ISO 22000 vs HACCP: the difference, and what your client requires

A buyer asks whether you are "HACCP certified". A tender requires "an ISO 22000 system". A retailer demands "a GFSI-recognised certification". These three sentences do not mean the same thing, and answering the wrong one is expensive: months of preparation against the wrong reference, or a bid set aside over one misread line. Here is the difference, as it plays out in contracts.

HACCP: a method, not a system certificate

HACCP (Hazard Analysis and Critical Control Points) is an approach in seven principles and twelve steps: assemble the team, describe the product and its intended use, establish and verify the flow diagram, analyse the hazards, determine the critical control points, set critical limits, monitor, correct, verify, document. It comes from the Codex Alimentarius, the joint FAO and WHO programme: the reference text is the code of practice General Principles of Food Hygiene, CXC 1-1969, whose 2020 revision moved HACCP from the annex into the body of the text.

Two practical consequences. First, HACCP is a methodological obligation before being a commercial argument: in most regulatory frameworks, including the Moroccan framework carried by Law 28-07 on the sanitary safety of food products, establishments must base their sanitary control on its principles. Second, "HACCP certified" is a shortcut: you can have the conformity of your HACCP approach attested, but there is no HACCP system certification comparable to an ISO 22000 certification delivered under accreditation. When a client writes "HACCP certification", the first thing to do is ask what exactly they mean.

ISO 22000: the management system that contains HACCP

ISO 22000:2018 is a management system standard, on the same harmonized structure as ISO 9001 or ISO 45001: context (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9), improvement (10). We covered this common structure in our watch on ongoing ISO revisions.

The whole HACCP machinery is there, in clause 8.5: preliminary steps, hazard analysis, validation of control measures, hazard control plan with CCPs and OPRPs. But the standard surrounds it with what makes a system: prerequisite programmes (8.2), traceability one step back, one step forward (8.3), emergency preparedness and recalls (8.4), verification (8.8) and control of potentially unsafe products (8.9). The logic is the same as for the occupational risk analysis in ISO 45001: an analysis method only delivers when carried by a system that keeps it alive.

The decisive difference with HACCP alone: ISO 22000 is certifiable. An accredited body audits the system and issues a certificate your clients can verify, with nonconformities classified as minor or major under accreditation rules.

The difference, line by line

Question	HACCP	ISO 22000
Nature	Method for hazard analysis and control	Management system standard
Source	Codex Alimentarius (FAO and WHO), CXC 1-1969	ISO, second edition 2018
Scope	Hazards, critical points, monitoring	HACCP included, plus context, leadership, PRPs, traceability, recalls, improvement
System certification	No: attestations are possible, no accredited system certificate	Yes, by an accredited body
Regulatory status	Required by many sanitary frameworks	Voluntary

And FSSC 22000, BRCGS, IFS: what the client actually requires

On retail and export markets, a third family appears: certification schemes recognised by GFSI (Global Food Safety Initiative), the arrangement through which major retailers mutually recognise certifications. The closest to the ISO universe is FSSC 22000: it is made of ISO 22000, the sector prerequisite programmes of the ISO/TS 22002 series, and additional scheme requirements. In other words, a serious ISO 22000 system puts you one step away from FSSC 22000, not at the summit.

BRCGS and IFS play the same GFSI-recognition role, with a different logic: site standards with detailed, highly prescriptive requirements, historically carried by British retail for one, Franco-German retail for the other. If your buyer is a European purchasing group, it is often one of these two names that appears in the contract, not ISO 22000.

Which one do you need? Three cases, three answers

Your requirement comes from the health authority. What you need is HACCP, documented and applied, within your country's regulatory framework. No ISO certificate exempts you from it.

Your client is an industrial or a B2B principal. ISO 22000 is the most frequent answer: it proves a complete, certifiable system, on the structure they already know from ISO 9001. It is also the best internal foundation: a system, roles, continual improvement, and HACCP inside.

Your client is an international retailer. Look at the exact line of the specification: if it says "GFSI-recognised certification", ISO 22000 alone will not suffice; you will need FSSC 22000, BRCGS or IFS depending on the market. The shortest path almost always goes through a solid ISO 22000 system, completed afterwards.

In all three cases, the starting point is the same: knowing where your system actually stands, clause by clause, HACCP plan included.

Getting support

HEMC supports organizations across the food chain on building the ISO 22000 system, the HACCP approach and certification readiness: initial diagnosis, hazard analysis, control plan, mock audit. To discuss it, talk to our consultants.

This article is provided for information. The text of the standards and codes of practice prevails in its official version: ISO 22000:2018 published by ISO, General Principles of Food Hygiene CXC 1-1969 (2020 revision) published by the Codex Alimentarius Commission, FSSC 22000 scheme requirements published by the Foundation FSSC. Private scheme requirements evolve: check the version in force before any decision.