What ISO 22000 tells a buyer

ISO 22000 is the international standard for food safety management systems. To a buyer, an ISO 22000 certificate says that the manufacturing site runs a system for preventing food safety hazards, that an independent certification body has audited it, and that the scope is written on the certificate. It does not say that every lot has been tested. This piece explains the standard in plain words, describes what an audit looks at, and separates what the certificate guarantees from what it does not.

The standard in plain words

ISO 22000 is published by the International Organization for Standardization; the current edition is 2018. It applies to every link in the food chain: factories, warehouses, transport companies, even packaging suppliers. It brings four things into one system:

• Communication along the chain. A site must understand the hazards coming from its suppliers and tell its customers what they need to know.
• System management. Committed leadership, objectives, internal audits and improvement, in the same way other ISO management standards work.
• Prerequisite programmes (PRPs). The basic conditions: plant hygiene, pest control, water quality, equipment maintenance, waste handling.
• The HACCP principles (hazard analysis and critical control points). Find the points in the process where a hazard can arise, put a control there, monitor it and keep records.

In short: PRPs keep the plant clean and orderly, HACCP stops hazards at specific points, and the management part makes sure both are maintained rather than staged for audit day.

What an audit looks at

ISO 22000 certification is issued by a third party certification body after an audit. Common practice is a three year cycle: a certification audit, annual surveillance audits, then a recertification audit. Auditors usually look at three layers.

Documents: the food safety policy, the hazard analysis, the HACCP plan, monitoring records for the critical control points, traceability records, and evidence that a mock recall has been run.

The floor: a walk along the line to see whether real practice matches the paperwork. Hygiene, separation of raw materials from finished goods, allergen control, labels on ingredient containers, warehouse temperatures, the condition of equipment.

People: asking line operators whether they know which control point they are responsible for and what to do when a limit is exceeded. This layer reveals the most, because documents can be written well while answers cannot.

What the certificate guarantees, and what it does not

A buyer should read a certificate the way they would read a contract: the site name and address, the scope (which product groups), issue date, expiry date, the certification body and its accreditation body, and the certificate number for looking it up. The certificate guarantees that at the time of audit the site had a system meeting the standard within the stated scope.

It does not guarantee the following:

• Individual lots are not tested. Lot results live on the COA (certificate of analysis), a separate document.
• It says nothing about taste, texture or shelf life.
• It does not automatically satisfy large retailers, who often require GFSI recognised schemes such as BRCGS, FSSC 22000 or IFS. FSSC 22000 is built on ISO 22000 with additional requirements, but it is a separate certification.
• It does not replace Halal, organic or any other certification.
• It does not renew itself. An expired certificate has no validity until recertification is complete.

How we talk about ISO 22000 with buyers

Color of Vietnam products are made at partner facilities in Hanoi. The facility holds ISO 22000:2018 and is currently going through renewal. When we speak with buyers we make three points: the certificate belongs to the manufacturing facility, not to the Color of Vietnam legal entity; this is its scope and validity status, including the renewal in progress; and a copy is sent on request so the buyer can verify it themselves.

A recent real situation: a buyer asked whether ISO 22000 meant that every lot of protein bars is tested. Our answer was no, and we attached the COA for the exact lot of the samples we had sent, together with how the partner keeps retained samples and in process check records for each lot. The certificate answers a question about the system. The COA answers a question about the lot. A buyer needs both, and we do not let one be mistaken for the other.

If you are an importer or distributor and would like to see the facility's certification file together with the COA for a specific lot, send us a message through the Contact page. If you would like to do quality and documentation work at a small snack company, the open roles are on the Careers page.