review demonstrates that top management is actively engaged with the FSMS and provides evidence of the review of the system’s performance and the decisions made to drive improvement.

Step 7: Selection of Certification Body

Select an accredited certification body to conduct the external certification audit. In India, reputable certification bodies accredited by the National Accreditation Board for Certification Bodies (NABCB) or by internationally recognised accreditation bodies include Bureau Veritas, SGS, TÜV SÜD, DNV, Intertek, Lloyd’s Register, and BSI Group.

When selecting a certification body, consider:

• Accreditation status and scope of accreditation (ISO 22000 specifically).
• Experience in the specific food sector in which the business operates.
• Geographic presence and audit team availability.
• Certification fee structure.
• Reputation with buyers and customers who may require ISO 22000 certification from their suppliers.

Step 8: Stage 1 Audit (Documentation Review)

The certification audit is conducted in two stages. Stage 1 is a documentation review conducted either on-site or remotely, during which the certification body’s auditor reviews the FSMS documentation to assess whether it meets the requirements of ISO 22000:2018 and whether the organisation is ready for the Stage 2 audit.

Stage 1 findings typically include:

• Confirmation of any conformities in the documentation.
• Identification of any gaps in the documentation that must be addressed before Stage 2.
• Confirmation of the scope of certification.
• Planning for the Stage 2 audit.

Step 9: Stage 2 Audit (On-Site Certification Audit)

Stage 2 is the main certification audit conducted on-site at the food business’s premises. The auditor reviews the implementation of the FSMS, verifies that the documented procedures are being followed in practice, interviews staff at all levels, observes operations, and reviews records of FSMS performance.

Stage 2 findings are classified as:

Major nonconformities. A failure to implement a fundamental requirement of ISO 22000:2018 or a systematic failure that calls into question the ability of the FSMS to achieve food safety. Major nonconformities must be resolved before certification can be granted.

Minor nonconformities. An isolated failure to meet a specific requirement. Minor nonconformities must be addressed through corrective actions within a specified period after certification is granted.

Observations. Opportunities for improvement that do not constitute nonconformities but that the auditor recommends the organisation consider addressing.

Step 10: Certification Decision and Certificate Issue

After the Stage 2 audit, the certification body reviews the audit findings and makes a certification decision. If the audit findings support certification (no unresolved major nonconformities), the certification body issues the ISO 22000:2018 certificate.

The certificate specifies:

• The organisation’s name and registered address.
• The scope of certification.
• The certificate number.
• The date of issue.
• The validity period (three years).
• The accreditation mark of the accreditation body.

Timeline for ISO 22000:2018 Certification

The typical timeline from initiating the certification process to receiving the certificate:

Maintaining Certification: Surveillance and Recertification Audits

ISO 22000:2018 certification is valid for three years but requires ongoing demonstration of the FSMS’s effectiveness through surveillance audits and recertification.

Surveillance Audits

The certification body conducts surveillance audits at least once a year during the three-year certification cycle. Surveillance audits are typically shorter than the initial certification audit and focus on:

• Verification that the FSMS is being maintained and that previous corrective actions have been implemented.
• Review of internal audit results and management review records.
• Assessment of changes to products, processes, or the organisation that could affect food safety.
• Verification of continued compliance with the standard’s requirements.

Failure to maintain the FSMS between surveillance audits, or failure to address nonconformities identified in surveillance audits, can result in suspension or withdrawal of certification.

Recertification Audit

At the end of the three-year certification cycle, a full recertification audit is conducted, similar in scope to the initial certification audit. If the recertification audit confirms that the FSMS continues to meet the requirements, the certification is renewed for a further three-year cycle.

ISO 22000 and FSSC 22000: Understanding the Difference

FSSC 22000 (Food Safety System Certification 22000) is a higher-level certification scheme that incorporates ISO 22000:2018 as its core standard, adds sector-specific Prerequisite Programme requirements from the ISO/TS 22002 series, and includes additional requirements specified by the FSSC 22000 Scheme. FSSC 22000 is recognised by the Global Food Safety Initiative (GFSI), which is significant because GFSI recognition is a benchmark requirement of major global food retailers and food service companies.

For food businesses that supply to global retailers such as Walmart, Tesco, Carrefour, or large food service chains, FSSC 22000 or another GFSI-recognised certification may be required rather than ISO 22000 alone. For businesses supplying to domestic Indian markets, ISO 22000:2018 is typically sufficient and is the certification most commonly requested by Indian buyers and institutions.

Cost of ISO 22000:2018 Certification in India

The cost of ISO 22000:2018 certification involves several components:

Consultancy Fees

Most food businesses engage an ISO 22000 consultant to assist with gap analysis, documentation development, training, and pre-audit preparation. Consultancy fees vary based on the size of the operation, the complexity of the food products and processes, and the current state of the business’s food safety practices.

• Small food businesses (restaurants, small manufacturers): Rs. 50,000 to Rs. 1,50,000.
• Medium food businesses (larger manufacturers, processors): Rs. 1,50,000 to Rs. 4,00,000.
• Large food businesses (multi-site operations, complex supply chains): Rs. 4,00,000 and above.

Certification Body Fees

Certification body fees for the Stage 1 audit, Stage 2 audit, annual surveillance audits, and recertification audit constitute a significant part of the total cost. Fee structures vary between certification bodies and are typically based on the number of employees and the complexity of operations.

Indicative fee ranges for the complete three-year certification cycle (Stage 1, Stage 2, two surveillance audits, and recertification):

• Small businesses: Rs. 80,000 to Rs. 2,00,000 per three-year cycle.
• Medium businesses: Rs. 2,00,000 to Rs. 5,00,000 per three-year cycle.
• Large businesses: Rs. 5,00,000 and above per three-year cycle.

