Food safety management
HACCP and ISO 22000 are connected but not identical
HACCP provides a systematic approach to identifying, evaluating, and controlling food-safety hazards. ISO 22000 is a food-safety management-system standard that integrates HACCP principles with management requirements, communication, prerequisite programs, and continual improvement.
Quick answer
HACCP vs ISO 22000: Differences for Supplier Evaluation
HACCP focuses on hazard analysis and controls specific to product and process. ISO 22000 covers the wider organizational system and can support certification by an independent certification body. ISO does not certify organizations, and a certificate does not replace product-specific review or supplier performance evidence.
- 01Review the scope and site on a certificate rather than relying on a logo or standard name.
- 02A HACCP-plan review covers product, flow, hazards, controls, monitoring, verification, and change.
- 03Supplier approval combines system evidence, product documents, history, and risk-based verification.
What HACCP means in practice
HACCP begins with a team, product description, intended use, flow diagram, and on-site confirmation. The team conducts hazard analysis, identifies necessary controls, sets critical limits for CCPs where applicable, and defines monitoring, corrective action, verification, and record keeping.
A plan cannot simply be moved from one product or line to another. Changes in raw material, process, equipment, packaging, consumer use, or regulation may require review. A buyer should look for evidence that the plan is maintained rather than a document merely titled HACCP.
What ISO 22000 adds
ISO 22000 places hazard control inside a management system. It covers organizational context, leadership, planning, support, operation, performance evaluation, and improvement. Communication across the food chain and prerequisite programs are important parts of the framework.
ISO 22000:2018 can be used for certification, but a certification body issues the certificate—not ISO. Review validity, scope, site, version, body, and surveillance information. Standard status can change, so verify the latest official information during review.
| Area | HACCP | ISO 22000 |
|---|---|---|
| Focus | Product/process hazard analysis and control | Organization-wide food-safety management system |
| Coverage | Operational plan and implementation | Management, communication, PRPs, HACCP, improvement |
| Certification | Depends on the applicable scheme or requirement | Can be certified by a certification body |
| Buyer still needs | Review of relevance and implementation | Scope, certificate, product, and performance review |
A certificate does not finish supplier approval
A certificate provides evidence that a management system was assessed against a defined scope at a point in time. It does not automatically guarantee that every shipment meets specification, every hazard in the buyer's use is covered, or supply performance is always acceptable.
Combine certificate review with product specifications, allergen information, COAs, traceability, complaint history, change control, delivery controls, and sample trials. Verification depth can differ by risk, volume, intended use, and the buyer's ability to control a hazard later in the process.
Questions for document review or audit
Confirm that the product family and manufacturing site fall within scope. Ask how the supplier assesses raw-material hazards, controls cross-contamination, monitors a cold chain where relevant, handles nonconforming product, approves sub-suppliers, and communicates change.
Request records relevant to the transaction and risk rather than every document without purpose. Review whether actions from audits or incidents were closed and verified. Specific evidence is usually more meaningful than a long presentation disconnected from the product.
- Does scope include the site, activity, and product family?
- Do the flow diagram and hazard analysis reflect actual conditions?
- How are traceability and recall exercises tested?
- How does change notification reach the buyer?
Setting the level of due diligence
A higher-risk ingredient, ready-to-eat use, absence of a later kill step, or critical supply may require stronger audit and testing. A lower-risk material or one controlled by a validated buyer process may use a different evidence combination. The rationale should be documented.
Do not turn one certificate into a permanent checkbox. Set review frequency, expiry monitoring, performance triggers, and re-evaluation after a complaint, major change, recall, or repeated gap. Supplier approval is a lifecycle rather than a one-time event.
Primary references
These references support the educational framework. Product-specific and regulatory decisions still require current-document review by qualified personnel.
Continue to sourcing guides
F&B ingredient supplier with ISO 22000 & HACCP
F&B ingredient supplier with ISO 22000 and HACCP standards, offering puree, concentrate, and frozen fruit for food and beverage production.
F&B ingredient supplier for vendor audit
Vendor audit ready supplier for F&B ingredients, with samples, product information, and supporting documents for internal supplier checks.
Keep learning
Related articles
Supply chain
The cold chain is one system, not merely a freezer
Understand frozen-food cold-chain control across storage, loading, transport, receiving, and use, including temperature evidence and traceability.
Procurement and quality
A COA should connect one lot to the agreed specification
A practical guide to identity, lot, specification limits, test results, methods, authorization, and traceability on a food-ingredient COA.
Procurement and supplier quality
Supplier evaluation should test fit, risk, and supply capability
A practical checklist for product fit, food safety, quality, supply, cold chain, traceability, commercial readiness, and ongoing performance.