hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us

FSSC 22000 · GFSI-recognised food safety certification scheme

FSSC 22000 certification consulting for GFSI-recognised food safety your buyers can verify.

Achieve FSSC 22000 certification with a certification body licensed by Foundation FSSC and accredited for the scheme, first time, before the buyer's deadline. Sterling's expert and experienced consultants build the three parts of the scheme as one working system: the ISO 22000 food safety management system, the ISO 22002 prerequisite programmes for your food chain category and the FSSC additional requirements, then prepare your site for the announced audits and the unannounced one, in 60+ countries. We ensure successful certification for our clients.

Book a free discovery callStart the free FSSC 22000 readiness check
  • One all-inclusive proposal for a fixed scope: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in a single proposal
  • A team of expert and experienced food safety consultants, advising on management systems across sectors and countries since 2003
  • The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides

8,100+ client engagements in 60+ countries.

FSSC 22000 client experience
  • Allianz
  • Emirates Flight Catering
  • Etihad Rail
  • Haier
  • Whirlpool
  • Emerson
  • Olam
  • Piramal Pharma Solutions

What it is

What is FSSC 22000 and what is it used for?

FSSC 22000 is a certification scheme, not a standard. Foundation FSSC owns it, its Board of Stakeholders governs it, and licensed certification bodies audit against it. The scheme document names three normative parts: ISO 22000:2018, the international food safety management system standard; the prerequisite programme standard of the ISO 22002 series that matches your food chain category, used with the common baseline ISO 22002-100; and the FSSC 22000 additional requirements, eighteen topics in Version 7 that the ISO texts do not reach, such as food defence, food fraud mitigation, allergens, environmental monitoring, culture and food loss and waste.

The scheme exists because ISO 22000 on its own is not recognised by the Global Food Safety Initiative, and many retailers and brand owners write "GFSI-recognised certification" into their supplier programmes; FSSC 22000 has carried that recognition since 2010. A certificate covers a defined scope within one food chain category and is published on the Foundation's public register, where a buyer can check its status.

Current version. FSSC 22000 Version 7 was published by Foundation FSSC on 1 May 2026 and replaces Version 6 of 2023. Audits against Version 6 are allowed until 30 April 2027; upgrade audits to Version 7 are conducted from 1 May 2027 to 30 April 2028, and any Version 6 certificate still open after 30 June 2028 is set to withdrawn. Version 7 adopts the ISO 22002-x:2025 prerequisite programme series with the new common baseline ISO 22002-100:2025, aligns the scheme with the GFSI Benchmarking Requirements v2024, sharpens the food chain categories and revises the additional requirements. ISO is preparing a third edition of ISO 22000, with no publication date announced. FSSC 22000 Version 7: what changed and what to do about it

Who it is for

Who needs FSSC 22000 certification?

The scheme covers the food chain after primary production, from food and feed manufacturing to catering, retail, trading, transport and storage, packaging and (bio)chemicals; farming sits outside it. Four situations bring organisations to Sterling for FSSC 22000:

  • A retailer, brand owner or export customer specifies a GFSI-recognised certificate. The questionnaire names FSSC 22000, BRCGS, SQF or IFS and nothing else will pass supplier approval. We confirm the category, the ISO 22002 part and the certification body the customer will accept at the outset.
  • You hold ISO 22000 or a HACCP certificate and the buyer has said it is not enough. Nothing is wasted. The ISO 22000 system carries over; the work is the sector PRP standard, the additional requirements and the audit discipline the scheme adds, including the unannounced audit.
  • A packaging, ingredient, feed, logistics or trading business is being pulled into a food customer's assurance programme. The scheme has categories for packaging and (bio)chemical producers, feed, transport and storage and even brokers and traders, who are audited on ISO 22000 and the additional requirements without a PRP standard.
  • A group wants one certificate across several sites. Multi-site certification brings a central function, qualified internal auditors, site sampling by the certification body and one consequence for all sites when one fails.

