ISO 22000 and HACCP for Food Plants

Last updated: 17 August 2026

When a food manufacturer in Jordan decides to develop a food safety management system or pursue ISO 22000 certification, several terms arise at the same time:

• ISO 22000.
• Hazard Analysis and Critical Control Points (HACCP).
• Prerequisite Programmes (PRPs).
• Good Manufacturing Practices (GMP).
• Jordan Food and Drug Administration requirements.
• Traceability and recall.
• Certification-body auditing.

A common mistake is to manage these requirements as separate files.

In practice, a prepared food manufacturer does not begin with a HACCP plan alone or by scheduling the certification audit.

The correct starting point is to confirm that:

The factory’s basic operating environment is suitable for producing safe food, applicable legal requirements have been identified, and hygiene and good manufacturing practices are effective. Hazard analysis and the management system are then built on this foundation.

ISO 22000 specifies requirements for a food safety management system. It incorporates the principles of HACCP and the application steps developed by the Codex Alimentarius Commission.

First: What Is the Difference Between ISO 22000 and HACCP?

The two terms should not be used as though they mean the same thing.

HACCP

HACCP is a systematic methodology for identifying, evaluating, and controlling significant food safety hazards.

Codex defines HACCP as a system that identifies, evaluates, and controls hazards that are significant for food safety.

It forms part of the General Principles of Food Hygiene, CXC 1-1969, whose most recent amendment listed by Codex was issued in 2022.

ISO 22000

ISO 22000 is a broader management system.

It incorporates HACCP within a framework that also addresses:

• Leadership.
• Policy.
• Responsibilities and authorities.
• Communication.
• Prerequisite programmes.
• Traceability.
• Emergency preparedness and response.
• Verification.
• Internal auditing.
• Management review.
• Nonconformity.
• Corrective action.
• Continual improvement.

ISO explains that the core elements of ISO 22000 include:

• Interactive communication.
• System management.
• Prerequisite programmes.
• HACCP principles.

The relationship can be summarized as follows:

PRPs establish and control the basic manufacturing environment.

Then:

HACCP analyzes product and process hazards and identifies the necessary significant controls.

Then:

ISO 22000 places these elements within an integrated management system that can be measured, audited, and continually improved.

What Is the Current Edition of ISO 22000?

As of 17 August 2026, ISO 22000:2018 remains the current published edition of the standard. ISO confirmed it as current following its review in 2023.

The related amendment ISO 22000:2018/Amd 1:2024, addressing climate-action changes, is also available.

There is, however, an important update for food manufacturers beginning a new project.

ISO is currently developing the third edition of the standard. ISO/DIS 22000 is under development and is intended to replace ISO 22000:2018 after the revision process is completed and the new edition is formally published.

Until then, the draft should not be treated as the applicable published standard.

Organizations should therefore:

• Build their systems against the current published edition.
• Monitor the official revision process.
• Avoid relying indefinitely on outdated checklists.

Second: What Is the Role of Jordanian Regulatory Authorities?

ISO 22000 certification does not replace the legal and licensing requirements applicable to a food factory in Jordan.

The Jordan Food and Drug Administration (JFDA) lists official services that include:

• Licensing new food factories.
• Approving the addition of production lines.
• Inspecting food manufacturing facilities.
• Conducting other regulatory activities related to food industries.

JFDA also currently publishes official guidance that includes:

• The Guide to Good Manufacturing Practices in Food.
• General Health Conditions for Licensing Food Laboratories and Factories.
• Other regulatory guidance for food factories.

The Food Law No. 30 of 2015 forms part of Jordan’s legal framework governing food manufacture and circulation.

Two separate pathways should therefore be distinguished:

The Jordanian Regulatory Pathway

This covers licensing, health requirements, regulatory oversight, and the applicable legal and technical requirements.

The ISO 22000 Pathway

This covers the establishment of a food safety management system and, where the organization chooses, independent certification against that system.

The two frameworks can operate together, but neither eliminates the other.

Is HACCP Mandatory for Every Food Factory in Jordan?

