Document control
Versions, approvals and distribution with read receipts.
Software for ISO 22000
ISO 22000, without folders or surprises
The ISO food safety standard: prerequisites, a HACCP plan with CCPs and OPRPs, traceability and emergencies in a certifiable, audited system.
What it is and which edition applies
ISO 22000 is the certifiable international standard setting out the requirements for a food safety management system for any business in the food chain, from feed producers to distributors: it combines the HACCP principles of the Codex Alimentarius with prerequisite programmes and with the management structure shared by ISO 9001 and ISO 14001. The current edition is the 2018 one, amended in 2024 to cover climate change, and it is the foundation of FSSC 22000, the scheme that adds the ISO 22002 series prerequisites and requirements of its own and which, unlike the standard on its own, is recognised by GFSI.
- Current edition
- ISO 22000:2018 Second edition, published in June 2018; it replaced the 2005 edition
- Amendment
- Amd 1:2024 Requires you to consider whether climate change is a relevant issue (4.1 and 4.2)
- Next edition
- ISO/DIS 22000, under development The committee expects to finalise the final draft (FDIS) in 2027; until then the 2018 edition applies
- Reference prerequisites
- ISO 22002:2025 series ISO 22002-100 brings together the common ones; Part 1 replaces ISO/TS 22002-1:2009
- Relationship with FSSC 22000
- It is the base standard FSSC 22000 v7, published on 1 May 2026, is still built on the 2018 edition
- GFSI recognition
- FSSC 22000 yes; ISO 22000 alone, no GFSI recognises certification programmes, and ISO 22000 is not on its list
- Certification
- Accredited under ISO 22003-1:2022 The standard that bodies auditing food safety systems must meet
Connected to your document cloud
Publish and version documents by connecting to OneDrive, Google Drive or SharePoint, without duplicating folders.
Audits
Annual program, checklists per standard, findings linked to actions.
Non-conformities
Root cause, action, owner, deadline and effectiveness check.
KPIs
Process objectives fed with real operating data.
Legal requirements
A register of legal and other requirements, with validity and compliance evaluation per standard.
Corrective actions
Root cause, action, owner, deadline and effectiveness check, all linked to the nonconformity.
Improvement actions
Improvement opportunities with an owner and tracking, beyond just fixing what already failed.
Management review
A pre-built report with indicators, audits and nonconformities, ready for the meeting.
Hazard analysis
Hazards by raw material and step, with their acceptable level and the category of each control measure.
CCPs and OPRPs monitored
Critical limits and action criteria with recorded monitoring and a correction opened as soon as there is a deviation.
Traceability and withdrawal
From the raw material batch to the customer who received it, with the mock recall and its response time.
Suppliers under control
Evaluation criteria, performance monitoring and re-evaluation of every external provider.
Requirements covered
What it solves for ISO 22000
- Hazard analysis with acceptable levels and categorisation as CCP or OPRP
- Hazard control plan with critical limits and action criteria
- Prerequisite programmes based on the ISO 22002 part for your sector
- Traceability tested with mock recalls, and documented product withdrawal
- Verification kept separate from monitoring, with trend analysis
- Evaluation of suppliers and externally provided processes (7.1.6)
- Emergency preparedness with periodic testing
- Internal audits and management review of the whole system
Standards covered
Pick your standard and see what it solves
GMP+
Animal feed safety
Food industry · animal feed
IATF 16949
Automotive
Automotive
SQAS2022
Chemical and logistics assessment
Quality · chemical and logistics
ISO 19600
Compliance management systems
Compliance · guidance
ISO 37301
Compliance management systems
Compliance
ISO 22716
Cosmetics manufacturing
Quality · cosmetics
GDPR
Data protection
Legal · data protection
ISO 14001
Environmental management
Environment
SGE 21
Ethical and responsible management
Social responsibility
IFS Food
Food safety
Food industry
ISO 22000
Food safety
Food industry
FSSC 22000
Food safety management system
Food industry
BRCGS
Global food standard
Food industry
ISO 14064
Greenhouse gases
Environment · carbon footprint
HACCP
Hazard analysis and critical control points
Food industry
ISO 27001
Information security
Cybersecurity
ISO 20000
IT service management
Quality · IT services
ISO 13485
Medical devices
Healthcare
ISO 15189
Medical laboratories
Quality · healthcare
ENS
National Security Framework
Security · public sector
UNE 73401
Nuclear quality assurance
Quality · nuclear
ISO 45001
Occupational health and safety
Health & safety
ISO 27701
Privacy management
Cybersecurity
ISO 9001
Quality management
Quality · every sector
ISO 26000:2010
Social responsibility
Social responsibility · guidance
Sustainability
Sustainability management
ESG
UNE 19602
Tax compliance
Compliance · tax
ISO 17025
Testing and calibration laboratories
Quality · laboratories
Templates and records
ISO 22000 records, explained one by one
Which clause of ISO 22000 calls for each record, which fields it needs, a completed example and what the auditor usually flags.
