ISO 22000 vs HACCP vs FSSC 22000: Which Does Your Restaurant Actually Need?

 

Most single restaurants need a HACCP-based food safety plan and the local food licence, not an ISO 22000 certificate. ISO 22000 fits central kitchens, caterers, chains and food suppliers that buyer’s audit. FSSC 22000 is for businesses whose customers require a GFSI-recognised scheme. Check what your regulator or buyer actually asks for before you spend anything.

Restaurant owners often hear three terms as if they were interchangeable. They aren't, and picking the wrong one can mean paying for an audit nobody asked for. This guide explains what each one is, who needs it and what auditors check in a kitchen.

In this post: quick answer by business type · what each one is · side-by-side comparison · what auditors check · what drives cost · common mistakes ·FAQ

Which one fits your business?

Your business	Usual starting point	Consider ISO 22000 when	Consider FSSC 22000 when
Single restaurant or café	Local food licence and a HACCP-based plan	A hotel group, airline, hospital or corporate client asks for a certificate	Rarely
Cloud kitchen	Licence, HACCP plan, delivery temperature controls	Delivery platforms or corporate buyers audit you	Only if a retail or GFSI-driven buyer requires it
Caterer or central kitchen	HACCP plan and licence	Buyers or tenders ask for a certificate, which is common	If a large buyer requires a GFSI-recognised scheme
Multi-outlet chain	HACCP across outlets	The central kitchen or commissary supplies several outlets	If the commissary supplies retailers
Food supplier to restaurants	HACCP and licence	Buyers ask for a certificate	Many retail buyers require it

What each one actually is

HACCP (Hazard Analysis and Critical Control Points) is a method for finding food safety hazards and controlling them at the points where they can be prevented. It is based on principles from the Codex Alimentarius. Many countries legally expect food businesses to run HACCP-based procedures, often in a simplified form for small businesses. HACCP is not an ISO standard.

ISO 22000:2018 is an international standard for a food safety management system. It includes HACCP, but adds prerequisite programmes (cleaning, pest control, supplier approval, training) and management system requirements: leadership, internal audits, management review and continual improvement. An accredited certification body audits you and issues a certificate valid for three years, with annual surveillance audits.

FSSC 22000 is a certification scheme built on ISO 22000, with sector-specific prerequisite requirements and extra scheme rules. It is recognised by the Global Food Safety Initiative (GFSI), which is why large retailers and manufacturers often ask for it. ISO 22000 on its own is not GFSI-recognised.

Side by side

	HACCP	ISO 22000:2018	FSSC 22000
What it is	A hazard analysis method	A certifiable food safety management system standard	A certification scheme based on ISO 22000
Includes management system (audits, review, improvement)	No	Yes	Yes
Third-party certification	Available under some schemes. Many businesses implement HACCP with no certificate.	Yes, by an accredited certification body	Yes, by a scheme-approved certification body
GFSI-recognised	No	No	Yes
Typical users	Any food business, often as a legal baseline	Caterers, central kitchens, chains, food suppliers	Manufacturers and suppliers to retailers, some large catering operations
Effort	Lowest	Medium	Highest

When a restaurant should step up

Move from a basic HACCP plan to ISO 22000 only when there is a reason you can name:

• A buyer, hotel group, airline, hospital or tender asks for a certificate.
• You run a central kitchen supplying several outlets and want one system across them.
• Repeated customer audit findings show you need a management system, not just a plan.
• You plan to supply other food businesses, not only serve diners.

If none of these applies, certification adds annual surveillance audits and internal effort with no return. Spend that effort on getting the HACCP plan and daily records right first.

What auditors check in a kitchen

Area	What the auditor asks to see	Common finding
Hazard analysis	A hazard analysis for each menu item or product group	One generic analysis copied from a template
Critical control points	Cooking, chilling and hot-holding temperature records	Records filled in at the end of the shift
Calibration	Thermometers checked against a reference	Thermometers never calibrated
Allergens	How allergens are controlled for specials and menu changes	No control when the menu changes
Suppliers	Approved supplier list and evaluations	Suppliers approved once, never re-evaluated
Traceability	Trace one ingredient forward and back	Delivery records don't link to batches
Cleaning and pests	Cleaning schedules, verification and pest control records	Schedules exist, no verification
Training	Hygiene training records and staff interviews	Training delivered in a language staff don't understand
Management system (ISO 22000 and FSSC 22000)	Internal audit report, management review minutes	Review held, required inputs missing

Auditors interview kitchen staff. If a cook can't explain a critical limit for their own station, expect a finding.

