Home/Food safety/Which standard
HACCP, ISO 22000 or FSSC 22000: which one do you actually need
They are not three competing products. They are three layers of the same idea, and the one you need is decided by who is asking for it. Answer four questions and see where your business sits.
In short
- HACCP is a method, not a certificate. It comes from the Codex General Principles of Food Hygiene: seven principles, twelve application steps. Everything else contains it.
- ISO 22000 is a management system standard that wraps HACCP in prerequisite programmes, planning, communication and improvement. It is certifiable by an accredited body.
- FSSC 22000 is a certification scheme built on ISO 22000, with sector specific prerequisites and extra requirements added. It is the one recognised by the Global Food Safety Initiative.
- If a supermarket, a multinational or an export buyer is asking, they usually mean a GFSI recognised scheme, and ISO 22000 on its own will not satisfy that.
- FSSC 22000 version 7 was published in May 2026. Audits against version 6 stop on 30 April 2027, so certified sites have a firm deadline.
The mental model
Three layers, not three choices
Most confusion about food safety standards comes from treating them as alternatives on a menu. They are not. Each one contains the one before it.
HACCP is the reasoning: work out what can go wrong with your product, decide where you can control it, set limits, monitor them, and keep the evidence. A business can run HACCP well and hold no certificate at all.
ISO 22000 takes that reasoning and puts a management system around it. Who is responsible, how you communicate up and down the supply chain, how you verify that your controls work, how you improve when they do not. It is auditable and certifiable, which is why buyers can ask for it.
FSSC 22000 takes ISO 22000 and adds the two things large buyers wanted: detailed prerequisite programmes written for your sector, and a set of additional requirements covering matters such as food fraud, food defence and allergen management. Because it is benchmarked against the Global Food Safety Initiative, a certificate is accepted by retailers that will not accept ISO 22000 alone.
So the real question is never which standard is best. It is how far up the stack your customers require you to be.
Four questions
Which one your business needs
Answer as your situation is today, not as you would like it to be. Nothing is stored or sent anywhere.
Standard chooser
Who is asking, and what do you do
1. Who is asking you for a food safety certificate?
2. What does your business do with food?
3. Do you already have written prerequisite programmes and a HACCP plan in use?
4. How soon do you need the certificate in hand?
Your answers stay on this page. The suggestion is a starting point for a conversation with your certification body, not a substitute for your customer’s own written requirement.
If the answer surprises you, the usual reason is question one. Buyers decide this, not standards bodies. Ask your customer to name the scheme in writing before you spend anything, because a certificate against the wrong standard is an expensive way to learn the difference.
Side by side
The comparison in one table
| Question | HACCP | ISO 22000 | FSSC 22000 |
|---|---|---|---|
| What is it | A method for controlling hazards | A management system standard | A full certification scheme |
| Who publishes it | Codex Alimentarius, the FAO and WHO food standards body | ISO, technical committee TC 34 subcommittee 17 | Foundation FSSC, an independent scheme owner |
| Can you be certified | Yes, against national or private HACCP standards, but there is no single global certificate | Yes, by an accredited certification body | Yes, by a certification body licensed by the scheme owner |
| Recognised by the GFSI | No | No, not on its own | Yes |
| What it covers | Hazard analysis and critical control points | Prerequisites, HACCP, leadership, communication, verification, improvement | All of ISO 22000, plus sector prerequisites and additional requirements such as food fraud and food defence |
| Best for | Any business starting out, and any business that needs the thinking right first | Companies that need a credible, auditable system and are not selling into GFSI driven supply chains | Manufacturers and packers supplying supermarkets, multinationals and export markets |
GFSI is the Global Food Safety Initiative, an industry body that benchmarks schemes so that large buyers can accept one audit instead of running their own.
Layer one
HACCP, the method underneath everything
Hazard Analysis and Critical Control Points
Seven principles, twelve steps
HACCP sits in the Codex General Principles of Food Hygiene, where good hygiene practices come first and HACCP second, because you cannot control critical points in a dirty facility. The seven principles are: conduct a hazard analysis, determine the critical control points, establish critical limits, establish monitoring, establish corrective actions, establish verification, and establish documentation. Twelve application steps carry you through them, starting with assembling a team and describing the product.
