Almost every food supplier you contact will send you a PDF within the first hour of conversation. It will carry a logo, a certificate number, an expiry date and the words "ISO 22000:2018". Most buyers file it, tick a box in the supplier questionnaire and move on. That habit is understandable and it is also the single most common weak point in B2B food sourcing diligence, because a certificate is a compressed statement about a management system — and unless you know what was compressed, you cannot tell whether it covers the product you are about to buy.
This guide unpacks ISO 22000 specifically: what the standard obliges a certified site to do, how it relates to HACCP as a method, how it sits beside retailer-driven schemes such as BRCGS and IFS Food, how to read the four fields on a certificate that actually matter, and — the part suppliers rarely volunteer — what ISO 22000 cannot tell you about the pallet arriving at your warehouse. For the broader landscape of food-safety and manufacturing certifications, including GMP variants and general verification tactics, our ISO, HACCP and GMP overview remains the wider map; this article is the deep dive on one standard.
What ISO 22000 actually is
ISO 22000 is a Food Safety Management System (FSMS) standard published by the International Organization for Standardization. The current edition, ISO 22000:2018, applies to any organisation in the food chain — growers, processors, packers, transporters, packaging manufacturers, ingredient suppliers — regardless of size or product.
Its defining feature is that it is a management system standard, built on the same high-level structure as ISO 9001. That means the requirements are not only technical hygiene rules; they are organisational obligations. A certified site has demonstrated to a third-party auditor that it operates the following, as documented and evidenced practice:
- Context and interested parties. The organisation has identified the regulatory, customer and market requirements that apply to it, and defined the scope of the FSMS accordingly.
- Leadership and food safety policy. Top management is accountable for the system, not just the quality department, and a food safety team with a named leader exists.
- Planning around risk. Risks and opportunities affecting food safety performance are identified, with measurable objectives attached.
- Prerequisite programmes (PRPs). The foundational conditions: building and equipment layout, cleaning and sanitation, pest control, personnel hygiene, water and air quality, waste handling, supplier approval, allergen management.
- Hazard analysis. Biological, chemical, physical and allergen hazards identified for each step of each process, assessed for severity and likelihood.
- Control measures split into oPRPs and CCPs. This is the analytical heart of the standard. Each control measure is classified as either an operational prerequisite programme or a critical control point, each with defined limits, monitoring, correction and corrective action.
- Traceability and emergency preparedness. One-step-back, one-step-forward traceability, plus a withdrawal and recall procedure that has been tested, not merely written.
- Verification, internal audit, management review, improvement. Evidence that the system checks itself and that findings actually change something.
The word to hold onto is evidenced. An auditor does not accept a policy document as proof of a policy. They ask for records: monitoring logs with dates and initials, deviation reports with closure, calibration certificates, training records, a recall simulation with a mass-balance result.
ISO 22000 versus HACCP: a system versus a method
This is where buyer confusion concentrates, and suppliers occasionally exploit the ambiguity.
HACCP is a method. Hazard Analysis and Critical Control Points is a structured, seven-principle approach to identifying hazards and controlling them at defined points in a process. It is codified internationally through the Codex Alimentarius, and in the European Union food business operators are legally obliged to put in place procedures based on HACCP principles under the food hygiene rules — an obligation flowing from the general food law framework set out in Regulation (EC) No 178/2002 and the hygiene regulations built on it. HACCP is therefore not a distinction. Every compliant food business in the EU has HACCP procedures, in the same way every road-legal car has brakes.
ISO 22000 is a certifiable management system that contains HACCP. It takes the HACCP method and wraps it in prerequisite programmes, documented management responsibility, internal audit, traceability and continual improvement — then subjects the whole thing to third-party audit on a recurring cycle.
There is also a third thing on the market: a "HACCP certificate". These exist, are voluntary, and are issued by certification bodies against various private schemes or against Codex principles directly. Their value varies enormously with the issuer. A HACCP certificate from an accredited body with a clear scope statement is a real, if narrower, assurance. A "HACCP certificate" with no scheme name and no accreditation mark tells you little more than that someone was paid to print it.
The practical rule for buyers: asking a supplier "do you have HACCP?" invites a yes from almost everyone. Asking "which food safety management system are you certified to, by which body, under which accreditation, and can I see the scope statement?" is a question that sorts suppliers within one email.
ISO 22000 versus BRCGS, IFS Food and FSSC 22000
These are frequently presented as competitors to ISO 22000. They are better understood as a different category of thing: retailer-driven schemes, developed by or for grocery retail to standardise supplier audits, and recognised under the Global Food Safety Initiative (GFSI) benchmarking process.
ISO 22000 on its own is not GFSI-recognised. FSSC 22000 is the route that makes it so: FSSC 22000 combines ISO 22000 with sector-specific prerequisite programme specifications (the ISO/TS 22002 series) and additional scheme requirements, and that package is GFSI-recognised.
This distinction has a direct commercial consequence. If your end customer is a European grocery retailer placing private label, their supplier approval policy will very likely name BRCGS, IFS Food or FSSC 22000 specifically, and ISO 22000 alone will not satisfy it. If you are an ingredient buyer, a supplement brand, a beverage formulator, a foodservice distributor or an e-commerce brand, ISO 22000 plus solid batch documentation is frequently the appropriate and proportionate level of assurance.
| Standard | What it is | Typically required by | Audit cycle | GFSI-recognised |
|---|---|---|---|---|
| HACCP (Codex principles) | A hazard-control method, legally mandatory in the EU as a procedure | Regulators; baseline for all food businesses | Not applicable (regulatory inspection) | No |
| HACCP certificate | Voluntary third-party certification against a HACCP scheme | Smaller buyers, some tenders | Usually annual | No |
| ISO 22000:2018 | Full food safety management system incorporating HACCP | Ingredient buyers, B2B manufacturers, distributors, exporters | Three-year cycle with annual surveillance | No |
| FSSC 22000 | ISO 22000 + sector PRP specification + scheme requirements | Manufacturers supplying GFSI-driven customers | Three-year cycle with annual (often unannounced) audits | Yes |
| BRCGS Food Safety | Retailer-origin standard, heavily product- and site-focused, graded | UK and international grocery retail, private label | Annual, graded (AA to D) | Yes |
| IFS Food | Retailer-origin standard from German and French retail | DACH and French retail, private label | Annual, scored | Yes |
Read the row that matches your customer, not the row your supplier prefers to discuss. A supplier holding ISO 22000 is not "less safe" than one holding IFS Food; they are certified against a system standard rather than a retail scheme, and if your channel does not require the retail scheme, paying for one changes nothing about the product.
How to read an ISO 22000 certificate
Four fields decide whether a certificate is relevant to your purchase. Everything else on the page is design.
1. Scope. This is the field that most often invalidates a certificate for a given transaction. The scope states which activities and which product categories the FSMS covers. "Production, packing and storage of dried fruits and herbal botanicals" is a usable scope. "Food safety management" with no product reference is not. If you are buying an essential oil and the scope names dried fruit processing only, the certificate does not cover what you are buying — the supplier may still be a perfectly good supplier, but you need to know which of their operations is inside the system and which is outside.
2. Site address. Certification attaches to sites, not to brands or trading companies. A multi-site group can hold certification for one plant and not another; a trading company can hold certification for its warehouse while the manufacturing happens elsewhere entirely. Check that the address on the certificate is the address where your goods will actually be produced. When a supplier subcontracts a process step — milling, cutting, packing, sterilisation — that subcontractor's status is a separate question, and a legitimate supplier will answer it without friction.
3. Validity and certificate number. Note the issue date, the expiry date and the certificate number as three separate facts. A certificate within its stated validity window can still have been suspended between surveillance audits, which is exactly why the number matters: it is your lookup key on the certification body's public register.
4. Certification body and accreditation. A certificate is worth what the issuing body is worth, and the issuing body is worth what its accreditation is worth. Look for the accreditation mark of a national accreditation body that is a signatory to the IAF Multilateral Recognition Arrangement — UKAS, DAkkS, ACCREDIA, RvA, COFRAC, ANAB, TÜRKAK and their equivalents. An unaccredited certification body is not automatically fraudulent, but it is outside the mutual-recognition chain that gives the certificate its meaning to your own auditors and customers.
| Field on the certificate | What good looks like | What should prompt a question |
|---|---|---|
| Standard and edition | "ISO 22000:2018" | "ISO 22000" with no year, or a superseded edition |
| Scope | Named activities and named product categories | Generic wording; product families you are not buying |
| Site | Full physical address of the production site | Head-office or trading address only |
| Validity | Issue and expiry dates, inside the window | Expired, or expiry within your production window |
| Certificate number | Present, and findable on the issuer's register | Absent, or no result on the register |
| Accreditation | IAF MLA signatory accreditation mark | No accreditation reference at all |
The verification itself takes about ten minutes. Search the certification body's online directory for the certificate number or company name, and confirm that scope, site and expiry match the PDF you were sent. Discrepancies between the register and the document are the strongest single signal you will get during supplier onboarding.
What ISO 22000 proves — and what it cannot
ISO 22000 proves that a system existed and functioned well enough to satisfy an auditor on the days the audit took place, across the activities named in the scope. That is genuinely valuable. It is not the same as a statement about your consignment.
Specifically, ISO 22000 does not tell you:
- Whether your batch met specification. That is what a batch certificate of analysis is for. Our guides on reading a CoA for dried fruit and on interpreting botanical test reports cover the parameters and methods that actually describe your goods.
- Whether the raw material origin is what you were told. Certification covers the process; origin is a traceability and documentation question, addressed in our EU lot tracking and traceability guide.
- Whether the product carries any particular attribute. Organic status, halal or kosher status, and fair-trade claims are separate certifications with separate scopes and separate registers. ISO 22000 says nothing about any of them; see the organic certification guide and the halal and kosher sourcing guide for how those are verified.
- Whether the supplier will behave well under commercial stress. Systems certify. Behaviour under a short crop, a price spike or a shipment delay is revealed by a sample order, a pilot run and a first real problem, not by a PDF. Our sample order best practices article is written around exactly that testing sequence.
The right mental model: certification is a filter, not a decision. It removes suppliers who cannot demonstrate a system. It does not select among those who can.
Building your supplier file around the certificate
A defensible incoming-goods file for a new B2B supplier usually contains the certificate plus five things around it:
- The register screenshot or link confirming the certificate is live, with the date you checked.
- The scope statement, saved separately, mapped against the exact products on your purchase order.
- A recent batch CoA for a comparable lot, with the test methods named — not just results.
- The specification sheet you and the supplier have both signed, including the parameters you will reject against.
- The traceability answer: what the lot code encodes, how far back the supplier can trace, and how quickly they can produce a mass balance if you ask.
If a supplier can produce all five without a chase, your risk profile is already better than most first orders. If the certificate arrives instantly and the other four take three weeks of chasing, that ratio is itself a finding.
Arovela operates under ISO 22000, ISO 9001 and ISO 27001 — food safety management, quality management, and information security management for the commercial and documentation side of the business. We do not hold retail schemes such as BRCGS or IFS Food, and we say so directly rather than letting a buyer discover it after a specification has been drafted. Production is at our facility in Sındırgı, Balıkesir, with a distribution warehouse in Solingen, Germany serving EU customers, and we will send the certificate, the scope statement and the batch documentation in the same reply — because the buyers we want are the ones who check.
FAQ
Is ISO 22000 mandatory to export food to the EU?
No. What is mandatory is compliance with EU food law: HACCP-based procedures, traceability, hygiene requirements, contaminant and residue limits, and correct labelling. ISO 22000 is a voluntary certification that demonstrates a managed system for meeting those obligations. Many EU importers require it contractually even though no regulation does.
My customer demands BRCGS. Can an ISO 22000 supplier still work?
For retail private label, usually not — the retailer's approval policy names the scheme. For ingredients that you further process in your own BRCGS-certified plant, it often can, because your own certification covers the finished product and your supplier approval procedure governs inbound material. Check your scheme requirements for approved-supplier criteria before ruling a supplier out.
How do I check whether a certificate is genuine?
Use the certificate number on the issuing body's public client register, then confirm that the certification body itself is accredited by an IAF MLA signatory. Match three fields against the PDF: company legal name, site address and scope wording. If any of the three differ, ask the supplier to explain before proceeding.
What is the difference between an oPRP and a CCP?
Both are control measures. A CCP is a step where control is essential to prevent or eliminate a food safety hazard, with a measurable critical limit and monitoring that allows immediate correction — a metal detector or a pasteuriser is typical. An oPRP controls a hazard but does not have that kind of single measurable limit with immediate corrective action; allergen changeover cleaning is a common example. ISO 22000 requires the supplier to justify which classification each control measure received.
How often is a certified site actually audited?
ISO 22000 certification normally runs on a three-year cycle: an initial certification audit, then surveillance audits, typically annual, then a recertification audit before expiry. This means a certificate can be up to a year old in terms of the last on-site verification. It is a reasonable question to ask a supplier when their most recent surveillance audit took place and whether any findings are still open.
Getting the documents before you commit
Certification is the beginning of diligence, not the end of it. Read the scope, verify the number, then move the conversation onto batch documents, specifications and a sample order — because those are the artefacts that describe what you will actually receive.
If you would like to see how this works with a real specification in front of us, tell us the product, the volume and the market you sell into, and request a quote. The certificate, the scope statement and the relevant test documentation come with the offer, not after the purchase order.