ISO 22000 Food Safety Management Certification
ISO 22000 food safety management certification in Colombo, Kandy and Sri Lanka. Prerequisite programmes, CCPs and supply chain. Accredited body.
ISO 22000 food safety management system certification in Colombo, Kandy and across Sri Lanka — prerequisite programmes, hazard analysis, CCPs, traceability and supply chain communication audited on a three-year cycle by an accredited body.
ISO 22000 is the management system standard for food safety. It incorporates hazard analysis principles and places them inside a full management system covering leadership, planning, competence, communication and improvement. The result is a system a customer can audit and a certification body can certify, rather than a plan sitting in a folder.
No food safety system guarantees safety absolutely, and any certification body claiming otherwise is not one to buy from.
Dubai requirements
Dubai Municipality requires food establishments to operate a food safety management system based on hazard analysis principles, and inspects and grades against it. ISO 22000 satisfies that requirement while adding the management system structure that hotel groups, retailers and export customers increasingly ask for on top. Food manufacturing and distribution operations in Al Quoz, Jebel Ali, Dubai Investment Park and the free zones commonly hold it to serve both regulator and customer with one system.
Abu Dhabi requirements
The Agriculture and Food Safety Authority (ADAFSA) applies food safety requirements across Abu Dhabi, Al Ain and Al Dhafra. Central production kitchens, catering companies and food suppliers serving government facilities, schools, healthcare sites and ADNOC operations are routinely required to hold certified food safety management as a condition of contract as well as licence.
What the standard requires
- Prerequisite programmesCleaning and sanitation, pest control, personal hygiene, water quality, waste, maintenance and supplier control — the foundation without which hazard analysis becomes unmanageable.
- Hazard analysisSystematic identification of biological, chemical, physical and allergen hazards across every process step, with significance assessed on defined criteria.
- Control measures: CCPs and OPRPsHazards controlled either at critical control points with measurable limits, or through operational prerequisite programmes where control is necessary but not measurable at a single point — a distinction ISO 22000 makes explicitly.
- TraceabilityOne step back, one step forward as a minimum, tested rather than assumed. If a recall is needed, traceability decides whether you withdraw one batch or everything.
- Emergency preparedness and recallDocumented procedures for withdrawal and recall, exercised to prove they work before they are needed.
- CommunicationAlong the supply chain in both directions — supplier specifications in, customer requirements and product information out — and internally where changes affect food safety.
- CompetenceFood safety team competence, and training for everyone whose work affects safety, evidenced rather than assumed.
- Validation and verificationValidation confirms a control measure is capable of achieving what it must; verification confirms it actually did. Both are required and the two are frequently confused.
- Internal audit and management reviewEvidence the organisation checks itself and that management acts on findings.
ISO 22000 and FSSC 22000
FSSC 22000 is a GFSI-recognised scheme built on ISO 22000 plus sector-specific prerequisite requirements and additional scheme requirements — and it is FSSC rather than ISO 22000 that most international retailers require. If your customer has asked for GFSI recognition, ISO 22000 alone will not satisfy it, and it is better to establish that before certifying than after.
Where audits find gaps
Validation is the most common. Organisations verify that a control ran but never validated that it was capable of achieving the required reduction in the first place — a cooking step at a temperature and time nobody has demonstrated is sufficient. Traceability exercises that were never actually run come second. And allergen management treated as labelling rather than as cross-contamination control through the process.
Who certifies
- Food manufacturers and processors
- Central kitchens, catering and food service
- Hotels, restaurants and hospitality groups
- Bakeries, dairies and beverage producers
- Cold stores, food logistics and distribution
- Retail food operations
- Packaging manufacturers supplying the food chain
- Agricultural producers and packhouses
The certification process
Stage 1 reviews the documented system, the hazard analysis and the prerequisite programmes, and confirms the scope of products and processes. Stage 2 assesses implementation on site: monitoring and verification records, validation evidence, traceability tested in practice, staff behaviour observed, and premises condition. The certificate runs three years with annual surveillance.
Our role and its limits
ITMAD is an accredited certification body. Under ISO/IEC 17021-1 we cannot write your food safety plan, conduct your hazard analysis or design your controls. We audit and we certify, with optional pre-assessment identifying gaps without prescribing how you close them.
What you receive
- Stage 1 report identifying readiness gaps before the main audit
- Stage 2 audit report with findings supported by objective evidence
- Non-conformities classified by severity with defined response timescales
- Certificate of registration stating your certified scope and products
- Certification mark for use under our mark and seal policy
- Annual surveillance audits and reports through the three-year cycle