Business benefits

How FSSC 22000 opens accounts, protects the brand and keeps the site audit-ready every day

The commercial reason is access: the scheme is the route many buyers accept for supplier approval. The operational reason is that the additional requirements force decisions most sites have postponed: who could deliberately contaminate the product, which raw material could be substituted for profit, which allergen could cross to the next run.

  • Supplier approval that closesA certificate within a GFSI-recognised scheme, with scope, category and status verifiable on the public register, so the customer can approve you without a second-party audit.
  • One system for every customer standardISO 22000 as the management system, the ISO 22002 part as the site standard and the additional requirements as the buyer's extras, in one set of procedures.
  • Food defence and food fraud under controlThreat and vulnerability assessments made by people with the competence to make them, with mitigation plans that purchasing, security and production own.
  • Allergen and environmental risks managed on evidencePrecautionary labels used only where the risk assessment justifies them, and a monitoring programme that finds a pathogen in the environment before it is found in the product.
  • A culture the auditor can measureCulture objectives with a documented plan, targets and timelines, supported by communication, training, employee feedback and performance measurement.
  • Ready for an audit nobody announcedRecords completed at the time and kept live, so an auditor arriving without notice finds the same site as the announced audit.

Requirements

What are the main FSSC 22000 requirements?

An FSSC 22000 audit tests three documents at once: ISO 22000:2018 clauses 4 to 10, the applicable ISO 22002 prerequisite programme standard with ISO 22002-100, and Part 2 of the scheme, whose section 2.5 lists the additional requirements. The table is a plain-language map; several requirements apply only to certain categories, so each is checked against yours during the programme.

Scheme elementWhat it requires of youWhat it looks like in practice
ISO 22000:2018 Clauses 4–7, 9 and 10: the management systemDefine the scope and context, commit leadership and a food safety team, plan objectives and change, provide competence and documented information, audit internally, review at management level and improveA scope in the scheme's category terms, a team leader with authority, an internal audit that also covers the additional requirements
ISO 22000:2018 Clause 8: operationEstablish PRPs, traceability and emergency response; analyse hazards, validate control measures, run the hazard control plan with its OPRPs and CCPs, monitor, verify and control unsafe product up to recallFlow diagrams confirmed on the floor, validated limits, monitoring recorded as the check is made, a timed mock recall
ISO 22002-100:2025 and the ISO 22002-x:2025 part for your categoryApply the common PRPs of the food, feed and packaging chain together with the sector part: Part 1 food manufacturing (also pre-process handling of plant products and (bio)chemicals), Part 2 catering, Part 4 packaging, Part 5 transport and storage, Part 6 feed, Part 7 retail and wholesale; brokers and traders have no PRP partPremises, utilities, cleaning, pest control, personnel hygiene, rework, storage and transport written to the 2025 editions, not the retired technical specifications
Additional requirements 2.5.1–2.5.5 Services and purchased materials, labelling and printed materials, food defence, food fraud mitigation, logo useControl services, suppliers and laboratories; validate claims and manage artwork; assess threats and vulnerabilities with competent people and keep mitigation plans; use the logo as permittedApproved supplier lists, a laboratory with proficiency testing or ISO/IEC 17025 accreditation, claim evidence, artwork approval, assessments with owners and review dates
Additional requirements 2.5.6–2.5.9 Allergens, environmental monitoring, food safety and quality culture, quality controlAssess allergen cross-contact and label only where the risk warrants it; run a risk-based monitoring programme for pathogens, spoilage and indicator organisms; set culture objectives and a plan; keep quality parameters, change-over checks and quantity controlAn allergen risk assessment kept current, swab results acted on, a culture plan with targets and timelines, change-over records
Additional requirements 2.5.10–2.5.14 Transport, storage and warehousing, cross-contamination measures, PRP verification, product design and development, traceabilityRotate stock on FEFO and FIFO principles; control functional packaging effects; inspect site and equipment routinely against the PRPs; design products, packaging and cooking instructions on validated grounds; trace edible carcass parts in primary conversionStock rotation records, monthly PRP inspections with actions, validation files for shelf life and cooking instructions
Additional requirements 2.5.15–2.5.18 Equipment management, food loss and waste, communication requirements, multi-site certificationPurchase and commission equipment on hygienic design specifications under change management; hold a policy and objectives to reduce food loss and waste; inform the certification body within three working days of a serious event; for groups, run a central function with qualified internal auditorsPurchase specifications and commissioning evidence, a food loss and waste register, a notification procedure, internal auditors who meet the scheme's qualifications