Prerequisite programmes (PRP) plan
How to document ISO 22000 prerequisite programmes: selection, responsibilities, monitoring and verification…
Hazard analysis
How to carry out the ISO 22000 hazard analysis: identification by step, acceptable level, significance…
Validation of control measures
How to document validation of ISO 22000 control measures before applying them: method, evidence, outcome and…
HACCP/OPRP plan
What the ISO 22000 hazard control plan must include for each CCP and OPRP: limits, action criteria…
CCP and OPRP monitoring
What the ISO 22000 record for each CCP and OPRP must capture: batch, reading, actual time, signature and…
PRP and plan verification
How to plan and record verification of PRPs and the HACCP/OPRP plan under ISO 22000 (8.8): activities…
Potentially unsafe product
How to record product leaving an out-of-control CCP or OPRP under ISO 22000: holding, evaluation for release…
Traceability and recall exercise
How to run and record a traceability and mock recall exercise under ISO 22000 (8.3 and 8.9.5): batch, time…
Emergency plan
How to prepare the ISO 22000 emergency plan: scenarios that affect food safety, response, communication…
Supplier evaluation
How to evaluate, select and re-evaluate suppliers under ISO 22000 (7.1.6): criteria, data sheets…
Nonconformities and corrective actions
How to record nonconformities and corrective actions under ISO 22000 (8.9.3 and 10.1): correction, root…
Vocabulary
The terms, stated precisely
- PRP (prerequisite programme)
- Basic conditions and activities — hygiene, cleaning, pest control, maintenance, water, training — that maintain a hygienic environment throughout the organisation, without being tied to a specific hazard.
- OPRP (operational prerequisite programme)
- A control measure applied to a significant hazard that is monitored against a measurable or observable action criterion, rather than a critical limit.
- CCP (critical control point)
- A step in the process at which a control measure is applied against a significant hazard, with a measurable critical limit which, if not met, makes the product potentially unsafe.
- Hazard control plan
- The document that brings together, for each CCP and OPRP, the hazard it controls, the limit or criterion, monitoring, corrections, responsibilities and records. The standard also calls it the HACCP/OPRP plan.
- Action criterion
- A measurable or observable specification for monitoring an OPRP: it shows whether the control measure is still working as intended.
- Potentially unsafe product
- Product leaving a CCP outside its critical limit, or an OPRP that fails its criterion: it is held until it has been evaluated whether it can be released.
Frequently asked questions
What people ask us before getting started
Which edition of the standard is current?
The edition in force is ISO 22000:2018 (2nd edition), with Amd 1:2024; the 3rd edition is at draft stage (ISO/DIS 22000). When the issuing body publishes a new one, a transition period opens; once it closes, certificates issued against the previous edition stop being valid.
Does this work if we are already certified?
Yes. Your existing system — processes, documents, records, audit history — is loaded in and kept alive from day one. Nothing needs redesigning and the certification cycle does not restart.
