ISO 22000 Certification in Malaysia – FSMS Requirements, Food Safety Laws & Get Certified with SCS

SCS Certification – Malaysia Office

SCS Certification
Jalan Pinang
50450 Kuala Lumpur
Malaysia

Phone: +60 11 6263 6611
Enquiry: Contact SCS Certification

http://www.scscertification.com/contactus.php

Malaysia's food sector includes manufacturers, processors, beverage companies, seafood businesses, cold-chain operators, food distributors, catering companies, restaurants, food-service providers and exporters.

For these organizations, food safety involves more than maintaining hygiene at the production site. Businesses need to understand their products, processes, suppliers, employees, storage arrangements, transportation activities and applicable Malaysian requirements.

ISO 22000 provides a structured Food Safety Management System (FSMS) for organizations involved in the food chain. It can help businesses identify food-safety hazards, establish controls, monitor performance, maintain traceability and continually improve their food-safety arrangements.

At the same time, ISO 22000 does not replace Malaysian food legislation. Businesses need to identify and comply with the legal and regulatory requirements applicable to their activities.

Malaysia's Ministry of Health administers food-safety programmes through its Food Safety and Quality Programme. Malaysian food businesses may also encounter national schemes such as MeSTI, HACCP and GMP depending on their activities and business objectives. The Ministry specifically identifies GMP, HACCP and ISO 22000 as food-safety assurance programmes, while MeSTI was introduced to provide a more accessible scheme for food-manufacturing premises, particularly SMEs.

http://www.scscertification.com/contactus.php

What Are ISO 22000 Requirements in Malaysia?

ISO 22000 establishes requirements for a Food Safety Management System that can be applied by organizations participating in the food chain.

For a Malaysian organization, implementation normally involves establishing a system appropriate to its actual products, processes and food-safety risks.

Key areas include:

• Understanding the organization and its context
• Identifying relevant interested parties
• Defining the FSMS scope
• Leadership and food-safety policy
• Responsibilities and authorities
• Planning
• Resources and competence
• Communication
• Documented information
• Prerequisite programmes
• Hazard analysis
• Operational planning and control
• Traceability
• Emergency preparedness and response
• Monitoring and measurement
• Verification
• Internal audit
• Management review
• Nonconformity and corrective action
• Continual improvement

The system should be practical for the organization rather than consisting only of documents prepared for an audit.

Why ISO 22000 Is Relevant to Malaysian Food Businesses

Food businesses operate through connected activities.

A problem with a supplier can affect production. A refrigeration failure can affect stored products. Poor traceability can make a product investigation difficult. Inadequate cleaning can create cross-contamination risks.

An FSMS gives the organization a structured way to manage these connections.

For Malaysian businesses, ISO 22000 can be particularly relevant where customers, supply-chain partners, export markets or internal management systems require a recognized food-safety framework.

The certification decision should nevertheless be based on the organization's actual commercial and regulatory requirements.

Malaysian Food-Safety Laws and ISO 22000

ISO 22000 should be implemented alongside applicable Malaysian legal requirements.

The Malaysian Ministry of Health maintains the country's food-safety legislation and related requirements through its Food Safety and Quality Programme.

Important references for many food businesses include:

• Food Act 1983
• Food Regulations 1985
• Food Hygiene Regulations 2009
• Applicable food-safety requirements issued by Malaysian authorities
• Requirements applicable to specific products, premises and activities

The organization should determine which requirements apply to its own operation instead of treating every food regulation as automatically applicable.

Food Act 1983 and Food-Safety Management

The Food Act 1983 forms part of Malaysia's food-safety legislative framework.

For an ISO 22000 implementation, the organization should identify the statutory and regulatory obligations that relate to its products, processes and premises.

The practical question is:

What legal food-safety requirements apply to this particular business, and how are they controlled?

That question should be reflected in the organization's compliance evaluation and FSMS planning.

Food Regulations 1985

The Food Regulations 1985 are an important reference for Malaysian food businesses.

The Ministry of Health currently publishes the regulations and their schedules, including an update uploaded in September 2026 reflecting amendments through August 2026.

Depending on the organization's products and activities, relevant considerations can include:

• Food standards
• Ingredients
• Food additives
• Product information
• Labelling
• Composition
• Product-specific requirements

A manufacturer should therefore establish a process for identifying and reviewing applicable regulatory requirements.

Food Hygiene Regulations 2009

The Food Hygiene Regulations 2009 are particularly relevant to day-to-day food operations.

They establish requirements associated with food premises, owners and food handlers.