The 2022 update added food safety culture as an obligation, and strengthened allergen management, training and the validation of control measures. That matters, because it is the point where an inspector stops reading your plan and starts watching your people.
- Owner
- Codex Alimentarius
- Certificate
- No single global one
- Needed for
- Everything above it
Our post on the HACCP certification process walks through what an implementation actually involves, and the HACCP certification service page covers how we run it.
Layer two
ISO 22000, the management system
ISO 22000:2018, second edition
Three things in one standard
ISO 22000 combines interactive communication, system management and hazard control. It runs two improvement cycles at once: one for the management system, one for the operational hazard control that HACCP describes. It applies to any organisation in the food chain, which is why feed producers, packaging makers, transporters and caterers can all use it, not just factories.
Prerequisite programmes are where most of the work sits, and ISO publishes them separately in the ISO/TS 22002 series, with parts for food manufacturing, catering, farming, packaging manufacturing, transport and storage, and animal feed. Pick the part that matches what you do.
- Edition
- Second, published 2018
- Committee
- ISO/TC 34/SC 17
- Certifiable
- Yes, by an accredited body
The catch is recognition. ISO 22000 is a genuine, auditable certificate, and for a great many buyers it is enough. It is not benchmarked by the GFSI on its own, so a retailer that requires a GFSI recognised scheme will not count it. That single fact decides the choice for most exporters. Details of our approach are on the ISO 22000 certification page.
Layer three
FSSC 22000, the scheme buyers ask for
Food Safety System Certification
ISO 22000 plus two things
FSSC 22000 takes ISO 22000 as its management system requirement, adds the sector prerequisite programme standard for your food chain category, and then adds its own additional requirements. Those additional requirements are where the scheme responds to what has actually gone wrong in the industry: food fraud prevention, food defence, allergen management, environmental monitoring, and the control of services and purchased materials.
It is owned by Foundation FSSC, an independent scheme owner, and delivered by certification bodies licensed by that foundation. Certified sites appear on a public register, which is part of why buyers trust it: they can check you without asking you.
- Current version
- Version 7, published May 2026
- GFSI
- Recognised
- Built on
- ISO 22000 and ISO/TS 22002
If you are already certified
The version 7 deadline is fixed
FSSC 22000 version 7 was published in May 2026, bringing in the new ISO 22002 prerequisite series, alignment with the 2024 GFSI benchmarking requirements and a clearer food chain category structure. The transition dates come from the scheme owner, not from your certification body, so they do not move. Our full guide to version 7 covers every change and an upgrade plan.
- May 2026
- Version 7 publishedRead it now if you hold a certificate. Your gap review is a day of work and it tells you what the upgrade audit will cost you.
- 30 April 2027
- Last version 6 auditsAfter this date no audit can be delivered against version 6.
- 1 May 2027
- Upgrade audits beginThe window for upgrade audits against version 7 runs from here to 30 April 2028.
- 30 June 2028
- Version 6 certificates withdrawnRemaining version 6 certificates are set to withdrawn and disappear from the public register.
Two practical points. The upgrade audit is normally combined with a surveillance or recertification visit, so the extra cost is audit time, not a whole new audit. And the new prerequisite series is the part that needs real work on the floor, because it is where the scheme has tightened.
Locally
What this looks like for a food business in Pakistan
Your provincial food authority licence is the law. A certificate is not a substitute for it, and a licence is not a substitute for a certificate. Both, in that order.
European and Gulf buyers, and the multinationals sourcing here, ask for a GFSI recognised scheme by name. That usually means FSSC 22000 for a manufacturer.
For hotels, caterers, distributors and companies supplying local chains, HACCP or ISO 22000 is usually what is asked for, and is a proportionate place to stop.
The mistake we see most often is a company buying the biggest certificate it can afford before anyone has asked for it, and then struggling to maintain it. The second most common is the opposite: a business that wins an export enquiry, discovers its buyer requires a GFSI recognised scheme, and has nine months of work to do in six weeks. Ask your buyer early, and read our post on food safety compliance in Pakistan for how the licence side fits with all this.
