ISO 22000 Implementation: 10 Clear Steps in Order (2026)

Last updated 19 September 2026

ISO 22000 implementation follows the structure of the standard itself, and the order matters more than it does for most ISO management systems: the operational clause 8 depends on documents that must exist first — product and process descriptions, prerequisite programmes, a hazard analysis — and the management clauses 9 and 10 depend on clause 8 having run long enough to produce records. A site that starts by writing a policy and a manual spends months on documents the certification auditor reads in minutes, and then discovers at stage 1 that the hazard analysis has no validation and the PRPs have no verification.

This guide sets out ISO 22000:2018 implementation as ten steps in the order that avoids that — scope and team first, PRPs and preliminary steps next, hazard control at the centre, the system layer around it, then the records, audit and review that a certification body needs to see — with a realistic timeline by starting point and the errors that stall the programme.

Before the ten ISO 22000 implementation steps: what you are implementing

ISO 22000:2018 is the harmonised ISO structure — context, leadership, planning, support, operation, performance evaluation, improvement — with the food safety content in clause 8: PRPs, traceability, emergency preparedness, hazard control on the Codex HACCP steps with the CCP/OPRP categorisation, updating, control of monitoring and measuring, verification, and control of nonconformities including recall. Our guide to ISO 22000 covers the standard; ISO 22000 vs HACCP explains what a HACCP-only site has to add.

The ten ISO 22000 implementation steps

Step 1: scope and team

The scope names the sites, products, processes and activities; it decides what the hazard analysis has to cover and what the certificate will say. The food safety team leader is a clause 5.3 role with defined authority — to ensure the FSMS is established, to manage the team, to report on its performance — and the team needs competence in the products, processes, hazards and the standard, documented under 7.2.

Step 2: gap assessment

Clause by clause, what exists, what is partial, what is missing. For a site with a Codex HACCP plan the gaps are predictable: PRPs undocumented or unverified, no OPRP categorisation, no validation record, traceability untested, no emergency procedure, no policy or objectives, no internal audit or management review. The assessment turns into the project plan.

Step 3: PRPs

Clause 8.2 requires PRPs established, documented, maintained and updated, selected and established with reference to ISO/TS 22002 for the sector — 22002-1 for food manufacturing — or an equivalent. The topics are fixed: construction and layout, premises, utilities, waste, equipment, purchased materials, cross-contamination, cleaning and sanitising, pest control, personnel hygiene, rework, recall, warehousing, product information, food defence. One procedure per topic with a verification method is the output. Our guide to ISO 22002 prerequisite programmes covers the list.

Steps 4 to 6: hazard control

The preliminary steps are the inputs; the hazard analysis is one worksheet with identification, acceptable levels, assessment of severity and likelihood, control measure selection and the 8.5.2.4 categorisation into CCPs and OPRPs; validation under 8.5.3 proves the control measures work before the plan relies on them; and the hazard control plan is the row-per-CCP-or-OPRP document that generates the monitoring records. Our guide to OPRP vs CCP covers the categorisation, and the HACCP plan guide the Codex steps.

Step 7: traceability, emergency, recall

Three procedures that one incident invokes together: the traceability system under 8.3, tested with a mass balance; emergency preparedness under 8.4, tested; and withdrawal and recall under 8.9.5 with named authority, tested with a mock recall. Test them in one exercise.

Step 8: the management-system layer

Context and interested parties (4.1–4.2), leadership commitment and the policy (5.1–5.2), risks and opportunities to the FSMS (6.1), measurable objectives (6.2), resources, competence, awareness and communication (7.1–7.4), documented information control (7.5) and control of externally developed elements and providers (7.1.6). These can be written in parallel with steps 3 to 7 by the people who are not on the food safety team. Our guide to ISO 22000 mandatory documents lists what each clause requires.

Step 9: run it

A certification body needs evidence the system operates: monitoring records at CCPs and OPRPs, PRP verification, calibration under 8.7, verification activities and their analysis under 8.8, a full internal audit under 9.2, and a management review under 9.3 with every input the clause lists. Three months of records is the practical minimum before stage 1.

Step 10: certification

Stage 1 reviews the documentation and readiness; stage 2 audits implementation on site. Audit time comes from ISO 22003-1:2022, driven by employees and HACCP studies. Our guide to ISO 22000 certification cost covers the fees and the preparation cost.

ISO 22000 implementation timeline by starting point

Errors that stall ISO 22000 implementation

• Writing the manual first. The manual is not required by the 2018 edition and describes a system that does not yet exist; write it last, if at all.
• Treating every control measure as a CCP. Sites that skip the 8.5.2.4 categorisation end up monitoring critical limits that do not exist; the OPRP category is there to be used.
• No validation. 8.5.3 requires evidence that the control measures are capable of the intended control before implementation; a cook step without a validated time-temperature is a finding.
• PRPs without verification. A cleaning procedure with no swab results, a pest control contract with no trend review — the PRP exists on paper only.
• Going to stage 1 with two weeks of records. The auditor needs to see the system run; a repeat stage 1 costs money and morale.
• A management review that skips inputs. Clause 9.3.2 lists the inputs; the minutes have to show each one was considered.

Frequently asked questions

How long does ISO 22000 implementation take?
Typically 6–8 months to stage 2 for a site with a working HACCP plan and documented PRPs, 9–12 months from a paper HACCP plan and informal hygiene practice, and 6–9 months for an ISO 9001 site adding clause 8 — including three months of operating records before stage 1.

What should be implemented first?
Scope and the food safety team, then the PRPs and the clause 8.5.1 preliminary steps, because the hazard analysis depends on them. The policy and management clauses can be written in parallel by people not on the food safety team.

Do we need a consultant?
Not necessarily. A site with HACCP competence and a documentation toolkit can implement without one; a consultant shortens the hazard analysis and validation steps and reduces the risk of a failed stage 1, at a cost of $5,000–25,000.

Is ISO/TS 22002-1 mandatory?
Clause 8.2 requires PRPs to be selected with reference to ISO/TS 22002 for the sector or an equivalent; for FSSC 22000 the relevant ISO/TS 22002 part is mandatory in full.

How many records are needed before certification?
Enough to show the system operates: three months of CCP and OPRP monitoring, PRP verification, a completed internal audit and a management review is the practical minimum most certification bodies expect at stage 1.

Where this leaves you

Run ISO 22000 implementation in the order the standard’s dependencies dictate: scope and team, gap assessment, PRPs, preliminary steps, hazard analysis with validation and the CCP/OPRP categorisation, the hazard control plan, the traceability-emergency-recall trio tested together, the management-system layer in parallel, then three months of records, an internal audit and a management review before the certification body arrives — because the auditor tests whether the system runs, and a system built in this order does.

References

• ISO 22000:2018 — Food safety management systems — Requirements for any organization in the food chain — Clauses 4–10.
• ISO 22003-1:2022 — Requirements for bodies providing audit and certification of food safety management systems — Certification audit time.
• FAO/WHO Codex Alimentarius — General Principles of Food Hygiene CXC 1-1969 — The HACCP steps clause 8.5 follows.

More on ISO 22000

• ISO 22000 implementation — you are here
• ISO 22000: how the food safety management standard works
• ISO 22000 mandatory documents
• ISO 22000 vs HACCP
• ISO 22000 certification cost
• The traceability system: clause 8.3

The FSMS manual set, the food safety policy and objectives, the prerequisite programme manual, the hazard analysis, the CCP and OPRP monitoring and verification plans and the traceability, emergency, internal audit and management review procedures are in the ISO 22000 Toolkit, or start with the free templates.