ISO 22000 (ISO 22000:2018): requirements, certification and cost
What ISO 22000 (ISO 22000:2018) requires from a chilled or frozen facility, and the practical route from gap analysis to certificate — what each stage takes, what the audit costs, and the temperature evidence that decides Stage 2.
What is ISO 22000 for cold storage?
ISO 22000 is the international food safety management standard (current edition ISO 22000:2018). For a cold store it certifies that each chilled and frozen chamber in scope is controlled by a documented FSMS: prerequisite programmes, a HACCP study with temperature as the critical control point, calibrated monitoring and evidenced corrective action.
Key figures at a glance
- •Current edition: ISO 22000:2018, certifiable by an accredited body
- •Typical route: 6-9 months from gap analysis to certificate
- •Core evidence: temperature mapping, calibration and excursion records
- •Scope must name every site, chamber and temperature regime
What is ISO 22000 in simple terms?
ISO 22000 is the international standard for a food safety management system. It combines management-system requirements, prerequisite programmes and Codex HACCP, so one certificate covers how a facility is run and how food safety hazards are identified, controlled and evidenced.
What are the main ISO 22000:2018 requirements?
A defined FSMS scope, prerequisite programmes, a HACCP study with critical control points, documented monitoring and corrective action, traceability and recall capability, internal audit and management review. For a cold store the holding temperature of each chamber is normally the critical control point.
How long does ISO 22000 certification take?
For a facility already running basic HACCP, expect roughly six to nine months from gap analysis to certificate: documentation and prerequisite work, at least three months of live records, internal audit and management review, then Stage 1 and Stage 2 audits with time to close findings.
What is the difference between ISO 22000 and HACCP?
HACCP is the hazard analysis method for identifying and controlling food safety risks. ISO 22000 wraps HACCP inside a full management system, adding scope definition, leadership, prerequisite programmes, competence, internal audit, management review and continual improvement — and is certifiable by an accredited body.
What is ISO 22000?
ISO 22000 is the international standard for a food safety management system, current edition ISO 22000:2018. It merges the ISO high-level management-system structure with prerequisite programmes and Codex HACCP principles, so a single certificate covers both how the facility is run and how food safety hazards are controlled. It applies across the food chain, and for a cold store, refrigerated distribution centre or temperature-controlled 3PL the certified scope must state every site, chamber and temperature regime.
ISO 22000 requirements for a cold store
- A documented FSMS scope naming each chilled, frozen and deep-frozen area on the certificate.
- Prerequisite programmes (ISO/TS 22002-1 based) for fabric, drainage, hygiene, pest control and plant maintenance.
- A HACCP study in which chamber holding temperature is normally the critical control point.
- Temperature mapping, justified sensor placement and calibration traceable to a national standard.
- Continuous monitoring, alarm set-points, escalation and documented excursion dispositions.
- Traceability and mock recall, internal audit, management review and corrective action with root cause.
ISO 22000 certification: the seven-stage path
Durations assume a facility already running basic HACCP. A new build should add the commissioning period, because auditors want live monitoring records from a loaded, operating chamber.
- 01Gap analysis against ISO 22000:20182–4 weeks
Compare current practice with clauses 4–10 and ISO/TS 22002-1. For a cold store the usual gaps are an undefined FSMS scope, missing temperature mapping and no documented refrigeration-failure contingency.
- 02Define FSMS scope and food safety team1–2 weeks
State every site, chamber and temperature regime (chilled, frozen, deep-frozen) that will appear on the certificate, and appoint a team that includes QA plus refrigeration/maintenance.
- 03Build prerequisite programmes (PRPs)4–8 weeks
Panel and floor integrity, drainage and condensate control, evaporator hygiene, pest control at dock doors, dock-seal condition, cleaning schedules and personnel hygiene — each with a record trail.
- 04HACCP study with temperature as the CCP3–5 weeks
Set critical limits per product group, monitoring frequency, alarm set-points, escalation list and product-disposition rules for excursions. Validate the limits against product shelf-life evidence.
- 05Temperature mapping and calibration2–4 weeks
Map each chamber loaded and empty, in warm and cool season conditions, place fixed sensors at the worst-case points found, and calibrate every probe, logger and reference thermometer.
- 06Run the system, internal audit, management review3–4 months
Auditors expect at least three months of live monitoring records, one completed internal audit cycle, a traceability test or mock recall, and a management review that discusses excursion trends.
- 07Stage 1 and Stage 2 certification audits4–8 weeks
Stage 1 is a documentation readiness review; Stage 2 is the on-site audit. Non-conformities are closed with root-cause evidence before the certificate is issued, then surveillance audits follow annually.
What ISO 22000 certification costs (USD)
Indicative planning ranges seen on cold-chain projects. Small = single chamber under ~500 m³; mid = multi-chamber site; large = multi-site or high-throughput distribution centre. Certification-body fees vary by country and accreditation.
| Cost item | Small store | Mid-size site | Large / multi-site |
|---|---|---|---|
| Certification body audit (Stage 1 + 2) | $4,000 – $7,000 | $7,000 – $12,000 | $12,000 – $25,000 |
| Annual surveillance audit | $1,500 – $3,000 | $3,000 – $5,000 | $5,000 – $10,000 |
| Consultancy / documentation support | $4,000 – $9,000 | $9,000 – $20,000 | $20,000 – $45,000 |
| Temperature mapping & validation | $2,000 – $5,000 | $5,000 – $12,000 | $12,000 – $30,000 |
| Monitoring, sensors & calibration | $3,000 – $8,000 | $8,000 – $25,000 | $25,000 – $80,000 |
Planning ranges only — confirm audit fees with an accredited certification body in your market.
