ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 22000 vs HACCP is a comparison between a method and a management system that contains it. HACCP — the Codex Alimentarius system of seven principles applied through twelve steps, set out in the General Principles of Food Hygiene CXC 1-1969 — identifies the significant hazards in a food process and controls them at critical control points with critical limits, monitoring, corrective action, verification and records.
ISO 22000:2018 takes that method whole, in clause 8.5, and wraps it in the requirements of a certifiable management system: context and leadership, a food safety policy and objectives, documented prerequisite programmes, a traceability system, emergency preparedness, internal and external communication, verification and its analysis, internal audit, management review and continual improvement. HACCP is what regulators require; ISO 22000 is what an accredited certification body certifies. This guide sets the two side by side on five differences, shows where ISO 22000 adds to Codex HACCP and where it changes the vocabulary — operational prerequisite programmes and action criteria in particular — and explains which to build for four common situations.
HACCP is the hazard analysis and critical control point system codified by the Codex Alimentarius Commission: seven principles — conduct a hazard analysis, determine the critical control points, establish critical limits, establish monitoring, establish corrective actions, establish verification procedures, establish documentation and records — applied through twelve steps that begin with assembling the team and end with the records.
It is required by law in many jurisdictions: EU Regulation 852/2004 requires food business operators to have procedures based on HACCP principles; US regulations mandate it for meat and poultry, seafood and juice, and the FSMA preventive controls rule builds on it. HACCP is not certifiable by an accredited body under an ISO scheme, though certification bodies do offer HACCP certificates against Codex or national standards. Our guides to the seven HACCP principles and the HACCP plan cover the method.
ISO 22000:2018 is the international standard for a food safety management system, applicable to any organisation in the food chain. It follows the harmonised structure of ISO management system standards — clauses 4 to 10 — with the food-specific content in clause 8: PRPs (8.2), traceability (8.3), emergency preparedness and response (8.4), hazard control (8.5, which contains the Codex steps), updating (8.6), control of monitoring and measuring (8.7), verification (8.8) and control of nonconformities including withdrawal and recall (8.9). It is certifiable by accredited bodies on a three-year cycle. Our guide to ISO 22000 covers the standard.
| Difference | HACCP (Codex) | ISO 22000:2018 |
|---|---|---|
| 1. What it is | A method for identifying and controlling significant hazards in a process | A management system standard that contains the method and adds the system around it |
| 2. Control measures | Critical control points with critical limits; prerequisite programmes assumed as the foundation but outside the plan | PRPs (8.2) documented and verified; significant hazards controlled by CCPs with critical limits or by OPRPs with action criteria, selected by a categorisation assessment (8.5.2.4) |
| 3. Scope of requirements | Hazard analysis through records — the twelve steps | Context, leadership, policy, objectives, risks and opportunities, resources, competence, communication, documented information, traceability, emergency preparedness, verification analysis, internal audit, management review, improvement — plus the twelve steps |
| 4. Status | Legally required in most jurisdictions; the basis of FSMA preventive controls | Voluntary; certifiable; the basis of FSSC 22000 and recognised in tenders and supplier approval |
| 5. Evidence an auditor tests | The HACCP plan, monitoring records, corrective action records, verification records | All of that plus policy, objectives, PRP verification, traceability tests, recall tests, communication records, internal audit and management review records |
The first ISO 22000 vs HACCP difference is the one the others follow from. HACCP answers one question: where in this process must a hazard be controlled, and how do we know it was? ISO 22000 answers that question and then asks who is responsible, what the policy is, how the organisation knows its PRPs work, how it communicates with suppliers and customers about hazards, what it does when the process changes, and whether management has reviewed the results. A site can have an excellent HACCP plan and no answer to any of those.
The vocabulary difference that catches HACCP-trained teams is the operational prerequisite programme. Codex has CCPs and prerequisite programmes; ISO 22000 adds a third category, the OPRP, for a control measure that addresses a significant hazard but where a measurable critical limit at a single step is not the right control — an action criterion, measurable or observable, is used instead. Clause 8.5.2.4 requires a systematic assessment to categorise each control measure as CCP or OPRP. Our guide to OPRP vs CCP covers the test.
Clauses 4 to 7, 9 and 10 are the management-system layer. For a site that has only run HACCP, they are where the implementation work is: a food safety policy and measurable objectives, a communication procedure that reaches suppliers, contractors, customers and authorities, competence records for the food safety team, documented PRPs with verification, a traceability system tested against the standard’s requirements, and internal audit and management review as recurring processes.
HACCP is compliance; ISO 22000 is assurance. A regulator inspects the HACCP plan; a customer asks for the ISO 22000 certificate or, more often now, for a GFSI-recognised certificate such as FSSC 22000, which is ISO 22000 plus the ISO/TS 22002 PRP standard plus FSSC’s additional requirements. Our guide to FSSC 22000 vs ISO 22000 covers that step.
