From HACCP to ISO 22000: scaling up your food-safety system

A HACCP plan is a method, not a management system

A mid-sized producer in Izmir runs a clean operation. The HACCP plan is current, the critical control points are monitored daily, and the last serious customer complaint was months ago. Then a European retailer puts a supply contract on the table and asks for certification against a recognised food safety management system. The HACCP file, accurate as it is, suddenly looks thin. Nothing on the line is actually wrong. What is missing is a way to prove, to an auditor who has never met the team, that food safety is managed across the whole business rather than held together by a few experienced people.

This is the moment many growing food companies reach, and it helps to name precisely what is changing. A HACCP study answers a narrow, vital question: where in this process can a biological, chemical or physical hazard reach the consumer, and how do we keep each one in check. The Codex principles behind it, from hazard analysis through critical limits, monitoring and corrective action, stay the technical heart of food safety. A good HACCP plan does not become wrong when you grow. It simply stops being enough on its own.

A management system answers a different question. How does the organisation keep that control reliable when staff change, volumes climb, the product range widens and a buyer audits you with little notice. ISO 22000 takes the hazard analysis you already run and surrounds it with leadership, planning, competence, communication and review. The study is not discarded. It gains a structure that keeps it alive once the people who wrote it move on.

The signals that you have outgrown a standalone plan

The step up rarely announces itself in a single email. It shows up as a pattern, and most quality managers recognise several of these at once:

• new export markets where the importer or retailer specifies a certified system, not a hygiene declaration
• buyers running their own second-party audits and asking for objective evidence instead of assurances
• a second site, an added line or a wider product range the original plan was never scoped to cover
• staff turnover that walks process knowledge out of the door with the people who carried it
• a near miss, a withdrawal, or a drift of complaints that a line-level plan caught late or not at all
• suppliers and co-manufacturers whose controls you are now expected to stand behind in front of a customer

When food safety still lives mainly inside one quality manager's head, the business has already outgrown the standalone plan, whatever the audit calendar says. Scaling up is less about producing more paperwork and more about making control independent of any single person, shift or site.

What ISO 22000 wraps around your HACCP study

The value of the standard is not that it replaces HACCP. It is that it frames HACCP inside a working organisation, and the change is structural rather than a matter of extra paperwork.

In practical terms, ISO 22000 leaves your hazard analysis where it is and builds a management system around it that runs on two levels at once. At the system level sit leadership, organisational context, scope, planning and review; at the operational level sits the day-to-day hazard control your HACCP study already performs. Because the standard shares the High Level Structure of ISO 9001 and ISO 14001, food safety ends up in the same management frame as quality and environment, which for an already-certified company can mean one integrated audit instead of three disconnected ones. Top management formally owns the food safety policy and the resources behind it, so control stops resting on a few experienced people. The detailed machinery that makes those two levels work is what the ISO 22000 standard itself sets out, and that linked page is the place to read it.

None of this is process for its own sake. What a management system gives a growing producer is capacity that does not depend on heroics: each complaint, internal-audit finding and management-review action feeds back into the hazard analysis instead of dying in a folder, so the system gets sharper as volumes and sites multiply. That feedback is the part a standalone plan cannot supply, and it is the honest reason a scaling operation reaches for a full system rather than a thicker binder.

Sequencing the step up without stalling production

Moving from a plan to a certified system is a project, and the order of work decides whether it helps or simply generates documents nobody opens. A sequence that respects the daily reality of a plant tends to look like the one below, and each phase earns its place.

Start with the prerequisite programmes, because everything above them assumes they are stable. Hygiene, maintenance, pest control, water, allergen separation and supplier control are the ground the hazard analysis stands on, and gaps here surface fast under a certified system. With the base firm, re-baseline the HACCP study itself: refresh the hazard analysis, redraw the flow diagrams to match how the line actually runs today, and confirm that each critical control point still reflects reality. Plans drift from practice over a few years, and an honest refresh at this stage saves arguments later.

Only then build the management-system shell around the study: context and interested parties, the scope statement, the food safety policy, defined roles and measurable objectives. With the frame in place, separate operational PRPs from CCPs deliberately and validate every control measure, so each one carries evidence before go-live. Next, wire in the parts a line-level plan usually lacks: internal and external communication, end-to-end traceability, emergency preparedness, and a recall procedure you have actually rehearsed. Finally, run a full internal audit and a management review before you invite anyone in, then move into the Stage 1 readiness review and the Stage 2 certification audit. Treating internal audit as a genuine dress rehearsal rather than a formality is what separates a calm certification from a stressful one.

Where the roadmap leads after certification

For many manufacturers the certified food safety management system is the destination. For those selling to the largest global retailers, there is one more rung. ISO 22000 on its own is not benchmarked by the Global Food Safety Initiative. Combined with sector-specific prerequisite specifications, the ISO/TS 22002 series, and a defined set of additional requirements, it becomes FSSC 22000, which most international retailers accept directly. The sensible move is to treat that as a later step, taken once the management system is stable and the team trusts it, not as the opening play. A scheme the organisation is not yet ready to run will pass an audit and then quietly decay.

If you are weighing the move, the most useful first step is an honest look at where your HACCP plan sits today and what a full food safety management system would ask of it. Read what each one is built to do, then decide how far up the ladder your market is actually pushing you.