This statement should be handled carefully.

The official sources reviewed confirm that JFDA addresses:

• Self-monitoring programmes.
• Good manufacturing practices.
• Health requirements.
• Factory inspection.
• Awareness activities relating to food safety systems and HACCP.

However, these sources alone do not support a general claim that:

“Independent HACCP certification is mandatory for every food factory in Jordan.”

Such a broad statement has not been established.

Mandatory requirements should be determined according to:

• The type of factory.
• The product.
• The manufacturing activity.
• Licensing conditions.
• Applicable instructions.
• Technical and health requirements.

Where an organization implements ISO 22000, food safety hazard analysis and the establishment of a hazard-control plan are fundamental parts of the system because ISO 22000 incorporates the HACCP principles and application steps developed by Codex.

Stage One: Verify the Factory’s Legal and Licensing Status

Before beginning the certification project, the factory should clearly understand its regulatory position.

Review:

• The licensed activity.
• Manufactured products.
• Approved production lines.
• Related approvals.
• Applicable health conditions.
• Requirements concerning raw materials.
• Product-specific requirements.
• Packaging requirements.
• Storage and transportation requirements.

JFDA explains that it licenses new food factories, approves additional production lines, and conducts inspections.

It has also issued instructions regulating food and beverage manufacturing activities, together with other requirements applying to food-sector operations.

This stage is essential because ISO 22000 should not be implemented separately from the applicable legal and regulatory requirements.

Stage Two: Conduct a Gap Analysis

Before drafting procedures, compare the factory’s actual condition with:

• ISO 22000 requirements.
• Applicable Jordanian legislation.
• Applicable health conditions.
• Relevant prerequisite programmes.
• Actual practices across production lines.

Do not search only for missing documents.

Inspect the facility and ask:

• How are raw materials received?
• How are they stored?
• How are materials segregated?
• How is the production line cleaned?
• How are pests controlled?
• How are temperatures controlled?
• How are measuring devices calibrated or verified?
• How is cross-contamination prevented?
• How are allergens managed?
• How is product release controlled?
• How can the product be traced if a problem occurs?

The objective is to determine the difference between:

What Should Happen → What Is Documented → What Actually Happens → What Can Be Demonstrated

Stage Three: Establish PRPs Before Building the HACCP Plan

One common mistake is to move directly to the HACCP table while the factory’s operational foundation remains unstable.

HACCP does not compensate for poor hygiene, an unsuitable process flow, weak pest control, or inadequate infrastructure.

Prerequisite Programmes (PRPs) establish the operating conditions that make hazard analysis and control effective.

In 2025, ISO published an important update to this framework. ISO 22002-1:2025, together with ISO 22002-100:2025, specifies prerequisite-programme requirements relevant to food manufacturing.

When developing PRPs, the factory will usually need to assess areas such as:

• Building and facility design.
• Utilities and water.
• Cleaning and disinfection.
• Pest management.
• Waste management.
• Prevention of cross-contamination.
• Storage.
• Suppliers and incoming materials.
• Personnel health and hygiene.
• Maintenance.
• Other controls relevant to the manufacturing process.

The actual PRPs must be designed according to:

• The factory.
• The product.
• The processes.
• The hazards.
• Applicable legal requirements.

They should not be copied from another facility.

The ISO 22002 family should also be used according to the management-system scope, project requirements, customer requirements, and any applicable certification scheme. It should not be presented as a Jordanian governmental certificate.

Stage Four: Establish a Competent Food Safety Team

The HACCP plan should not be prepared by one person working separately from operations.

The factory needs a team with knowledge of areas relevant to its activities, which may include:

• The product.
• Production processes.
• Equipment.
• Quality.
• Microbiology or other relevant technical disciplines.
• Maintenance.
• Storage.
• Procurement.
• Distribution.

Not every member must be an expert in every discipline.

The requirement is that the team collectively possesses sufficient knowledge and competence to analyze hazards and make technically defensible decisions.

The organization should:

• Define team responsibilities.
• Build the team’s competence.
• Maintain appropriate evidence of training and experience.
• Use external technical expertise where necessary.