For an FSMS, related operational controls may include:

• Personal hygiene
• Premises hygiene
• Cleaning and sanitation
• Food handling
• Storage
• Packaging
• Transportation
• Equipment
• Pest control
• Cross-contamination prevention
• Employee practices

The exact controls should correspond to the organization's activities and risks.

MeSTI and ISO 22000 in Malaysia

MeSTI is an important consideration for Malaysian food-manufacturing businesses.

The Ministry of Health explains that MeSTI was introduced as a scheme that can help food-manufacturing premises, particularly SMEs, meet minimum requirements under the Food Hygiene Regulations 2009. The Ministry also lists ISO 22000, HACCP and GMP as examples of food-safety assurance programmes.

Is MeSTI the Same as ISO 22000?

No.

MeSTI and ISO 22000 are different schemes.

MeSTI is a Malaysian food-safety certification scheme administered under the Ministry of Health framework.

ISO 22000 is an international Food Safety Management System standard.

A Malaysian business should determine which scheme or combination of systems is appropriate for its customers, market, operations and regulatory requirements.

HACCP and ISO 22000 in Malaysia

HACCP is another important part of Malaysia's food-safety environment.

The Ministry of Health's HACCP scheme covers food-manufacturing premises and requires implementation of HACCP and prerequisite programmes. The Ministry also states that applicable premises need to comply with Malaysian food laws and regulations.

HACCP and ISO 22000 are related but are not identical.

HACCP concentrates on systematic identification and control of food-safety hazards.

ISO 22000 provides a broader management-system framework around food safety.

An organization that already operates HACCP may therefore have useful foundations for ISO 22000 implementation, but it should still assess the complete ISO 22000 requirements.

GMP and ISO 22000

Good Manufacturing Practice is another relevant food-safety approach in Malaysia.

The Ministry of Health's GMP scheme is available to food-manufacturing premises and requires implementation of GMP requirements based on the applicable Malaysian Standard.

GMP commonly provides the operational foundation for areas such as:

• Hygiene
• Premises
• Equipment
• Personnel
• Production
• Storage
• Cleaning
• Process controls

ISO 22000 can provide a broader FSMS structure around these operational controls.

ISO 22000 Requirements for Malaysian Food Manufacturers

Food manufacturing is one of the strongest applications for ISO 22000.

A manufacturing FSMS may need to address:

• Raw-material approval
• Supplier controls
• Production planning
• Process controls
• Cleaning
• Sanitation
• Allergen controls
• Product specifications
• Packaging
• Storage
• Product release
• Traceability
• Complaints
• Product withdrawal and recall

The scope should reflect the actual manufacturing activities.

ISO 22000 for Food Processing Businesses

Food processors can face different risks depending on their products.

Examples include:

• Meat processing
• Seafood processing
• Dairy products
• Frozen foods
• Bakery products
• Sauces
• Ready-to-eat foods
• Beverages
• Processed agricultural products

The FSMS should identify hazards specific to the products and processes rather than relying on generic controls.

ISO 22000 for Malaysian Food and Beverage Companies

The Malaysian food and beverage sector includes manufacturers, processors, restaurants, catering companies, beverage producers and food-service businesses.

Relevant FSMS controls can include:

• Supplier management
• Receiving
• Storage
• Food preparation
• Production
• Temperature control
• Cleaning
• Personal hygiene
• Allergen management
• Packaging
• Transportation
• Traceability

The certification scope should be based on the activities actually performed by the organization.

ISO 22000 for Seafood Businesses in Malaysia

Seafood businesses can face significant food-safety and supply-chain risks.

Depending on the operation, an FSMS may address:

• Supplier and landing-site controls
• Receiving temperatures
• Cold storage
• Processing
• Cross-contamination
• Product identification
• Packaging
• Transportation
• Traceability
• Product testing
• Emergency response

This can be particularly relevant to seafood-processing businesses serving domestic and export markets.

ISO 22000 for Cold-Chain and Food Logistics Businesses

Food safety does not stop when a product leaves a factory.

Cold-chain and logistics companies can influence food safety through:

• Temperature-controlled storage
• Refrigerated transportation
• Loading and unloading
• Product segregation
• Vehicle hygiene
• Temperature monitoring
• Equipment maintenance
• Traceability
• Emergency arrangements

For these businesses, the certification scope should clearly define the logistics activities included in the FSMS.

ISO 22000 for Malaysian Food Exporters

Export businesses may have to satisfy requirements from customers, destination markets and relevant authorities.

An FSMS can provide structured controls for:

• Product specifications
• Supplier information
• Traceability
• Testing
• Product release
• Documentation
• Customer complaints
• Product recall
• Corrective action

Malaysia's Ministry of Health also operates food-safety assurance and export-related activities. Its published export compliance material references food-safety assurance programmes including HACCP and GMP.