What does useful FSSC 22000 evidence look like?

A scope statement in the scheme's category language; PRPs mapped to ISO 22002-100 and the sector part, with the inspection that proves they hold; a hazard analysis the food safety team can defend; threat and vulnerability assessments signed by people who know the site; an allergen risk assessment that justifies every precautionary label; environmental monitoring results trended and acted on; a culture plan with dated targets; and records readable on the day of an unannounced visit, each a register in Effivity with owners, dates and attachments.

FSSC 22000 additional requirements explained, one by one

Certification process

How do you get FSSC 22000 certified?

The scheme is delivered only by certification bodies that hold a licence agreement with Foundation FSSC and accreditation for the scheme under ISO/IEC 17021-1 and ISO 22003-1; promoting FSSC services without a licence is prohibited. Sterling prepares your organisation and builds the system with your team; the certification body audits and decides, and the Foundation's public register and integrity programme make the certificate worth having.

  1. 01
    Define the scope, category and prerequisite standard.Products, processes, sites and headcount; the food chain category and sub-category; the ISO 22002 part that applies; the certification body your customer accepts.
  2. 02
    Gap analysis: review the current system against the three components.The existing HACCP or ISO 22000 system, the PRPs against the 2025 standards and each applicable additional requirement, with actions, owners, dates and any works agreed up front.
  3. 03
    Implement and generate evidence.Update the PRPs, validate and run the hazard control plan, complete the food defence, food fraud and allergen assessments, set the culture plan and start the records in daily production.
  4. 04
    Verify, audit and review.PRP verification inspections, a mock recall, an internal audit covering all three components and a management review, with findings raised by us first and closed.
  5. 05
    Pass the licensed certification body's audits.Stage 1, the readiness review, then Stage 2 on site within six months of it; respond to any findings, graded minor, major or critical, and await the decision and the register entry.
  6. 06
    Stay certified through the cycle.A full surveillance audit within twelve months of the decision and every calendar year, at least one unannounced per three-year cycle, and recertification before expiry.

Check the route as carefully as the fee. Ask which certification body will audit, confirm it on the Foundation's list of licensed bodies and with its accreditation body, and ask how the audit duration was calculated: the scheme sets it under ISO 22003-1 plus its own component of half a day to a day and a half, and forbids reductions below the calculated time. An offer that skips implementation produces a certificate the customer will reject. How to choose a credible FSSC 22000 provider · The certification buyer's checklist

Cost

How much does FSSC 22000 certification cost?

There is no list price. A single-site manufacturer upgrading a certified ISO 22000 system and a packaging group building prerequisite programmes across three plants are different engagements. Every Sterling proposal is an all-inclusive proposal with each component in view.

Cost componentWhat affects it
Consulting and implementationWhether ISO 22000 or HACCP is already in place, the state of the PRPs against the 2025 standards, the applicable additional requirements, sites and products, and how much of the work your team carries (Design™ or Drive™)
Independent certificationThe licensed certification body's audit duration, set under ISO 22003-1 by category, HACCP studies, employees and sites plus the scheme's own component; annual surveillance including the unannounced audit; scheme fees; travel
Internal resourcesFood safety team and supervisor time, assessment workshops, laboratory testing and environmental monitoring, validation studies, hygienic design or zoning works, training hours
Software and learningIncluded in a Sterling engagement: Effivity for the food safety system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued supportUnannounced-audit readiness reviews, internal audits, mock recalls, refresher training and scheme version upgrades under Sustain™