Internal Implementation Costs

Internal costs include staff time for training and implementation, the cost of upgrading premises, equipment, and infrastructure to meet PRP requirements, the cost of laboratory testing for HACCP validation, and the ongoing cost of monitoring records and internal audit activities.

Business Benefits of ISO 22000:2018 Certification

Access to Organised Retail and Institutional Markets

Large retail chains, hotel chains, hospital supply contracts, airline catering, and institutional food buyers increasingly require their food suppliers to hold ISO 22000 certification as a condition of supply. For food businesses seeking to access these markets, certification is not optional.

Export Market Access

International buyers and importing countries often require food safety management system certification as a condition of supply. ISO 22000 is internationally recognised and provides a credible basis for food export to markets across Asia, Europe, the Middle East, and beyond.

Improved Food Safety Performance

The systematic implementation of hazard analysis, critical control points, and prerequisite programmes genuinely reduces the risk of food safety incidents. Businesses with robust FSMS report fewer batch rejections, fewer consumer complaints, and fewer recall events than businesses relying solely on ad hoc quality checks.

Regulatory Alignment and FSSAI Complementarity

FSSAI’s Food Safety Management System requirements under the Food Safety and Standards Regulations align closely with the principles of ISO 22000. A business that has implemented ISO 22000 will typically find itself well positioned for FSSAI inspections and will have documentation that supports all FSSAI compliance requirements. For food businesses seeking FSSAI licensing or renewal, ISO 22000 certification strengthens the compliance profile significantly.

Competitive Differentiation

In a competitive food market, ISO 22000 certification provides a visible, independently verified signal of food safety commitment that differentiates the business from uncerti, competitors. This differentiation can be used in marketing, in tenders, and in customer negotiations.

Supply Chain Confidence

Buyers who require their suppliers to hold ISO 22000 certification are not simply requesting a certificate. They are requiring evidence that the supplier has systematic controls in place to deliver consistently safe food. Certification provides this evidence in a format that buyers’ procurement and quality teams are trained to evaluate and trust.

ISO 22000 and Other Food Safety Certifications

Relationship with GMP Certification

Good Manufacturing Practice certification addresses the basic conditions and practices required for the manufacturing of safe, quality food products. GMP is often considered a prerequisite to ISO 22000 implementation, as the infrastructure, hygiene, and operational discipline required for GMP compliance form the foundation of the Prerequisite Programmes required by ISO 22000.

Relationship with HACCP Certification

HACCP certification (standalone) verifies that a business has implemented Hazard Analysis and Critical Control Points in accordance with Codex Alimentarius principles. ISO 22000 incorporates HACCP as one component of a broader management system. A business with standalone HACCP certification has a solid foundation for ISO 22000 implementation but will need to add the management system elements (context, leadership, planning, support, performance evaluation, improvement) to meet the full ISO 22000 requirements.

Relationship with ISO 9001

ISO 9001 is the quality management system standard. While ISO 9001 does not specifically address food safety, its management system framework overlaps significantly with ISO 22000’s. A business that already holds ISO 9001 certification has the management system infrastructure (documented procedures, internal audits, management review, corrective action) already in place and can build the food safety-specific elements of ISO 22000 on this foundation, significantly reducing the implementation effort.

Frequently Asked Questions

Conclusion

ISO 22000:2018 is the internationally recognised framework that transforms food safety from an ad hoc response to hazards into a systematic, documented, monitored, and continuously improved management discipline. For Indian food businesses that aspire to supply organised retail, institutional buyers, export markets, or any commercial buyer that takes supply chain food safety seriously, ISO 22000 certification is the credential that demonstrates this discipline in a form that buyers, regulators, and consumers can independently verify.

The certification process requires meaningful investment: management commitment, food safety expertise, documentation development, staff training, and the engagement of an accredited certification body. The return on this investment is access to markets and buyers that are not accessible without it, a systematic reduction in food safety incidents, and a defensible position in the event of any regulatory inspection or product liability claim.

For food businesses at any scale, the question is not whether ISO 22000 is worth pursuing, but when. The earlier in the business’s growth trajectory the FSMS is implemented and certified, the more deeply food safety is embedded in the business culture and operations, and the more naturally the certification is maintained through surveillance and recertification cycles without disruptive scrambles to rebuild documentation and practices before each audit.

Build food safety into the operation, not onto it. Pursue certification as a demonstration of genuine commitment. And maintain it as an ongoing business discipline, not a one-time achievement.

Get Expert ISO 22000 Certification and Food Safety Compliance Support

🟡 Legal Tax provides complete ISO 22000:2018 certification advisory, FSSAI registration, and food business compliance support across all sectors and states.

👉 ISO 22000 Certification 👉 GMP Certification 👉 ISO 9001 Certification 👉 ISO 14001 Certification 👉 ISO 27001 Certification 👉 ISO Certification 👉 FSSAI Registration 👉 FSSAI State Licence 👉 FSSAI Central Licence 👉 GST Registration and Filing 👉 MSME Registration 👉 Import Export Code Registration 👉 Private Limited Company Registration 👉 LLP Registration 👉 Income Tax Return 👉 Legal Documentation and Drafting

🟡 IT and Digital Services

👉 Website Development 👉 SEO Services 👉 Social Media Marketing 👉 Logo Design 👉 Google and Facebook Ads 👉 Branding Services

📞 Call Now: +91 8595439395 🕐 Free Consultation: Monday to Saturday, 9 AM to 6 PM

Aman G

I’m Aman Arora aka Aman G — 10+ years in SEO and Digital Marketing, and I love getting results. I don’t just do SEO & Website Design; I build strategies that work. I’m a CA drop out, but what I enjoy most is helping entrepreneurs and NGOs reach their goals. For me, happy customers are the real reward.

quickstartupindia.com/blog/