ISO 22000:2018 Food Safety Management System Implementation
ASC Food Safety Consultants implements ISO 22000:2018 food safety management systems for South African food businesses, from gap analysis and prerequisite programmes through the hazard control plan to internal audit and certification readiness. ASC is a consultancy and not a certification body.
Consulting is charged hourly. A full implementation is quoted on scope once ASC has seen the site and the size of the gap, and ASC will tell you before the quote if the work is smaller than you think.
ISO 22000:2018 is the international standard for a food safety management system, and it applies across the food chain, from manufacturing to storage, transport and catering. It asks you to run food safety the way you run the rest of the business: a defined scope, a policy leadership stands behind, measurable objectives, competent people and evidence that your controls work. Inside that frame sit the HACCP principles and the prerequisite programmes that make HACCP possible.
ISO 22000:2018 can be certified on its own. FSSC 22000 is a scheme recognised by the Global Food Safety Initiative, built in layers: ISO 22000:2018 as the management system, a prerequisite programme specification such as ISO 22002-1 for food manufacturing, and the scheme owner’s additional requirements. ISO 22000:2018 alone is not GFSI recognised, which matters only when a customer asks for it. Where no contract names such a scheme it is a credible international system and the sensible first step; where a retailer or export buyer does, ASC scopes towards FSSC 22000.
None of this replaces South African law. Every business handling food here works to the general hygiene requirements in R638 of 22 June 2018, Government Gazette 41730, under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, and food premises must hold a certificate of acceptability from the local authority. Certification is voluntary; the hygiene law is not.
Key facts at a glance
When a business calls ASC in
- A customer or export buyer has named ISO 22000:2018 in your supply agreement.
- Your HACCP file was written years ago and no longer matches the process.
- You have no formal system, hygiene runs on habit, and it must now be written down.
- An inspection under R638 has raised findings and management wants a system, not one finding at a time.
- A certification audit is booked, or a first stage assessment has returned gaps.
- You are weighing ISO 22000:2018 against FSSC 22000 and want an honest reading of what your market needs.
How ASC works with you
Gap analysis, context and the management frame
ASC starts on site, walking the process from receiving to dispatch and interviewing the people doing the work, which produces a clause by clause gap analysis and an implementation plan with owners and dates. ASC then builds the management frame: context of the organisation and interested parties, a defensible scope, a signed food safety policy the team understands, a food safety team leader with resources, planning of risks, opportunities and objectives, and support, meaning competence, communication and document control.
Prerequisite programmes, hazard analysis and the hazard control plan
Prerequisite programmes come first, because a hazard analysis built on shaky basic hygiene pushes every hazard onto a critical control point. ASC writes or reworks cleaning, pest control, personal hygiene, maintenance, calibration, water, allergens, waste, supplier approval and transport, to your process and to R638. The hazard analysis follows: product descriptions and intended use, flow diagrams verified on the line, hazards assessed for severity and likelihood, and control measures chosen against them.
Categorising each control measure as an operational prerequisite programme or a critical control point is where implementations most often go wrong. A critical control point has a measurable critical limit and monitoring fast enough to isolate affected product, such as a cook step with a time and temperature. An operational prerequisite programme has an action criterion that may be measurable or observable, with monitoring that confirms the control was applied rather than that each unit is safe. Both are validated before you rely on them, monitored by named people at a stated frequency, and verified afterwards, separately from monitoring. Loss of control at a critical control point means product since the last sound check is held and evaluated; at an operational prerequisite programme it means a correction and an evaluation of the consequence. Traceability and emergency preparedness complete the operation stage.
Verification, internal audit and certification readiness
ISO 22000:2018 runs on Plan, Do, Check, Act at two levels: an outer management system cycle of planning, operating, evaluating and improving, and an inner cycle inside operation, where the hazard control plan is monitored, verification results are analysed as a whole, and the system is updated when a process, raw material or law changes.
The internal audit programme covers every clause and process, with competence criteria for auditors. ASC runs the ISO 22000:2018 internal audit on site over two days, presents findings to management on the last day and issues the full report within two weeks of the closing meeting. ASC also runs a timed mock recall with you, and set the management review against the inputs the standard requires.
For certification you appoint an accredited certification body of your choosing, and ASC readies you with a clause by clause evidence index, closure of open findings, and coaching for your team leader. Confirm the applicable version of the standard and its transition dates with that body.