What moves the price

  • Starting point: nothing, a HACCP plan, a certified ISO 22000 system or a Version 6 certificate
  • Category and sub-category, which decide the PRP part and the applicable additional requirements
  • Number of sites, products, lines and HACCP studies, and whether multi-site certification is wanted
  • Works the PRP standard exposes: hygienic design, segregation, monitoring capacity
  • Laboratory arrangements, artwork control and supplier management maturity

What a Sterling proposal always shows

  • Deliverables, responsibilities, assumptions and exclusions, in writing
  • Certification-body audit time and scheme fees identified separately, so the programme cost is comparable
  • Effivity, training and Academy access itemised at no additional cost
  • Payment milestones tied to deliverables, not to the calendar
  • One all-inclusive proposal. No surprises, ever

Timeline

How long does FSSC 22000 certification take?

Six to twelve months is the realistic range. The short end belongs to a site with a certified ISO 22000 system and prerequisite programmes already written to the ISO 22002 standards, where the work is the additional requirements and the audit discipline. The long end belongs to a site starting from a HACCP plan, or one whose PRPs need hygienic design or monitoring capacity that has to be installed. In between, records have to accumulate: an environmental monitoring programme needs results to trend and a culture plan needs a first measurement. The certification body then needs Stage 1 and Stage 2 within six months of each other.

PhaseWhat determines the pace
Scope, category and gap analysisAccess to the site and the process flows, the existing documentation, the last customer audit, and a quick decision on category, PRP part and certification body
PRPs, hazard control and the additional requirementsWorks the PRP standard needs, validation of control measures, the food defence, food fraud and allergen assessments, and laboratory arrangements
Operation and recordsProduction running under the system long enough for monitoring, PRP inspection, environmental monitoring and mock recall records to exist, then internal audit and review
Certification assessmentThe licensed certification body's availability, the interval between Stage 1 and Stage 2, and the time to close any findings before the decision

If a customer listing, a tender or a Version 6 audit expiry fixes the date, say so at the first call and we will build backwards from it, including the certification body's lead time. A certificate date promised by someone who has not asked which food chain category you are in is a sales figure, not a plan.

Challenges

Common FSSC 22000 implementation challenges

The scheme fails in predictable places; each has a practical answer.

The prerequisite programmes were written to the old technical specifications.

Version 7 requires the ISO 22002-x:2025 standards with ISO 22002-100 as the baseline, and a PRP manual built on the retired texts leaves gaps an auditor finds quickly. We remap every PRP to the 2025 requirements and separate what a procedure fixes from what needs budget.

Food defence and food fraud assessments were downloaded, not done.

The scheme expects the threat and vulnerability assessments to be developed and maintained by people with the appropriate knowledge and competence; a template signed by the quality manager alone does not meet that. We run them as workshops with purchasing, security, production and quality.

Precautionary allergen labels are doing the work the controls should do.

Under the scheme a warning label is allowed only where the risk assessment identifies cross-contamination as a risk, and applying one does not excuse the site from control measures or verification testing. We rebuild the assessment from the line and remove labels that were never justified.

The site is ready for the announced audit and afraid of the unannounced one.

At least one surveillance audit in each three-year cycle arrives without notice, and the inspection of production starts within an hour of arrival. Records completed at month end cannot survive that. We move monitoring, PRP inspections and quality checks into Effivity so a missed check is visible the same day.

Several plants, one logo, no central function.

Multi-site certification needs a central function that controls the system, internal auditors with the experience and training the scheme sets, and a discipline that accepts one site's failure as the group's. We define the group system and give the central function one Effivity view across sites.

Your engagement

What your FSSC 22000 engagement includes

A Sterling engagement covers the whole route, from category and scope to the register entry, under one all-inclusive proposal and one accountable team.

