ISO 22000 Certification in Kenya: What It Is and Who Actually Needs It
ISO 22000 is the standard most Kenyan processors have heard of and the one most often bought for the wrong reason. It is a genuinely good management system — and it is not recognised by GFSI, which means if a large international retailer is your target buyer, ISO 22000 on its own will not satisfy them.
This guide explains what ISO 22000:2018 actually requires, the PRP/OPRP/CCP distinction that trips up most implementations, how certification works, and the honest answer on whether it — or FSSC 22000 — is the right purchase for your business.
It completes the food-safety ladder we set out in our HACCP guide: HACCP is the method, ISO 22000 is the management system, FSSC 22000 is the buyer-recognised scheme.
Agrosocial Services is an independent agricultural certification and compliance consultancy. We prepare organisations for ISO 22000 and related audits — certification is issued by an accredited certification body, not by us.
⚡ Key Facts — ISO 22000
- 📘 Current version is ISO 22000:2018 — a Food Safety Management System standard, not just a hazard-control method.
- 🔗 Built on the Annex SL High Level Structure — the same backbone as ISO 9001 and ISO 14001, so systems integrate cleanly.
- 🔄 Uses two nested PDCA cycles — one for the management system, one for HACCP operations.
- ⚠️ Not GFSI-recognised. FSSC 22000 is. This is the single most commercially important fact about it.
- 📅 Typically a 3-year certificate with annual surveillance audits.
Sources: ISO 22000:2018; Kenya Bureau of Standards; accredited certification body documentation. Verified August 2026.
In This Guide
The Basics
What ISO 22000 Actually Is
ISO 22000:2018 is the international standard for a Food Safety Management System (FSMS). The distinction from HACCP matters: HACCP is a method for identifying and controlling hazards. ISO 22000 wraps that method inside a full management system — with leadership accountability, planning, resources, documented information, performance evaluation and continual improvement.
Its scope is deliberately broad. It applies to any organisation in the food chain, regardless of size or complexity — primary producers, processors, ingredient and additive manufacturers, packaging producers, transport and storage operators, retailers, caterers, and providers of cleaning, sanitation and equipment services.
A practical advantage worth knowing: ISO 22000:2018 uses the Annex SL High Level Structure, the common framework shared by ISO 9001 (quality) and ISO 14001 (environment). If you already hold either, the management-system clauses will look familiar and much of the documentation can be integrated rather than duplicated.
The Architecture
The Four Key Elements
ISO 22000 rests on four pillars working together:
1 · Interactive communication. Food safety hazards can enter at any point in the chain, so the standard requires structured communication both upstream (suppliers) and downstream (customers, regulators) — not just internally.
2 · System management. Food safety is run as a formal, documented management system with defined roles, objectives, and top-management accountability — not left to one committed individual.
3 · Prerequisite programmes. The basic hygiene and operating conditions — cleaning, pest control, maintenance, staff hygiene — that must be in place before hazard analysis is meaningful.
4 · HACCP principles. The Codex hazard analysis and critical control point methodology, applied within the system.
The 2018 revision runs these through two nested Plan-Do-Check-Act cycles: an outer cycle governing the management system, and an inner cycle governing the operational HACCP work. It also strengthened risk-based thinking at two levels — organisational risk (threats to the business) and operational risk (hazards to food safety) — alongside emergency preparedness and product withdrawal/recall requirements.
Where Implementations Go Wrong
⚠️ PRP vs OPRP vs CCP — the distinction auditors test
If there is one technical concept that separates a system that passes from one that fails, this is it. ISO 22000 recognises three tiers of control, and misclassifying between them is among the most common sources of non-conformity.
| Control type | What it is | Measured against | Example |
|---|---|---|---|
| PRP Prerequisite programme | Basic conditions maintained throughout the operation | General good practice; not hazard-specific | Cleaning schedules, pest control, staff hygiene |
| OPRP Operational PRP | Control measure for a significant hazard not managed at a CCP | Action criteria — observable or measurable | Verified sanitation of a specific line before allergen changeover |
| CCP Critical control point | Step where control is essential to prevent or eliminate a hazard | Critical limit — a hard measurable threshold | Pasteurisation temperature and hold time |
📌 The practical test: if failure at that step means the product is unsafe and there is a measurable limit that decides it, it is a CCP. If the measure genuinely reduces a significant hazard but is judged against action criteria rather than a hard limit, it is an OPRP. If it is simply good hygiene maintained everywhere, it is a PRP. Get these labels wrong and your monitoring, corrective actions and records will all be wrong too — which is exactly what the auditor will find.
Free Download
The 25 gaps that fail Kenyan audits
Documentation and record-keeping are where food safety audits are won or lost — across HACCP, ISO 22000 and FSSC alike. Get the checklist auditors work from.
What You’ll Document
The Clause Structure
The certifiable requirements sit in clauses 4 to 10 — the same shape as other modern ISO standards:
- 4 · Context of the organisation — internal and external issues, interested parties, FSMS scope.
- 5 · Leadership — top-management commitment, food safety policy, roles and responsibilities.
- 6 · Planning — actions to address risks and opportunities, food safety objectives.
- 7 · Support — resources, competence, awareness, communication, documented information.
- 8 · Operation — the operational heart: PRPs, traceability, emergency preparedness, hazard analysis, the hazard control plan (CCPs and OPRPs), verification and handling of non-conforming product.
