If you supply food to a large retailer, a hotel chain, or an overseas buyer, you've probably already been asked for this. Reliance Retail, D-Mart, QSR chains, institutional caterers, and most EU and US importers want to see a HACCP-based food safety system before they'll onboard you as a supplier. ISO 22000 is the internationally recognised way of proving you have one.
ISO 22000:2018 is the global standard for a Food Safety Management System (FSMS). It takes the HACCP methodology — the science of identifying and controlling food safety hazards — and wraps it inside a proper management framework covering leadership, policy, documentation, internal audits, and continual improvement. That's the key distinction from standalone HACCP certification, which covers the hazard analysis without the surrounding management system.
This trips up a lot of food business owners, so let's be clear about it.
FSSAI licensing is legally mandatory. You cannot operate a food business in India without it. There's no choice involved.
ISO 22000 is voluntary. No Indian law requires it. It's driven entirely by commercial demand — buyers, exporters, tenders, and corporate clients who want independent assurance rather than a self-declaration.
The two aren't in competition, though. The prerequisite programmes under ISO 22000 (built to ISO/TS 22002-1) map closely onto FSSAI's Schedule 4 requirements for GMP and GHP, and the HACCP methodology at the core of ISO 22000 satisfies what FSSAI expects from high-risk food business operators. In practice, implementing ISO 22000 properly tends to clean up your FSSAI compliance at the same time — which is why it makes sense to treat them as one project rather than two separate exercises.
This is the part most introductory articles skip entirely, and it's genuinely the heart of ISO 22000. Food safety hazards get controlled at three different levels:
Prerequisite Programmes (PRPs) — the foundational hygiene and infrastructure conditions that need to exist before you even start analysing specific hazards. Premises design, cleaning and sanitation schedules, pest control, personal hygiene, waste management, utilities, equipment maintenance. If your PRPs are weak, nothing built on top of them will hold.
Operational Prerequisite Programmes (OPRPs) — controls for significant hazards that general PRPs can't adequately manage, but which don't need a measurable critical limit. Under the 2018 version, OPRP classification is explicitly required and each one has to be justified. This is a common audit finding when businesses haven't thought it through.
Critical Control Points (CCPs) — specific process steps where a measurable critical limit applies and continuous monitoring happens. Cooking temperature, metal detection, pasteurisation time. These are the points where failure means the hazard reaches the consumer.
Getting the classification wrong in either direction causes problems. Under-classifying CCPs is a genuine food safety failure. Over-classifying everything as a CCP creates a monitoring burden your team won't sustain, and auditors notice when monitoring records look fabricated.
The standard applies to anyone in the food chain, not just manufacturers:
The traceability and recall drill catches people out. Auditors don't just want the written procedure — they want evidence you've actually run a mock recall and can trace a batch both upstream and downstream within a reasonable time.
For a food business with reasonable existing hygiene practices and FSSAI compliance already in place, 3 to 6 months is realistic from gap analysis to certificate. Businesses needing infrastructure changes — better layout separation, improved pest-proofing, new monitoring equipment — take longer, and that's largely determined by how fast the capital work happens rather than the paperwork.
You'll sometimes see claims of ISO 22000 certification in 15 to 30 days. That timeline doesn't allow for a genuine HACCP study, PRP validation, staff training, an internal audit, and two audit stages. Treat it as a warning sign about the certification body, not a selling point.
Two separate buckets:
Certification body fees — priced on audit man-days, which depend on your headcount, number of sites, product categories, and process complexity. A single-site small to mid-sized food unit in India typically falls in the ₹60,000 to ₹2.5 lakh range across the three-year cycle including surveillance audits.
Implementation costs — consulting support, documentation, training, and any physical infrastructure or monitoring equipment your gap analysis flags. The infrastructure portion varies enormously and is often the larger number for older facilities.
On accreditation: insist your certification body is accredited under NABCB in India or another IAF member. Unaccredited certificates exist, they're cheap, and buyers who verify them will reject them. If a provider offers a certificate with no site audit, what you're buying has no commercial value.
Worth knowing before you start. FSSC 22000 is a GFSI-recognised scheme built on top of ISO 22000, adding sector-specific prerequisite requirements and additional scheme criteria. Many global retailers and multinational food companies specifically require GFSI recognition, which ISO 22000 alone doesn't provide.
If there's any chance your buyers will ask for FSSC 22000 down the line, it's worth structuring your FSMS with that upgrade path in mind from the start rather than rebuilding later. We'll flag this during scoping if your customer profile suggests it.
Most ISO 22000 failures aren't about bad hygiene — they're about a HACCP study done at a desk instead of on the production floor, OPRP classifications that can't be justified, or a recall procedure that's never been tested.
LegalDev starts with a proper gap analysis covering both documentation and physical infrastructure, so you know upfront whether this is a three-month project or a capital-spend one. We build the FSMS around your actual process flow rather than handing over a template pack, run the HACCP study on-site with your team, prepare your floor staff for auditor interviews, and coordinate Stage 1 and Stage 2 with an accredited certification body. We also align the whole system with your FSSAI Schedule 4 obligations so you're not maintaining two parallel compliance regimes.
No. FSSAI licensing is the legal requirement to operate a food business and is mandatory. ISO 22000 is voluntary and commercially driven, pursued because buyers, exporters, and tender processes ask for it.
HACCP is a hazard-control methodology focused on identifying hazards and establishing critical control points. ISO 22000 embeds HACCP inside a full management system, adding leadership commitment, policy, documented information, internal audits, management review, and continual improvement.
PRPs are foundational hygiene and infrastructure conditions like cleaning and pest control. OPRPs control significant hazards that PRPs can't adequately manage but don't need a measurable critical limit. CCPs are specific process steps with measurable critical limits and continuous monitoring.
Typically 3 to 6 months for a business with reasonable existing hygiene practices. Operations needing infrastructure changes take longer, driven mainly by how quickly the physical work is completed.
Three years, with surveillance audits usually conducted annually and a full recertification audit at the end of the cycle.
No. FSSAI licensing is a legal requirement that ISO 22000 does not substitute for. However, the two align closely — ISO 22000's prerequisite programmes map onto FSSAI's Schedule 4 GMP and GHP requirements, so implementing one strengthens the other.
The 2018 revision adopted Annex SL, the common high-level structure shared across ISO management standards, making integration with ISO 9001 easier. It also introduced risk-based thinking at both organisational and operational levels, strengthened requirements around traceability and recall, and clarified the distinction between OPRPs and CCPs.
FSSC 22000 is a GFSI-recognised scheme built on ISO 22000 with additional sector-specific requirements. Many global retailers and multinational buyers specifically require GFSI recognition, which ISO 22000 alone doesn't carry. If your buyers may ask for it, plan the upgrade path from the start.
Yes. Both share the Annex SL structure, so an integrated management system covering quality and food safety is common and usually cheaper than certifying separately.
Confirm it's accredited by NABCB in India or another IAF member accreditation body. A certificate issued without a genuine site audit has no commercial value, regardless of how official it looks.