ISO 22000 Certification in Morocco and Africa: PRPs and HACCP Plan

What is ISO 22000:2018?

It is the international standard that sets the requirements for a food safety management system (FSMS), for any organisation in the food chain, from animal feed to retail, including packaging and transport. Published in June 2018 by committee ISO/TC 34/SC 17, it remains the version in force (ISO 22000:2018 page).

It brings four elements together: a management system built on the common structure of ISO management system standards, interactive communication along the food chain, prerequisite programmes (PRPs) and the HACCP principles of the Codex Alimentarius. Its logic rests on two levels of risk: the organisation’s own risks and opportunities (clause 6.1) and food safety hazards (clause 8.5).

Its ten-clause structure is the same as that of other management system standards, such as ISO 9001:2026 or ISO 14001:2026. A site that targets several certifications can therefore run a single process map, a single audit programme and a single management review: see our integrated QHSE management system page.

What ISO 22000 is not

It is neither a GFSI-recognised programme nor a legal requirement in Morocco. The legal requirement is the sanitary authorisation or approval issued by ONSSA under Law 28-07, together with an own-check programme based on HACCP principles: see our HACCP plan and ONSSA approval page. ISO 22000 is a voluntary certification that structures this foundation and makes it verifiable by a third party. For a site elsewhere in Africa or in the Middle East, the starting point is the national food safety approval or registration that applies there: certification builds on legal compliance, it does not replace it.

For a European or Gulf buyer, the practical consequence is straightforward. An ISO 22000 certificate shows that a supplier runs a structured system. If your own supplier policy requires a GFSI-recognised scheme, ISO 22000 alone will not meet it.

What do the 2024 climate amendment and the current revision change?

The 2024 amendment adds climate change to the issues the organisation must consider. The full revision is under way and has no announced publication date.

Published in February 2024, Amendment 1:2024 concerns clauses 4.1 and 4.2. The organisation determines whether climate change is a relevant issue for it, and its interested parties may have climate-related requirements. The amendment requires neither a carbon footprint nor a numerical target. For a fish cannery or a fruit packhouse, the question may be about the availability of raw material, holding the cold chain during heatwaves, or access to water. The same reasoning applies to a dairy in North Africa or a cocoa grinder in West Africa. The auditor checks that the question has been asked and that the answer is consistent with the rest of the system.

FSSC sites are affected too: the FSSC 22000 Version 7 scheme refers to ISO 22000:2018, including the amendments published by ISO.

What should you do in the meantime? Get certified to ISO 22000:2018 and its amendment, do not write your system on a draft that may still change, and plan a gap review as soon as the new edition is published. You can follow the project on the ISO/DIS 22000 page.

ISO 22000 or FSSC 22000: what is the difference?

FSSC 22000 is a certification scheme that contains ISO 22000. It adds the mandatory PRPs of the ISO 22002-x:2025 series and additional requirements, and it is FSSC 22000, not ISO 22000 on its own, that appears among the programmes recognised by the GFSI.

The choice starts with your customers. Ask them for the written list of standards they accept. An ingredient supplier delivering to food manufacturers in Morocco, a central kitchen, a cold store or a packaging manufacturer may be asked for ISO 22000. A cannery exporting to European retail will be asked for a GFSI-recognised scheme, BRCGS, IFS or FSSC 22000, depending on the buyer: see our GFSI standards comparison. The same logic holds for a juice plant in Egypt supplying a Gulf distributor or a cashew processor in Côte d’Ivoire selling to a European roaster: the buyer’s written requirement decides.

If you are the buyer, put that list in your supplier specification. It saves your suppliers from certifying against the wrong standard, and saves you from receiving a certificate you cannot accept.

Moving from ISO 22000 to FSSC 22000

The ISO 22000 system stays in place. You add the mandatory ISO 22002 part for your category, the additional requirements (food defence, food fraud, allergens, environmental monitoring, and food safety and quality culture, among others) and an audit by a certification body licensed by the Foundation FSSC. How the move is handled, initial audit or switch during the cycle, is agreed with that certification body: ask for it in writing. The v6 to v7 timetable and the additional requirements are covered on our FSSC 22000 Version 7 page.

Which prerequisite programmes (PRPs) do you need?

The ones your activity, the law and your customers require. ISO 22000 lets the organisation choose and justify its PRPs, taking into account the applicable part of the ISO 22002 series and relevant codes of practice. This summary does not reproduce the standard’s wording, which is a paid text: the justification of each PRP is built on that text and on the part of the ISO 22002 series specific to your sector.