  • Scope, category, gap analysis and implementation plan

    Category confirmed, the existing system reviewed against ISO 22000, the ISO 22002 part and each applicable additional requirement, with actions, owners and dates agreed before work starts.

  • Food safety system development and documentation

    PRPs to ISO 22002-100 and the sector part, hazard analysis and hazard control plan, and the additional-requirement procedures and registers, built with your people on Sterling's templates.

  • Effivity ISO & GRC software

    Your FSSC 22000 system runs in Effivity from day one, included with the engagement at no additional cost.

  • Training for everyone

    Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

  • Verification, internal audit and management review

    PRP verification inspections, a mock recall and a rehearsed unannounced-audit walk, then internal audit and management review, conducted or facilitated as agreed, with findings closed before the audit.

  • Certification readiness and support

    Preparation for Stage 1 and Stage 2, presence during the audits as agreed, help closing any findings, and support until the certificate appears on the public register.

Certification decisions remain with the independent certification body.

How we deliver

How Sterling supports your FSSC 22000 implementation

Every FSSC 22000 engagement runs on Sterling OS™, our delivery operating system: five phases, each with defined deliverables, decision owners and the evidence it must produce. Your team carries as much of the work as you choose; the method and the accountability do not change.

  1. 01
    Design™Guided implementation: your food safety team does the work, with Sterling's structure, templates and coaching, workshop by workshop.
  2. 02
    Drive™Fully managed consulting: Sterling consultants carry the agreed consulting and documentation work with your food safety team and supervisors.
  3. 03
    Sustain™After certification: unannounced-audit readiness reviews, internal audits, mock recalls, refresher and new-hire training, and surveillance preparation every year.
  4. 04
    Automate™The scheme in Effivity: PRPs, the hazard control plan, the additional-requirement registers, monitoring, audits and management review in one workspace.
  5. 05
    Revise™Version 6 to Version 7, ISO 22000 or HACCP to FSSC 22000, the coming third edition of ISO 22000, and changes to products, categories, sites or customers.

The engagement team, the weekly working session, the deliverables and the decision owners are fixed at kick-off and progress is measured weekly, so an unstarted vulnerability assessment is visible in month two, not at Stage 1.

How Sterling OS™ works

FSSC 22000 implementation

FSSC 22000 requirements

Get the document

We e-mail the document as a PDF link. Tell us who you are and where to send it.

A quick security check confirms the request comes from a person.

By requesting the document you agree to our privacy notice. Sterling uses these details to send it and to respond to your request. We never sell your data.

Effivity · FSSC 22000 software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of FSSC 22000 Version 7.

Every Sterling FSSC 22000 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope so the three parts of the scheme sit in one place: the ISO 22000 management system, the PRPs mapped to ISO 22002-100 and your sector part, and a register for each additional requirement. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.

Included in every engagementSee Effivity
Effivity food safety system: Context of the Organisation dashboard
Effivity · Context of the Organisation dashboard
Context of the organisation

Scope, category and interested parties

The certified scope in the scheme's category terms, the customers and their assurance programmes, regulators and the supply chain, reviewed on a schedule.

Leadership and planning

Policy, food safety team and culture objectives

The policy, the team and its leader, roles for hold, release and notification, and the culture objectives with their plan, targets and timelines, reported from the system.

Prerequisite programmes

PRPs to ISO 22002-100 and your sector part

Every PRP mapped to the requirement it satisfies, with its checks and records, and the routine site inspections the scheme requires as PRP verification, completed on the floor.

Hazard control

Hazard analysis and the hazard control plan

Flow diagrams, hazard assessment by step, OPRPs and CCPs, validation evidence, and monitoring against critical limits and action criteria, with corrections recorded at the time.

Food defence and food fraud

Threat and vulnerability assessments

Assessments with the people who made them, mitigation plans with owners and review dates, material vulnerability scores, and evidence of review after a change in suppliers or materials.

