Retail chains, exporters’ buyers and multinational customers increasingly ask Pakistani food businesses the same question: “Are you ISO 22000 or HACCP certified?” A provincial food authority licence lets you operate. It does not prove to a buyer that your plant controls food safety hazards systematically. This guide explains what ISO 22000 and HACCP are, how they differ from FSSC 22000, which one your business actually needs, and how certification works in Pakistan from gap analysis to certificate.
Quick answer: HACCP is a method for identifying and controlling food safety hazards at critical points in your process. ISO 22000 is an international management system standard that builds HACCP into a full food safety management system with prerequisite programmes, documented procedures and continual improvement. FSSC 22000 adds sector-specific requirements to ISO 22000 and is recognised by the Global Food Safety Initiative (GFSI), which many large retailers and exporters require. Certification is issued by an accredited certification body after a two-stage audit.
What is HACCP?
Hazard Analysis and Critical Control Point (HACCP) is a preventive system defined by the Codex Alimentarius. Instead of testing finished products and hoping to catch problems, you identify where biological, chemical and physical hazards can enter or grow in your process, and control them at those points. HACCP rests on seven principles:
- Conduct a hazard analysis
- Determine the critical control points (CCPs)
- Establish critical limits for each CCP
- Establish monitoring procedures
- Establish corrective actions
- Establish verification procedures
- Establish documentation and record keeping
Pasteurisation temperature in a dairy, metal detection in a snack line and cooking temperature in a frozen food plant are typical CCPs.
What is ISO 22000 and how is it different from HACCP?
ISO 22000:2018 is the international standard for food safety management systems. It includes HACCP, but wraps it in a management system with the same high-level structure as ISO 9001: leadership commitment, a food safety policy, risk-based planning, prerequisite programmes (PRPs) for hygiene and infrastructure, internal audits, management review and continual improvement. HACCP tells you how to control hazards; ISO 22000 makes sure the organisation keeps doing it consistently and can prove it.
| Feature | HACCP | ISO 22000 | FSSC 22000 |
|---|---|---|---|
| What it is | Hazard control method | Food safety management system standard | Certification scheme built on ISO 22000 |
| Prerequisite programmes | Assumed, not detailed | Required, organisation defines them | Sector-specific PRP standards required |
| Management system elements | Limited | Full (policy, audits, review, improvement) | Full, plus scheme additional requirements |
| GFSI recognition | No | No | Yes |
| Typical buyer | Local customers, hotels, caterers | Distributors, institutional buyers | Large retailers, multinationals, demanding export markets |
Which certification does my food business need?
Start with your customers, not the standard. Ask your key buyers which certificate they accept, and read their supplier requirements carefully:
- Restaurants, caterers and small processors supplying locally often start with HACCP certification, which builds discipline without a full management system.
- Manufacturers supplying distributors, institutions or brands usually need ISO 22000.
- Exporters and suppliers to international retailers are often asked for a GFSI-recognised certificate such as FSSC 22000. ISO 22000 alone may not satisfy them, so confirm before you start.
Food safety certification sits alongside, not instead of, your legal approvals. You still need your provincial food authority licence (see our Punjab Food Authority licence guide), PSQCA certification for compulsory products such as dairy and edible oil and ghee, and halal certification where buyers or destination markets require it. Our frozen food registration guide shows how these layers fit together for one sector.
How does ISO 22000 certification work in Pakistan?
1. Gap analysis
Compare your current practices, premises and records with the standard. In Pakistani plants the biggest gaps are usually pest control, water quality records, allergen and foreign-body control, cleaning verification and supplier approval.
2. Prerequisite programmes and infrastructure fixes
Fix hygiene basics before writing procedures: separation of raw and finished areas, hand-wash stations, drainage, lighting, glass control and storage. A HACCP plan cannot compensate for a building that contaminates the product.
3. HACCP study and documentation
A multidisciplinary food safety team maps each process, analyses hazards, sets CCPs and critical limits, and writes monitoring and corrective action procedures. Keep documents short and usable on the shop floor.
4. Implementation, training and records
Run the system for long enough to generate records the auditor can review, typically a few months. Train operators on what they monitor and what to do when a limit is breached. Testing support matters here; our laboratory compliance service covers in-house labs and external testing arrangements.
5. Internal audit and management review
Audit the system yourself, close the findings and hold a management review before inviting the certification body.
6. Two-stage certification audit
The certification body first reviews documentation and readiness (Stage 1), then audits implementation on site (Stage 2). Once nonconformities are closed, it issues a certificate that is normally valid for three years, with surveillance audits in between.
How do you choose a credible certification body?
A certificate is only as credible as its issuer. Choose a body accredited for ISO 22000 or FSSC 22000 by the Pakistan National Accreditation Council (PNAC) or another accreditation body that is a member of the International Accreditation Forum, and check that the accreditation covers your food category. Be wary of offers of certification within days without an on-site audit. Our article Is your ISO certificate actually worth anything? explains how to verify a certificate and its accreditation.
What does ISO 22000 cost and how long does it take?
Cost depends on three things: the size and number of sites, the infrastructure fixes your plant needs, and the certification body’s audit days. For many plants, the building and equipment improvements cost more than consultancy and audit fees combined. Timelines vary in the same way; a well-run plant with good hygiene can be ready within a few months, while a plant needing layout changes takes longer. Ask for a written gap analysis before accepting any fixed quote or timeline. For the wider ISO picture, see our guide to ISO certification in Pakistan.
Frequently asked questions
Is ISO 22000 mandatory in Pakistan?
No. ISO 22000 is voluntary. Food businesses must hold their provincial food authority licence and any compulsory PSQCA certification, but buyers, retailers and export customers often require ISO 22000, HACCP or FSSC 22000 as a supply condition.
What is the difference between HACCP and ISO 22000?
HACCP is a method for controlling food safety hazards at critical control points. ISO 22000 is a full food safety management system that includes HACCP plus prerequisite programmes, leadership, internal audits and continual improvement.
Is ISO 22000 the same as FSSC 22000?
No. FSSC 22000 is a certification scheme that combines ISO 22000 with sector-specific prerequisite programme standards and additional requirements. Unlike ISO 22000 on its own, FSSC 22000 is recognised by GFSI.
How long is an ISO 22000 certificate valid?
A certificate is normally valid for three years, provided the business passes the annual surveillance audits carried out by the certification body.
Can a restaurant get HACCP certification?
Yes. Restaurants, hotels and caterers commonly implement HACCP for their kitchens and get it certified, especially when supplying airlines, hospitals or corporate clients.
How CEC can help with ISO 22000 and HACCP
Connect Engineers & Consultants helps food manufacturers, processors and exporters through gap analysis, PRP and layout improvements, HACCP studies, documentation, training, internal audits and certification audit support. We also handle the regulatory side: food authority licences, PSQCA and halal certification. See our ISO certification service.
Has a buyer asked for food safety certification? Send us their requirement and we will tell you which standard fits and what your plant needs to get there.
Standards and certification scheme rules are revised periodically. Confirm the current version of ISO 22000 and any scheme requirements with your certification body. This guide is general information, not professional advice.