The Codex Alimentarius defines prerequisite programmes as good hygiene, agricultural and manufacturing practices, complemented by other practices such as training and traceability, that set the basic conditions for a HACCP system (CXC 1-1969). ISO 22000 (clause 8.2.4) lists the topics to cover:

• construction and layout of buildings, and associated utilities;
• layout of premises, zoning, work areas and employee facilities;
• air, water, energy and other utilities;
• pest control, waste and wastewater disposal;
• suitability of equipment for cleaning and maintenance;
• supplier approval and monitoring;
• receipt, storage, dispatch, transport and handling of products;
• prevention of cross-contamination;
• cleaning and disinfection;
• personal hygiene;
• product information and consumer awareness.

Since 2025, the ISO 22002 series has been made up of international standards rather than technical specifications. ISO 22002-100:2025 sets the requirements common to all sectors; a sector part completes them.

The gap we find most often at gap analysis is a PRP list copied from another site, with no link to the real hazards. The auditor asks why each PRP exists, who monitors it and how you verify that it works (clause 8.8). A justified PRP fits in three lines: the hazard or requirement it covers, how often it is checked, and the record that proves it. Cross-cutting programmes (allergens, traceability and recall, environmental monitoring, pest control) are covered on our food safety programmes page.

How does the HACCP plan fit into ISO 22000?

ISO 22000 takes the Codex HACCP method into clause 8.5 and completes it: each control measure for a significant hazard is classified as a CCP or an OPRP, and together they form the hazard control plan. The Codex reference is the 2022 revision of the General Principles of Food Hygiene, CXC 1-1969.

CCP or OPRP: how do you classify a control measure?

With a logical, written approach that takes into account, among other factors, the likelihood that the measure fails and the severity of the consequences if it does. Classification is not a formality: it decides what happens when the measure goes wrong.

• CCP: the measure has a measurable critical limit. If the limit is not met, the product concerned is handled as potentially unsafe, segregated and evaluated before any decision.
• OPRP: the measure has an action criterion, measurable or observable. If it is not met, you correct and assess the effect on the product.
• PRP: the measure does not target an identified significant hazard; it maintains basic hygiene conditions.

In a cannery, sterilisation is typically a CCP, with a critical limit validated for each can format and recipe. Monitoring of cooling water treatment may be an OPRP, depending on the site’s hazard analysis. The Codex itself does not use the term OPRP: it distinguishes ordinary good hygiene practices, those that need greater attention, and CCPs. Our HACCP plan page explains this correspondence, with a complete cannery example.

How does ISO 22000 certification work?

In five stages: the regulatory prerequisite, building the system, internal audit and management review, a two-stage certification audit by an accredited body, then a three-year cycle with annual surveillance audits.

The certification body must be accredited for ISO 22000. FSSC 22000 Version 7 recalls the framework: accreditation under ISO/IEC 17021-1 and ISO 22003-1:2022. Check on the accreditation certificate that the scope covers your category of activity, ask for a quote that states the audit duration and the auditor’s language, and keep consulting and auditing separate: the consultant who prepares you cannot audit you. Buyers checking a supplier can apply the same test, from the other side of the table.

If you would rather test your system before the audit, a mock audit or an outsourced internal audit gives an independent measure of the remaining gap.

Training is the easiest cost to fund. For Moroccan companies, project training may fall under the OFPPT special training contracts (CSF), under precise rules: see our CSF and OFPPT funding page for a simulation, with no amount promised.

Is your site ready for its ISO 22000 audit?

This is the checklist we use before proposing an audit date to a site.

• Valid ONSSA sanitary authorisation or approval, or the national equivalent, covering the whole intended scope.
  
• Written list of the standards accepted by each customer: ISO 22000 alone or a GFSI scheme.
  
• Written certification scope: products, lines, addresses, outsourced activities.
  
• Internal and external issues analysed, climate included, and interested parties identified.
  
• PRPs covering the topics of clause 8.2.4, linked to the ISO 22002 part for your activity.
  
• Up-to-date hazard analysis, measures classified as CCPs or OPRPs, validations documented.
  
• Monitoring, corrections and verification recorded over a period of real production.
  
• Traceability test and withdrawal exercise carried out, results analysed.
  
• Food safety team and internal auditors trained, competence evidenced.
  
• Full internal audit completed and management review held.
  
• Certification body accredited for ISO 22000 and your category, selected and under contract.
  

What ACG does for your ISO 22000 certification

Our food safety training covers ISO 22000, the HACCP team and internal audit, on site, in public sessions or remotely, in French, Arabic or English. For an overview of the field, see our food safety consulting practice. To see where your site stands against ISO 22000:2018, describe your project.