Allergens and environmental monitoring

Allergen management and the monitoring programme

The allergen risk assessment that justifies each label, cleaning validation and verification, and the environmental monitoring programme with results trended and acted on.

Performance evaluation

Verification, internal audit and management review

Verification schedules and results, calibration due dates, an internal audit programme covering all three components, and a management review with inputs, decisions and actions.

Improvement and communication

Nonconformities, complaints, waste and notifications

Audit findings, complaints, product holds and food loss and waste events raised, investigated and closed with root cause, and the serious-event notification to the certification body logged and dated.

What this means at the audit

An FSSC 22000 auditor arrives, announced or not, walks the production areas with the flow diagram, asks for the hazard analysis behind each control, opens the threat and vulnerability assessments, checks a day's monitoring and reads the culture plan and the last management review. Effivity holds each as a dated record with an owner and the evidence behind it, and Sustain™ runs in the same workspace after certification, so the unannounced audit finds a system that never paused.

Effivity for FSSC 22000: the guideEffivity food safety software on effivity.com

In your engagement

  • Subscription included with the engagement, at no additional cost
  • Configured by your Sterling consultant within the agreed scope
  • Your HACCP plan, PRP records and assessments migrated
  • Admin and user training for the food safety team and supervisors
  • Modules for QMS, EMS, OHSMS, ISMS and more for integrated systems

FSSC 22000 client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for FSSC 22000 are available on request. The client feedback wall lists every letter by standard.

How an FSSC 22000 programme runs

What an engagement looks like in practice.

All case studies
  1. 01

    Food and beverage manufacturing: food safety and consistency it can prove

    A food and beverage manufacturer was confident in its products but needed systems that could demonstrate they were safe and consistent. ISO 9001, ISO 22000 and FSSC 22000 brought firm food safety controls, allergen management and preventive risk reduction, lowering the likelihood of recalls and protecting consumers. Standard procedures in production, routine quality checks and analysis of data kept quality consistent and raised customer satisfaction; its plant manager called the change a turning point for the business.

    Read the case study

Sterling Academy · FSSC 22000 e-learning

Train every employee on the scheme, not just the food safety team.

Sterling Academy is e-learning built for a food site: short video lessons with checkpoints, a final exam and a numbered Certificate of Completion, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

Contact us about Academy accessSee the courses
  • FSSC 22000 and food hygiene awareness for every employee, with the competence evidence the scheme requires
  • Practitioner courses for the food safety team leader, supervisors and quality staff
  • Internal auditor training for your audit team, as applicable to your standard, as part of the engagement
  • Completion tracked by department and shift, with a status report ready on any day
  • New hires and seasonal workers trained as they arrive, so the record is current on any day
  • A Sterling consultant reachable when a learner has a question

Where we work

Where Sterling delivers FSSC 22000

Keep exploring

Explore more about FSSC 22000

Watch a video on how to implement FSSC 22000 here.
Watch a video on FSSC 22000 requirements here.

FSSC 22000 resources

Services for FSSC 22000

Industries

Why Sterling

Want successful FSSC 22000 certification? Come to Sterling.

Whether you run one line or plants in several countries, Sterling builds the scheme as a system production can live with and an auditor can test on any day, reconciling the customer's programme, national food law, the ISO 22002 part and the additional requirements for each site.

Food safety systems in 60+ countries since 2003

HACCP-based, ISO 22000 and scheme-ready systems for manufacturers, caterers, packaging producers and distributors, with one engagement team accountable in every country you operate in.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with audit time and scheme fees identified separately. No surprises, ever.

Built for the unannounced audit

Registers your supervisors actually complete, PRPs matched to your category and assessments your own people made, so the system is the same on the day nobody expected an auditor.

Expert and experienced consultants

Consultants who have built food safety management systems across sectors and countries since 2003 and know which additional requirements apply to your category, so the audit confirms a system that already works.

