Food Safety Guide: ISO 22000, FSSC 22000 and FSMA
Many food manufacturers answer to three audiences: customers who ask for a GFSI-recognized certificate, a certification body auditing to ISO 22000 or FSSC 22000, and the FDA, which inspects against the Preventive Controls for Human Food rule. The requirements overlap, but the terms and expected records differ.
This guide explains how the three frameworks relate, how the plans they require compare, what the Preventive Controls Qualified Individual (PCQI) does, and which A.P. Lyon documents cover each part.
The three frameworks at a glance
ISO 22000:2018
ISO 22000:2018 sets requirements for a food safety management system (FSMS) for any organization in the food chain. It combines management system clauses with operational requirements built on prerequisite programs (PRPs) and Codex HACCP principles.
ISO 22000:2018 remains the current edition, with Amendment 1:2024 (climate action changes). A revision is in development, so watch for the new edition, but work to the 2018 text until it is replaced.
FSSC 22000 Version 7
FSSC 22000 is a certification scheme, not a separate standard. It requires:
ISO 22000:2018, including amendments issued by ISO
The sector-specific PRP standard for your food chain category (the ISO 22002 series)
The FSSC 22000 additional requirements
The scheme is recognized by the Global Food Safety Initiative (GFSI). Version 7 was published in May 2026. According to the transition timeline published by certification bodies, Version 6 audits may be conducted through 30 April 2027, and upgrade audits to Version 7 run from 1 May 2027 to 30 April 2028. Confirm your own upgrade timing with your certification body.
The Version 7 additional requirements cover topics such as purchased materials and services, labeling, food defense, food fraud, allergens, environmental monitoring, food safety and quality culture, equipment management, and food loss and waste.
FDA 21 CFR Part 117
21 CFR Part 117 is the FDA rule for human food, issued under the Food Safety Modernization Act (FSMA). It has two main parts that matter here:
Subpart B, current good manufacturing practice (CGMP): applies broadly to food manufacturing, processing, packing and holding.
Subpart C, hazard analysis and risk-based preventive controls: generally applies to facilities required to register with FDA, unless an exemption applies.
Subpart C requires a written food safety plan prepared or overseen by a PCQI. Subpart G adds a supply-chain program when a hazard requiring a preventive control is controlled before receipt of a raw material or other ingredient.
Not every facility is subject to Subpart C. Qualified facilities follow modified requirements, and activities covered by FDA's seafood HACCP (Part 123), juice HACCP (Part 120) and low-acid canned food (Part 113, for microbiological hazards) rules are exempt when the facility complies with those rules. Confirm applicability for your operation.
How the three fit together
Think of ISO 22000 as the framework, FSSC 22000 as a set of extra requirements on top of it, and 21 CFR 117 as the legal floor for US facilities.
ISO 22000 gives you the management system structure and the hazard analysis method.
FSSC 22000 adds requirements that ISO 22000 does not spell out, such as food defense, food fraud, a documented food safety and quality culture plan and environmental monitoring.
21 CFR 117 adds specific legal requirements: a written food safety plan, defined preventive control types, a PCQI, a written recall plan, a supply-chain program where needed, record review timeframes and reanalysis at least every three years.
A single documented system can meet all three if it is built on ISO 22000 and the FDA requirements are mapped into the same procedures and records. Separate binders for the auditor and the FDA tend to drift apart.
Hazard control plan vs HACCP plan vs FSMA food safety plan
These three plans come from the same root, but they are not interchangeable.
Hazard control plan (ISO 22000) | HACCP plan (Codex, USDA, FDA seafood/juice) | Food safety plan (21 CFR 117) | |
|---|---|---|---|
Basis | ISO 22000:2018, clause 8.5.4 | Codex HACCP principles; mandatory HACCP rules for certain sectors | 21 CFR 117.126 |
Control types | CCPs with critical limits; OPRPs with action criteria | CCPs with critical limits | Preventive controls: process, food allergen, sanitation, supply-chain, recall plan and other controls, including controls at CCPs |
Who prepares it | Food safety team | HACCP team or trained individual | Prepared or overseen by a PCQI |
Review | Updated through FSMS verification and updating | Varies by rule (for example, annual reassessment under USDA's 9 CFR 417) | Reanalysis at least every three years and when triggers occur |
Hazard control plan (ISO 22000). ISO 22000:2018 combines the former HACCP plan and OPRP plan into one hazard control plan. Each significant hazard is controlled at a critical control point (CCP), with measurable critical limits, or by an operational prerequisite program (OPRP), with measurable or observable action criteria.
HACCP plan. A traditional HACCP plan follows the Codex HACCP principles and focuses on CCPs. In the US, HACCP plans are mandatory under specific rules, such as USDA's 9 CFR Part 417 and FDA's seafood and juice HACCP regulations.
FSMA food safety plan. The 21 CFR 117 plan is broader. It includes the written hazard analysis, preventive controls, the supply-chain program, the recall plan, and procedures for monitoring, corrective actions and verification. Allergen and sanitation controls, for example, are preventive controls even though they often have no critical limit.
