HACCP is a hazard-control methodology built on seven principles for identifying, evaluating, and controlling food safety hazards. ISO 22000 incorporates HACCP as its technical foundation while wrapping it in a full management system — adding leadership commitment, worker communication, documented information control, internal auditing, and continual improvement that HACCP alone does not require.
Organizations new to food safety certification often ask whether they need HACCP or ISO 22000 — but that framing misunderstands the relationship between the two. ISO 22000 doesn't compete with HACCP; it formalizes and extends it. Understanding exactly how the seven HACCP principles map into ISO 22000's broader requirements is essential both for organizations implementing a food safety management system and for internal auditors reviewing one. This article explains that relationship in detail, drawing on the audit experience of Maria Falbo, a Lead Auditor with decades of food safety experience.
HACCP — Hazard Analysis and Critical Control Points — is a systematic, science-based methodology for identifying, evaluating, and controlling food safety hazards, originally developed for NASA's space program in the 1960s and since adopted globally as the foundation of modern food safety management.
HACCP is built on seven principles, defined by the Codex Alimentarius Commission, that a food safety team applies after completing five preliminary steps — assembling the HACCP team, describing the product, identifying its intended use, constructing a process flow diagram, and confirming that diagram against actual operations.
HACCP is a methodology, not a management system. It tells an organization how to identify and control hazards, but it doesn't require leadership commitment, worker consultation, documented policy, or a formal internal audit program the way a full management system standard does. In many countries, some form of HACCP is a legal requirement for food businesses, independent of any ISO certification.
ISO 22000 takes HACCP's seven principles and embeds them within a complete management system framework — the same Harmonized Structure used by ISO 9001, ISO 14001, and ISO 45001. Where HACCP tells an organization how to analyze and control hazards, ISO 22000 additionally requires top management commitment, a documented food safety policy, competent personnel and a formally empowered food safety team, interactive communication throughout the food chain, and internal audits and management review to verify the whole system is functioning — not just the HACCP plan itself.
The most significant technical addition ISO 22000 makes to pure HACCP methodology is the introduction of operational prerequisite programs, or OPRPs. Under traditional HACCP, an organization typically has only two categories for control measures: general prerequisite programs and critical control points. This binary structure creates a well-documented practical problem — without a middle category, food safety teams applying HACCP alone tend to over-classify controls as CCPs, since anything identified as important gets pushed into the only "critical" category available. ISO 22000's addition of OPRPs gives hazard analysis a genuine middle tier: controls that are essential to managing a specific significant hazard but don't require the critical-limit-based monitoring a true CCP demands. For a full explanation of the distinction between these three categories, see our ISO 22000 requirements explained.
For a comprehensive overview of the full ISO 22000 internal audit lifecycle and how it examines these hazard controls in practice, see our ISO 22000 Internal Audit: The Complete Guide.
One of the most common technical gaps I find when auditing organizations transitioning from a pure HACCP program to ISO 22000 is a hazard analysis still carrying forward the old HACCP-era over-classification — a dozen controls all designated as CCPs, several of which, on closer examination, were never genuinely critical in the ISO 22000 sense. Reclassifying some of those into OPRPs isn't just a paperwork exercise. It changes the monitoring rigor, the corrective action requirements, and the verification activities that apply to each control — and getting that classification right is one of the clearest signals of whether an organization has genuinely understood ISO 22000's hazard analysis requirements or is still thinking in pure HACCP terms.
Each of HACCP's seven principles has a direct, formalized home within ISO 22000's clause structure.
Principle 1 — Conduct a hazard analysis maps to ISO 22000 Clause 8.5.2, which requires the organization to identify and evaluate hazards across biological, chemical, physical, and allergen categories, considering both likelihood and severity.
Principle 2 — Determine critical control points maps to Clause 8.5.4, where ISO 22000 requires the organization to classify each control measure — as a PRP, an OPRP, or a CCP — based on defined criteria, rather than defaulting everything significant into a single critical category.
Principle 3 — Establish critical limits and Principle 4 — Establish monitoring procedures are addressed together under ISO 22000's hazard control plan requirements, which require documented critical limits and defined monitoring frequency and methods for each CCP and OPRP.
Principle 5 — Establish corrective actions maps to ISO 22000's requirements for handling potentially unsafe products and nonconformities — including specific requirements around product disposition and, where necessary, withdrawal or recall procedures that go beyond what traditional HACCP alone typically specifies.