Sterling vs the rest: the full comparisonExplore FSSC 22000 client experience

The Sterling Promise

What our FSSC 22000 certification success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with your organisation until the agreed FSSC 22000 certification outcome is reached, through consulting, audit preparation and the closure of any findings the certification body raises. Plain explanations, practical delivery on the floor, and the software and learning included in the fee turn the programme into a capability your site keeps.

The engagement defines the scheme version, the scope and category, the outcome and each party's responsibilities. Your organisation supplies accurate information and runs the agreed controls. The licensed certification body audits and retains its certification decision. Our commitment concerns the agreed certification support; it does not warrant that no food safety incident will occur, that an unannounced audit raises no findings or that every customer approves you.

After certification

What happens after FSSC 22000 certification?

The certificate opens a three-year cycle in which every visit is a full system audit against all the scheme requirements. The first surveillance audit falls within twelve months of the certification decision and one follows in each calendar year; at least one surveillance audit in each three-year period is unannounced, with the plan shared only at the opening meeting. Refusing it suspends the certificate; a certified organisation may also choose to have every audit unannounced. Recertification is scheduled before expiry, preferably three months before; a surveillance audit missed within its window also leads to suspension.

Between visits the scheme keeps making demands: serious events must be reported to the certification body within three working days, and the assessments and the culture plan must be reviewed. Under Sterling OS™ Sustain™ we run the internal audits, mock recalls and readiness walks with you, keep the PRPs and the registers current as products change, and prepare each audit as if it were unannounced.

FAQs

Frequently asked questions about FSSC 22000

What is the difference between ISO 22000 and FSSC 22000?

ISO 22000 is a management system standard; FSSC 22000 is a certification scheme that uses it. An FSSC 22000 certificate means the organisation was audited against ISO 22000:2018, the ISO 22002 PRP standard for its category and the FSSC additional requirements, by a certification body licensed by Foundation FSSC, under the scheme's audit rules. ISO 22000 alone is not recognised by GFSI; FSSC 22000 is.

Is FSSC 22000 Version 7 recognised by GFSI?

FSSC 22000 has been benchmarked and recognised by GFSI since 2010, and Version 7 was written to align with the GFSI Benchmarking Requirements v2024. At the time of writing, GFSI's published list names FSSC 22000 Version 6 against its v2020 requirements; recognition of Version 7 is a matter for GFSI's benchmarking process, so check GFSI's list, or ask us, when a customer requirement turns on it.

Which food chain categories does the scheme cover?

Pre-process handling of plant products (BIII); animal primary conversion and the processing of perishable, mixed and ambient-stable products (C0 to CIV); feed and animal food (D); catering (E); retail, wholesale and e-commerce (FI); brokering and trading (FII); transport and storage (G); packaging material production (I); (bio)chemical production (K). GFSI's current recognition covers BIII, the C sub-categories, D, G, I and K; caterers, retailers and traders are certified under the scheme but sit outside that list at present.

What are the FSSC 22000 additional requirements?

Part 2 of the Version 7 scheme lists eighteen: management of services and purchased materials; product labelling and printed materials; food defence; food fraud mitigation; logo use; management of allergens; environmental monitoring; food safety and quality culture; quality control; transport, storage and warehousing; hazard control and measures for preventing cross-contamination; PRP verification; product design and development; traceability; equipment management; food loss and waste; communication requirements; and requirements for organisations with multi-site certification. Several apply only to particular categories.

What is the unannounced audit, and can we refuse a date?

After initial certification, at least one surveillance audit in each three-year period is unannounced. The site is not told the date, the plan is shared at the opening meeting and the auditor begins with an inspection of production within an hour of arriving. Blackout days are agreed with the certification body in advance; refusing the audit leads to suspension within three working days. The initial certification audit is always announced.

Does FSSC 22000 include a quality management system?

No. The FSSC 22000-Quality option was removed from the scheme in Version 6; in its place is a Quality Control additional requirement, which the Foundation describes as elements of quality control and not the equivalent of a quality management system. Sites that need one implement ISO 9001 alongside the scheme.

