HACCP Principles

HACCP vs ISO 22000: What UK Food Businesses Need to Know

Comparing HACCP and ISO 22000 for UK Food Businesses

HACCP and ISO 22000 are related but distinct approaches to food safety management. HACCP is a set of seven principles focused on identifying and controlling hazards at critical points in the food production process. ISO 22000 is a comprehensive food safety management system (FSMS) standard that incorporates HACCP principles within a broader management framework. For most UK hospitality businesses, Codex HACCP (or the SFBB equivalent) satisfies legal requirements. But understanding ISO 22000 helps you see where HACCP fits in the bigger picture and may be relevant if you supply larger organisations or seek formal certification.

Key takeaways

HACCP is a set of seven principles for controlling food safety hazards at critical points.

ISO 22000 is a complete management system standard that incorporates HACCP within a broader framework.

Most UK hospitality businesses only need HACCP (or SFBB equivalent) to comply with the law.

ISO 22000 is worth considering if you supply to organisations requiring certified food safety management.

HACCP: The Core Framework

HACCP, as defined by the Codex Alimentarius, consists of seven principles and five preliminary steps. It focuses on hazard identification and control at specific points in the food production process. HACCP is the minimum legal requirement for food businesses in the UK under EC Regulation 852/2004 (retained in UK law). It is a focused, practical system: identify hazards, determine critical control points, set limits, monitor, correct, verify, and document. For most hospitality businesses - restaurants, cafes, hotels, pubs, catering companies - a well-implemented HACCP plan is sufficient and appropriate. The Codex guidelines are flexible enough to be applied proportionately: a small cafe can use the SFBB approach while a large hotel banqueting operation might have a more detailed formal HACCP study. HACCP does not prescribe a management system structure - it is about the technical food safety controls.

ISO 22000: The Management System

ISO 22000 is an international standard published by the International Organization for Standardization. It specifies requirements for a food safety management system that combines HACCP principles with prerequisite programmes, management commitment, resource management, communication, continual improvement, and a Plan-Do-Check-Act (PDCA) cycle. ISO 22000:2018 (the current version) introduces the concept of OPRPs as a formal control category between PRPs and CCPs. It requires organisations to establish a food safety policy, define management responsibilities, plan and implement food safety controls, and systematically evaluate and improve the system. Think of HACCP as the engine and ISO 22000 as the complete vehicle. HACCP tells you how to control hazards; ISO 22000 tells you how to manage the entire food safety programme including leadership, resources, communication, emergency preparedness, and continual improvement.

Key Differences

Scope: HACCP focuses on hazard control in production. ISO 22000 covers the entire management system including leadership, planning, support, and improvement. Certification: HACCP can be certified by various bodies (typically under Codex guidelines), but there is no single global HACCP certification standard. ISO 22000 provides a single, globally recognised certification audited by accredited certification bodies. OPRPs: Codex HACCP does not formally define OPRPs (though many practitioners use them). ISO 22000 explicitly includes OPRPs as a defined control category with specific requirements. Communication: ISO 22000 places significant emphasis on interactive communication along the food chain, both upstream (suppliers) and downstream (customers, regulators). HACCP does not address this formally. Continual improvement: ISO 22000 requires a structured approach to continual improvement through management review, internal audits, and corrective actions at the system level. HACCP addresses corrective actions at the CCP level but does not mandate a management-level improvement cycle.

HACCP Principles

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

Which Do You Need?

For most UK hospitality businesses, a well-implemented HACCP plan (or SFBB/CookSafe equivalent) satisfies legal requirements and provides effective food safety management. You do not need ISO 22000 certification to comply with UK food law. ISO 22000 certification may be beneficial if: you supply food to large retailers, contract caterers, or organisations that require certified suppliers; you want to demonstrate a high level of food safety management to potential clients; you operate across multiple sites and need a standardised management framework; or you are seeking to differentiate your business in a competitive market. BRC Global Standard for Food Safety is another option more commonly used in UK food manufacturing and retail supply. SALSA (Safe and Local Supplier Approval) is a less onerous certification suitable for smaller suppliers. Each serves a different market need. Choose based on your customers' requirements and your business strategy, not as a blanket "more is better" approach.

What to do next

Assess whether you need ISO 22000

Review your customer requirements. If none of your clients require ISO 22000 certification, focus on implementing an excellent HACCP system instead.

Strengthen your HACCP plan first

Whether or not you pursue ISO 22000, your HACCP plan must be robust. A weak HACCP system within an ISO 22000 framework is still a weak food safety system.

Frequently asked questions

Is ISO 22000 a legal requirement in the UK?

No. UK food law requires food businesses to implement food safety management procedures based on HACCP principles (EC Regulation 852/2004). ISO 22000 certification is voluntary and goes beyond the legal minimum. It may be required by specific customers or supply chains, but it is not a regulatory requirement.

Can I have HACCP without ISO 22000?

Yes, and most UK hospitality businesses do. HACCP is a focused hazard control system that can stand alone. ISO 22000 includes HACCP but adds management system requirements. You can implement HACCP without any reference to ISO 22000.

What about FSSC 22000?

FSSC 22000 (Food Safety System Certification) is a certification scheme that builds on ISO 22000 by adding sector-specific prerequisites (ISO/TS 22002 series) and additional FSSC requirements. It is primarily used in food manufacturing and is recognised by the Global Food Safety Initiative (GFSI). It is rarely relevant for hospitality businesses.

HACCP Principles