Many businesses buy an “ISO + permit” package as if it were one job. In fact these are two different doors, with two fees and two dossiers: ISO (14001, 22000…) are system certifications issued by certification bodies, which are independent assessors and not licensing authorities, on a voluntary basis. Environmental permits and food safety certificates are administrative procedures issued by government agencies to facilities that must hold them.
Short answer: holding an ISO certificate does not mean holding a government permit, and the reverse is also true. ISO assessment teams do not issue permits; government agencies do not issue ISO certificates. This article separates the two doors, points out the common mix-ups, and helps a business decide when it needs both.
Why is ISO often confused with a permit?
Both are “certificates”, both relate to how a facility operates, and many consultants sell them as one bundle. But they differ in four respects:
| ISO (14001, 22000…) | Government permit (environment, ATTP…) | |
|---|---|---|
| Who issues it | A registered certification body (an independent organization, not a licensing authority) | A competent government agency for each field |
| Is it mandatory | No. Voluntary under the Law on Standards and Technical Regulations 68/2006/QH11, as amended by Law 70/2025/QH15, unless a contract, customer or tender requires it | Mandatory for facilities within the scope of the specialized law |
| What it assesses | Whether the management system operates as the standard requires (procedures, records, objectives, improvement) | Whether the facility or product meets the conditions set by law |
| If it fails | Certificate is not granted, or is suspended or withdrawn under the certification body’s rules | Handled under the specialized law of each field |
Three questions to ask before “doing ISO”:
- Which door is asking? A tender, a customer, or a government agency? Each needs a different document.
- Which system? Quality, environment, safety or food. There is no single certificate for everything.
- Which scope? One site, one industry. A branch at a different location usually needs an assessment or a separate permit. For how to read the scope on a certificate, see the article ISO certification scope.
If the government permit is still missing, ISO cannot make up for it. One situation to avoid: displaying an ISO 14001 certificate on the wall while the environmental permit dossier is incomplete. Customers read the certificate; inspectors read the permit in the file.
ISO 14001 and the environmental permit: two tasks, two schedules
The environmental permit is a government procedure under the Law on Environmental Protection 72/2020/QH14 and Decree 08/2022/NĐ-CP, as amended and supplemented by Decree 05/2025/NĐ-CP and Decree 48/2026/NĐ-CP. The permit answers two questions: is the facility required to obtain a permit, and is it allowed to operate and discharge as permitted.
ISO 14001 is the standard for environmental management systems. Assessors ask about how the organization is managed: significant environmental aspects, reduction targets, incident response, and evaluation of compliance with legal obligations. ISO 14001 does not grant a facility the right to discharge.
The two run in parallel, each on its own schedule: the permit follows its validity period and the requirements of the government agency; ISO 14001 follows the certification cycle, with annual surveillance audits (see the 3-year ISO certification cycle). The update to ISO 14001:2026, and how a plant reconciles it with its environmental permit, is covered separately in ISO 14001:2026: how plants update their environmental system.
ISO 22000, HACCP and the food safety certificate (ATTP)
For food, government procedures follow Decree 15/2018/NĐ-CP. This is the text currently in force; Decree 46/2026/NĐ-CP, which replaces it, is temporarily suspended by Resolution 15/2026/NQ-CP:
- Facility door: the food safety eligibility certificate. See the food safety eligibility certificate for facilities.
- Product door: self-declaration, or registration of the product declaration, as required.
HACCP, ISO 22000 and FSSC 22000 are voluntary system certifications issued by certification bodies. The link between the two doors is Point k, Clause 1, Article 12 of Decree 15/2018/NĐ-CP: a facility holding a valid GMP, HACCP, ISO 22000, IFS, BRC, FSSC 22000 or equivalent certificate is not required to obtain an ATTP certificate. It must still ensure food safety conditions, and a system certificate cannot replace the product door.
| HACCP / ISO 22000 certification | ATTP eligibility certificate | |
|---|---|---|
| Nature | System certification, voluntary (HACCP follows Codex principles; ISO 22000 is an international standard that uses HACCP as its core) | Administrative procedure for facilities within scope |
| Who issues it | Certification body | Government regulator for the sector |
| Relation between the two | A valid certificate means the facility is not required to obtain an ATTP certificate (Point k, Clause 1, Article 12, Decree 15/2018/NĐ-CP) | Cannot replace the ISO 22000 or HACCP requirements of customers, supermarket chains or export contracts |
For how to choose between HACCP, ISO 22000 and FSSC 22000 by customer and scale, see ISO 22000, HACCP or FSSC 22000: what food businesses should choose.
What to prepare to identify the right door?
Before choosing a permit, ISO, or both, a business should assemble a short set of information. It helps the advisor and the certification body answer quickly and avoids redoing work:
| Information group | Used to determine |
|---|---|
| Industry, products, production scale, and the address of each facility | Whether the facility must hold an environmental permit or an ATTP certificate |
| Government permits and certificates held (copies, validity dates) | Which government procedures are complete and which are missing |
| ISO and HACCP certificates held (scope, site, expiry date) | Whether the certificates are still valid and cover the right facility and products |
| Written requirements from customers, supermarket chains or tender invitations | Which standard and version the customer needs |
Once these four groups are clear, separating the work is simple: which parts are procedures with government agencies, which are voluntary certifications required by customers, and which the business already has and only needs to maintain.