Does Sterling issue the FSSC 22000 certificate?

No. Sterling builds the system with you, trains your people and gets the site ready. A certification body licensed by Foundation FSSC and accredited for the scheme conducts Stage 1, Stage 2, the surveillance and unannounced audits, and makes the decision; the Foundation publishes the result on its register. Anyone offering consulting and the certificate on one invoice is offering paper.

We are certified to Version 6. What do we have to do, and by when?

Audits to Version 6 may be delivered until 30 April 2027. From 1 May 2027 to 30 April 2028 your certification body conducts a full upgrade audit against Version 7, announced or unannounced; after 30 June 2028 any remaining Version 6 certificate is withdrawn from the public register. Before the audit, move the PRPs to the ISO 22002-x:2025 standards and close the gaps in the revised additional requirements; a gap analysis against Version 7 sizes that work.

Can FSSC 22000 be integrated with ISO 9001, Halal or FSSC 24000?

Yes. ISO 22000 shares the harmonised structure with ISO 9001, ISO 14001 and ISO 45001, so context, leadership, documented information, internal audit and management review can be one system with the hazard control plan and the PRPs as the food safety core. Halal certification adds its own requirements and certifier. FSSC 24000, the Foundation's scheme for social management systems based on PAS 24000, is designed to integrate with FSSC 22000.

Before the first call

Prepare a useful FSSC 22000 readiness brief

No scheme documentation is needed before the first conversation; a plain description of the operation and of who is asking is enough. Seven questions:

  1. Who is asking, and in what words: FSSC 22000, "any GFSI-recognised scheme" or a specific certification body?
  2. Which products, processes and sites should the certificate cover, and which food chain category do you believe you fall in?
  3. What do you hold today: nothing, a HACCP plan or certificate, ISO 22000 or FSSC 22000 Version 6, and when does it expire?
  4. Were your prerequisite programmes written to the ISO 22002 standards, and to which edition?
  5. Have food defence, food fraud and allergen assessments been done, by whom, and when were they last reviewed?
  6. What do complaints, holds, customer audits and inspections say about the starting point, and which laboratory do you use?
  7. Who is on the food safety team, who can take decisions, and does a customer listing, tender or audit expiry fix the date?

With those answers we can size the work and put a realistic, all-inclusive proposal in front of you. It is groundwork for a conversation, not a scored assessment.

Don’t be fooled by certification scams

If it takes ten days, it is not FSSC 22000 certification.

An FSSC 22000 certificate is only worth what the customer can verify: a licensed and accredited certification body, the right category and an entry on the public register. The market sells the look of it: "FSSC 22000 certificates" from bodies with no licence and "GFSI certified" badges that GFSI does not issue. They are cheaper until the buyer looks up the register.

How to choose a credible FSSC 22000 provider

  1. Ask which certification body will issue the certificate and confirm it on Foundation FSSC's list of licensed bodies; selling FSSC services without a licence is prohibited.
  2. Confirm the body's accreditation for the scheme under ISO/IEC 17021-1 and ISO 22003-1 with the accreditation body itself, and whether it sits within the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA in January 2026.
  3. Ask how the hazard analysis and the assessments will be done. If nobody plans to walk your line and run the workshops with your people, the system will be someone else's with your name on it.
  4. Identify who carries each task, which audit and scheme costs are separate, and what support exists when an audit raises findings.
  5. Find out what your operators will be taught and where the records will be kept. Without training and a system, the registers stop the week the consultant leaves.
  6. Turn down "certified in 7 to 10 days", "GFSI certified", "we manage everything" and a single invoice for consulting and certificate. GFSI does not certify anyone; PRPs, validated controls and records must exist before any audit.
All ten warning signs of shortcut certification

Keep exploring

More on FSSC 22000 and related standards

Every FSSC 22000 guide

More in Food safety & agriculture

Talk to a consultant

Plan your FSSC 22000 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice