Loading

Food Certifications

Food Safety Management (ISO 22000) Certification

Management system certification
A moment from a certification audit

What Is the Certificate?

ISO 22000 defines food safety management system requirements for organisations at any link in the food chain. It brings three elements together: ISO's common management-system structure, HACCP principles, and prerequisite programmes (PRPs). Its distinguishing feature is handling hazard control at two levels: critical control points (CCPs) and operational prerequisite programmes (oPRPs). The current version is ISO 22000:2018.

Who Needs It?

  • Food producers and processors
  • Feed producers and primary-production farms
  • Manufacturers of food packaging, additives and processing aids
  • Providers of storage, transport and logistics services
  • Mass catering, catering and retail food businesses

Is It Mandatory?

The certificate is not legally mandatory; complying with food-safety legislation and establishing a HACCP-based system is mandatory. In Turkey, food businesses have a legal obligation to apply a system based on HACCP principles. ISO 22000 places this obligation in an internationally accepted framework. ISO 22000 alone is not recognised by GFSI; FSSC 22000 is required for GFSI recognition.

Scope of the Standard

  • Clauses 4-10 — Management system requirements: context, leadership, planning, support, operation, performance evaluation, improvement
  • Prerequisite programmes (PRPs): infrastructure, cleaning, pest control, personnel hygiene, waste management
  • The traceability system
  • Emergency preparedness and response
  • Hazard analysis: product and process description, flow-diagram verification, hazard identification and assessment
  • Selecting control measures and classifying them as a CCP / oPRP
  • The hazard control plan: critical limits, monitoring, correction and corrective action
  • Verification planning and analysis of verification activities
  • Product withdrawal and recall
  • Updating and validating the system

Certification Process

  1. 1ApplicationThe organisation's field of activity, headcount, number of sites and scope boundaries are determined. The number of audit days is calculated from this information.
  2. 2Document Review (Stage 1)The management system documentation, scope definition, risk assessment and internal-audit/management-review records are examined; readiness for the on-site audit is assessed.
  3. 3Certification Audit (Stage 2)It is verified on site that the system is implemented and effective. Findings are classified as major/minor nonconformity or observation.
  4. 4Closing NonconformitiesThe organisation submits a root-cause analysis and corrective action plan. The certificate is not issued until major nonconformities are closed.
  5. 5Issuing the CertificateThe certificate is issued after review by an independent decision-maker. The audit team cannot make the certification decision.
  6. 6Surveillance AuditsA surveillance audit is carried out at least once a year during the certificate's validity. The first surveillance cannot exceed 12 months from the last day of Stage 2.
  7. 7RecertificationAt the end of three years, the entire system is re-audited; it must be completed before the certificate expires.

Period of Validity

Management system certificates are valid for three years. At least one surveillance audit is carried out per year during this period; the certificate is suspended if surveillance is not carried out. A recertification audit is completed at the end of the third year.

Required Documents

  • Trade registry record and operating licence
  • The organisation's organisation chart and headcount
  • The list of sites/branches within scope
  • The management system manual or process documentation
  • Internal audit and management review records
  • Legal permits, licences and operating documents, if any
  • Product descriptions and intended use
  • Process flow diagrams and the facility layout plan
  • The hazard analysis and hazard control plan
  • Prerequisite programme documentation
  • Traceability and recall-exercise records
  • Legal permits: the food business registration/approval document

Certification Cost

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

  • The headcount within scope (directly determines the number of audit days)
  • The number of sites and branches; whether multi-site sampling applies
  • The activity's risk level and process complexity
  • The number of standards to be certified — an integrated audit reduces the number of days
  • The three-year cycle: certification + two surveillance audits

Accreditation

Management system certification is carried out within the scope of ISO/IEC 17021-1. The certification body is accredited by an accreditation body party to the IAF multilateral recognition agreement (IAF MLA); This agreement establishes a chain of international recognition that ensures that a document issued in one country is accepted in other countries. EUROLAB has internationally recognized accreditation from IAF member accreditation bodies within the scope of ISO/IEC 17021-1.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

Scope and authorisations

Related Certifications

Frequently Asked Questions

What is the difference between ISO 22000 and HACCP?

HACCP is a hazard-control method consisting of seven principles. ISO 22000 is a comprehensive standard that incorporates HACCP and adds a management-system structure, prerequisite programmes and communication requirements on top of it.

My customer wants GFSI recognition — is ISO 22000 enough?

No. ISO 22000 alone is not recognised by GFSI. For GFSI recognition, you need to move to the FSSC 22000 scheme, which consists of ISO 22000 + the ISO/TS 22002 series + FSSC's additional requirements.

What is the difference between a CCP and an oPRP?

A CCP has a measurable critical limit, and exceeding it means the product is not safe; a loss of control requires direct intervention. In an oPRP, control is provided by the practice as a whole rather than a single measurable limit, and a loss of control alone does not show the product is unsafe.

We use cookies required for the site to work. With your permission we also add an analytics cookie to understand how pages are used. Cookie Policy