Management System Certification

Yes, and it is usually the efficient choice. Both standards share the High Level Structure, so context, leadership, internal audit, management review and improvement can be run as one integrated system. An integrated audit reduces total audit days compared with two separate certifications.

OHSAS 18001 was withdrawn in March 2021 and is no longer a valid certification. Migration requires you to add the elements ISO 45001 introduced — organisational context, interested parties, leadership accountability, worker consultation mechanisms, and OH&S risks and opportunities beyond hazard-level risk. In most cases a transition audit rather than a full initial certification is sufficient.

HACCP is a hazard-control methodology, not a management system. ISO 22000 wraps HACCP inside a full management system with leadership, planning, competence, verification and improvement. FSSC 22000 is ISO 22000 plus the sector-specific ISO/TS 22002 prerequisite programme and additional scheme requirements — and unlike ISO 22000 on its own, it is GFSI-recognised.

Annex A was restructured from 114 controls across fourteen domains into 93 controls across four themes, with eleven genuinely new controls covering threat intelligence, cloud security, ICT readiness for continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring, web filtering and secure coding. Organisations still certified to the 2013 version were required to transition by 31 October 2025.

The standard requires exercising at planned intervals and after significant change, without prescribing a frequency. Common practice is at least annually for each critical plan, with a mix of tabletop and technical exercises. What we assess is whether the programme is justified against your risk profile and whether findings were acted on.