The FSSC 22000 certification process, step by step

Who does what in FSSC 22000 certification

Four parties take part. Foundation FSSC owns the scheme, writes the scheme documents and holds the agreement with every certification body allowed to audit against it. The certification body must hold that licence and must also be accredited for the scheme under ISO/IEC 17021-1 and ISO 22003-1 by an accreditation body; accreditation bodies are recognised internationally through the Global ACI arrangement, which took over from the IAF MLA and the ILAC MRA in January 2026. Your organisation owns the food safety management system and every record in it. A consultancy such as Sterling helps you design, implement and prepare that system; it cannot issue anything.

The certification body follows two rulebooks at once: the audit rules of ISO/IEC 17021-1 and ISO 22003-1, and Part 3 of the scheme, which adds conditions on timing, audit duration, unannounced visits and reporting.

Steps 1 to 5: the work on your side

Step 1: fix the scope and the food chain category

Start with what the certificate will describe: the products, processes and site, and the food chain category and sub-category they fall into. The category decides which ISO 22002 part applies alongside ISO 22002-100:2025, for example Part 1 for food manufacturing, Part 5 for transport and storage or Part 4 for packaging; brokers and traders in category FII work from ISO 22000 alone.

Step 2: gap analysis against all three components

Sterling's gap analysis compares the existing HACCP plan or ISO 22000 system with ISO 22000:2018, with the prerequisite programme standard for the category and with each additional requirement that applies to the site. The result is a dated action list with owners, including any works or laboratory arrangements with long lead times.

Step 3: implement

The prerequisite programmes are rewritten to the 2025 standards, hazards are analysed and control measures validated, and the assessments the scheme requires are carried out by competent people: food defence, food fraud mitigation and allergen risk. A food safety and quality culture plan with targets and timelines is agreed. Our guide FSSC 22000 additional requirements explained, one by one takes each topic in turn.

Step 4: operate and accumulate records

The certification body audits a system that runs, not one that has only been written. Monitoring, PRP inspections, environmental monitoring results and change-over checks need enough history to show a pattern and a response.

Step 5: internal audit and management review

An internal audit covering the whole scope, including the additional requirements, and a management review that acts on its results close the preparation.

Step 6: engage a licensed certification body

Check the licence with Foundation FSSC and the accreditation in the accreditation body's own directory, then look at how the audit time was worked out. The scheme sets it in two parts: a base duration calculated under ISO 22003-1 from the category, the number of HACCP studies and the headcount, plus a scheme component of half a day to a day and a half that grows with the number of full-time employees and HACCP studies. No reduction below the calculated figure is allowed, and the processing categories C, D and K carry a minimum duration. The price side of the quotation is covered in FSSC 22000 certification cost: what moves the price.

Apply while implementation is still in progress; the application review is what sets your Stage 1 date.

Steps 7 and 8: Stage 1 and Stage 2

The initial certification audit has two stages, both announced. Stage 1 is the certification body's readiness review: the auditor examines the documented system and the scope, and judges whether the site is prepared for Stage 2. Stage 2 then evaluates whether the system is implemented and effective across the scope, on the production floor, in the records and in interviews with the people who run each process. The scheme allows no more than six months between the two stages, so a Stage 1 report that raises concerns has to be dealt with promptly.

Steps 9 and 10: findings, the decision and the register

Stage 2 findings are graded in three levels: minor, major and critical. Minor and major findings are closed with a correction and a corrective action that the certification body accepts within the periods the rules set; a critical nonconformity leads to suspension of the certificate. Once the findings are dealt with, the certification body takes the certification decision, and that decision is the start of the three-year cycle.

The certification body then uploads the audit pack to the Foundation's Assurance Platform, including the audit report, the plan, the duration calculation and the nonconformity reports. The certificate is published on the FSSC public register, updated daily, and Public Register Plus notifies subscribing buyers automatically when a certificate's status changes, so a suspension reaches your customers quickly.

Steps 11 and 12: surveillance, the unannounced visit and recertification

FSSC 22000 surveillance is heavier than in many schemes. Every surveillance audit is a full system audit of all scheme requirements, held within each calendar year, with the first due within twelve months of the certification decision. A surveillance audit that is not held within the required timeframe leads to suspension. At least one surveillance audit in each three-year period is unannounced: the site agrees blackout days with the certification body in advance, receives no notice of the date, and the audit opens with an inspection of production within an hour of the auditor's arrival. Refusing the visit leads to suspension within three working days. The unannounced audit: how to be ready on any day covers the preparation.

Between audits the site must also tell the certification body within three working days when a serious event affects the food safety system, its legality or the integrity of the certificate. Recertification, again a full system audit, is best held at least three months before expiry.

Audits against Version 6 are allowed only until 30 April 2027; FSSC 22000 Version 7: what changed sets out the upgrade route for sites already certified.

How long the FSSC 22000 certification process takes

Sterling's experience is that the whole route, from scoping to the certification decision, typically takes six to twelve months. A certified ISO 22000 site with current prerequisite programmes sits at the short end; a site starting from a HACCP plan, or needing building works first, sits at the long end. The scheme itself fixes only part of the calendar: Stage 2 within six months of Stage 1, and the first surveillance within twelve months of the decision. The rest depends on how quickly records accumulate and on auditor availability.

FSSC 22000 certification process: questions buyers ask