Article

ISO 22000 Certification: What It Involves, Costs and How Long It Takes

ISO 22000 can be challenging because it brings together two areas that organisations often manage separately: a food safety management system and HACCP.

Neha Dvivedi · August 16, 2026

Organisations that already have HACCP may think ISO 22000 certification will be easy. However, ISO 22000 also includes several management system requirements. Similarly, organisations with ISO 9001 may think HACCP will simply be an additional requirement. In reality, the hazard analysis must be technically accurate and suitable for the organisation’s actual processes.

Here is what the ISO 22000 certification process involves.

What Does ISO 22000 Require?

ISO 22000 brings four important elements together:

- Communication across the food chain: Information about food safety hazards must be shared between relevant parties so that risks can be identified and controlled.

- Management system: A structured system for managing food safety, similar to the approach used in other ISO management standards.

- Prerequisite programmes (PRPs): Basic conditions and activities needed to maintain a clean and hygienic food production environment.

- HACCP principles: Identifying food safety hazards and controlling them at the stages where control is most important.

One important feature of ISO 22000 is how food safety controls are categorised. Controls may be managed through PRPs, Operational PRPs (OPRPs), or Critical Control Points (CCPs).

Correctly identifying which control belongs in which category requires technical understanding. This is also an area auditors examine closely.

Main Stages of ISO 22000 Certification

1. Define the Scope

First, the organisation needs to clearly define the products, processes and locations covered by the certification.

The scope is important because the certificate represents the organisation’s ability to control the food safety risks related to the activities included in it.

2. Establish Prerequisite Programmes

The organisation needs to address areas such as:

- Facility construction and layout

- Utilities

- Waste management

- Equipment suitability

- Cleaning and sanitation

- Pest control

- Personal hygiene

- Allergen management

- Storage and transportation

If the facility has problems with its layout, infrastructure or hygiene conditions, additional physical improvements may be required. This can increase both the cost and the implementation time.

3. Conduct Hazard Analysis

The organisation needs to review every relevant process step and identify potential:

- Biological hazards

- Chemical hazards

- Physical hazards

- Allergen-related hazards

The hazards are then assessed for their significance, and suitable control measures are identified and categorised.

4. Identify CCPs and OPRPs

Critical Control Points and Operational Prerequisite Programmes need to be clearly established.

For relevant controls, the organisation must define critical limits or criteria, monitoring methods, corrections and corrective actions.

5. Validate Control Measures

Validation provides evidence that the selected control measures are capable of effectively controlling the identified hazards.

Validation is different from verification and is an area that organisations sometimes overlook.

6. Plan Verification Activities

The organisation must establish methods for checking that the food safety system is working as intended.

7. Establish Traceability and Recall Systems

The organisation needs an effective traceability system and documented withdrawal and recall procedures.

These systems should also be tested through practical exercises, such as a mock recall.

8. Implement the System

The system needs to operate long enough for the organisation to generate meaningful records and evidence.

In many cases, organisations should plan for at least three months of implementation and records before certification audits.

9. Conduct Internal Audit and Management Review

Before the certification audit, the organisation should conduct an internal audit and management review to identify and address gaps.

10. Certification Audit

The certification process generally includes:

- Stage 1 audit: Review of the organisation’s readiness and documented system.

- Stage 2 audit: Detailed assessment of the implementation and effectiveness of the system.

- Certification: If the requirements are successfully met, the ISO 22000 certificate is issued.

How Long Does ISO 22000 Certification Take?

The timeline depends on the size and complexity of the organisation and the condition of its existing food safety system.

Typical timelines may be:

- Small operation with suitable facilities: Around 6–9 months

- Medium-sized food manufacturer: Around 9–15 months

- Facility requiring significant infrastructure improvements: Potentially longer

Two common reasons for delays are physical improvements required under prerequisite programmes and missing validation evidence.

What Does ISO 22000 Certification Cost?

There is no single fixed cost for ISO 22000 certification. The total investment depends on several factors.

Certification Body Fees

Certification body fees are generally influenced by:

- Number of employees

- Number of sites

- Complexity of processes

- Number of production activities

- Number of audit days

- Shift patterns

Food safety audits often require auditors to spend time observing actual production activities. If the organisation operates multiple shifts, the audit schedule may need to include different shifts.

Consultancy Costs

Consultancy costs depend on the organisation’s requirements and the complexity of its food safety system.

Hazard analysis is particularly important because identifying and correctly categorising control measures requires technical knowledge and practical experience.

Facility Improvement Costs

Facility improvements can sometimes become the largest additional expense.

For example, an organisation may need to address:

- Drainage

- Floors and wall junctions

- Air handling

- Production segregation

- Equipment placement

- Hygiene-related infrastructure

These improvements involve both construction costs and additional implementation time.

Laboratory Testing

Validation and verification may require laboratory testing. These costs can continue after certification and should therefore be included in the overall food safety budget.

Common Problems During ISO 22000 Implementation

Generic Hazard Analysis

A hazard analysis copied from another organisation or product may not accurately reflect the actual process.

The analysis should be based on the organisation’s real activities, equipment, materials and production conditions.

Too Many Critical Control Points

If almost every process step is classified as a CCP, it may indicate that OPRPs and other control measures have not been properly understood.

Too many CCPs can also make monitoring difficult and increase the risk of records being missed.

Confusing Validation and Verification

These two activities have different purposes.

Validation asks whether a control measure is capable of controlling the hazard.

Verification checks whether the system is actually working as planned.

An organisation may have many verification records but still lack sufficient validation evidence.

Prerequisite Programmes Not Properly Documented

Cleaning may be carried out regularly, but this is not enough by itself.

There should be clear information about cleaning methods, frequencies, responsibilities and verification activities.

Traceability Not Tested

Having a documented traceability procedure is not enough. The organisation should test it.

A mock recall exercise can show how quickly the organisation can trace affected products and identify any gaps in the system.

Allergen Management Limited to Labelling

Allergen control is more than checking product labels.

It also involves preventing cross-contamination during:

- Storage

- Production

- Cleaning

- Equipment changeover

- Material handling

Is ISO 22000 Certification Worth It?

If a customer or market requires ISO 22000 certification, the decision may already be clear. However, organisations should first confirm whether the customer actually requires ISO 22000 certification or a GFSI-recognised food safety scheme.

For organisations pursuing certification voluntarily, one of the biggest benefits is the opportunity to examine the food safety process in a structured way.

Many food businesses depend heavily on the experience and knowledge of their employees. ISO 22000 helps turn that practical knowledge into a documented and controlled system.

The process of identifying hazards, deciding where they are controlled and validating that the controls actually work can reveal gaps that may have gone unnoticed for years.

Ultimately, ISO 22000 is not just about obtaining a certificate. It is about creating a structured, practical and effective approach to managing food safety risks.

What this covers

ISO 22000

See how this looks as a working system

Reading about a requirement and seeing the documentation that satisfies it are different things. In a short demo we open the actual manual, procedures and records set for ISO 22000, show you how each clause is answered and where your existing way of working already fits. You will know what implementation involves before you commit to it.