ISO 22000 should therefore be viewed as part of an exporter's wider compliance system, not as a replacement for destination-country requirements.

ISO 22000 for Halal Food Businesses

Malaysia has a significant halal food market.

However, ISO 22000 and halal certification should not be presented as equivalent.

ISO 22000 focuses on food-safety management.

Halal certification addresses halal requirements under the applicable Malaysian halal certification framework.

Where customers or markets require both, an organization should manage the two sets of requirements appropriately.

ISO 22000 for Food Packaging Businesses

Food-contact packaging can form an important part of the food chain.

Depending on its role, a packaging organization may need controls covering:

• Raw materials
• Supplier approval
• Production hygiene
• Contamination prevention
• Product specifications
• Storage
• Traceability
• Customer requirements

The FSMS scope should clearly describe the organization's role in the food chain.

ISO 22000 Business Locations in Malaysia

Malaysia's food manufacturing, processing, distribution and food-service activities are spread across multiple states and industrial centres.

Location itself does not determine ISO 22000 applicability. The organization's activities and intended scope do.

Selangor and Shah Alam

Selangor has extensive manufacturing, warehousing, logistics and commercial activity.

Relevant business areas include:

• Shah Alam
• Klang
• Port Klang
• Petaling Jaya
• Subang Jaya
• Puchong
• Rawang
• Sepang

Food manufacturers, processors, distributors and logistics companies in these areas can consider ISO 22000 according to their operational and customer requirements.

Kuala Lumpur

Kuala Lumpur has significant food-service, hospitality, catering, trading and distribution activity.

Potential applications include:

• Catering
• Food service
• Hospitality
• Food distribution
• Food trading
• Central kitchens

The FSMS scope should correspond to the organization's actual activities.

Penang

Penang has substantial manufacturing and supply-chain activity.

Relevant locations include:

• George Town
• Bayan Lepas
• Butterworth
• Perai
• Bukit Mertajam

Food manufacturers and related businesses can consider ISO 22000 where a structured FSMS is commercially or operationally appropriate.

Johor

Johor is an important location for manufacturing, logistics and international trade.

Relevant areas include:

• Johor Bahru
• Pasir Gudang
• Kulai
• Senai
• Iskandar Puteri

Food manufacturers, processors, exporters, warehouses and logistics providers can evaluate ISO 22000 according to their activities.

Negeri Sembilan

Important industrial and business locations include:

• Seremban
• Nilai
• Sendayan
• Port Dickson

Food and manufacturing organizations in these areas can develop their FSMS around their actual food-safety risks.

Perak

Relevant business areas include:

• Ipoh
• Taiping
• Kampar
• Manjung

Potential applications include food manufacturing, agricultural processing, food distribution and related businesses.

Kedah

Relevant locations include:

• Alor Setar
• Sungai Petani
• Kulim

Food manufacturing and agro-based organizations can consider ISO 22000 where it fits their operational and customer requirements.

Melaka

Melaka includes manufacturing, hospitality, tourism and food-service businesses.

Relevant locations include:

• Melaka City
• Alor Gajah
• Batu Berendam
• Jasin

Sabah

Sabah has food, seafood, agricultural, hospitality and distribution activities.

Relevant locations include:

• Kota Kinabalu
• Sandakan
• Tawau
• Lahad Datu

Seafood processors and temperature-controlled businesses may have particular traceability, storage and transportation considerations.

Sarawak

Sarawak has food processing, agriculture, hospitality, manufacturing and distribution activity.

Relevant locations include:

• Kuching
• Miri
• Bintulu
• Sibu

The appropriate ISO 22000 scope depends on the organization's products and food-chain activities.

How to Establish an ISO 22000 FSMS in Malaysia

A practical implementation can be approached in stages.

1. Define the Food-Chain Activities

Identify exactly what the organization manufactures, processes, stores, transports or supplies.

2. Define the FSMS Scope

Identify the relevant:

• Products
• Processes
• Sites
• Departments
• Food-chain activities

3. Identify Applicable Malaysian Requirements

Review the legal and regulatory requirements relevant to the business.

This may include applicable provisions of the Food Act 1983, Food Regulations 1985, Food Hygiene Regulations 2009 and other requirements relevant to the organization's activities.

4. Conduct a Gap Assessment

Compare existing practices with ISO 22000 requirements.

Existing HACCP, GMP or MeSTI arrangements can provide useful information during this stage, but they should not be assumed to cover every ISO 22000 requirement.

