ISO 22000 Explained for Food Buyers

What the certificate on the wall actually says

A food buyer sees "ISO 22000 certified" in nearly every supplier presentation. Fewer buyers could say, if asked, what the certificate proves, what it does not, and which lines on the document deserve a second look. This guide is for them, and it uses MADESA's own certificate as the worked example, because a real document is more useful than an abstract one.

ISO 22000 in one paragraph

ISO 22000 is the international standard for food safety management systems, published by the International Organization for Standardization. The current edition is ISO 22000:2018; in Ukraine it is adopted as DSTU ISO 22000:2019. It specifies what a food business must have in place to control food safety hazards, not what the food must taste like, and not how it is priced. A certificate against ISO 22000 means an independent body has audited the company's system and found that it conforms.

The four pillars

The standard rests on four elements that are easy to remember and worth asking about in a supplier audit:

• Interactive communication, up and down the chain: with raw-material suppliers, with customers, with authorities. Hazards that enter with a raw material are only controllable if someone is talking to the supplier.
• System management: food safety is run as a management system with documented responsibilities, objectives, internal audits and management review, not as a set of unwritten habits.
• Prerequisite programmes (PRPs), the baseline conditions of a food factory: hygiene, pest control, cleaning, water quality, maintenance, staff training, waste handling.
• HACCP principles, hazard analysis and critical control points, as described by the Codex Alimentarius: identify hazards, determine the points where they must be controlled, set limits, monitor, correct, verify and keep records.

ISO 22000 incorporates HACCP rather than replacing it; a company with an ISO 22000 certificate operates HACCP-based procedures by definition. That is also why "HACCP certified" is not a separate claim we make, it is already inside the certificate.

How the standard is organised

Since the 2018 edition, ISO 22000 uses the same ten-clause structure as other ISO management-system standards: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement, preceded by scope, normative references and terms. Clause 8, "Operation", is where the food-specific content lives, PRPs, traceability, emergency preparedness, hazard control, verification and the handling of nonconformities.

The standard also runs two Plan-Do-Check-Act loops at once: one at the level of the whole management system, one at the level of the hazard control plan. In practice this means a sterilisation process is not only validated once, but monitored, verified and reviewed as a routine.

Reading a certificate line by line

Take our certificate, number FSMS.8O140.35-2024. The lines that matter:

• Standard and edition. DSTU ISO 22000:2019 (ISO 22000:2018, IDT), "IDT" means the national adoption is identical to the international text.
• Validity. From 24 September 2024 to 23 September 2027. ISO management-system certificates run on a three-year cycle with annual surveillance audits; a certificate without surveillance lapses.
• Scope. The activities and products the system covers. Ours includes the manufacture of processed and preserved fruit and vegetables, sauces, condiments and spices, condensed milk products and butter, and wholesale trade including warehousing and storage. If a product you buy is not in the scope, the certificate does not cover it.
• Sites. Our certificate names both production sites, in Chyhyryn and in Chornobai, Cherkasy Oblast. A certificate issued for a head office alone says nothing about a factory elsewhere.
• Food chain categories. Certificates reference the ISO/TS 22003 categories. Ours lists C (food manufacturing: CI, CIII and CIV, perishable animal products, mixed products and ambient-stable products), G (transport and storage services) and F (distribution: FI, wholesale and retail).
• Certification body and accreditation. Issued by the certification body of Conformity Assessment Centre "Ukrsertyfikatsiia" LLC, accredited by the National Accreditation Agency of Ukraine (NAAU) under certificate No. 8O140. NAAU is a signatory to the IAF Multilateral Recognition Arrangement, which is what makes a Ukrainian accreditation meaningful to a buyer in another country.

A certificate missing any of these, no accreditation symbol, no scope, no site addresses, should prompt a question.

Surveillance between audits

A certificate is not a one-off event. During its three years of validity the certification body carries out surveillance audits under an approved programme and confirms that the system still conforms; at the end of the cycle the company is recertified. If a company fails surveillance or does not close identified nonconformities, the certificate can be suspended or withdrawn, and the date printed on the document then guarantees nothing. Beyond checking the expiry date, it is worth asking a supplier from time to time for confirmation that the latest surveillance audit has been passed, or checking the certificate's status with the certification body.

What ISO 22000 does not tell you

It is as important to know the limits:

• It is not a product certificate. It says the system for controlling hazards conforms; it does not certify any individual jar.
• It does not cover sensory quality, specifications or consistency of supply. For that, see ISO 9001 and how the two standards differ.
• It is not an organic, religious or sustainability certification.
• It does not replace your own supplier approval. Specifications, certificates of analysis, a site visit where feasible, and a look at the complaint-handling record remain yours to do.

How to use it in supplier approval

A practical sequence for a buyer:

• Ask for the certificate PDF and check number, dates, scope and sites against the goods you intend to buy.
• Verify the certification body's accreditation on the accreditation body's register.
• Ask for the product specification and a recent certificate of analysis; a certified system should produce both without delay.
• Ask how critical control points for your products, sterilisation, seal integrity, pH, are monitored and recorded.
• Keep a copy with a renewal reminder before the expiry date.

Our certificates, with scope and site details, are published on the quality page; the registered company data is on the company details page. If you need copies for a supplier file, ask our team and we will send them with the product documentation.