Stage Five: Describe the Product and Its Intended Use Accurately

Before analyzing hazards, the food safety team must clearly understand what the factory produces.

The description should cover, as applicable:

• Raw materials and ingredients.
• Final-product characteristics.
• Processing methods.
• Packaging type.
• Storage conditions.
• Shelf life.
• Distribution method.
• Expected preparation and use.
• Relevant consumer groups.

A hazard that may be controlled through later cooking may require different consideration from the same hazard in a ready-to-eat product.

The intended use of the product is part of hazard analysis, not merely a marketing description.

Stage Six: Develop and Verify the Process Flow Diagram

Prepare a flow diagram covering all actual stages within the defined scope, from receipt of materials through final product, storage, and distribution.

Do not approve the diagram solely from the office.

Verify it on the factory floor.

Confirm that it reflects, where applicable:

• Rework.
• Returned products entering the process.
• Waiting stages.
• Transfers between tanks.
• Alternative process routes.
• Outsourced or supporting steps.
• Any stage that may affect food safety.

An inaccurate flow diagram leads directly to an incomplete hazard analysis.

The diagram should be reviewed again whenever the process, equipment, materials, or layout changes.

Stage Seven: Conduct a Scientifically Supported Hazard Analysis

This is where the core HACCP function begins.

At each process stage, identify food safety hazards that can reasonably be expected to occur.

Depending on the product and process, these may include:

• Biological hazards.
• Chemical hazards.
• Physical hazards.
• Allergens.
• Other relevant food safety hazards.

The team must then determine the significance of each hazard.

Not every possible hazard requires a Critical Control Point.

The assessment should consider questions such as:

• How likely is the hazard to occur?
• How severe would its effect be?
• Does it require a specific control to ensure that it is prevented, eliminated, or reduced to an acceptable level?
• What evidence supports the assessment?

The reasons for decisions should be documented and explainable.

Stage Eight: Classify PRPs, OPRPs, and CCPs Correctly

This is one area that distinguishes ISO 22000 from the use of simplified HACCP tables alone.

After assessing hazards, the organization determines the appropriate control strategy.

Some hazards are controlled through general PRPs.

Some control measures are managed as Operational Prerequisite Programmes (OPRPs).

Others are managed through Critical Control Points (CCPs).

The objective is not to maximize the number of CCPs.

A factory with dozens of CCPs is not necessarily safer than one with a limited number.

Incorrect classification makes the management system more complicated and less effective.

The decision should be based on:

• The hazard analysis.
• The nature of the control measure.
• Its role in preventing the hazard or reducing it to an acceptable level.
• The consequences of control failure.

Stage Nine: Define Monitoring Limits and Criteria

When a CCP or OPRP is established, the operating team must know:

• What is being measured?
• Which instrument is used?
• How frequently is it monitored?
• Who is responsible?
• What result is acceptable?
• What happens when a deviation occurs?

For a CCP, critical limits are fundamental.

For an OPRP, the system uses operating criteria or action criteria, according to the design of the control system.

The criteria must be:

• Measurable or observable.
• Suitable for timely monitoring.
• Supported by an appropriate basis.
• Capable of distinguishing acceptable from unacceptable conditions.

They should not be numbers selected merely to complete the form.

Stage Ten: Conduct Validation Before Relying on the Control Measure

The existence of a temperature, time, or concentration in a procedure does not prove that the measure can actually control the hazard.

The organization must establish an adequate basis showing that the selected control measure—or combination of control measures—is capable of achieving the required control.

This is Validation.

Depending on the situation, validation may rely on:

• Regulatory requirements.
• Scientific references.
• Technical data.
• Studies.
• Tests.
• Historical evidence.
• Other appropriate sources.

Validation asks:

Is the control measure we designed capable of working?

Verification later asks a different question:

Is the system actually operating as designed?

Confusing validation with verification is a common weakness in food safety systems.

Stage Eleven: Establish an Effective Traceability and Recall System

Traceability is not an optional addition for food manufacturers.