5. Establish Prerequisite Programmes

Develop operational conditions appropriate to the organization's food-safety risks.

6. Perform Hazard Analysis

Identify relevant biological, chemical, physical and other food-safety hazards.

7. Establish Operational Controls

Define how significant hazards are controlled, monitored and verified.

8. Establish Traceability

Ensure the organization can identify relevant inputs, processes and outputs.

9. Prepare Emergency Arrangements

Consider incidents such as:

• Power failure
• Refrigeration breakdown
• Flooding
• Fire
• Contamination
• Water problems
• Equipment failure
• Supplier disruption

10. Conduct Internal Audit

Evaluate whether the FSMS is implemented and effective.

11. Conduct Management Review

Top management should review FSMS performance and determine necessary actions.

12. Certification Audit

The organization can then proceed through the applicable independent certification process.

ISO 22000 Certification Cost in Malaysia

There is no single price applicable to every Malaysian organization.

The certification cost can depend on factors such as:

• Number of employees
• Number of sites
• Certification scope
• Food-chain category
• Operational complexity
• Number of shifts
• Existing FSMS
• Outsourced processes
• Audit duration
• Multi-site arrangements

A small food business and a large multi-shift manufacturing facility should not be expected to have identical certification requirements or costs.

For an accurate quotation, the certification provider needs sufficient information about the organization and intended scope.

How Long Does ISO 22000 Certification Take in Malaysia?

The implementation period depends on the organization's starting point.

A company that already has mature:

• HACCP controls
• GMP practices
• MeSTI arrangements
• Documented procedures
• Traceability
• Internal audits
• Corrective-action systems

may have useful foundations.

However, existing food-safety certification does not automatically mean that all ISO 22000 requirements have been implemented.

A gap assessment should determine the actual preparation needed.

Benefits of ISO 22000 for Malaysian Businesses

More Systematic Food-Safety Management

The organization has a structured framework for identifying and controlling food-safety risks.

Improved Traceability

Documented traceability arrangements can make investigations and product withdrawals more manageable.

Better Supplier Control

Food-safety criteria can be incorporated into supplier selection and monitoring.

Stronger Customer Confidence

Certification can provide independent evidence that the organization's FSMS has been assessed against the applicable standard.

Support for International Supply Chains

ISO 22000 can provide a common food-safety management framework for businesses working with international customers, subject to destination-market requirements.

Improved Internal Accountability

Responsibilities and monitoring arrangements become clearer across production, procurement, warehousing, quality and management functions.

Continual Improvement

Audits, corrective actions, verification and management review provide a structured improvement cycle.

Accreditation and ISO 22000 Certification in Malaysia

Accreditation and certification are different activities.

Certification involves assessment of an organization's management system.

Accreditation provides independent recognition of a conformity-assessment body's competence for specified activities and scopes.

When a customer specifically requires accredited ISO 22000 certification, a Malaysian organization should verify the certification body's current accreditation status and applicable scope rather than relying only on a general statement that the provider is “accredited”.

Malaysia's Ministry of Health also publishes information concerning accredited certification bodies and FSMS-related auditor arrangements under the relevant accreditation framework.

What Malaysian Businesses Should Prepare Before ISO 22000 Certification

Before contacting a certification body, it is useful to prepare basic information about the organization.

This can include:

• Company name and activities
• Product categories
• Number of employees
• Number of locations
• Production activities
• Storage arrangements
• Transportation activities
• Existing HACCP or GMP systems
• Existing MeSTI status
• Export activities
• Intended certification scope
• Customer requirements

This information helps establish a more realistic certification route.

Why the Right ISO 22000 Scope Matters

The scope should describe what the organization actually does.

For example, a food manufacturer may require a scope covering:

• Manufacturing
• Processing
• Packaging
• Storage

A cold-chain business may require a scope covering:

• Storage
• Distribution
• Transportation

A catering company may require a scope covering:

• Food preparation
• Cooking
• Packaging
• Transportation
• Catering services

The certificate should accurately represent the organization's activities.

Get ISO 22000 Certified in Malaysia with SCS

For Malaysian food businesses, ISO 22000 should be approached as a practical Food Safety Management System rather than simply a documentation exercise.

The right approach starts with the organization's actual activities, products, sites, food-safety hazards, Malaysian legal requirements and customer expectations.

Whether your business operates in Selangor, Kuala Lumpur, Penang, Johor, Negeri Sembilan, Perak, Kedah, Melaka, Sabah or Sarawak, SCS can discuss the intended ISO 22000 certification scope and requirements.

http://www.scscertification.com/contactus.php