How to Get ISO 22000 Certified in Kenya
A Step-by-Step Guide

1. What is ISO 22000?

ISO 22000 is the international standard for Food Safety Management Systems (FSMS). Published by the International Organization for Standardization and most recently revised in 2018 as ISO 22000:2018, it provides a framework that any organisation in the food chain — from farm to fork — can use to demonstrate that its food safety management system is documented, implemented, and continuously improved.

ISO 22000 builds on the seven HACCP principles we covered in our earlier articles, but it goes further. It adds the discipline of a formal management system — with documented policies, defined responsibilities, internal audits, management reviews, and a structured continual improvement cycle — on top of the operational food safety controls that HACCP provides.

2. ISO 22000 vs HACCP vs FSSC 22000 — understanding the landscape

These three names appear constantly in food safety conversations in Kenya, and the relationships between them are frequently misunderstood. Here is a clear breakdown:

HACCP is a food safety methodology — a set of seven principles for identifying and controlling hazards. It can exist as a standalone plan or be embedded within a broader management system.

ISO 22000 is a management system standard that incorporates HACCP. If you implement ISO 22000, you are implementing HACCP — but you are also implementing a full quality management framework around it. ISO 22000 certification is granted by accredited certification bodies after a successful third-party audit.

FSSC 22000 (Food Safety System Certification 22000) is a Global Food Safety Initiative (GFSI) benchmarked scheme built on top of ISO 22000. It adds sector-specific prerequisite programme requirements (based on ISO/TS 22002 series) and additional FSSC requirements. FSSC 22000 is required by major global food retailers and manufacturers — Walmart, Tesco, Nestlé, Unilever — as a baseline supplier requirement. It is the next step above ISO 22000 for businesses targeting premium export markets.

3. Who in Kenya needs ISO 22000?

ISO 22000 applies to any organisation in the food chain that wants to demonstrate its ability to control food safety hazards and ensure food is safe at the time of human consumption. In the Kenyan context, the following categories of businesses have the most immediate commercial and regulatory incentive to pursue certification:

• Food manufacturers and processors supplying to major domestic retail chains — supermarkets are increasingly requiring ISO 22000 from their suppliers as a listing condition
• Export-oriented food businesses — any Kenyan food business exporting to the EU, UK, Middle East, or US markets that wants to move beyond basic KEBS certification toward GFSI recognition
• Dairy processors — the Kenya Dairy Board recognises ISO 22000 as a mark of food safety management maturity
• Contract manufacturers producing for branded principals — brand owners increasingly require ISO 22000 from their manufacturing partners
• Food service operators at scale — institutional catering, airline catering, and large hotel groups supplying to corporate clients
• Ingredient and additive suppliers — businesses supplying raw materials to ISO 22000 certified manufacturers are increasingly asked to demonstrate their own food safety management systems

4. The Kenyan certification pathway

ISO 22000 certification in Kenya follows a defined pathway involving KEBS, accredited certification bodies, and the Kenya Accreditation Service (KENAS). Here is how it works:

KEBS and KENAS roles: KEBS is Kenya's national standards body — it publishes KS ISO 22000:2018 as a Kenya Standard and promotes its adoption. KENAS (the Kenya Accreditation Service, established under the Standards Act Cap 496) accredits certification bodies operating in Kenya. ISO 22000 certification is issued not by KEBS or KENAS directly, but by accredited certification bodies that have been assessed as competent to audit and certify against ISO 22000.

Accredited certification bodies operating in Kenya include: Bureau Veritas Kenya, SGS Kenya, TÜV Rheinland Kenya, Lloyd's Register, Intertek Kenya, and several others. Each has slightly different pricing and sector expertise — it is worth comparing at least two before committing.

The certification audit process: ISO 22000 certification is obtained through a two-stage audit. Stage 1 (document review) assesses whether your documented management system meets the requirements of the standard. Stage 2 (implementation audit) assesses whether the documented system is actually implemented and effective. Both stages are conducted at your facility by an auditor from the certification body.

Certificates are typically valid for three years, with annual surveillance audits in years one and two, and a full recertification audit in year three.

5. Key requirements of ISO 22000:2018

ISO 22000:2018 is structured around ten clauses. Clauses 1–3 cover scope, references, and definitions. The requirements that organisations must demonstrate compliance with are in Clauses 4–10:

Clause 4 — Context of the organisation. Understand the internal and external factors that affect your food safety management system. Know your interested parties (customers, regulators, suppliers) and their requirements. Define the scope of your FSMS.

Clause 5 — Leadership. Top management must demonstrate commitment to food safety — not just sign a policy. This includes establishing a food safety policy, assigning a food safety team leader, and ensuring that food safety objectives are aligned with the strategic direction of the business.

Clause 6 — Planning. Identify and address risks and opportunities. Set measurable food safety objectives with plans to achieve them. Plan changes to the FSMS in a controlled way.

Clause 7 — Support. Ensure the FSMS has what it needs to function: competent people, adequate infrastructure, a suitable work environment, calibrated monitoring equipment, documented information (procedures, records), and effective communication both internally and with external parties.

Clause 8 — Operation. This is the operational heart of ISO 22000 and where HACCP lives. It covers prerequisite programmes (PRPs), the hazard analysis, the HACCP plan (CCPs, critical limits, monitoring, corrective actions), and the operational procedures that control food safety in real time. Traceability and emergency preparedness are also covered here.