- 9 · Performance evaluation — monitoring, internal audit, management review.
- 10 · Improvement — non-conformity, corrective action, continual improvement and FSMS updating.
Clause 8 carries the most work and the most audit findings. Clause 5 is where many Kenyan implementations quietly fail — because leadership commitment is a documented, auditable requirement, not a sentiment.
The Commercial Reality
The GFSI Question — Read Before You Buy
ISO 22000 certification alone is not recognised by the Global Food Safety Initiative. That is not a criticism of the standard — it is a fact about what large retailers accept. Many international supermarket buyers require GFSI-benchmarked certification, and ISO 22000 does not carry it. FSSC 22000 — ISO 22000 plus sector-specific prerequisite programmes and additional requirements — does.
| Standard | GFSI recognised? | Best fit |
|---|---|---|
| HACCP | No | Baseline; effectively required for EU/US market entry |
| ISO 22000 | No | Genuine management system; regional and institutional buyers |
| FSSC 22000 | Yes | Large international retailers and branded food companies |
The honest advice: before you commit to ISO 22000, ask your buyer — in writing — exactly which certification they require. If the answer is “GFSI-benchmarked” or “FSSC 22000”, going to ISO 22000 first is an extra cost and delay unless you are deliberately using it as a stepping stone.
Is This You?
Who Should Choose ISO 22000
- Organisations wanting a real management system, not just a hazard plan — where food safety needs to survive staff turnover and scale.
- Businesses already holding ISO 9001 or ISO 14001 — the shared Annex SL structure makes integration genuinely efficient.
- Suppliers to regional, EAC and domestic institutional buyers who value a recognised international standard but do not demand GFSI.
- Anyone building deliberately toward FSSC 22000 — KEBS notes that ISO 22000-certified operators can transition to FSSC 22000 relatively smoothly, since ISO 22000 is its foundation.
In Kenya’s regulatory context, KEBS positions Good Manufacturing Practices as the foundation layer, with HACCP and then ISO 22000 built on top — a sequence that matches how most processors realistically mature.
Getting There
The Certification Process
1 · Gap analysis. Assess your current operation against every clause — and be honest about clause 8 and clause 5.
2 · Build the system. Policy, scope, hazard analysis, the hazard control plan classifying every measure as PRP, OPRP or CCP, traceability, and the documented information the standard requires.
3 · Implement and run it. Operate through a real production cycle so there are genuine records — not a system assembled the week before the audit.
4 · Internal audit and management review. Both are mandatory clause requirements, and auditors check they genuinely happened.
5 · Stage 1 audit. The certification body reviews your documentation and readiness.
6 · Stage 2 audit. On-site assessment of the system actually operating. Non-conformities must be closed before certification.
7 · Certification and maintenance. Typically a three-year certificate with annual surveillance audits and full recertification at the end of the cycle.
Costs vary meaningfully by certification body, organisation size and audit scope, so rather than quote a figure here, get a real quote from an accredited body. What we help with is the preparation — so the audit confirms a working system rather than exposing an unfinished one.
Not sure whether you need ISO 22000 or FSSC 22000?
We help processors and exporters match the standard to what their buyers actually require — then build the system and prepare for the audit. Start with a readiness assessment.
Quick Answers
Frequently Asked Questions
What is ISO 22000?
ISO 22000:2018 is the international standard for a Food Safety Management System. It combines HACCP hazard-control principles with prerequisite programmes, interactive communication along the food chain, and formal management system requirements. It applies to any organisation in the food chain, regardless of size.
What’s the difference between a PRP, an OPRP and a CCP?
A PRP covers basic hygiene conditions maintained throughout the operation. A CCP is a step where control is essential, measured against a hard critical limit. An OPRP sits between them — a control measure for a significant hazard not managed at a CCP, verified against action criteria rather than a critical limit. Confusing OPRPs and CCPs is one of the most common causes of audit non-conformities.
Is ISO 22000 recognised by GFSI?
No. ISO 22000 on its own is not GFSI-recognised. FSSC 22000, built on ISO 22000 plus sector-specific prerequisite programmes and additional requirements, does carry GFSI recognition. If a large international retailer requires GFSI-benchmarked certification, ISO 22000 alone will not satisfy them.
How long does ISO 22000 certification take?
It depends on your starting point, but a typical implementation runs several months: gap analysis, documentation, implementation, internal audit and management review, then a two-stage external audit. Certification is generally valid for three years with annual surveillance audits.
Key Takeaways
- ISO 22000 is a management system standard, not just a hazard-control method.
- The PRP / OPRP / CCP distinction is where most implementations and audits go wrong.
- It is not GFSI-recognised — confirm what your buyer actually requires before you commit.
- Shared Annex SL structure makes it efficient if you already hold ISO 9001 or 14001.
- It is the natural foundation for FSSC 22000 if GFSI recognition is where you’re heading.
Related Guides & Resources
Food Safety Ladder
Related Standards
GLOBALG.A.P Certification Kenya
Agricultural Export from Kenya
Work With Us
Last reviewed: August 2026 by Agrosocial Services. Compiled from ISO 22000:2018, Kenya Bureau of Standards guidance and accredited certification body documentation. Certification body requirements, timelines and costs vary — confirm current terms with an accredited body before making commercial decisions. Agrosocial Services is an independent certification-preparation consultancy; we are not a certification body.