Will the auditor accept digital records?
Yes, provided they are traceable, controlled and able to show who did what and when. No standard requires paper; every standard requires reliable evidence, and a properly controlled electronic record provides it better than a folder.
Can it be combined with other standards?
Yes, and that is the sensible route. The common Annex SL structure lets a single integrated system share the process map, document control, internal audits, nonconformities and indicators between ISO 22000 and the rest, leaving only the standard-specific parts separate.
How long does it take to be ready for an audit?
It depends on the starting point. An organisation already working with written procedures is usually ready in two or three months; one starting from scratch needs longer. The bottleneck is rarely the tool — it is the availability of the people who know the processes.
What happens to the documentation we already have?
It is migrated. Existing procedures, forms and records are loaded with their version and approver, so the history is not lost and the system starts with the memory the organisation already had.
Can the auditor look directly at the system?
Yes. They are given read-only access with a defined scope and an expiry date. It is more comfortable for both sides than preparing a folder of screenshots and exports.
What is the difference between a major and a minor nonconformity?
A major one compromises the system's ability to meet a requirement — a required process missing altogether, systematic failure, or a failure affecting the product — and usually blocks certification until it is closed. A minor one is a specific lapse resolved with an action plan.
Are the indicators calculated automatically?
Yes, from the data the processes themselves generate. That is the difference between a dashboard that reflects what is happening and a spreadsheet somebody fills in the week before the management review.
Does it work across several sites or legal entities?
Yes. The model is multi-company and multi-site: what makes sense to share is shared, and what belongs to each location stays separate — including the certificate scope where it differs.
Get ready for your ISO 22000
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 22000 · Food safety
Free guide to ISO 22000:2018: prerequisites, hazard analysis, the HACCP/OPRP plan, traceability and…
HACCP or FSSC 22000: obligation versus certification
HACCP is mandatory under Regulation (EC) 852/2004; FSSC 22000 is a voluntary certification built on ISO…
FSSC 22000, without folders or surprises
ISO 22000 plus sector prerequisites and additional scheme requirements, in a single structure.
HACCP, without folders or surprises
A living HACCP plan: identified hazards, critical control points with limits, and monitoring logged for…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 22000:2018 — Food safety management systems. Requirements for any organization in the food chain ISO · 2018 ed. (2nd edition), published June 2018
- ISO 22000:2018/Amd 1:2024 — Climate action changes ISO · February 2024
- ISO/DIS 22000 — Draft revision of the standard (3rd edition) ISO · Under development
- ISO/TC 34/SC 17: status of the ISO 22000 revision ISO/TC 34/SC 17 · March 2026
- ISO 22002-100:2025 — Prerequisite programmes on food safety. Part 100: requirements for the food, feed and packaging chain ISO · 29 July 2025
- ISO 22002-1:2025 — Prerequisite programmes on food safety. Part 1: food manufacturing ISO · 29 July 2025; replaces ISO/TS 22002-1:2009
- FSSC 22000 Version 7: frequently asked questions and transition timeline Foundation FSSC · 1 May 2026
- GFSI-recognised certification programme owners Global Food Safety Initiative · Official list
- ISO 22003-1:2022 — Requirements for bodies providing audit and certification of food safety management systems ISO · June 2022
- General Principles of Food Hygiene, CXC 1-1969 Codex Alimentarius (FAO/WHO) · 2020 revision
Software for ISO 22000 — Food safety
Kimobox is a software for ISO 22000 that digitizes the requirements of the standard: hazard analysis with acceptable levels and categorisation as ccp or oprp, hazard control plan with critical limits and action criteria, prerequisite programmes based on the iso 22002 part for your sector, traceability tested with mock recalls, and documented product withdrawal, with full traceability and evidence ready for the auditor.
The platform lets you run an integrated management system that combines ISO 22000 with other ISO standards and sector protocols, sharing the process map, document control, internal audits, non-conformities and KPIs.