Clause 9 — Performance evaluation. Monitor and measure the FSMS. Conduct internal audits. Review the system at management level. Analyse data to assess performance against food safety objectives.

Clause 10 — Improvement. Correct nonconformities when they occur. Investigate root causes and take corrective actions that prevent recurrence. Continually improve the food safety management system.

6. Realistic timeline for Kenyan food businesses

7. Understanding the investment in ISO 22000

ISO 22000 certification is a meaningful investment — in time, people, and resources. The total cost varies significantly depending on your starting point, the complexity of your operation, the number of product lines in scope, and the certification body you choose.

The cost breakdown spans several components: gap assessment and planning, documentation development, staff training, equipment calibration, the certification body's Stage 1 and Stage 2 audit fees, and ongoing annual surveillance costs. Facility improvement works — which can range from minor to substantial depending on your current GMP baseline — are additional and highly variable.

The most important cost-reduction strategy is building internal capacity before engaging external support. A food safety team leader who understands the standard deeply will reduce consultant dependency significantly. Our free HACCP Fundamentals course on DESMA Learn is the right starting point.

8. Common gaps found in Kenyan ISO 22000 audits

Based on DESMA Consult's experience supporting Kenyan food businesses through ISO 22000 certification, these are the nonconformities that appear most frequently in Stage 1 and Stage 2 audits:

• Food Safety Policy not communicated or understood. The policy exists as a document but front-line production staff have never seen it and cannot explain what it means for their work. ISO 22000 requires that the policy is communicated, understood, and applied.
• Food safety objectives not measurable. "We will improve food safety" is not an objective under ISO 22000. Objectives must be measurable (e.g., "Achieve zero KEBS enforcement actions in the 12-month period ending December 2026"), have an owner, and have a plan for achievement.
• Internal audits conducted by the auditee. A food safety manager who audits their own department is not providing independent assurance. Internal auditors must be independent of the area being audited.
• PRPs not validated or monitored. Cleaning schedules exist on paper but frequency is not monitored and effectiveness is not verified through environmental swabbing or other methods.
• Traceability not tested. ISO 22000 requires the ability to trace a product forward to distribution and back to raw material origin within a defined timeframe. Many Kenyan businesses document a traceability procedure but have never run a live trace exercise to verify it works.
• Supplier approval process absent or incomplete. ISO 22000 requires that externally provided products and services that affect food safety are controlled. Buying raw materials from an unapproved supplier without a quality evaluation is a nonconformity.
• Management review not conducted or not documented. The annual management review must be a formal, minuted meeting at which the FSMS performance is assessed against data — not an informal discussion.
• Calibration records missing or equipment out of calibration. Consistently one of the top three nonconformities across all Kenyan food safety audits.

9. Step-by-step: how to prepare for ISO 22000 certification in Kenya

1. Build your foundation first. Ensure GMP and HACCP are in place and working before starting ISO 22000 implementation. Read our guides on What is HACCP and The 7 Principles of HACCP if you need to start here.
2. Conduct a formal gap assessment. Map your current practices against every clause of ISO 22000:2018 and identify the gaps. Use a structured checklist. DESMA Consult conducts ISO 22000 gap assessments for Kenyan food businesses — contact us at desmatech.africa/consult.html.
3. Train your Food Safety Team Leader. This person leads implementation and is the primary contact for the certification body. They must understand ISO 22000 deeply — not just HACCP. Consider formal ISO 22000 Lead Implementer or Internal Auditor training.
4. Select and contract your certification body early. Engage your chosen certification body before you start implementation — they can provide guidance on what they expect to see and their timeline for scheduling audits.
5. Develop your Food Safety Policy and objectives. These are the top-level documents that set direction for the entire system. They must be approved by top management and communicated to all staff.
6. Develop or update your HACCP plan and PRP documentation. Your HACCP plan must meet the specific requirements of ISO 22000 Clause 8 — which is more detailed than a standalone HACCP plan in some respects, particularly around validation of control measures.
7. Develop your SOPs and supporting documentation. Document all critical processes, including traceability, allergen management, supplier approval, nonconforming product, and emergency preparedness.
8. Train all relevant staff. Every person whose work affects food safety must understand their role in the system and be able to demonstrate it to an auditor. Training records must be maintained.
9. Generate a minimum of 3 months of operational records. Monitoring logs, corrective action records, calibration data — your system must be demonstrably running before you invite Stage 1. A documented system with no records is not an implemented system.
10. Complete at least one full internal audit cycle. The internal audit must cover all clauses in scope. All findings must be formally closed before Stage 1.
11. Hold your management review meeting. Formal, minuted, data-driven. This is one of the most commonly missing elements in Kenyan first-time applicants.
12. Proceed to Stage 1 and Stage 2 audits. Address all findings within agreed timeframes. Certification is issued once nonconformities are satisfactorily closed.

10. Maintaining certification after you pass

Certification is not a destination — it is the beginning of an ongoing commitment. Many businesses pass their initial audit and then let the system slide until the next surveillance audit approaches. This approach is both stressful and risky, and it is the most common reason businesses fail their first surveillance audit.

The businesses that maintain ISO 22000 certification successfully treat the standard as a management tool, not a compliance exercise. Their food safety system is alive between audits — not reconstructed before them.

Maintaining certification requires designated ownership, scheduled activities, management commitment, and a culture where food safety records are completed accurately and consistently. The specific mechanisms — how you structure your ongoing audit programme, how you run management reviews, how you track corrective actions — are where the real operational expertise lies.