What Is ISO 22000? How It Differs From HACCP, Whether You Need It, and How Certification Works
What Is ISO 22000?
ISO 22000 is the food safety management system standard published by the International Organization for Standardization (ISO); its full title is Food safety management systems — Requirements for any organization in the food chain. The current version is ISO 22000:2018, published in June 2018, which replaced the first edition from 2005. In early 2026, articles from certification bodies mentioned that a new edition was being drafted, but at the time of writing we found no official ISO publication date for a new version. The full text of the standard must be purchased from ISO or national standards bodies; the official website provides only a summary.
It brings three things together:
- HACCP principles: Based on the Codex Alimentarius Commission's General Principles of Food Hygiene (CXC 1-1969), it performs hazard analysis and sets control measures.
- Prerequisite programs (PRPs): Basic conditions such as the environment, equipment, cleaning, pest control, and personnel hygiene, a concept close to Taiwan's GHP.
- Management system framework: It uses the high-level structure common to ISO management systems and the PDCA (Plan–Do–Check–Act) cycle, and can be integrated with the ISO 9001 quality management system.
The title says "any organization in the food chain," so not only food factories but also organizations involved in feed, agricultural products, logistics, packaging materials, cleaning agents, and equipment can, in principle, use it.
How ISO 22000 Differs From HACCP
| Item | Taiwan's statutory HACCP | ISO 22000 |
|---|---|---|
| Nature | Regulation, mandatory for designated sectors | Voluntary international standard |
| Basis | Regulations on Food Safety Control System (amended May 1, 2018) | ISO 22000:2018 |
| Scope | Hazard analysis, critical control points, monitoring, corrective action, records | Includes HACCP, plus management system, leadership responsibility, communication, continual improvement |
| Proof | Inspection by the competent authority | Certificate issued by a third-party certification body |
Put simply: HACCP is a method for "finding hazards and controlling the critical points"; ISO 22000 places that method inside a complete company management system, with requirements covering management commitment, internal and external communication, supplier management, and emergency response. Implementing ISO 22000 doesn't automatically satisfy every detail of Taiwan's statutory HACCP; for example, the recognized training hours for control team members still follow Taiwan's regulations.
Do You Need It?
In Taiwan, ISO 22000 isn't a legal obligation. Those who pursue it on their own initiative are mostly:
- Exporting, or supplying brands and retail channels that require international certification.
- Wanting to systematize quality management so the system doesn't depend on individuals.
- Already certified to ISO 9001 and wanting to extend into food safety.
If the customer requires a GFSI-recognized certification scheme, an ISO 22000 certificate alone may not be enough; the common choice is FSSC 22000. Continue with What Is FSSC 22000.
The Certification Process
Details vary by certification body, but the general process is:
- Gap analysis: Compare against the standard to see what your current system lacks.
- Build the system: Form a food safety team and complete the hazard analysis, prerequisite programs, operating procedures, and record forms.
- Run it for a while: Let records accumulate to show the system is actually working.
- Internal audit and management review.
- Third-party certification audit: Usually in two stages; stage 1 reviews documents and readiness, stage 2 checks implementation on site.
- Certification and follow-up: After the certificate is issued, there are periodic surveillance audits and recertification audits.
How This Relates to Equipment
ISO 22000's prerequisite programs require equipment design and materials suitable for cleaning and maintenance, along with a preventive maintenance plan. When implementing it, plants often go back and review every machine: what needs to be disassembled and washed, how often it's serviced, whether lubricants are food grade, and whether broken parts could fall into the product. For design principles, see hygienic design principles; for the sectors subject to statutory HACCP, see What Is HACCP, and Who Must Implement It.
FAQ
Q: What's the difference between ISO 22000 and HACCP?
A: HACCP is a method of hazard analysis and critical control points, mandatory in Taiwan for designated sectors; ISO 22000 is a voluntary international standard that includes HACCP principles plus prerequisite programs and full management system requirements, with certificates issued by third-party certification bodies.
Q: Is ISO 22000 required in Taiwan?
A: It isn't a legal obligation. Businesses usually adopt it voluntarily because of exports, customer requirements, or a desire to systematize management.
Q: What is the current version of ISO 22000?
A: At the time of writing, the current version is ISO 22000:2018.
Q: How does ISO 22000 certification generally work?
A: Typically gap analysis, building the system, running it to accumulate records, internal audit and management review, then a two-stage audit by a third-party certification body, followed by certification and periodic surveillance.