The Jordanian Food Law No. 30 of 2015 addresses food traceability.

JFDA explains that Article 17 provides for the appointment of a competent responsible person to verify the implementation of food-traceability arrangements throughout the stages of food circulation.

JFDA has also referred to the Instructions for the Traceability and Recall of Noncompliant Food of 2017.

In practice, the factory should be able to answer quickly:

• Where did this raw material come from?
• In which batch was it used?
• Which finished products were produced from it?
• Where were those products distributed?
• How much affected product remains in stock?

The system should not exist only in theory.

It must be tested through a traceability or recall exercise to evaluate whether the required information can be retrieved within the necessary timeframe and with the required effectiveness.

Stage Twelve: Control Suppliers and Raw Materials

The safety of the finished product begins before materials enter the production line.

The factory should:

• Establish criteria for selecting suppliers.
• Define material specifications.
• Identify required documents, certificates, and test results according to the material and associated risks.
• Define inspection, acceptance, rejection, and release methods.
• Evaluate supplier performance periodically.
• Control supplier changes.

Where a significant hazard enters through raw material, the factory cannot ignore supplier controls and rely only on final-product testing.

Supplier management should be linked directly to hazard analysis and the required level of control.

Stage Thirteen: Manage Allergens Systematically

In factories handling food allergens, listing them on the product label is not enough.

The system should consider:

• Receipt of allergenic materials.
• Storage and segregation.
• Production scheduling.
• Cleaning.
• Rework.
• Tools and utensils.
• Unintended cross-contact.
• Accuracy of product information and labelling.

Control should be built into the process itself, after which the effectiveness of the measures should be verified.

The allergen-management approach must reflect the actual materials, products, and risks present in the facility.

Stage Fourteen: Make Cleaning and Disinfection Verifiable

A hygiene programme should not consist solely of a schedule signed by a worker at the end of a shift.

It should define:

• What is cleaned?
• How is it cleaned?
• Which chemical or method is used?
• At what concentration?
• How frequently?
• Who is responsible?
• How is cleaning effectiveness confirmed?
• What action is taken if the result is unacceptable?

The required level and method of verification will differ depending on the process and risk.

Cleaning validation or verification should be designed according to the hazard and the purpose of the cleaning programme.

Stage Fifteen: Control Measurement and Calibration

If a food safety decision depends on a:

• Thermometer.
• pH meter.
• Detector.
• Scale.
• Other measuring instrument.

Then the reliability of the decision depends on the reliability of that equipment.

The organization should:

• Identify critical measuring devices.
• Establish an appropriate calibration or verification programme.
• Know the current status of each device.
• Protect instruments from unauthorized adjustment or damage.
• Address previous results if equipment is later found to have operated outside acceptable limits.

The purpose is not simply to hold calibration certificates. It is to ensure that food safety decisions are based on dependable measurements.

Stage Sixteen: Establish a System for Potentially Unsafe Products

What happens if a batch is found not to meet food safety requirements?

The factory needs a process that:

• Prevents unintended release.
• Identifies and isolates affected products.
• Evaluates the affected product.
• Defines escalation and decision-making authority.
• Determines the appropriate disposition.
• Maintains traceable records.

Where a problem has reached the market, traceability and withdrawal or recall arrangements should operate according to applicable requirements.

These procedures should not be written only after an incident occurs.

They must be designed, communicated, and tested in advance.

Stage Seventeen: Collect Genuine Operating Evidence

Before considering a certification audit, the system must operate long enough to generate genuine evidence.

Records should not be created merely because an auditor is expected to arrive.

They should arise naturally from operations, including:

• Monitoring results.
• Cleaning records.
• Incoming-material inspections.
• Temperature records.
• CCP and OPRP monitoring.
• Laboratory results where applicable.
• Training and competence records.
• Calibration records.
• Customer complaints.
• Nonconformities.
• Corrective actions.
• Traceability activities.
• Verification results.

Documentation without operational implementation is insufficient.

Stage Eighteen: Conduct the Internal Audit

Before external assessment, the organization must test its own management system.