For a closer look at the differences, see our post HACCP Plan vs FSMA Food Safety Plan.
The PCQI's role
21 CFR 117.180 lists activities that must be performed or overseen by a Preventive Controls Qualified Individual:
Preparing the food safety plan
Validating preventive controls
Justifying a validation timeframe longer than 90 days after production starts
Determining that validation is not required for a control
Reviewing records
Justifying a records review timeframe longer than seven working days
Performing reanalysis of the food safety plan
Determining that reanalysis and validation can be completed in a timeframe longer than 90 days
A PCQI qualifies by completing risk-based preventive controls training at least equivalent to an FDA-recognized standardized curriculum, or through job experience. The PCQI does not have to be an employee of the facility. Training records for PCQIs must be kept.
In an ISO 22000 or FSSC 22000 system, it is practical to name the PCQI in the food safety team's roles so the same people oversee both plans.
Which A.P. Lyon documents cover what
The Food Safety Management System, Complete ($1,295) is written to ISO 22000:2018 and the FSSC 22000 additional requirements, with FDA 21 CFR 117 requirements built in, including the written food safety plan, preventive controls and the designation of a PCQI. It includes the Food Safety Manual, the Food Safety Plan and HACCP Workbook, 57 procedures and 104 forms, plus PDF copies of the manual and procedures.
Need | Where it is covered |
|---|---|
Clause-by-clause ISO 22000 structure, FSSC 22000 and FDA cross-reference | Food Safety Manual (FSM-F), $99 |
Product description, process steps, hazard analysis, CCP/OPRP plan, FSMA preventive controls, supply-chain program, verification schedule | Food Safety Plan and HACCP Workbook (FSP-F), $149 |
Hazard analysis | Preliminary Steps for Hazard Analysis (SOP 8-020-F); Hazard Analysis (SOP 8-021-F) |
CCPs and OPRPs | Hazard Control Plan (HACCP/OPRP) (SOP 8-023-F); Monitoring and Corrections at CCPs and OPRPs (SOP 8-025-F) |
Written FSMA plan, PCQI record review, reanalysis | FSMA Food Safety Plan and Preventive Controls (SOP 8-024-F) |
Validation | Validation of Control Measures (SOP 8-022-F) |
Allergen, sanitation and environmental monitoring | Allergen Management (SOP 8-005-F); Cleaning and Sanitation (SOP 8-003-F); Environmental Monitoring Program (SOP 8-011-F) |
Supplier controls | Supplier Approval and Control (SOP 8-040-F) |
Recall and traceability | Product Withdrawal and Recall (SOP 8-051-F); Traceability (SOP 8-050-F); Mock Recall and Traceability Exercise (SOP 8-053-F) |
FSSC 22000 additional requirements | Food Defense (SOP 8-028-F); Food Fraud Vulnerability Assessment (SOP 8-029-F); Food Safety and Quality Culture (SOP 5-003-F); Food Loss and Waste (SOP 10-003-F) |
Every document is an editable Word or Excel file that works on paper or in an eQMS, with one year of free updates. Build Your QMS applies volume discounts automatically: 20% off 5–9 procedures, 35% off 10–19, 50% off 20–39 and 60% off 40 or more. See also Compare QMS and the food safety system launch post.
Adapt responsibilities, limits, frequencies and records to your site, and have a PCQI or other qualified person review your food safety plan. The documents do not certify your organization or replace validation and testing; A.P. Lyon is not a certification body.
FAQ
Do I need both a hazard control plan and an FSMA food safety plan?
If you are certified to ISO 22000 or FSSC 22000 and subject to 21 CFR 117 Subpart C, you must meet both. One integrated set of records works if the FDA-required elements, such as the recall plan, supply-chain program and PCQI oversight, are clearly identifiable.
Is FSSC 22000 Version 6 still valid?
Version 7 was published in May 2026. Based on published transition timelines, Version 6 audits can be conducted through 30 April 2027, and upgrade audits to Version 7 run from 1 May 2027 to 30 April 2028. Your certification body will confirm your schedule.
Does an OPRP count as an FSMA preventive control?
Often, yes. FSMA preventive controls include allergen, sanitation and other controls without critical limits, which maps well to OPRPs. Each still needs monitoring, corrective actions and verification as appropriate to the control.
Does the PCQI have to be on staff?
No. Under 21 CFR 117.180 the PCQI may be, but is not required to be, an employee of the facility.
Does 21 CFR 117 apply to my facility?
It depends on whether you must register with FDA, your size and your activities. Qualified facilities and some activities covered by other FDA HACCP or canning rules have exemptions or modified requirements. Check the regulation and FDA guidance for your situation.
Next steps
If you are building or updating a food safety management system, review the Food Safety Management System documents. If you want help tailoring documentation to your site, structuring hazard analysis and food safety plan records, running internal audits or preparing for a certification audit, see A.P. Lyon consulting. Our team has a background in regulated manufacturing and quality systems.
Comments