ISO 22000 step-by-step plan
From zero to an ISO 22000 certificate. This step-by-step plan takes you through the whole process. Use the NVWA HACCP guidance as your practical basis (NVWA = Netherlands Food and Consumer Product Safety Authority), and choose an accredited certification body under RvA (Dutch Accreditation Council) supervision .
A realistic process usually takes 4-10 months. Organisations with stable processes and clear process owners often move through the implementation phase faster.
Overview of the ISO 22000 process
| Phase | Guide duration | Important result | Read more |
|---|---|---|---|
| 1. Scope and context | 2-4 weeks | Clear definition of products and processes | Who is it for? |
| 2. HACCP and hazard analysis | 3-8 weeks | Hazards, CCPs/OPRPs and control measures | HACCP and PRPs |
| 3. FSMS design and documentation | 4-10 weeks | Auditable procedures and records | Requirements of the standard |
| 4. Implementation and building evidence | 6-14 weeks | Working system with KPIs and records | Audit process |
| 5. Stage 1 + Stage 2 | 4-8 weeks | Certification decision | Costs and timeline |
Tip: Step 4 (the HACCP study) is the heart of ISO 22000. Spend most of your time here. If your hazard analysis and CCP/OPRP determination are sound, the rest of the system falls logically into place.
The 8 steps to ISO 22000 certification
Step 1: Define scope, products and chain
Record which sites, product groups, processes and chain partners fall within scope.
Action: determine straight away where food safety risks are greatest, so you do not choose a scope that is too broad to start with.
Step 2: Set up team and governance
Form a multidisciplinary team (quality, operations, production, purchasing, logistics).
Action: record ownership for each process and each critical control measure.
Step 3: Get PRPs in order
Develop basic conditions such as hygiene, cleaning, maintenance, pest control, supplier management and personal hygiene.
Action: make sure PRPs are measurable through checklists and records.
Step 4: Carry out the HACCP study
Carry out hazard analyses for each process step and determine CCPs/OPRPs with limits, monitoring and corrective actions.
Action: make sure every decision from the hazard analysis is traceable and justified.
Step 5: Set up FSMS procedures and traceability
Put procedures in place for document control, incidents, recall, internal audits, corrective actions and management review. An overview of which documents are mandatory is in the overview of mandatory documents for ISO 22000.
Action: test traceability at least with a mock recall. You can find a step-by-step guide with a fillable table on the page about mock recall for ISO 22000.
Step 6: Implement, train and record
Train teams on the shop floor and on the line, and collect evidence that processes are carried out consistently.
Action: actively manage nonconformities so that your improvement cycle is visible.
Step 7: Internal audit and management review
Carry out internal audits, close nonconformities demonstrably and discuss the results in management review.
Action: resolve critical points before the start of Stage 1.
Step 8: Stage 1 and Stage 2 audit
Stage 1 checks design and documentation. Stage 2 checks how the system works in practice, on the shop floor.
Action: have process owners explain their own decisions, records and improvement actions.
ISO 22000 lead time by type of organisation
Small food business
Total lead time: 4-6 months
- Scope + HACCP: 4-6 weeks
- FSMS set-up: 4-8 weeks
- Implementation + audit preparation: 6-10 weeks
- External audit: 4-6 weeks
Common mistakes in ISO 22000 implementation
| Mistake | Consequence | Better alternative |
|---|---|---|
| Starting with too broad a scope | Slow and expensive process | Start with critical product lines |
| PRPs not developed sufficiently | Weak basis for HACCP | Secure basic conditions first |
| HACCP without a sound justification | Discussion and findings at audit | Record decisions in a traceable way |
| Not training teams | Good documents, weak execution | Role-specific training and follow-up |
| Never testing the recall | Major risk at Stage 2 | Practise a mock recall every year |