ISO 22000:2018
ISO 22000 Standard Implementation
ISO 22000 is the international standard for food safety management systems (FSMS). It combines HACCP methodology with the structure of an ISO management system — leadership, risk management, communication across the food chain, and continual improvement.
What is ISO 22000:2018?
ISO 22000 raises HACCP to the level of a certified management system: besides hazard control, it organises management responsibility, internal and external communication, emergency management and continual improvement. It applies to every link of the food chain — producers, processors, warehouses, transport, catering — as well as manufacturers of packaging and equipment.
The standard distinguishes three levels of control measures: prerequisite programmes (PRP) as the hygiene foundation, operational prerequisite programmes (OPRP), and critical control points (CCP) — enabling more precise control than classic HACCP.
Implementation phases
The real phases we guide every project through — from preparation to the certificate, which comes only at the end:
Verification, Audit and Improvement
The steps follow clauses 4–10 of the standard, with HACCP methodology at the heart of clause 8. Not sure whether you already meet these requirements? Check with the short self-assessment at the bottom of this page.
Context and scope of the FSMS
We define the organisation's place in the food chain, the products and processes within the system, and customer and regulatory expectations.
Leadership and the food-safety policy
Management adopts the policy, appoints the food-safety team leader, and secures resources.
Risks, opportunities and objectives
Risks at the organisational level (suppliers, equipment, staff) and measurable food-safety objectives.
Support and communication across the chain
Competence, training and — specific to this standard — organised communication with suppliers, customers and regulators.
Prerequisite programmes (PRP)
The hygiene foundation per the ISO/TS 22002 series: facility, equipment, pest control, waste, staff, traceability.
Hazard analysis: CCPs and OPRPs
A HACCP analysis that categorises control measures into critical control points (CCPs) and operational prerequisite programmes (OPRPs), with a hazard control plan.
Traceability, withdrawal and emergencies
A traceability system, product withdrawal and recall procedures, and emergency preparedness — with mandatory testing.
Verification, audit and improvement
Verification activities, the internal audit, management review and updating the system.
The path to certification
Certification follows the standard two-stage model.
The prerequisite for everything: the system is implemented and applied in practice — every requirement of the standard met, the internal audit carried out and the management review completed.
Checking PRP programmes, HACCP documentation and the hazard control plan.
A plant visit, checking monitoring records and the traceability/withdrawal test.
A certificate valid for 3 years.
Annual audits and recertification in the third year.
Benefits of Adopting the Standard
ISO 22000 is a globally recognised proof of food safety — it opens export markets.
An existing HACCP system is raised to a certified management system without duplicating work.
Shortens customer due diligence and eases entry into supply chains.
With additional PRP requirements and the FSSC module, the system can be upgraded to a GFSI-recognised certificate.
An illustrative, typical scenario we often hear from clients — it does not represent a specific, named client.
“We had had HACCP for years, but every new site drew up its own plan from scratch. ISO 22000 forced us to introduce a single system of PRP programmes and a product recall test that actually works — when we first tested it with a simulation, we found it would take us three days to recall a batch, and the target was 24 hours.”
— a common scenario among our clients
Related standards
HACCP is the methodological heart of the standard — if you already have it, ISO 22000 is a logical next step. FSSC 22000 combines ISO 22000 with ISO/TS 22002 prerequisites into a GFSI-recognised scheme on par with IFS and BRCGS standards required by major retail chains. ISO 9001 integrates naturally for the quality of the whole organisation.
ISO 22000 training — from a basic understanding of the standard to internal auditor training. Delivered at your premises, online or as a combination of both.
FAQ about ISO 22000:2018
What's the difference between HACCP and ISO 22000?
HACCP is a hazard-control methodology (and a legal obligation); ISO 22000 is a certifiable standard that builds HACCP into a complete management system with leadership, communication and improvement.
What is an OPRP?
An operational prerequisite programme — a control measure significant to food safety that isn't a classic CCP (it has no critical limit like temperature/time), but is planned and monitored under stricter rules than an ordinary PRP.
Is ISO 22000 recognised by GFSI?
ISO 22000 itself is not; GFSI recognises the FSSC 22000 scheme, which is built on ISO 22000 with additional requirements. For chains that require GFSI recognition, FSSC or IFS are the right choice.
How long does implementation take?
With an existing, functioning HACCP system, usually 3 to 5 months; without one, 5 to 8 months. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
How much does ISO 22000 implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organisation's field of activity, its size and number of employees, the chosen standard and the current state of the system. Send us a short description of your organisation and we will prepare a free, tailored estimate.
Standards that fit together like a honeycomb
Each standard keeps its own shape, but together they form a single solid, integrated management system (IMS) — with no gaps or overlaps. Click a hexagon to open that standard.
More about the integrated management system
An integrated management system (IMS) combines two or more ISO standards — for example ISO 22000 with ISO 9001 or ISO 14001 — into one shared framework of documentation, objectives and internal reviews, instead of each standard living in its own parallel procedure.
A single structure (the High-Level Structure — HLS) shared by every modern ISO standard. Thanks to it, the quality policy, risk management, internal audits and management review can be common to several standards at once.
Each standard on its own addresses one part of the business — quality, environment, safety, information. When an organisation introduces several of them, separate systems quickly duplicate the same documentation and the same auditors.
Less duplicated procedure work, simpler management, stronger process oversight, more efficient use of resources and easier preparation for a combined certification audit.
ISO 22000 can be implemented on its own or as part of an integrated system — the decision depends on how many standards you're targeting and whether you're introducing them at once or gradually.
Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for ISO 22000.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
The EU, the US and other markets
ISO 22000 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Montenegro and the region: MEST EN ISO 22000:2019
When people ask about a MEST EN ISO 22000:2019 certificate (or a ISO 22000:2018 certificate), they mean the confirmation issued by an independent accredited certification body to an organisation whose system complies with every requirement of this standard. Montenegro's national edition of the standard carries identical content to the international edition — the same requirements, the same clauses, just under a national designation — which is why both designations turn up in tenders for the same standard.
Why do the designations differ if it's the same standard?
Every member country of the European and international standardisation system adopts the same standard into its own national catalogue and adds a national prefix — in Montenegro, that's MEST. The content, structure, clauses and every requirement an auditor checks during certification remain completely identical regardless of which designation appears on the document. That's why a certificate issued under one designation fully covers the other — it isn't two standards, but one and the same, simply under two names.
Our core activity is standards implementation and rollout: we prepare your organisation so the certification audit goes without surprises, and we explain terms like "ISO 22000:2018 certification" and "MEST EN ISO 22000 certificate" because that's exactly how clients search for them. What certification, accreditation, IAF and surveillance audits involve — read the Certification / ISO Certificate page, and about tender designations on the ISO Standards in Tenders page.
Montenegro is where we work from: our consultants are based in Podgorica, Budva and Bijelo Polje, documentation and training come in Montenegrin or in English, and the certificate itself is issued by an independent accredited certification body — not by us. We work on site in Serbia, Bosnia and Herzegovina, Croatia, North Macedonia, Albania and Kosovo as well — more about what we do in Montenegro.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organisation. Call us or send an inquiry — we reply within 24 hours.