ISO 22000 Certification in Morocco: Complete Guide from PRPs to Audit

Who needs ISO 22000 certification in Morocco?

Companies whose customer, contractor or tender asks for a certified food safety management system without requiring a GFSI-recognised scheme. Certification is voluntary: the legal requirement remains the sanitary approval or authorisation issued by ONSSA (Office national de sécurité sanitaire des produits alimentaires, Morocco’s national food safety office), under Law 28-07 and Decree 2-10-473.

ISO 22000:2018 applies to any organisation in the food chain, whatever its size: ingredient producer, processor, packaging manufacturer, carrier, warehouse, central kitchen, distributor. So it is not your type of activity that decides, but what your customer accepts.

At gap analysis, our first question is always the same: who is asking you for this certificate, and have they put it in writing? A buyer’s email listing the accepted standards saves you from building the wrong system. If you are the buyer or the importer, the same logic works from the other side: write the standards you accept into your supplier specification. The rest of this guide assumes the answer is ISO 22000, or that it will be for your first customers.

The standard has another advantage for a Moroccan SME: its ten-clause structure is the same as that of ISO 9001:2026 or ISO 14001:2026. A site that targets several certifications can run a single process map, a single audit programme and a single management review, as explained on our integrated QHSE management system page.

What does ISO 22000 require beyond the HACCP plan filed with ONSSA?

A complete system: top management sets a policy and objectives, a food safety team runs justified prerequisite programmes (PRPs) and a hazard control plan, and the whole system is verified, audited and improved. The HACCP plan in the sanitary file covers part of clause 8; the rest has to be built.

The version to certify against is ISO 22000:2018, published in June 2018 and supplemented in February 2024 by Amendment 1 on climate action changes, which concerns issues and interested parties (clauses 4.1 and 4.2). The ISO page for the standard shows it at stage 90.92, “International Standard to be revised”; the revision draft changes nothing in what the auditor checks today.

The table below starts from what most Moroccan sites already have, to show what remains to be done.

Two points surprise sites that discover the standard. First, it reasons on two levels of risk: the organisation’s risks and opportunities (clause 6.1), such as losing a customer or a key skill, and food safety hazards (clause 8.5). Second, the internal audit must be carried out by trained auditors who do not audit their own work. The reference guidelines are those of ISO 19011:2026, published on 27 May 2026.

How do you build the PRPs and the HACCP plan without doing the work twice?

By starting from the site’s real hazards and writing once what will serve ISO 22000 and then, if a buyer requires it, a GFSI-recognised scheme. PRPs are built on the ISO 22002 series; the hazard control plan flows from the hazard analysis.

For PRPs, ISO 22000 lets the organisation choose and justify its programmes. The ISO 22002 series was recast in 2025: ISO 22002-100:2025, published in July 2025, sets the requirements common to the food, feed and packaging supply chain, and a sector part completes it, such as ISO 22002-1:2025 for manufacturing. According to the ISO page, Part 100 is not mandatory by itself, but it supports compliance with clause 8.2 of ISO 22000:2018, the PRP clause. FSSC 22000 Version 7, on the other hand, makes it mandatory. A site that builds its PRPs on these texts from the start will not have to rework them the day a customer asks for FSSC 22000.

For the HACCP plan, ISO 22000 follows the Codex steps and adds a decision: each control measure for a significant hazard becomes either a CCP, with a measurable critical limit, or an OPRP (operational prerequisite programme), with a measurable or observable action criterion. This classification decides what happens to the product when the measure goes wrong. It is justified in writing, case by case.

The gap we see most often at gap analysis is not a missing PRP, but a PRP with no reason to exist: a list copied from another site, which no analysis links to the product’s hazards. Our how-to guide on the ISO 22000 HACCP plan, PRPs, OPRPs and CCPs details the steps, the CCP or OPRP classification and the validation checklist. The seven principles and twelve steps of the Codex are explained on our HACCP plan and ONSSA approval page.

Is ISO 22000 enough, or should you aim for FSSC 22000?

ISO 22000 is enough when your customers accept it in writing; FSSC 22000 becomes necessary as soon as a buyer requires a GFSI-recognised scheme. The GFSI page lists FSSC 22000 among the recognised programmes, not ISO 22000 on its own.

FSSC 22000 contains ISO 22000:2018 and adds three things: mandatory application of ISO 22002-100:2025 and of the sector part, except for trading without physical handling; additional requirements 2.5.1 to 2.5.18 of the Version 7 scheme, including allergen management, environmental monitoring for categories BIII, C, I and K, food safety and quality culture, and quality control; and at least one unannounced surveillance audit per three-year cycle.

