HACCP or ISO 22000: regulatory obligation versus voluntary certification

“Are you HACCP certified?” The question — asked by a buyer or read in a tender — mixes two worlds: a regulatory obligation binding every food-business operator — the HACCP method — and voluntary certifications that embed it, first among them ISO 22000. Confusing the two loses you money one way (paying for a pointless certification) or contracts the other (answering “yes” with no certificate to show). Here is how to decide.

Two different logics

HACCP is a hazard-analysis and critical-control-point method made mandatory by regulation (EC) no. 852/2004: every food-business operator must apply procedures based on its principles, folded in France into the sanitary control plan — the plan de maîtrise sanitaire (PMS). No certificate is issued or required: the State inspects application (through the DDPP), not possession of a diploma — we explain this in does an official “HACCP certification” exist?.

ISO 22000 is a voluntary international standard for a food safety management system (current version: 2018). It embeds the HACCP method and adds the logic of a management system: policy and objectives, resource management, internal and external communication, emergency preparedness, performance evaluation, continual improvement. Certification is issued by an accredited third-party body after an audit, and maintained through surveillance audits.

	HACCP method / PMS	ISO 22000
Status	Mandatory (EU hygiene package)	Voluntary
Who checks	DDPP, unannounced official inspections	Accredited certification body, scheduled audits
Central document	Sanitary control plan	Documented management system (which includes HACCP)
Outcome	Regulatory compliance; level published on Alim’confiance	Certificate valid in cycles, with surveillance audits
Cost	Internal time (and possible consultancy)	Initial and surveillance audits, certification fees
For whom	Every food-business operator	Businesses whose customers demand third-party assurance

What certification really brings

If HACCP is already mandatory, why pay for a certification that embeds it? Because it brings what regulation alone does not: third-party proof, usable with customers who will never visit your premises.

Businesses’ real motivations are well documented. The study by Escanciano and Santos-Vijande published in 2014 in Food Control, “Reasons and constraints to implementing an ISO 22000 food safety management system: Evidence from Spain”, shows certification is driven first by image, market access and customer requirements — and that the main brakes are cost and documentation load. In other words: ISO 22000 is a commercial decision as much as a quality one.

On effectiveness, the work of Fotopoulos, Kafetzopoulos and Psomas published in 2009 on the critical factors of implementing a food safety system recalls a constant: without management commitment and staff training, the certificate guarantees nothing. A certification bolted onto a for-show sanitary control plan will fail its audits — and its inspections.

IFS, BRCGS: the other family of certifications

If your customers are retail chains, the demand will often not be ISO 22000 but IFS or BRCGS, private schemes recognised by GFSI (Global Food Safety Initiative), the international mutual-recognition scheme for food safety standards. All embed the HACCP method; they differ through detailed requirements on sites, products and food-safety culture, and their own scoring grids. The practical rule is simple: ask your customers which scheme they recognise before choosing — certifying against the wrong standard costs a full certification for zero commercial benefit.

What a certification project looks like

If you conclude that certification is justified, the typical journey runs as follows: a gap analysis of what you already have against the standard’s requirements (your sanitary control plan already covers a good share), the construction of the missing management system — policy, objectives, management review, document control, emergency preparedness —, then the initial audit by the accredited certification body, generally in two stages (document review, then on-site audit). The findings must be closed out to obtain the certificate, which is then maintained through periodic surveillance audits and a renewal audit at the end of the cycle.

On budget, do not trust a universal figure: the cost depends on site size, headcount, certified scope and the body you choose. It adds up the audit days invoiced by the certifier, the internal time spent building the system and, often, external support. Get several quotes from accredited bodies — the spreads are real — and weigh them against what the certificate will bring commercially: that is the only calculation that matters.

How to decide, case by case

• Restaurant, food trade, retail shop with no industrial clients: no certification needed. Your priority is a written and applied sanitary control plan — that is what the DDPP inspects and what drives your Alim’confiance rating.
• Caterer or workshop supplying professionals: check your regulatory obligations first (sanitary approval where applicable), then assess whether a major customer conditions its listing on a certification.
• Processor, manufacturer, retail supplier or exporter: certification becomes a market entry ticket. ISO 22000 for general recognition of your management system, IFS/BRCGS if your retail customers require them — our page ISO 22000 details the approach, stages and costs.

In every case, the order of work does not change: certification is built on top of a solid sanitary control plan, never instead of it. An ISO 22000 system reuses your good hygiene practice, your hazard analysis and your traceability, and inserts them into a management loop. If the regulatory base is shaky, start there.

Take action

Before signing a certification quote, bring your foundations up to standard: the page HACCP and the sanitary control plan gathers your real obligations, the step-by-step approach and a free guide to building a solid plan. The certification, if your customers require it, will only come faster.