Evidence pack for the Stage 2 audit
- FSMS scope, food safety policy and org chart covering every chilled and frozen area
- HACCP study with validated critical limits for each temperature regime
- Temperature mapping report per chamber — loaded and empty, warm and cool season
- Continuous monitoring records with alarm set-points and escalation response times
- Calibration certificates for probes, loggers and reference thermometers
- Excursion log with product-disposition decisions and corrective actions
- Refrigeration preventive maintenance plan, defrost schedule and breakdown log
- Documented power- and refrigeration-failure contingency plan with standby capacity
- Supplier and 3PL approval files, including reefer transport temperature evidence
- Traceability test or mock recall completed within the last 12 months
ISO 22000:2018 clause by clause (4–10)
The 2018 edition follows the ISO high-level structure. Clauses 4 to 10 carry the auditable requirements; this is what each one means for a chilled or frozen facility.
| Clause | Requirement | What it means for a cold store |
|---|---|---|
| 4 | Context of the organisation | Interested parties and the FSMS scope by site, chamber and temperature class. Chambers left out of scope cannot be sold as certified space. |
| 5 | Leadership | Food safety policy, an appointed food safety team leader, and evidence management funded corrective action and infrastructure such as standby refrigeration. |
| 6 | Planning | Risk register covering plant failure, power loss, loading excursions and multi-client cross-contamination, with measurable food safety objectives. |
| 7 | Support | Competence and training per shift including agency and night staff, calibration traceable to a national standard, and controlled documented information. |
| 8 | Operation | PRPs, operational PRPs and the HACCP plan: inbound acceptance, holding temperature, blast cycles, dispatch loading, vehicle pre-cool, traceability, recall and emergency preparedness. |
| 9 | Performance evaluation | Internal audits across every clause, verification of monitoring data, and management review using excursion trends, complaints and recall-test results. |
| 10 | Improvement | Non-conformity handling with root-cause analysis, effectiveness checks and continual improvement of the FSMS. |
ISO 22000 vs FSSC 22000 vs BRCGS
| Topic | ISO 22000 | FSSC 22000 / BRCGS |
|---|---|---|
| What it is | ISO 22000:2018 — a management-system standard for food safety across the whole chain, storage and distribution included. | FSSC 22000 is ISO 22000 plus sector PRPs and scheme rules; BRCGS Storage & Distribution is a prescriptive graded warehouse standard. |
| GFSI recognition | ISO 22000 on its own is not GFSI-recognised. | FSSC 22000 and BRCGS are GFSI-recognised. |
| Style | Risk-based and flexible — you justify your own controls. | Prescriptive on fabric, temperature control, docks, pest control and traceability timing. |
| Outcome | Pass / fail certificate after non-conformity closure. | FSSC pass / fail; BRCGS issues a grade (AA–D) that sets audit frequency. |
| Choose it when | You already run ISO systems (9001, 14001, 45001) or clients accept ISO 22000. | Retail or branded-manufacturer clients demand a GFSI-recognised certificate in tender. |
Gaps that fail cold stores at audit
A certificate that says 'storage of food products' without naming temperature regimes and chambers creates non-conformities at Stage 1. Name each regime and each site.
Mapping done once in mild conditions is the most common Stage 2 finding. Repeat loaded, in the warmest period, and place fixed sensors where mapping found the warm spots.
Auditors ask for evidence the standby generator or backup plant was tested and that staff know the product-disposition rule during a prolonged excursion.
For a new build, commissioning data, pull-down curves and mapping support belong in the RFQ so they arrive with the plant instead of being priced later as variations.
Buying equipment for an ISO 22000 cold store
Equipment is never certified against ISO 22000 — the management system is. What the supplier delivers decides whether you can evidence the standard. Put these six requirement blocks into the specification and the RFQ, not into a post-award variation.
Food-grade PIR/PUR panels with sealed joints, coved floor-to-wall detailing, drained and trapped condensate lines, and pest-proof dock seals. Ask for panel certificates and a hygienic-design statement in the offer.
Calibrated sensors with traceable certificates, logging at 15 minutes or better, tamper-evident records, full export without vendor assistance, and defined retention aligned to your traceability window.
Two-tier warning and critical alarms, remote notification, acknowledgement logging and read-only auditor access — priced in the base scope, not as an option.
Standby or N+1 capacity for the temperature class held, defrost strategy, critical spares list and a documented plant-failure contingency the auditor can read.
Temperature mapping loaded and empty as a contractual deliverable, calibration certificates, O&M manuals, PM schedule and operator training records handed over before final payment.
Tie retention or the final milestone to the mapping report and successful temperature hold test, and require the supplier to close mapping non-conformities at their cost.
ISO 22000 cold storage FAQ
How ColdMatch Group works — independent B2B procurement and sourcing platform — ColdMatch Group is an independent B2B procurement and sourcing platform for industrial refrigeration, cold storage and cold-chain projects from USD $250K+, where the ColdMatch team reviews each buyer brief, contacts suitable third-party suppliers on the buyer's behalf and organizes their responses.
Send your temperature regimes, volumes and target standard — we collect comparable quotes that include mapping, monitoring and documentation.