ISO 22000 vs ISO 9001: What Each One Covers

Two certificates, two questions

MADESA holds two management-system certificates, issued by the same body on the same day and valid for the same period: ISO 22000 (No. FSMS.8O140.35-2024) and ISO 9001 (No. QMS.8O140.36-2024), both running from 24 September 2024 to 23 September 2027. Buyers regularly ask why a food manufacturer needs both, and whether one makes the other redundant.

The short answer is that they answer different questions. ISO 22000 answers: is the food safe? ISO 9001 answers: will I get what I ordered, consistently, and what happens when something goes wrong? A factory can, in principle, be strong at one and weak at the other. Holding both, under one integrated system, is how a manufacturer shows it has looked at both.

ISO 9001: quality as a managed process

ISO 9001:2015 is the generic standard for quality management systems; it applies equally to a canning plant, a software company or a hospital. Ukraine has adopted it as DSTU EN ISO 9001:2018, identical to the European and international text. It is built on seven quality management principles: customer focus, leadership, engagement of people, a process approach, improvement, evidence-based decision making and relationship management.

For a buyer of preserves, the parts of ISO 9001 that matter most are concrete:

• Requirements are captured and reviewed. Your specification, pack format, labelling and delivery terms are recorded and checked for feasibility before the order is accepted.
• Processes are controlled. Production follows defined procedures with defined responsibilities; changes go through change control.
• Suppliers are evaluated. Raw materials, packaging and services come from approved sources against defined criteria.
• Nonconformities are handled. A wrong label, a short delivery or a customer complaint is recorded, traced to its root cause and followed by corrective action, and the record exists for the next audit.
• Performance is measured. Customer satisfaction, on-time delivery and internal audit results feed into management review.

None of this is about food safety as such. It is about reliability: that the lecho you receive in November matches the one you approved in March.

ISO 22000: safety as a managed risk

ISO 22000:2018 takes the same management-system skeleton and fills it with food safety: prerequisite programmes, HACCP-based hazard analysis, critical control points, traceability, withdrawal and recall, and verification. We explain its structure in detail in ISO 22000 explained for food buyers.

What ISO 22000 adds that ISO 9001 does not require:

• a documented hazard analysis for every product and process step;
• validated control measures: for sterilised preserves, the heat process and the container seal;
• monitoring records for critical limits, with defined corrective actions when a limit is missed;
• traceability from raw-material lot to finished-product lot and onward to the customer;
• a tested procedure for withdrawing product from the market.

Where they overlap: and why that helps

Since 2015 and 2018 respectively, both standards share the ISO "high-level structure": the same ten clauses, the same vocabulary for context, leadership, planning, support, operation, performance evaluation and improvement. In practice this lets a manufacturer run one integrated management system with one set of internal audits, one management review and one document-control process, and be audited for both standards in a combined visit.

For the buyer this has a practical consequence: the systems reinforce each other. A customer complaint about a loose lid is a quality nonconformity under ISO 9001 and a potential food-safety signal under ISO 22000; one record serves both, and the corrective action is reviewed from both angles.

What the two audits look like in practice

The difference is easiest to see in what an auditor asks to see. On the ISO 9001 side the evidence is commercial and organisational: order and contract review records, the list of approved suppliers and how they were evaluated, calibration records for scales and thermometers, the complaint log with root-cause analyses, training records, internal audit reports and the minutes of management review. On the ISO 22000 side the evidence is technical: the hazard analysis for each product group, the list of critical control points with their limits, the sterilisation and seal-check records for specific batches, hygiene and pest-control logs, water test results, and a traceability exercise in which the auditor picks a finished-product lot and asks the company to trace it back to raw materials and forward to customers within a set time. A factory that can produce both sets of records without searching is running an integrated system rather than two binders.

A side-by-side summary

If you need to explain the difference internally in a sentence each:

• ISO 9001: a system for meeting customer requirements consistently and improving; generic, applicable to any industry; verified by audit of processes, records and customer outcomes.
• ISO 22000: a system for identifying and controlling food safety hazards along the food chain; specific to food and feed businesses; verified by audit of PRPs, the hazard control plan and its records.
• Both: certified by an accredited third party on a three-year cycle with annual surveillance; cover a defined scope and named sites; do not certify individual products.

What to check on each document

The same reading discipline applies to both certificates:

• the standard and edition (ISO 9001:2015 / ISO 22000:2018, or the identical national adoptions);
• the validity dates and the certification cycle;
• the scope: ours is the same on both certificates and covers processed and preserved fruit and vegetables, sauces, condiments and spices, condensed milk products and butter, and wholesale trade with warehousing;
• the sites: Chyhyryn and Chornobai, Cherkasy Oblast, on both;
• the certification body and its accreditation, Ukrsertyfikatsiia, accredited by NAAU under No. 8O140, an IAF MLA signatory.

What neither certificate replaces

Two management-system certificates, however well kept, are a framework and not a substitute for product-level evidence. For supplier approval you will still want the product specification, a certificate of analysis for the lots you receive, the label artwork for compliance review and, where possible, a site visit. What the certificates tell you is that the factory producing those documents has a system behind them, and that someone independent has checked that the system is in use.

Both certificates, with their scope and site details, are published on our quality page. For copies and product documentation, contact our team.