FSSC 22000 unannounced audit: how to be ready on any day of the year

What does the FSSC 22000 unannounced audit rule require?

The scheme requires every certified organisation to receive at least one surveillance audit without notice after initial certification, and at least one more in each three-year period that follows. Your certification body chooses the date, does not tell you in advance and keeps the audit plan to itself until the opening meeting.

Some points of the rule are often misread:

• Initial certification cannot be unannounced. Stage 1 and Stage 2 are scheduled with you; the surprise visit belongs to the surveillance years that follow the certificate.
• An unannounced visit is not a lighter check. Every FSSC 22000 surveillance is a full system audit covering all of the scheme requirements: ISO 22000, the ISO 22002 prerequisite programmes for your category and the additional requirements.
• A site may choose to take every surveillance and recertification audit unannounced.
• The upgrade audit to Version 7 can itself be the unannounced one where the three-yearly requirement calls for it. The Version 7 guide covers the upgrade timetable.

Blackout days and the arrival protocol

Blackout days are dates you agree with the certification body beforehand on which a surprise visit will not take place. Sensible candidates are dates when the site will not be producing, such as a planned shutdown or a closure for works; your certification body confirms which reasons and how many days it accepts. Agree them in writing and keep the list short. Outside those dates, the auditor can arrive on any working day.

What happens in the first ten minutes is decided long before the auditor reaches the gate. A written arrival protocol settles it:

• Reception: security or reception staff know the certification body's name, check the auditor's identity and call one named contact, not whoever happens to pass.
• Host and deputies: the food safety team leader hosts, with two named deputies for leave, night shifts and weekends. An absent team leader is not a reason to turn the visit away.
• Entry to production: hygiene rules, protective clothing and visitor health screening for the auditor are the same as for any visitor, and they are ready at the door.
• Documents: the deputy knows how to open every register in the system, including those of absent colleagues.

Test the protocol: a guard who does not know what an FSSC 22000 auditor is, or a supervisor who asks the auditor to wait until the manager returns, turns an ordinary visit into a finding before the audit has started.

The first hour on the production floor

Within one hour of arrival the auditor starts with an inspection of production facilities and premises. This inspection is where an unannounced audit differs most from an announced one, because what the auditor sees is the site's normal state, not its prepared one.

The table lists what that first walk commonly shows and the record behind it.

An empty column on the right is the most common weakness. The floor looks acceptable, but the monitoring sheet was completed at the end of the shift, or the last pest report has no follow-up, and the auditor then looks for the same pattern all day.

Records that must be readable on any day

An unannounced visit removes the week of filing and signing that precedes an announced audit, so records must be complete every day. Four habits make the difference.

Write it when you check it

Monitoring, cleaning and change-over records are made at the moment of the activity, by the person doing it.

Let the PRP inspections do the auditor's job first

The scheme's additional requirement on PRP verification expects routine site inspections, monthly for example. Run them without warning, on different shifts, using the same eye an auditor would bring, and close the actions they raise.

Keep the assessments current

The food defence, food fraud and allergen assessments, the environmental monitoring plan and the culture plan must show a recent review date and actions under way. The additional requirements guide and the food defence and food fraud guide explain what each one contains.

Make the system open to more than one person

If only the quality manager knows where the evidence sits, the audit depends on one diary. Holding each register in Effivity, with owners, dates and attachments, lets a deputy show the auditor the current state in minutes, on any day.

A worked example: an ordinary Tuesday

The following is an illustration, not a client account. A snack manufacturer in the ambient stable products category runs two shifts. Its certification body arrives unannounced at 07:40 on a Tuesday in the second surveillance year, a day that is not on the agreed blackout list.

Security checks the auditor's identity and calls the food safety team leader, who is on leave. The first deputy, the production supervisor, takes over the visit, as the arrival protocol says.

On the walk the auditor watches a change-over from a nut-containing product to a nut-free one. The operator follows the change-over checklist, the line is cleared of the previous run's packaging and labels, and the clearance is signed before the new run starts. At a metal detector, the operator records a test while the auditor watches; the sheet shows each test at the time it was made, not a column of identical entries.

At a drain near the fryer, the auditor asks about a recent positive environmental monitoring result. The deputy opens the register, shows the investigation, the extra cleaning, the follow-up swabs and the trend over the last six months.

The audit ends with one minor finding, about a pest-control recommendation not yet closed. Nothing on the site was changed for the auditor, which is exactly what the scheme intends.

Mistakes that appear only when nobody is expected

• Treating refusal as an option. A visit refused outside the blackout days suspends the certificate within three working days, and buyers who follow the public register see the change.
• A single point of failure. The site can receive the auditor only when one person is present.
• Cleaning for the auditor. Staff sent ahead to tidy the line are noticed, and it tells the auditor that the normal state is not the audited one.
• Records filled in at the end of the shift. Real-time monitoring is a basic expectation, and the first hour is designed to test it.
• Serious events not reported. The scheme requires the certification body to be told of serious events affecting food safety, legality or certification integrity within three working days of their start; an auditor who learns of an unreported recall or incident on the day raises it.

FSSC 22000 unannounced audit: questions buyers ask