The choice of certification body matters for what comes next. Part 4 of the FSSC scheme requires a body applying for a licence to already hold accreditation for ISO 22000:2018 under ISO/IEC 17021-1 and ISO 22003-1:2022. A body licensed by FSSC can therefore certify ISO 22000, then FSSC 22000. However, the transfer of certification provided for by the scheme (Part 3, §5.6) only concerns existing FSSC 22000 certificates. For a site already certified to ISO 22000, the scheme provides for a transition audit (Part 3, §5.8): the accredited ISO 22000 certificate must still be valid and cover an equivalent scope, but it does not have to come from the same certification body. This audit starts a new certification cycle, meets the objectives of a stage 2 audit and lasts at least two-thirds of the basic audit duration calculated under ISO 22003-1:2022, plus the additional FSSC time, without going below the scheme’s minimum durations; a stage 1 audit is at the certification body’s discretion. It leads to an FSSC 22000 certificate valid for three years.

Timing matters too: audits against Version 6 are only possible until 30 April 2027. Any FSSC 22000 project launched today is built on Version 7, as our guide to the FSSC 22000 Version 7 consultant in Morocco explains. The move from ISO 22000 to FSSC 22000 is illustrated by the case study of a Moroccan dairy.

How does the ISO 22000 certification process work?

In seven phases: gap analysis, build, implementation over a period of real production, internal audit and management review, Stage 1 then Stage 2 of the certification audit, and maintenance over a three-year cycle with annual surveillance audits.

Implementation is the phase people underestimate. The Stage 2 auditor reads records filled in at the time of measurement, verifications carried out, deviations handled. A system written the day before produces none of that. In a seasonal plant, this period must fall during representative production.

How do you choose the certification body?

On its accreditation, first. It must be accredited for ISO 22000, under ISO/IEC 17021-1 and ISO 22003-1:2022, and the scope of its accreditation must cover your food chain category. Ask for the accreditation certificate and check it with the accreditation body, using the method in our checklist for checking a certificate and a certification body.

On what your customer accepts, second. As of 6 November 2026, the Global ACI associate members page lists the Moroccan Accreditation Service, SEMAC (Service marocain d’accréditation), among the accreditation bodies that have not yet been accepted as signatories of its Multilateral Recognition Arrangement (MRA), and the list of accreditation bodies under agreement with the Foundation FSSC includes no Moroccan body. A foreign buyer may therefore require a certificate issued under an accreditation it recognises.

On the clarity of the quote, finally: audit duration and its justification, the auditor’s language, travel costs, surveillance schedule. The duration is calculated under ISO 22003-1:2022 from the category, the number of HACCP studies and the headcount: our article on ISO 22000 certification cost in Morocco details these factors. And keep the roles separate: the consultant who prepares you cannot audit you, as our guide consultant vs certification body: who does what explains.

Which mistakes most often delay certification?

Mistakes of method more than of resources. Here are the ones we meet most often when a site calls us after a first failure or a stalled project.

• Building before asking. The system is ready, and the buyer replies that it expects a GFSI scheme. One written question at the start would have been enough.
• A HACCP plan where everything is a CCP. Monitoring becomes unmanageable, the real critical points get lost, and the auditor asks for the justification of each classification.
• Critical limits without validation. A value taken from a template or from a machine is no proof that it controls your hazard, on your product.
• Records filled in at the end of the shift. Identical entries, written at the same time, are spotted at first glance.
• A scope that does not match the sanitary file. A recent line missing from the ONSSA authorisation blocks the certification of that line.
• An internal audit run by the quality manager on their own work. It does not count as an independent audit, and the management review that follows from it is fragile.

Before asking a certification body for a quote, check these points.

• The standards accepted by each customer are in writing, with the expected version and scope.
  
• The ONSSA sanitary authorisation or approval covers the products, lines and premises in scope.
  
• The certification scope is written: products, lines, addresses, outsourced activities.
  
• PRPs are linked to ISO 22002-100:2025 and to the sector part for your activity.
  
• The hazard analysis is up to date; every measure is classified as a CCP or an OPRP and validated.
  
• Records cover a period of real, representative production.
  
• A traceability test and a withdrawal or recall exercise have been carried out and analysed.
  
• A full internal audit has been run by trained, independent auditors, and the management review has been held.
  
• The accreditation of the intended certification body, and its acceptance by your customers, have been checked.