Practical
What getting certified actually takes
The sequence is the same whichever layer you stop at. Only the depth changes.
- Confirm the requirement in writingWhich standard, which version, and whether an accredited or GFSI recognised certificate is needed. One email saves a year of wrong work.
- Fix the prerequisites firstCleaning, pest control, maintenance, personal hygiene, water, waste, layout. No hazard plan survives a facility that has not sorted these.
- Build the HACCP study properlyProduct description, flow diagram verified on the floor, hazard analysis with reasoning recorded, critical limits you can actually measure.
- Write only what you will useThe documented information the standard requires, plus what your own people need. Nothing else.
- Train the team, including managementFood safety culture is now an explicit expectation, and auditors test it by talking to staff, not by reading your policy.
- Run it and collect recordsThree months of real monitoring records is the minimum that makes an audit credible.
- Audit yourself firstAn internal audit and a management review before the certification body arrives. Every finding you raise is one they do not.
- Stage one, then stage twoThe document review comes first, the full audit second, and the gap between them is your chance to fix what stage one found.
Our ISO training courses cover the auditor side if you want the capability in house, and the cost guide explains how audit days are calculated so you can read a quote properly.
Questions
Common questions
Is HACCP the same as ISO 22000?
No. HACCP is a method for identifying and controlling hazards. ISO 22000 is a management system standard that includes HACCP and adds prerequisite programmes, leadership, communication, verification and improvement. You can do HACCP without ISO 22000, but you cannot do ISO 22000 without HACCP.
What is the difference between ISO 22000 and FSSC 22000?
FSSC 22000 is a certification scheme that uses ISO 22000 as its management system requirement, then adds a sector prerequisite programme standard and its own additional requirements. The practical difference is recognition: FSSC 22000 is recognised by the Global Food Safety Initiative and ISO 22000 on its own is not.
Do we need FSSC 22000 to export?
Not always, but often. It depends on the buyer, not the country. Retailers and multinationals that follow GFSI will name a recognised scheme in their supplier requirements. Ask for that requirement in writing before choosing.
Can we get certified to HACCP alone?
Yes, against a national or private HACCP standard, and many buyers in the region accept it. There is no single global HACCP certificate, so check whose HACCP standard the certificate is against before you rely on it.
When does FSSC 22000 version 6 expire?
Audits against version 6 can only be delivered up to 30 April 2027. Upgrade audits against version 7 run from 1 May 2027 to 30 April 2028, and remaining version 6 certificates are withdrawn from the public register after 30 June 2028.
Does a certificate replace our food authority licence?
No. The licence from your provincial food authority is a legal requirement to operate. Certification is voluntary and commercial. Businesses need the licence regardless of which certificate they hold.
How long does certification take?
It depends almost entirely on your starting point. A business with working prerequisites and real records moves quickly. One starting from nothing needs the system running long enough to produce evidence, which is the part that cannot be shortened.
Can we combine this with ISO 9001?
Yes. ISO 22000 shares the structure of other ISO management system standards, so a combined audit against both is normal and costs less than two separate ones.
Which one should a small food business start with?
HACCP, done properly, with the prerequisites fixed first. It is the foundation of both certificates, so nothing you do is wasted if you move up the stack later.
Sources
- Foundation FSSC, FSSC 22000 version 7 scheme documents and the version 7 upgrade process, fssc.com, May 2026
- Codex Alimentarius, General Principles of Food Hygiene CXC 1-1969, including the HACCP chapter and the 2022 update on food safety culture
- ISO 22000:2018, second edition, ISO/TC 34/SC 17, and the ISO/TS 22002 prerequisite programme series
- Global Food Safety Initiative recognised schemes, as summarised by SGS, 2026
- DNV, the difference between HACCP and ISO 22000
Next step
Tell us what your buyer asked for
Send us the line from your customer’s requirement, or just describe what you make and who you sell to. We will tell you which standard fits, what your gap actually is, and what the work involves. No obligation, and no pressure to buy the biggest certificate on the list.
Ask about your requirementSee our food safety services
We work with food businesses across Pakistan, including Lahore, Karachi and Islamabad.