HACCP, ISO 22000, FSSC 22000 and ISO 9001 Compared
Which one does a food business need: HACCP, ISO 22000, FSSC 22000, or ISO 9001 as well?
Food businesses often hear four names at once: HACCP, ISO 22000, FSSC 22000 and ISO 9001. They overlap, they build on each other, and customers ask for them in different combinations. Choosing the wrong one can mean building a system twice, or holding a certificate that a key customer does not accept.
This article explains what each one is, how they relate, and how to choose.
1. Four references, four different purposes
| HACCP | ISO 22000:2018 | FSSC 22000 | ISO 9001:2026 | |
|---|---|---|---|---|
| What it is | Principles for controlling food safety hazards | Food safety management system standard | Certification scheme built on ISO 22000 | Quality management system standard |
| Published by | Codex Alimentarius | ISO | Foundation FSSC | ISO |
| Focus | Hazard analysis and critical control points | Food safety across the organisation and the food chain | Food safety, with sector prerequisite programmes and additional requirements | Customer satisfaction and consistent quality |
| GFSI-recognised? | No | No, on its own | Yes | No (not a food safety scheme) |
| Typical customers asking for it | Regulators, local buyers | Buyers seeking a management system approach | International retailers and brand owners | Tenders, industrial customers, any sector |
2. HACCP: the foundation
HACCP is a set of seven principles, applied through the Codex logical sequence of steps: assemble the team, describe the product and intended use, draw and verify the flow diagram, analyse hazards, determine critical control points, set critical limits, monitoring, corrective actions, verification and documentation. The Codex General Principles of Food Hygiene, revised in 2020, set out the prerequisite good hygiene practices on which HACCP depends.
HACCP is required by food law in many countries. It controls hazards in the process, but it does not on its own cover management responsibility, communication along the food chain or continual improvement of the whole system.
3. ISO 22000: HACCP inside a management system
ISO 22000:2018 combines:
- HACCP principles in a hazard control plan with CCPs and operational prerequisite programmes (OPRPs).
- Prerequisite programmes (PRPs) for hygiene and infrastructure.
- Interactive communication with suppliers, customers and authorities.
- The harmonized management system structure: context, leadership, risks and opportunities, objectives, internal audit, management review and improvement.
ISO 22000 can be certified, but on its own it is not recognised by GFSI, mainly because it does not specify the prerequisite programmes in detail.
4. FSSC 22000: the GFSI-recognised route
FSSC 22000 adds to ISO 22000:
- Sector-specific prerequisite programmes, from the ISO 22002 series or equivalent, for food manufacturing, packaging, catering, retail and other categories.
- FSSC additional requirements, such as food defence, food fraud mitigation, food safety and quality culture, allergen management, environmental monitoring and product labelling.
- Scheme rules for certification bodies, including unannounced audits.
FSSC 22000 Version 7 was released in 2026, with upgrade audits from 1 May 2027 to 30 April 2028.
5. Where ISO 9001 fits
ISO 9001 is not a food safety standard. It covers quality: meeting customer requirements, controlling processes, and improving based on evidence. Many food businesses hold ISO 9001 alongside ISO 22000 or FSSC 22000, because customers and tenders ask for both, and because quality and food safety share the same structure. Both can run as one integrated management system.
6. How to choose
| Your situation | Usual choice |
|---|---|
| Small business, local market, regulator requires HACCP | HACCP plan with good hygiene practices; consider HACCP certification |
| Growing manufacturer wanting a full management system | ISO 22000, with a plan to move to FSSC 22000 if customers require GFSI |
| Supplying international retailers or brand owners | FSSC 22000 (or another GFSI-recognised scheme such as BRCGS, as the customer specifies) |
| Customers and tenders also ask for quality certification | Add ISO 9001 as part of an integrated system |
The most reliable way to decide is simple: ask your key customers which certificate they accept, and check whether they require a GFSI-recognised scheme.
7. Common mistakes
- Building ISO 22000 and then rebuilding for FSSC 22000, instead of designing for FSSC from the start when GFSI is likely to be required.
- Treating HACCP as a document rather than a working system with validation and verification.
- Running quality and food safety as two separate systems with two document sets.
- Assuming ISO 9001 covers food safety requirements.
Conclusion
HACCP is the foundation, ISO 22000 puts it inside a management system, FSSC 22000 adds what GFSI requires, and ISO 9001 covers quality. The right combination depends on your market and your customers, and the best results come from building them as one integrated system.
Before you start, list your three biggest customers and the certificate each one requires.