ISO 22000 Audit Checklist for Restaurants: What Auditors Check in Your Kitchen

An ISO 22000 audit is not a paperwork exam. The auditor walks through your kitchen, watches your staff work, and asks to see the records behind what they see. If you know what they look for, you can get ready in a few weeks and avoid most findings.

This guide explains what happens during the audit, what the auditor checks in each part of your kitchen, and how to prepare. It is written for restaurant owners, kitchen managers and caterers.

Quick note: ISO 22000 is voluntary. Your local food licence and inspections are separate, and they are required. An ISO 22000 certificate does not replace them. If you are not sure whether you need ISO 22000 at all, read our guide on [which ISO certification is best for restaurants].

How an ISO 22000 audit works

The certification audit has two stages. An independent certification body does the audit. A consultant cannot do it for you.

• Stage 1: The auditor reviews your documents and checks you are ready. This is often a mix of document review and a short site visit.
• Stage 2: The auditor visits your kitchen and checks that the system is really in use. This is the main audit.

After Stage 2, the auditor may raise findings:

• Minor nonconformity: a small gap. You send a corrective action plan.
• Major nonconformity: a serious gap. You must fix it before you get the certificate.

Once certified, you get a certificate that is valid for three years. The certification body returns every year for a surveillance audit, and again before the three years end for a recertification audit.

What drives cost and time

Cost has two parts. Consultancy depends on the number of outlets, how much is already documented and how many standards you combine. Certification body fees cover the application, Stage 1 and Stage 2 audits, annual surveillance and recertification in year three. They depend on audit days, which depend on headcount, number of sites, risk and complexity. FSSC 22000 also carries scheme fees, and it requires additional audit elements such as an unannounced audit within each cycle. Also budget for thermometers and calibration, pest control, any lab testing, training and staff time.

A single kitchen with some documented practice often takes roughly [3 to 6] months to certify. Multi-outlet or multi-standard projects take longer. The slowest part is rarely the writing. Auditors want records that show the system has been running, such as completed internal audits and months of temperature logs.

Five mistakes we see

1. Buying ISO 22000 when a licence and HACCP plan were all the buyer wanted. Always ask for the exact wording first.
2. One hazard analysis for the whole menu. Auditors expect it to reflect real products and processes.
3. Temperature logs filled in later. Backfilled records are easy to spot, and they undermine every other record.
4. Treating the certificate as a licence. ISO 22000 doesn't replace local food licensing or inspection.
5. Ignoring allergens on specials and menu changes.

Five questions to ask before you decide

1. Who is asking? Get the exact requirement in writing.
2. Which scheme do they accept? Some buyers accept HACCP, others want ISO 22000, others want a GFSI-recognised scheme.
3. What is the scope? A certificate covers only the sites and activities you list.
4. What do you already have? Licences, HACCP plan, training and logs reduce the work.
5. Do you have someone to own it? A named owner on your side matters more than any template.

FAQ

Is ISO 22000 mandatory for restaurants? No. Food licensing and inspection are mandatory and set by your country or municipality. Buyers or tenders may ask for ISO 22000. (Add your markets' regulators and verify them.)

Can a restaurant get HACCP certified? Yes, under some certification schemes, and the rules differ by country. Many restaurants implement HACCP without any certificate.

What is the difference between ISO 22000 and FSSC 22000? FSSC 22000 is a GFSI-recognised scheme built on ISO 22000, with extra sector and scheme requirements. ISO 22000 alone is not GFSI-recognised.

Does ISO 22000 replace my food licence? No. A certificate shows you run a food safety management system. It doesn't replace licensing or inspection.

Can a cloud kitchen or small caterer get certified? Yes. The scope and effort scale to your operation, and a smaller scope is a legitimate start.

Is Halal certification part of ISO 22000? No. Halal is a separate scheme run by approved certifying bodies.

How long is the certificate valid? Three years, with annual surveillance audits and a recertification audit before it expires.

Not sure which one your buyer means?

Send us the buyer's requirement, tender clause or audit finding. We'll tell you which one it asks for, what scope makes sense and what affects the cost, in writing, before you spend anything. You can also download our free ISO 22000 readiness checklist to see where your kitchen stands.