Principle 6 — Establish verification procedures connects to ISO 22000's Clause 8.8, which requires the organization to verify that the PRPs and hazard control plan are functioning as designed.
Principle 7 — Establish record-keeping and documentation maps to ISO 22000's documented information requirements under Clause 7.5, which govern how FSMS records are controlled, retained, and made available as evidence during internal and external audits.
Record-keeping is the HACCP principle I see treated most casually, and it's the one that ends up mattering most during an audit. Organizations often focus their energy on getting the hazard analysis and the CCP classifications right, and treat the documentation requirement as an afterthought — a filing task rather than a genuine element of the food safety system. But documented information under ISO 22000 isn't just record-keeping in the HACCP sense; it's evidence. A CCP that was correctly monitored, but whose records are incomplete, inconsistent, or hard to retrieve, creates exactly the same audit finding as a CCP that wasn't monitored at all, because the organization can't demonstrate the control was actually working.
Our ISO 22000 Internal Auditor course covers the technical foundation both draw on, built on ISO 22000 and ISO 19011.
For internal auditors, understanding the relationship between HACCP and ISO 22000 isn't academic — it directly shapes what a credible audit looks like. An auditor who understands HACCP principles but not how ISO 22000 formalizes them will miss the management system elements — leadership accountability, verification distinct from monitoring, documented objectives — that separate a functioning FSMS from a HACCP plan sitting in a binder.
Conversely, an auditor who understands ISO 22000's clause structure without genuine HACCP technical grounding won't be able to meaningfully assess whether a hazard analysis is credible, whether CCP versus OPRP classifications are correctly made, or whether critical limits are scientifically defensible. Effective FSMS auditing requires both: the management system auditing methodology and the food safety technical foundation HACCP provides. For a step-by-step walkthrough of how this plays out across a full internal audit, see our guide on how to conduct an ISO 22000 internal audit.
Many organizations building their food safety credentials also consider whether to pursue FSSC 22000 alongside ISO 22000, which layers sector-specific prerequisite programs — for a full comparison of what that adds, see our article on ISO 22000 vs FSSC 22000, and for a detailed look at how sector-specific PRPs work under FSSC 22000, see our guide to what are prerequisite programs in FSSC 22000.
If an organization is pursuing ISO 22000 certification, HACCP principles are already built into the standard's requirements — you don't need a separate, standalone HACCP program in addition to a properly implemented ISO 22000 FSMS.
HACCP is a hazard-control methodology focused specifically on identifying, evaluating, and controlling food safety hazards through seven defined principles. ISO 22000 is a complete management system standard that incorporates HACCP as its technical foundation while adding leadership commitment, worker communication, documented information control, internal audits, and continual improvement requirements that HACCP alone does not include.
HACCP certification exists as a standalone credential in many markets, separate from ISO 22000. However, HACCP-only certification does not include the broader management system requirements — leadership, formal internal audit program, management review — that ISO 22000 requires. Organizations pursuing ISO 22000 certification don't need a separate HACCP certificate, since HACCP principles are embedded within ISO 22000's requirements.
An operational prerequisite program (OPRP) is a control measure identified through hazard analysis as essential to controlling a specific significant hazard, but not requiring the critical-limit monitoring a CCP demands. Traditional HACCP only distinguishes between general prerequisite programs and CCPs, which frequently leads organizations to over-classify important controls as CCPs by default. ISO 22000 introduced OPRPs specifically to give hazard analysis a more deliberate middle category.
HACCP's monitoring principle covers the routine, ongoing check that a control measure is operating within limits. ISO 22000's verification requirement, addressed under Clause 9.1, is a separate, independent activity that confirms the FSMS as a whole — not just individual monitoring results — is functioning as intended. Verification and monitoring are related but distinct, and organizations that conflate the two are not genuinely meeting ISO 22000's verification requirement.
Maria Falbo has over 25 years of experience working as a Lead Auditor for certification bodies worldwide. She founded Logix ISO with the mission of making expert-level ISO training accessible to organizations of all sizes. Her work spans Quality, Environmental, Occupational Health and Safety, Food Safety, Automotive, and Energy management systems.
Learn more about Maria →Self-paced · 365-day access · Training certificate included