What you receive
| Deliverable | What it contains |
|---|---|
| Gap analysis and implementation plan | A clause by clause assessment of your site, each gap with an owner, a priority and a date. |
| Management system documentation set | Scope, context and interested parties register, policy and objectives, team structure, competence records and document control. |
| Prerequisite programme suite | Cleaning, pest control, personal hygiene, maintenance, calibration, water, allergens, waste, supplier approval and transport, to R638. |
| Hazard analysis and hazard control plan | Product descriptions, verified flow diagrams, hazard assessment, every control categorised as an operational prerequisite programme or a critical control point with the reasoning recorded, plus limits, monitoring and validation. |
| Traceability and recall pack | Traceability and recall procedures, recall team and contacts, holding rules, and the mock recall ASC runs with you. |
| Internal audit and management review pack | Audit programme, auditor competence criteria, checklists, the two day internal audit and its report, review agenda and minutes, and the evidence index. |
Everything you need for ISO 22000, in one place
Consulting is one route. Build it yourself with the ASC toolkit, train your team online, or read the guidance first. All three come from the people who run the audits.
Do it yourself
Editable ASC document toolkits and templates, built by the same auditors who run the audits.
Train your team
Accredited online courses on ascfoodsafetytraining.com, studied at your own pace with certificates on completion.
Read first
Free guidance from the ASC library, written for South African food businesses.
Who this work suits
ASC implements ISO 22000:2018 in dairies, meat and poultry processors, bakeries, beverage plants, dry blending operations, packhouses, ready meal kitchens, catering groups, cold stores and logistics, and in the packaging and chemical suppliers pulled in by their customers. Much of ASC’s work is with businesses that have no formal system today, and a site with one line and ten staff can hold a credible system written for that site.
ASC is led by founder and lead consultant Mthokozisi Nkosi, a SAATCA registered lead auditor. ASC is a FoodBev SETA Accredited Provider No. 587/00337/1900 and is B-BBEE Level 1. Consulting is charged hourly, and a full implementation runs over days or weeks and is quoted on scope.
Where ASC stops
ASC is not a certification body. ASC does not certify anyone, does not award a certificate against ISO 22000:2018 or any other standard, and cannot guarantee a certification result. That decision belongs to the accredited certification body you appoint, after its own independent third party audit. ASC builds the system with you and stays available while findings are closed.
Frequently asked questions
Should we implement ISO 22000:2018 on its own or go for FSSC 22000?
Your customers decide, not ASC. Where a retailer or an export buyer requires a scheme recognised by the Global Food Safety Initiative, ISO 22000:2018 alone will not satisfy it, and the route is FSSC 22000 implementation. Otherwise it is a complete international system and a more achievable start, and the work is not wasted if you move up later.
We have no formal system at all. Can we start from nothing?
Yes, and many ASC implementations start there. Duration depends on the size of the site, its processes and products, the state of the prerequisite programmes and the time your team can give, so ASC confirms a timeline when scope is agreed. The sequence stays the same, and where the base is not there yet it starts with HACCP and GMP: hygiene compliance and prerequisite programmes, then the hazard analysis, then the management system.
How do we tell an operational prerequisite programme from a critical control point?
Ask whether a measurable critical limit can be set, and whether monitoring will tell you it was breached in time to hold the product. If both are true, you have a critical control point. If the control works by being applied consistently rather than measured on each unit, it is an operational prerequisite programme.
Do we still have to comply with R638 once we are certified?
Yes. Certification is voluntary and does not displace the law. The general hygiene requirements in R638 of 22 June 2018, under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, apply whatever certificate hangs on the wall, including the certificate of acceptability food premises must hold.
What happens if the certification audit still raises findings?
Some will. An audit that raises nothing at all is unusual, and the certification body is entitled to see things ASC did not. What ASC works to prevent is a finding against a requirement it built, and a finding the site cannot close inside the certification body’s deadline. ASC stays available while findings are closed, works each one back to a root cause rather than patching it, and gathers the closure evidence in the form the auditor asked for. ASC cannot guarantee the outcome, because the decision belongs to the certification body, and any consultant who guarantees it is telling you something they cannot deliver.
Find out whether ISO 22000 is the right target
Send ASC a description of your site, your products and what your customer has actually asked for. You will get a straight answer on whether ISO 22000:2018 is enough, or whether your market needs a GFSI recognised scheme.
Not ready for a quote? Use Where Do I Start to see which standard your market actually needs, or book a virtual consultation.