ISO 22000 Certification for Food Safety Management Systems

ISO 22000 is the international management system standard for food safety, and itmad audits ISO 22000 systems for organisations anywhere in the food chain. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 22000 in brief

ISO 22000 builds hazard analysis into a full management system that covers leadership, planning, competence, communication and improvement. The outcome is a system that a customer can audit and a certification body can certify, not a plan left in a folder. No food safety system can guarantee safety absolutely, and a certification body that claims otherwise should not be trusted.

Who the standard is for

ISO 22000 applies to any organisation in the food chain, including:

• Food manufacturers and processors
• Central kitchens, catering and food service
• Hotels, restaurants and hospitality groups
• Bakeries, dairies and beverage producers
• Cold stores, food logistics and distribution
• Retail food operations
• Packaging manufacturers supplying the food chain
• Agricultural producers and packhouses

What auditors examine

• Prerequisite programmesCleaning and sanitation, pest control, personal hygiene, water quality, waste, maintenance and supplier control: the foundation without which hazard analysis cannot be managed.
• Hazard analysisA systematic search for biological, chemical, physical and allergen hazards at every process step, with significance judged on defined criteria.
• Control measuresHazards are controlled either at critical control points with measurable limits, or through operational prerequisite programmes where control matters but cannot be measured at a single point. The standard draws that line explicitly.
• TraceabilityAt least one step back and one step forward, tested and not assumed. When a recall is needed, traceability decides whether one batch is withdrawn or everything.
• Emergency preparedness and recallDocumented withdrawal and recall procedures, exercised to prove that they work before an incident occurs.
• CommunicationInformation flowing both ways along the supply chain, with supplier specifications in and customer requirements and product information out, and internally wherever a change affects food safety.
• CompetenceA food safety team that is competent, and training for everyone whose work affects safety, evidenced rather than assumed.
• Validation and verificationValidation confirms that a control measure is capable of doing what it must. Verification confirms that it actually did. Both are required, and the two are often confused.
• Internal audit and management reviewEvidence that the organisation checks itself and that management acts on what is found.

ISO 22000 and FSSC 22000

FSSC 22000 is a scheme recognised by GFSI that builds on ISO 22000 with sector-specific prerequisite requirements and additional scheme rules. A customer that insists on GFSI recognition needs more than an ISO 22000 certificate, and it is better to establish that before certifying than after.

Where ISO 22000 audits find gaps

Validation is the most frequent gap. Organisations verify that a control ran but never validate that it could achieve the required reduction in the first place, for example a cooking step at a temperature and time that nobody has shown to be enough. Traceability exercises that were never run come second, and allergen management treated as labelling instead of cross-contamination control through the process comes third.

How an itmad audit runs

Stage 1 reviews the documented system, the hazard analysis and the prerequisite programmes, and confirms the scope of products and processes. Stage 2 tests the system on site: monitoring and verification records, validation evidence, traceability exercised in practice, staff behaviour observed, and the condition of the premises.

The certificate cycle

An ISO 22000 certificate from itmad runs for three years. Surveillance audits take place in each of the two intervening years, and recertification is completed before the certificate expires.

Independence

A certification body has to stay separate from the systems it certifies. Under ISO/IEC 17021-1, itmad does not design, implement or consult on an organisation's ISO 22000 system. What itmad offers is the audit, the certification decision, and an optional pre-assessment that shows where the gaps against ISO 22000 lie, leaving the organisation to decide how to close them.

What itmad delivers

• A Stage 1 report setting out readiness gaps ahead of the main audit
• A Stage 2 report with findings tied to objective evidence
• Nonconformities classified by severity, with defined response timescales
• A certificate of registration stating the certified scope and locations
• The certification mark, under the terms of itmad's mark and seal policy
• Annual surveillance audits and reports for the full three-year cycle

Frequently asked questions

What is ISO 22000?

ISO 22000 is the management system standard for food safety. It places hazard analysis principles inside a full management system that covers leadership, planning, competence, communication and improvement.

What is the difference between ISO 22000 and FSSC 22000?

FSSC 22000 is a GFSI-recognised scheme built on ISO 22000, with sector-specific prerequisite requirements and additional scheme rules. A customer that requires GFSI recognition needs more than an ISO 22000 certificate alone.

What is the difference between validation and verification?

Validation confirms that a control measure is capable of achieving what it must achieve. Verification confirms that the control measure actually did, and ISO 22000 requires both.

What are the most common ISO 22000 audit findings?

Validation comes first: controls are verified as having run, but never validated as capable of the required reduction. Traceability exercises that were never run come second, and allergen management treated as labelling rather than process control comes third.

How does an ISO 22000 audit work?

itmad audits in two stages. Stage 1 reviews the documented system, the hazard analysis and the prerequisite programmes. Stage 2 tests implementation on site, including records, validation evidence and traceability exercised in practice.

How long does an ISO 22000 certificate last?

An ISO 22000 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years. Recertification is completed before the certificate expires.