Brix & BatchPractical food science for the lab and the plant floor
Home / HACCP & ISO 22000

HACCP vs ISO 22000 vs FSSC 22000: Which One Does Your Business Need?

A plain comparison of HACCP, ISO 22000 and FSSC 22000, how they relate to GFSI, BRCGS and SQF, and how to choose the right system for regulators and retail customers.

By , MSc, Food Science and EngineeringUpdated 3 min read

"Do we need HACCP or ISO 22000?" is often the wrong question. They are different layers, and many businesses need more than one.

The short version

HACCP ISO 22000:2018 FSSC 22000
What it is A method (7 principles, Codex) A management system standard A certification scheme
Who writes it Codex Alimentarius (FAO/WHO); national regulators International Organization for Standardization (ISO) Foundation FSSC
Includes HACCP? It is HACCP Yes, as the core of operational planning Yes, via ISO 22000
Management system elements (context, leadership, objectives, internal audit, management review, improvement) Limited Yes, using the ISO high-level structure Yes
Detailed prerequisite programmes Refers to good hygiene practices Requires PRPs but does not detail them Yes: adds sector technical specifications such as ISO/TS 22002-1 for food manufacturing
GFSI-recognised No (on its own) No Yes
Typical driver Legal compliance Structured system; some customers and export markets Retailer and brand-owner requirements

HACCP is a systematic way to identify significant hazards and control them at critical points. In the EU and UK, every food business must have procedures based on HACCP principles. In the US, HACCP is required in some sectors, and the Preventive Controls rule requires a broader food safety plan for most others. HACCP certification exists (offered by various certification bodies), but it is generally not what large customers mean when they ask for a "certified" supplier. Our HACCP plan guide walks through building one.

ISO 22000: a management system around HACCP

ISO 22000:2018 uses the same high-level structure as ISO 9001 (quality) and ISO 14001 (environment), which makes integration easier. On top of HACCP it adds:

  • Understanding the organisation's context and interested parties
  • Leadership commitment and a food safety policy
  • Risk-based thinking at both the business and operational level
  • Operational PRPs (OPRPs) as a category between general PRPs and CCPs
  • Interactive communication along the food chain
  • Internal audit, management review and continual improvement

Its weakness for retail purposes is that it leaves PRP detail to the user. That is why GFSI does not benchmark it on its own.

FSSC 22000: ISO 22000 plus the missing pieces

FSSC 22000 is built from three parts:

  1. ISO 22000:2018
  2. Sector-specific PRP technical specifications, such as ISO/TS 22002-1 for food manufacturing or ISO/TS 22002-4 for food packaging manufacturing
  3. FSSC additional requirements, which cover topics such as food defence, food fraud mitigation, product labelling, environmental monitoring, allergen management and food safety culture

Because it is GFSI-recognised, FSSC 22000 is accepted by many large retailers and brand owners.

Where BRCGS and SQF fit

BRCGS Food Safety (widely used in the UK and by UK retailers) and SQF (widely used in the US and Australia) are also GFSI-recognised schemes. They are prescriptive standards rather than ISO management system standards. Choosing between FSSC 22000, BRCGS and SQF usually comes down to which scheme your key customers accept, and how your team prefers to work:

If your situation is... Often a good fit
You need legal compliance only and sell locally A strong HACCP-based system, no certification required
You already run ISO 9001 or ISO 14001 FSSC 22000 (same structure)
Your main customers are UK retailers BRCGS Food Safety (check each customer's list)
Your main customers are North American retailers or foodservice SQF or FSSC 22000 (check each customer's list)
You export to many markets with different customers FSSC 22000 or another GFSI scheme your key customers accept
You make food packaging FSSC 22000 with ISO/TS 22002-4, or BRCGS Packaging Materials

Always confirm with your customers before choosing. A certificate the customer does not recognise is expensive and does not open the door.

A realistic path for a growing manufacturer

  1. Get the basics right: PRPs, a validated HACCP plan, trained staff and reliable records.
  2. Add management system elements: document control, internal audits, supplier approval, complaint handling, management review.
  3. Run a gap analysis against your chosen GFSI scheme.
  4. Close gaps and run the system for a few months to build records.
  5. Book a certification audit with an accredited certification body.

Sources

  1. International Organization for Standardization. ISO 22000:2018, Food safety management systems: Requirements for any organization in the food chain.
  2. Foundation FSSC. FSSC 22000 Scheme, current version, and Additional Requirements.
  3. International Organization for Standardization. ISO/TS 22002-1, Prerequisite programmes on food safety: Food manufacturing.
  4. Global Food Safety Initiative (GFSI). Recognised certification programmes.
  5. Codex Alimentarius Commission. General Principles of Food Hygiene (CXC 1-1969), revised 2020.

This guide is educational. Safety-critical limits (thermal processes, pH limits, allergen claims) must be confirmed with your process authority, certification body or regulator for your product and market. Spotted an error? Tell the editors.

Related guides