Understanding the relationship between ISO 22000 HACCP is essential for any organisation that wants a credible, auditable food safety management system (FSMS). ISO 22000:2018 is the internationally recognised standard for food safety management, and it embeds the Hazard Analysis and Critical Control Points (HACCP) methodology into a broader management-system framework. This guide explains how the two fit together, what the standard adds beyond classic HACCP, and how to put it into practice.
What is ISO 22000 HACCP?
ISO 22000 is a food safety management system standard that applies to any organisation in the food chain, from primary producers and processors to packaging suppliers, transporters, retailers and food-service providers. HACCP is the risk-based methodology, originally codified by Codex Alimentarius, for identifying, evaluating and controlling significant food safety hazards.
The term “ISO 22000 HACCP” reflects how the standard integrates HACCP principles into a wider system that also covers prerequisite programmes (PRPs), interactive communication along the food chain, and overall system management. In other words, HACCP supplies the hazard-control logic, and ISO 22000 wraps it in leadership, planning, support, operation, evaluation and improvement requirements.
How ISO 22000 builds on classic HACCP
Traditional HACCP focuses on the product and process: conducting a hazard analysis, determining critical control points (CCPs), setting critical limits, monitoring, taking corrective action, verifying and keeping records. ISO 22000 keeps all of that but adds structure that a standalone HACCP plan often lacks.
The 2018 revision follows the Harmonized Structure (the common high-level framework shared across modern ISO management-system standards). This makes it easier to integrate ISO 22000 with standards such as ISO 9001. It also introduces risk thinking at two levels: organisational risks and opportunities, and operational food safety hazards controlled through the HACCP-based hazard analysis.
Prerequisite programmes and operational PRPs
A key contribution of ISO 22000 is how it organises control measures. After hazard analysis, control measures are categorised into prerequisite programmes (PRPs), operational prerequisite programmes (OPRPs), and critical control points (CCPs). This gives a more nuanced picture than CCPs alone.
- PRPs — the basic conditions and activities (hygiene, sanitation, pest control, facility design) that maintain a suitable environment.
- OPRPs — control measures identified by hazard analysis as essential to control significant hazards, managed through action criteria and monitoring rather than measurable critical limits.
- CCPs — steps where control is applied and is essential, with measurable critical limits and monitoring.
ISO 22000 HACCP versus standalone HACCP and FSSC 22000
It helps to see where a HACCP plan, ISO 22000, and FSSC 22000 sit relative to one another. The table below is a qualitative comparison; always verify the current version and scope of each before relying on it.
| Aspect | Standalone HACCP | ISO 22000:2018 | FSSC 22000 |
|---|---|---|---|
| Primary focus | Hazard analysis and CCPs for a product/process | Full FSMS integrating HACCP, PRPs, communication and management | ISO 22000 plus sector-specific PRPs and additional scheme requirements |
| Management-system requirements | Limited | Yes (Harmonized Structure) | Yes, plus extra requirements |
| GFSI recognition | No | Not by itself | Yes, GFSI-recognised certification scheme |
| Certifiable | Sometimes, via national schemes | Yes, against ISO 22000 | Yes, against the FSSC scheme |
FSSC 22000 is a separate certification scheme built on ISO 22000 as its foundation, adding technical sector PRP specifications and further requirements. Organisations seeking GFSI recognition often pursue FSSC 22000, while ISO 22000 certification alone remains widely used and respected.
Implementing ISO 22000 HACCP step by step
A practical implementation typically moves through the following phases. The exact clause numbering and structure should be confirmed against your copy of the standard, but the flow is consistent.
- Define the FSMS scope and understand the organisation, interested parties and the food chain context.
- Secure leadership commitment, set a food safety policy and assign roles, including a food safety team.
- Establish and maintain prerequisite programmes appropriate to your operations.
- Conduct the hazard analysis: describe products and processes, identify hazards, assess significance.
- Determine control measures and categorise them as PRPs, OPRPs or CCPs.
- Set monitoring, action criteria or critical limits, corrections and corrective actions.
- Validate control measures, verify the system, and plan interactive communication internally and externally.
- Evaluate performance through internal audit and management review, then continually improve.
Why interactive communication matters
One distinctive feature of ISO 22000 is its emphasis on interactive communication along the food chain. Food safety hazards can be introduced at any stage, so information must flow between suppliers, the organisation, customers and, where relevant, regulators. This is more explicit than in a classic HACCP plan and is one reason the standard suits complex, multi-party supply chains.
Frequently asked questions
Is ISO 22000 the same as HACCP?
No. HACCP is a hazard-control methodology; ISO 22000 is a full management-system standard that incorporates HACCP principles alongside PRPs, communication and system management. Implementing ISO 22000 means you are applying HACCP within a broader, auditable framework.
Does ISO 22000 replace my existing HACCP plan?
Not exactly. Your hazard analysis and CCP logic remain central, but ISO 22000 restructures control measures into PRPs, OPRPs and CCPs and requires supporting management elements. Existing HACCP work usually becomes the operational core of the FSMS rather than being discarded.
What is the current version of ISO 22000?
The current version is ISO 22000:2018, which adopts the Harmonized Structure. Standards are reviewed periodically, so verify the current version before certification or major documentation work.
Is ISO 22000 certification enough for retailers requiring GFSI recognition?
Often not on its own. Many retailers require a GFSI-recognised scheme such as FSSC 22000, which is built on ISO 22000 plus additional requirements. Confirm your customers’ specific expectations before deciding on a certification route.
Learn more from the standards body
For the authoritative overview of the standard, its scope and benefits, see the official page from the International Organization for Standardization (ISO 22000 food safety management).
Related guides
- ISO 22000 Food Safety Management: A Complete Guide
- ISO 22000 Requirements Checklist for Implementation
- The ISO 22000 Certification Process Explained
Ready to build a compliant FSMS faster? Our editable ISO 22000:2018 toolkit gives you ready-to-use policies, procedures, PRP and HACCP-based hazard analysis templates so you can implement ISO 22000 HACCP with confidence. Explore the ISO 22000 toolkit and start today.