ISO 22000:2018 Food Safety Management System: What Food Businesses Must Know in 2026

Introduction

Food safety is one of the most important responsibilities across the global food supply chain. From farms and food manufacturers to storage facilities, transport companies, retailers, caterers, and food service organizations, businesses must have effective systems for identifying and controlling food safety hazards.

ISO 22000 provides an internationally recognized framework for establishing, implementing, maintaining, and continually improving a Food Safety Management System (FSMS).

As of 2026, ISO 22000:2018 remains the published edition, together with ISO 22000:2018/Amd 1:2024, which introduced climate-action considerations into the management system. At the same time, a new edition, ISO/DIS 22000, is under development. Therefore, organizations should understand the current 2018 requirements while monitoring the development of the next edition.

This guide explains ISO 22000:2018, its major requirements, the role of HACCP and prerequisite programmes, the 2024 climate-change amendment, and practical steps organizations can take to prepare for certification and maintain an effective food safety management system.

What Is ISO 22000?

ISO 22000 is an international standard specifying requirements for a Food Safety Management System for organizations involved directly or indirectly in the food chain.

The standard is designed to help organizations consistently provide safe products and services while meeting applicable statutory, regulatory, and customer food safety requirements.

ISO 22000 integrates several important food safety concepts, including:

• Interactive communication
• System management
• Prerequisite programmes (PRPs)
• HACCP principles
• Risk-based thinking
• Continual improvement

The standard can be applied by organizations of different sizes and levels of complexity across the food chain.

Examples include:

• Food manufacturers
• Dairy processors
• Meat and poultry processors
• Beverage manufacturers
• Ingredient manufacturers
• Primary producers
• Food packaging manufacturers
• Food storage and distribution companies
• Transport providers
• Catering organizations
• Retail and food service businesses
• Cleaning and sanitation service providers

ISO 22000 can be implemented independently or used as a foundation for certification schemes such as FSSC 22000.

ISO 22000:2018 Structure

ISO 22000:2018 follows the ISO High-Level Structure used by many management system standards.

The main requirements are organized into Clauses 4 to 10:

1. Context of the organization
2. Leadership
3. Planning
4. Support
5. Operation
6. Performance evaluation
7. Improvement

These requirements work together to create a systematic approach to managing food safety risks.

1. Context of the Organization

Organizations must understand the internal and external factors that can affect their ability to achieve the intended results of the Food Safety Management System.

This includes identifying:

• Internal issues
• External issues
• Interested parties
• Legal and regulatory requirements
• Customer requirements
• The scope of the FSMS

Organizations should also determine the boundaries of their food safety management system.

For example, a dairy processing company may define its scope around the reception of raw milk, processing, packaging, storage, and dispatch of finished dairy products.

Climate Change Considerations

The 2024 amendment introduced an additional consideration relating to climate change.

Organizations are expected to determine whether climate change is a relevant issue affecting the effectiveness of their management system.

Potential considerations for food businesses may include:

• Water availability
• Changes in raw material supply
• Extreme temperatures
• Flooding
• Drought
• Changes in pest patterns
• Supply chain disruption
• Changes in food safety hazards

The organization should determine the relevance of climate change based on its own context rather than simply adding generic statements to its documentation.

2. Leadership and Commitment

Top management plays a central role in ISO 22000.

Food safety cannot be managed effectively by the quality or microbiology department alone. Senior management must demonstrate commitment to the FSMS.

Management responsibilities include:

• Establishing a food safety policy
• Ensuring food safety objectives are established
• Providing adequate resources
• Supporting responsible personnel
• Promoting continual improvement
• Ensuring the FSMS is integrated into business processes
• Communicating the importance of food safety

Management must also ensure that responsibilities and authorities are clearly defined.

A strong food safety system requires leadership involvement, not merely documentation.

3. Planning

Organizations must plan actions to address risks and opportunities associated with the FSMS.

Food businesses should establish measurable food safety objectives that are appropriate to their operations.

Examples include:

• Reducing microbiological nonconformities
• Improving environmental monitoring results
• Reducing customer complaints
• Improving sanitation effectiveness
• Increasing supplier compliance
• Reducing product rejection
• Improving corrective action effectiveness

Planning should also include consideration of changes that may affect food safety.

