ISO 22000: Build Food Safety into Everyday Operations

ISO 22000 provides a food safety management system (FSMS) framework for organizations working in the food chain. It connects responsibilities, communication and controls so that food safety is part of everyday operations. For businesses in the UAE, the useful starting point is a system matched to their products, processes and role in the supply chain—not simply a certificate displayed at reception.

Why food safety needs a management system

In its June 2026 fact sheet, the World Health Organization reported estimates of more than 866 million foodborne illness cases and 1.52 million deaths worldwide in 2021. These are global estimates covering multiple hazards, not figures for the UAE or evidence of the effect of ISO certification. They illustrate why prevention and coordination matter across the food chain.

A food business involves handovers: purchasing receives information from suppliers, operations handle products, storage maintains specified conditions and distribution transfers responsibility. A weakness at a handover can undermine work performed elsewhere. Management needs a clear way to communicate changes and respond when an agreed condition is not met.

What ISO 22000 includes

ISO 22000 combines management system arrangements, communication, prerequisite programmes (PRPs) and Hazard Analysis and Critical Control Points (HACCP) principles. Prerequisite programmes establish basic conditions supporting a suitable operating environment. HACCP provides a systematic approach to identifying and controlling significant food safety hazards. The management system connects this technical work with leadership, competence, review and improvement.

At the 7 October 2026 review, the ISO catalogue lists ISO 22000:2018 and its 2024 climate action amendment, while a revision is under development. A draft revision should not be presented as an already published replacement. Organizations planning implementation should check the applicable edition and requirements for their specific scope.

How the elements fit together

This conceptual illustration explains the relationship between activities; it is not a hazard-control plan for a particular food product.

Define the scope before building the paperwork

A manufacturer, warehouse and catering operation have different activities. The system should state which sites, products and processes it covers. It should also make outsourced activities and important interfaces visible. A supplier certificate alone does not explain what happens when products arrive, how discrepancies are escalated or who can authorize the next step.

Scope clarity also makes communication more accurate. A certificate covering one location should not be described as covering every location in a group. Claims on websites, quotations and other commercial materials should reflect the actual certified scope.

Make records useful during real work

Records should help people understand what happened and what action followed. A completed checklist with no ownership or response route can give a false sense of control. Consider whether a person finding an abnormal result knows whom to contact, what information to record and which decision they are authorized to make.

Use current product and process descriptions, and assign responsibility for receiving supplier and customer changes and passing them to the relevant people. Employees need access to current instructions and a clear understanding of their authority. When an exception occurs, record the condition, action and decision owner so the next shift can understand what happened without relying on a lost verbal message.

Technical limits and control measures must be appropriate to the product and process, established through competent work and applicable requirements. A generic article cannot supply a safe universal temperature, time limit or inspection frequency for every operation.

An illustrative handover problem

Imagine a business that changes an ingredient supplier. Purchasing updates the commercial record, but the revised specification does not reach the people responsible for product information and process controls. The issue is not solved by placing another form in a shared folder. The change process needs to identify the affected decisions and the people authorized to review them.

This is a hypothetical example, not a documented ATMACSS case. Suppose the new specification identifies an allergen absent from the previous information. The change now affects hazard assessment, product information and handling or cleaning arrangements, depending on the situation. Commercial approval of the supplier does not establish that using the new ingredient is appropriate.

Refer the specification to the food safety team before approving the change for use. The team identifies controls, instructions and product information requiring revision, while the authorized decision-maker sets the conditions for use. A shipment arriving before review is complete follows the organization’s process for unapproved cases; receiving staff do not independently bypass the review. If distributed products may be affected, activate the assessment, communication and withdrawal or recall process appropriate to the situation and applicable requirements.

Distinguish monitoring, validation and verification

Monitoring follows the condition of a control during operations. Validation provides evidence that the control or plan can control the intended hazard under the conditions of use. Verification examines implementation and effectiveness, for example through record review and appropriate testing. Many readings do not prove that a control was properly selected, and evidence of its capability does not replace operational monitoring. Product or process changes require a review of the plan’s suitability and any need for revalidation.

Connect a lot to its source and route

Traceability connects food movement through specified stages. In the supplier example, the business needs to link the ingredient lot to the products in which it was used and relevant distribution destinations. This supports identifying affected products when withdrawal or recall is needed. Successful tracing does not establish product safety; it helps define the response accurately and promptly.

A practical internal exercise can select one lot and request its source, quantities used and remaining, and recorded destinations. Examine gaps and the time needed to retrieve the information. This is an implementation suggestion, not a universal mandatory time limit. Assign missing links for correction, then test the revised arrangement.

Review system performance, not just completed records

Connect improvement through Plan–Do–Check–Act (PDCA). Measures could include repeated receiving discrepancies, time to retrieve traceability data and corrective-action effectiveness, each with a clear definition. Fewer complaints alone do not prove food safety; a problem may exist without being reported.

Internal audit examines whether system arrangements are implemented and effective. Management review uses findings, problems and resource needs to make decisions. If specification handover failures recur, resending the file is insufficient. Investigate why it did not reach the user or was not used, change the process and verify that the corrective action worked.

Certification and business expectations

ISO 22000 certification is an assessment of a defined management system scope by an external body. It is not a guarantee that no incident can occur, and it does not automatically secure every customer contract or replace applicable food legislation. A buyer may specify a particular certification scheme or additional requirements; commercial teams should establish exactly what the buyer requests.

Consultancy supports implementation and readiness. The certification decision belongs to the certification body. Keeping these roles clear helps a business plan its work and communicate accurately with customers.

Check whether a change reaches the people using it

For the supplier-change example, trace the revised information from approval to the point where employees use it. Check who updates the ingredient specification, who assesses affected product information and who releases revised instructions. The responsible food-safety specialists determine the technical actions; a general management checklist cannot replace their assessment.

Ask the receiving team to locate the current instruction and explain how it recognizes an unexpected delivery. Ask the next shift how it learns about the change. This practical exercise tests communication and responsibility, without prescribing a universal temperature limit or release decision.

Record gaps and resolve them through the authorized process. Check again after correction, rather than treating a completed training attendance sheet as proof that the change works. If the relevant information is unavailable or contradictory, use the established escalation route. Do not invent an informal workaround to keep the paperwork moving. The purpose is a traceable handover between the commercial decision and the controls that apply to the actual product and process.

Explore ATMACSS services for ISO implementation and certification readiness . Scope, deliverables and terms are defined in the proposal and agreement.