Common pitfalls and how to handle them
- Buying an “ISO + permit” package as one job. How to handle it: separate the two items from the start, ask the advisor who does which part, and get a separate quote for each.
- Pursuing ISO before the base permit is in place. How to handle it: review the legal status (environmental permit, ATTP certificate) before inviting a certification body to assess.
- Forgetting the ISO surveillance schedule while keeping the certificate on display. How to handle it: put surveillance and recertification dates in the annual calendar, alongside the government permit renewal dates.
- A new branch reusing the head office’s permit or certificate. How to handle it: check the scope written on each document. Both government permits and ISO certificates are tied to a specific facility and location.
- Not distinguishing the facility door from the product door in ATTP. How to handle it: list each product, check Decree 15/2018/NĐ-CP for which products require self-declaration, and whether the facility itself is within the scope for a certificate.
How Thái Tín can help
Thái Tín receives information about the industry, products and the requirements of customers or tenders, and helps the business determine which door to open first: a government permit, an ISO certificate, or both. We connect the business with environmental consultants, ATTP consultants and certification bodies that suit its industry. Assessment and issuance of government permits are decided by government agencies; assessment and issuance of ISO certificates are decided by certification bodies. Thái Tín is the coordinating point and tracks progress within the agreed scope.
Costs include consulting fees (if a consultant is engaged), government fees and charges (if any), and certification assessment fees charged by the certification body (if ISO is pursued). We provide a quote once the industry, scale and the door the business needs are clear. See also ISO 9001 certification: what a business needs to prepare, ISO 45001, 50001, 27001: when to use them and ISO, standards and certification services.
Next step: send the industry, products and the specific requirements from your customer or tender dossier, and we will check which door you need to open first.
Questions and answers
Will an environmental inspection team accept ISO 14001 certification in place of an environmental permit?
No. Facilities that must hold an environmental permit under the Law on Environmental Protection 72/2020/QH14 (Luật Bảo vệ môi trường) and Decree 08/2022/NĐ-CP (as amended and supplemented by Decree 05/2025/NĐ-CP and Decree 48/2026/NĐ-CP) must present a permit issued by a government agency. ISO 14001 is a voluntary certification of how an organization manages environmental matters. It has value for customers and supply chains but cannot replace the permit.
If a facility already has a food safety certificate (ATTP), does it still need ISO 22000 or HACCP?
It depends on who is asking. If a government agency inspects, it reviews the food safety certificate, or a valid ISO 22000, HACCP, GMP or similar certificate, because a facility holding these certifications is not required to obtain an ATTP certificate under Point k, Clause 1, Article 12 of Decree 15/2018/NĐ-CP. If a customer, a supermarket chain or an export contract requires ISO 22000, a food safety certificate cannot meet that requirement.
Are HACCP and ISO 22000 the same thing?
No. HACCP is a set of principles for hazard analysis and control of critical control points under Codex. HACCP certification is issued by a certification body and is voluntary. ISO 22000 is an international standard for food safety management systems. It uses HACCP principles as its core and adds management requirements; it is also a voluntary certification. Under Decree 15/2018/NĐ-CP, a facility holding either valid certification is not required to obtain an ATTP certificate.
A new business: should it obtain the permit or the ISO certificate first?
Complete the mandatory legal procedures first. ISO assesses a system that is already operating; it cannot fill the gap for a facility that has no legal foundation. Once the base permit is in place, ISO certification helps the business meet the requirements of customers, supply chains or tender dossiers.
Can a new branch reuse the permit or ISO certificate of the head office?
Usually not, depending on the scope of each type. Environmental permits and ATTP certificates are issued for each specific facility. ISO certificates also state the site that was assessed. A branch at a different location usually needs an extended scope assessment or its own certification, depending on the rules of the certification body.
Legal basis · verification date
Verified 2 October 2026 · next review 30 December 2026. The content is general guidance and does not replace advice for a specific case.
- Law on Standards and Technical Regulations No. 68/2006/QH11 (Luật Tiêu chuẩn và quy chuẩn kỹ thuật), amended and supplemented by Law No. 70/2025/QH15 (effective 01/01/2026): standards, including ISO standards, are applied voluntarily; technical regulations are mandatory.
- Law on Environmental Protection No. 72/2020/QH14 and Decree 08/2022/NĐ-CP detailing a number of its articles, amended and supplemented by Decree 05/2025/NĐ-CP (issued 06/01/2025) and Decree 48/2026/NĐ-CP (issued 29/01/2026): an environmental permit is a procedure issued by a government agency to facilities within its scope.
- Decree 15/2018/NĐ-CP detailing the Law on Food Safety (Luật An toàn thực phẩm): Articles 11 and 12 (facilities subject to licensing, and facilities not required to obtain an ATTP certificate, including Point k, Clause 1, Article 12 on facilities holding a valid GMP, HACCP, ISO 22000, IFS, BRC, FSSC 22000 or equivalent certificate). The text currently in force: Decree 46/2026/NĐ-CP (which replaces Decree 15/2018) is temporarily suspended by Resolution 15/2026/NQ-CP dated 06/04/2026.
- ISO 14001:2015 Environmental management systems — Requirements (iso.org); the revised ISO 14001:2026 as announced by certification bodies (DNV, TÜV SÜD, DEKRA, SGS; accessed 30/9/2026), with a 3-year transition period.
- ISO 22000:2018 Food safety management systems — Requirements, and ISO 22000:2018/Amd 1:2024 (iso.org, accessed 30/9/2026).