For example, introducing a new product, changing a processing line, changing suppliers, or modifying a cleaning chemical may require reassessment of food safety risks.

4. Support

An effective FSMS requires adequate resources and competent personnel.

ISO 22000 addresses several support requirements, including:

Competence

Employees performing work that affects food safety must be competent based on appropriate education, training, skills, or experience.

Training may cover:

• Food hygiene
• GMP/GHP
• HACCP
• Allergen management
• Cleaning and sanitation
• Food defense
• Laboratory practices
• Personal hygiene
• Chemical handling
• Emergency procedures

Awareness

Employees should understand how their activities affect food safety.

Communication

Food safety information must be communicated effectively both internally and externally.

This may involve communication with:

• Suppliers
• Customers
• Regulatory authorities
• Certification bodies
• Contractors
• Employees
• Transport providers

Documented Information

Organizations must establish and control documented information required by the FSMS.

Examples include:

• Food safety procedures
• HACCP studies
• Monitoring records
• Laboratory results
• Cleaning records
• Training records
• Calibration records
• Corrective action records
• Internal audit reports

Documentation should reflect actual operations rather than being maintained only for audit purposes.

5. Operational Planning and Control

Operation is one of the most important parts of ISO 22000 because it is where food safety controls are actually implemented.

Organizations must plan, implement, control, maintain, and update processes necessary to meet food safety requirements.

Operational controls may include:

• Good Manufacturing Practices
• Good Hygiene Practices
• Cleaning and sanitation
• Pest management
• Personnel hygiene
• Temperature control
• Raw material inspection
• Supplier control
• Process control
• Product release
• Traceability
• Recall and withdrawal procedures

6. Prerequisite Programmes (PRPs)

Prerequisite programmes provide the basic environmental and operational conditions necessary for producing safe food.

PRPs may address:

• Facility design
• Equipment suitability
• Cleaning and sanitation
• Pest control
• Waste management
• Personnel hygiene
• Water quality
• Air quality
• Storage
• Transport
• Chemical management
• Cross-contamination prevention

The specific PRPs required depend on the organization’s sector and activities.

For example, a milk processing facility will require effective controls for raw milk reception, hygienic processing, equipment cleaning, water quality, storage temperatures, and prevention of microbial contamination.

7. Hazard Analysis and HACCP

HACCP is a fundamental component of ISO 22000.

Organizations must identify and evaluate food safety hazards associated with their products and processes.

Hazards may include:

Biological Hazards

Examples include:

• Salmonella
• Listeria monocytogenes
• Escherichia coli
• Staphylococcus aureus
• Yeasts and moulds
• Parasites

Chemical Hazards

Examples include:

• Cleaning chemical residues
• Pesticide residues
• Veterinary drug residues
• Mycotoxins
• Heavy metals
• Allergens

Physical Hazards

Examples include:

• Metal fragments
• Glass
• Stones
• Plastic fragments
• Wood particles

The organization must determine appropriate control measures and establish controls for significant hazards.

Depending on the hazard analysis, controls may include:

• Critical Control Points (CCPs)
• Operational Prerequisite Programmes (OPRPs)
• General PRPs

Monitoring and verification activities must demonstrate that these controls remain effective.

8. Traceability

Traceability allows organizations to identify the history, location, and movement of products and materials through the food chain.

An effective traceability system should enable an organization to identify:

• Raw material suppliers
• Production batches
• Processing dates
• Packaging materials
• Finished product lots
• Distribution information

For example, if a microbiological problem is identified in a finished dairy product, the organization should be able to trace the affected product back to relevant raw materials, processing records, packaging materials, and distribution information.

Traceability systems should also be periodically tested to confirm their effectiveness.

9. Emergency Preparedness and Response

Food businesses must establish procedures for responding to situations that could affect food safety.

Potential emergencies include:

• Fire
• Flooding
• Power failure
• Water contamination
• Equipment failure
• Chemical contamination
• Major microbiological contamination
• Product tampering
• Supply chain disruption
• Natural disasters

Emergency procedures should define responsibilities, communication channels, immediate controls, product disposition, and recovery actions.

Organizations should periodically test or review their emergency response arrangements.

10. Control of Monitoring and Measuring

Food safety decisions depend heavily on reliable measurements.

Organizations must ensure that monitoring and measuring resources are suitable for their intended purpose.

Examples include:

• Thermometers
• Weighing equipment
• pH meters
• Pressure gauges
• Temperature data loggers
• Laboratory equipment
• Microbiological testing equipment

Where applicable, equipment should be calibrated or verified at defined intervals.

Calibration records should be maintained and measurement results should be assessed when equipment is found to be inaccurate.

11. Verification and Validation

Validation and verification are important but different concepts.

Validation

Validation provides evidence that a control measure or combination of control measures is capable of achieving the intended food safety outcome.

Examples include:

• Validating pasteurization conditions
• Validating cleaning processes
• Validating thermal processing
• Validating shelf-life controls

Verification

Verification determines whether the FSMS and its controls are being implemented as planned and remain effective.

Examples include:

• Internal audits
• Microbiological testing
• Environmental monitoring
• Record review
• Calibration verification
• Inspection activities
• Trend analysis

A strong food safety system requires both validation and verification.

12. Internal Audit

Internal audits help organizations determine whether their FSMS:

• Conforms to ISO 22000 requirements
• Conforms to internal procedures
• Is effectively implemented
• Is maintained
• Continues to achieve intended results

Internal audits should be risk-based and cover relevant processes.

Auditors should look beyond documentation and verify actual implementation.

For example, an auditor should not only check whether a cleaning procedure exists but should also verify cleaning records, inspect the equipment, review microbiological results, and assess whether corrective actions are effective.

13. Management Review

Top management must periodically review the FSMS to determine whether it remains suitable, adequate, and effective.

Management review may consider:

• Internal audit results
• External audit results
• Customer complaints
• Food safety incidents
• Nonconformities
• Corrective actions
• Performance of processes
• Supplier performance
• Changes affecting the FSMS
• Opportunities for improvement

Management review ensures that food safety remains a strategic organizational priority.

14. Nonconformity and Corrective Action

When a food safety problem or system nonconformity occurs, the organization must respond appropriately.

Corrective action should address the underlying cause rather than simply correcting the immediate problem.

Common root cause analysis techniques include:

• 5-Why analysis
• Fishbone/Ishikawa analysis
• Fault-tree analysis
• Process analysis

For example, if repeated environmental swab failures occur, simply resampling the area may not address the root cause.

The organization may need to investigate:

• Cleaning effectiveness
• Equipment design
• Drainage
• Personnel practices
• Traffic patterns
• Cleaning frequency
• Sanitation chemicals
• Environmental conditions

Corrective actions should subsequently be verified for effectiveness.

15. Continual Improvement

ISO 22000 requires organizations to continually improve the suitability, adequacy, and effectiveness of their FSMS.

Improvement can be achieved through:

• Trend analysis
• Internal audits
• Management reviews
• Corrective actions
• Employee suggestions
• Customer feedback
• New technology
• Improved laboratory methods
• Improved sanitation programmes
• Supplier improvement programmes

A mature FSMS should become stronger over time rather than remaining static.

ISO 22000:2018 and FSSC 22000: What Is the Difference?

ISO 22000 and FSSC 22000 are closely related but are not the same.

ISO 22000 provides the core Food Safety Management System requirements.

FSSC 22000 builds upon ISO 22000 and combines it with sector-specific prerequisite programme requirements and additional FSSC requirements.

Therefore:

ISO 22000 = Food Safety Management System standard

FSSC 22000 = ISO 22000 + sector-specific PRPs + FSSC additional requirements

Organizations seeking a GFSI-recognized certification may therefore consider FSSC 22000 or another recognized certification scheme depending on their market and customer requirements.

ISO 22000:2018 and the 2024 Climate Amendment

The 2024 amendment introduced climate-change considerations into ISO management system standards, including ISO 22000:2018.

For food businesses, climate change may affect the FSMS through factors such as:

• Water scarcity
• Extreme weather
• Flooding
• Changes in agricultural production
• Changes in pest populations
• Raw material availability
• Temperature changes
• Supply chain interruptions

Organizations should determine whether climate change is relevant to their FSMS and consider relevant interested-party requirements.

This does not mean every organization must create a separate climate management system. Instead, climate-related issues should be considered within the organization’s existing management-system context where relevant.

Is ISO 22000:2018 Being Replaced?

As of 2026, ISO 22000:2018 remains the published standard.

However, ISO has begun developing ISO/DIS 22000, a draft revision intended to become the next edition of the standard.

Because the document is still under development, organizations should avoid treating draft requirements as final certification requirements.

Companies currently implementing or maintaining ISO 22000 should continue working against the applicable published requirements and monitor official ISO announcements regarding the future edition.

Why ISO 22000 Matters for Public Health

Food safety management is directly connected to public health.

Effective implementation of ISO 22000 can help organizations:

• Reduce foodborne disease risks
• Prevent contamination
• Improve hygiene practices
• Strengthen hazard control
• Improve traceability
• Strengthen emergency response
• Improve supplier management
• Reduce food safety incidents
• Improve consumer confidence

From a public health perspective, preventing contamination at the production level is generally more effective than responding after unsafe food reaches consumers.

How to Prepare for ISO 22000 Certification

Organizations preparing for ISO 22000 certification can follow a structured approach.

1. Conduct a Gap Analysis

Compare the existing food safety system against ISO 22000:2018 requirements.

2. Define the FSMS Scope

Clearly identify the products, processes, sites, and activities covered by the system.

3. Establish PRPs

Ensure that prerequisite programmes are appropriate for the organization’s sector and operations.

4. Develop or Review the HACCP System

Identify hazards, evaluate risks, and establish appropriate control measures.

5. Strengthen Traceability

Test whether raw materials and finished products can be traced effectively.

6. Review Emergency Procedures

Ensure the organization can respond to events that could compromise food safety.

7. Train Employees

Ensure personnel understand their food safety responsibilities.

8. Conduct Internal Audits

Audit both documentation and actual implementation.

9. Conduct Management Review

Ensure senior management reviews FSMS performance and provides necessary resources.

10. Correct Identified Nonconformities

Complete root cause analysis and verify the effectiveness of corrective actions before certification.

Common ISO 22000 Implementation Weaknesses

Organizations may encounter weaknesses such as:

• Incomplete hazard analysis
• Poorly defined PRPs
• Weak monitoring records
• Inadequate traceability testing
• Poor calibration control
• Incomplete training records
• Weak internal audits
• Ineffective root cause analysis
• Poor corrective action follow-up
• Inadequate management involvement
• Outdated food safety documentation
• Failure to consider relevant climate-related issues

Addressing these areas before an external audit can significantly improve FSMS effectiveness.

Final Thoughts

ISO 22000:2018 provides a systematic framework for organizations to identify, evaluate, control, monitor, and continually improve food safety risks throughout the food chain.

Its strength lies in combining management-system principles with prerequisite programmes, HACCP-based hazard control, communication, traceability, verification, and continual improvement.

For organizations operating in 2026, it is particularly important to understand that ISO 22000:2018 remains the current published edition, while the 2024 climate-action amendment is applicable and a new edition is under development.

Food businesses should therefore focus on implementing the current applicable requirements effectively while monitoring official developments concerning the next revision.

Ultimately, ISO 22000 should not be treated simply as a certification exercise. When properly implemented, it becomes a management tool for protecting consumers, reducing food safety risks, improving operational control, and strengthening confidence throughout the food supply chain.

References

International Organization for Standardization (ISO). ISO 22000:2018. Food safety management systems — Requirements for any organization in the food chain.

International Organization for Standardization (ISO). ISO 22000:2018/Amd 1:2024. Food safety management systems — Requirements for any organization in the food chain — Amendment 1: Climate action changes.

International Organization for Standardization (ISO). ISO 22000:2018 Food Safety Management Systems — A Practical Guide.

International Organization for Standardization (ISO). ISO/DIS 22000. Food safety management systems — Requirements for any organization in the food chain. Draft under development.

Codex Alimentarius Commission. CXC 1-1969. General Principles of Food Hygiene. Revised 2022.

Food and Agriculture Organization of the United Nations (FAO) & World Health Organization (WHO). Codex Alimentarius — Food Safety and Hygiene Guidance.