The internal audit should examine questions such as:

• Are PRPs implemented?
• Does the hazard analysis reflect actual operations?
• Is monitoring conducted as defined?
• Do workers know what to do when deviation occurs?
• Are required records retained?
• Is the system verified?
• Are identified legal requirements current?
• Was the cause of a closed problem genuinely addressed?

IAC’s ISO 22000 services include:

• Technical-team development.
• Internal auditing.
• Continual improvement.
• Connecting findings with corrective actions.

The audit should evaluate actual implementation, not documents alone.

Stage Nineteen: Conduct Management Review

ISO 22000 is not a system owned solely by the quality department.

Top management should review system performance and make decisions concerning:

• Resources.
• Risks.
• Objectives.
• Results.
• Changes.
• Corrective actions.
• Improvement.

If every food safety decision remains confined to the quality manager, this may indicate that the management system has not been integrated into organizational leadership.

Management review should be a decision-making meeting, not merely a presentation of audit files.

Stage Twenty: Conduct a Readiness Review Before Certification

Before applying for ISO 22000 certification, conduct a final readiness review.

The review may examine ten principal areas:

1. Legal and licensing status and applicable requirements.
2. Prerequisite programmes.
3. The food safety team and hazard analysis.
4. The hazard-control plan, CCPs, and OPRPs.
5. Traceability and recall.
6. Monitoring, verification, and calibration.
7. Competence and awareness.
8. Nonconformities and corrective actions.
9. Internal auditing.
10. Management review.

Where significant gaps remain, they should preferably be addressed before the certification process begins.

How Does ISO 22000 Certification Work?

ISO itself does not issue certificates.

Where an organization chooses to obtain ISO 22000 certification, it contracts with an independent Certification Body.

ISO explains that certification is not mandatory for using the standard. Organizations choosing certification should engage an appropriate external certification provider.

The certification process generally includes an initial assessment followed by a more comprehensive evaluation of the system and its implementation, according to the Certification Body’s procedures and applicable rules.

The auditor will not limit the assessment to reading the HACCP plan.

The audit will trace evidence from the product and process through to:

• The hazard.
• The control measure.
• The record.
• The responsible worker.
• The resulting action.

The auditor may begin with a CCP and ask:

• Why was it classified as a CCP?
• What is the source of the critical limit?
• Who monitors it?
• What happened during the most recent deviation?
• Where is the corrective action?
• How was its effectiveness verified?

The auditor may instead begin with a customer complaint and trace it to:

• The product.
• The supplier.
• The production batch.
• The control plan.
• The investigation and resulting actions.

This reveals the difference between a functioning management system and a HACCP file prepared for an audit.

Is HACCP Certification Required Before ISO 22000 Certification?

No such general requirement exists in ISO 22000.

ISO 22000 itself incorporates the HACCP principles and the application steps developed by Codex within a food safety management system.

The standard does not generally require the organization to obtain a separate “HACCP certificate” before it can pursue ISO 22000 certification.

Contractual, market, customer, or scheme-specific requirements may exist. They should be treated as separate requirements and verified before implementation.

Does ISO 22000 Replace JFDA Licensing in Jordan?

No.

Food-establishment licensing and regulatory oversight fall within the authority of the competent Jordanian bodies under applicable legislation and procedures.

JFDA officially lists services covering the licensing and inspection of food factories.

ISO 22000 certification, by contrast, is an independent assessment of the food safety management system against the international standard.

The certificate should never be presented in a way that suggests it is a governmental operating licence.

Are GMP, PRPs, and HACCP Alternatives to One Another?

No.

They can be understood as interconnected layers.

GMP, health requirements, and PRPs establish the basic operating environment.

HACCP analyzes significant hazards and identifies the necessary control measures.

ISO 22000 manages these elements through an organizational system incorporating leadership, planning, evaluation, corrective action, and continual improvement.

Weakness in the foundational layer will make the higher layers complex and unstable.

What Are the Most Common Mistakes Before Certification?

1. Building a HACCP Plan From a Generic Template

The plan does not reflect the actual product, process, equipment, or hazards.