The ISO 22000 audit tests the HACCP evidence and the system evidence. Most first-certification findings are in the second group — no PRP verification records, traceability never tested, management review that did not cover the inputs clause 9.3 lists — not in the hazard analysis.
| ISO 22000 clause | Addition over Codex HACCP | What it looks like in practice |
|---|---|---|
| 4.1–4.3 Context and scope | Internal and external issues, interested parties, a defined FSMS scope | A scope statement naming sites, products and processes |
| 5.2 Policy; 6.2 Objectives | A food safety policy and measurable objectives | Policy signed by top management; objectives with targets and owners |
| 6.1 Risks and opportunities | Organisational-level risks to the FSMS, distinct from hazard analysis | A risk register for the system, not the product |
| 7.4 Communication | External communication with suppliers, customers, authorities; internal communication of changes that affect food safety | A communication procedure and records |
| 8.2 PRPs | PRPs established, documented, verified, against ISO/TS 22002 or equivalent | PRP procedures and verification records |
| 8.3 Traceability | A system able to identify incoming material to supplier and end product to first distribution; tested | Lot coding, mass-balance tests |
| 8.4 Emergency preparedness | Procedures for emergencies and incidents that can affect food safety; tested | Emergency plan and test records |
| 8.5.1 Preliminary steps | Codex steps 1–5 as documented requirements: team, product characteristics, intended use, flow diagrams, process descriptions | Documented and kept current |
| 8.5.2–8.5.4 Hazard control | Codex principles 1–5 plus the CCP/OPRP categorisation and validation before implementation | Hazard analysis worksheet, validation records, hazard control plan |
| 8.8 Verification and 8.8.2 analysis | Verification planned, results analysed, used as management review input | Verification schedule and analysis report |
| 8.9.5 Withdrawal and recall | A recall procedure with named authority, tested | Mock recall records |
| 9.2 Internal audit; 9.3 Management review | Recurring system processes with defined inputs and outputs | Audit programme, review minutes |
| Situation | Build | Why |
|---|---|---|
| Regulatory compliance only, no customer demand | Codex HACCP with documented PRPs | It is what the law requires; the system layer can wait |
| Customers ask for ISO 22000 | ISO 22000, built on the existing HACCP plan | The HACCP plan becomes clause 8.5; the work is clauses 4–7, 9, 10 and the rest of 8 |
| Customers ask for a GFSI-recognised certificate | FSSC 22000 (or BRCGS, SQF, IFS) | ISO 22000 alone is not GFSI-recognised; FSSC adds ISO/TS 22002 and additional requirements |
| Already ISO 9001 certified | ISO 22000 integrated with the QMS | Clauses 4–7, 9 and 10 are shared; the food-specific work is clause 8 |
What is the difference between ISO 22000 and HACCP?
HACCP is the Codex method — seven principles, twelve steps — for identifying and controlling significant hazards at critical control points. ISO 22000 is a certifiable food safety management system standard that contains HACCP in clause 8.5 and adds documented PRPs, OPRPs, traceability, emergency preparedness, communication, verification analysis, internal audit, management review and the ISO clauses 4–7, 9 and 10.
Is HACCP included in ISO 22000?
Yes. Clause 8.5 hazard control follows the Codex steps — preliminary steps, hazard analysis, validation, the hazard control plan — and adds the CCP/OPRP categorisation.
Can I be certified to HACCP instead of ISO 22000?
Certification bodies offer HACCP certificates against Codex or national standards, but they are not ISO management-system certificates and are not GFSI-recognised. Regulators require HACCP; customers increasingly ask for ISO 22000 or FSSC 22000.
What is an OPRP?
An operational prerequisite programme: an ISO 22000 control measure for a significant hazard where an action criterion — measurable or observable — rather than a critical limit at a single step is the right control. Codex HACCP has no equivalent category.
Is ISO 22000 GFSI-recognised?
Not on its own. FSSC 22000 — ISO 22000 plus ISO/TS 22002 PRPs plus FSSC additional requirements — is the GFSI-recognised scheme built on it.
Read ISO 22000 vs HACCP as containment rather than competition: keep the Codex plan, categorise its control measures into CCPs and OPRPs, document and verify the PRPs beneath it, and build the management-system layer around it — policy, objectives, communication, traceability, emergency preparedness, verification analysis, internal audit and management review — because that layer is what a certification audit tests and what a HACCP-only site does not yet have.
The food safety policy, the prerequisite programme manual, the hazard analysis, the CCP and OPRP monitoring and verification plans, the traceability and emergency preparedness procedures and the management review procedure are in the ISO 22000 Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026