2. Classifying Every Hazard as a CCP

This creates a complex monitoring system that the factory may be unable to operate effectively.

3. Focusing on CCPs While Neglecting PRPs

A weak operational foundation cannot be corrected through critical control points alone.

4. Maintaining a Flow Diagram That Does Not Match the Production Line

Any missing stage may lead directly to an incomplete hazard analysis.

5. Establishing Limits Without a Clear Technical Basis

Numbers should not be selected merely to complete the HACCP table.

6. Confusing Validation With Verification

The first asks whether a control is capable of working. The second asks whether it operates as intended.

7. Weak Traceability and Recall Arrangements

The factory cannot rapidly connect materials, batches, products, and distribution records.

8. Recording Training Without Demonstrating Competence

Attendance does not necessarily prove the worker can perform the task correctly.

9. Assigning the Entire System to the Quality Manager

Production, maintenance, warehouses, procurement, and management must all participate.

10. Scheduling the Audit Before Collecting Sufficient Evidence

Certification readiness requires proof that the system has operated in practice.

What Is IAC’s Role in Preparing Food Manufacturers?

IAC’s official consulting catalogue includes an ISO 22000 Food Safety Management System Consulting pathway.

Its scope includes:

• Hazard analysis in accordance with HACCP.
• Identification of Critical Control Points and development of controls.
• Development of prerequisite programmes suited to the facility.
• Documentation of the food safety management system.
• Team capability building.
• Internal auditing.
• Continual improvement.

The engagement follows IAC’s methodology:

Objective Diagnosis → Tailored Design → Phased Implementation → Internal Capability Building → Impact Measurement

The objective is not to prepare a package of documents solely for certification.

It is to build a system that enables the factory to control food safety hazards and sustain the system after the development project ends.

Frequently Asked Questions

What Is the Current Edition of ISO 22000?

As of 17 August 2026, the current published edition is ISO 22000:2018, together with its 2024 amendment.

A new edition is at the Draft International Standard stage but has not yet been published as the final international standard.

Is HACCP Part of ISO 22000?

Yes.

ISO explains that ISO 22000 incorporates the HACCP principles and application steps developed by the Codex Alimentarius Commission.

What Is the Current PRP Standard for Food Manufacturing?

In 2025, ISO published ISO 22002-1:2025 for food manufacturing, to be used together with the general requirements in ISO 22002-100:2025.

The applicable framework should be determined according to the organization’s scope and any relevant project, customer, or certification-scheme requirements.

Can a Small Food Manufacturer Implement ISO 22000?

Yes.

ISO 22000 is designed for organizations across the food chain regardless of size or complexity.

The system should be proportionate to the facility’s actual operations, products, hazards, and resources.

Is ISO 22000 Certification Legally Mandatory for Every Jordanian Food Factory?

The official sources reviewed do not establish a general rule requiring every food factory in Jordan to obtain ISO 22000 certification.

The factory must determine the legislation, licensing conditions, and requirements applicable to its activity and products.

Certification itself remains optional under ISO 22000.

Is Food Traceability Required in Jordan?

Jordan’s Food Law addresses food traceability, and JFDA refers to instructions concerning the traceability and recall of noncompliant food.

Traceability should therefore not be treated merely as an ISO certification requirement.

Conclusion

The journey towards ISO 22000 does not begin with the certification audit.

It begins with a safe and controlled operational foundation inside the food factory.

The structured pathway is:

Legal and Licensing Requirements → GMP and PRPs → Food Safety Team → Product and Process Descriptions → HACCP Analysis → Identification of OPRPs and CCPs → Monitoring and Verification → Traceability and Recall → Capability Building and Implementation → Internal Audit → Management Review → Readiness Review → External Assessment

When these elements operate as one system, certification becomes the result of an implemented food safety management system—not an objective separate from product safety.

To request an initial diagnostic session for your food factory and assess the gaps between its current state and ISO 22000 and HACCP requirements, contact IAC to determine the appropriate development scope and readiness roadmap.