The ISO 22000 certification process, step by step, for food businesses

Who does what in ISO 22000 certification

A food business that decides to certify deals with three parties. It owns the food safety management system and the food it releases. A consultancy helps design and prepare the system. The certification body audits the system against ISO 22000:2018, including Amendment 1:2024, and decides. Above it sits an accreditation body, recognised through the Global ACI arrangement, which checks that the certification body is competent to audit food safety.

Two sets of rules shape the audit. ISO/IEC 17021-1 applies to every management system certification body. ISO 22003-1 adds the food-specific rules: food chain categories and subcategories, auditor competence by category, the minimum audit time and how multi-site operations are sampled. The current edition was published in 2022; confirm with your chosen body which edition its accreditation references.

Steps 1 to 6: preparing the plant and the system

Step 1: fix the scope and the food chain category

Write down the products, process lines, sites and shifts the certificate will name, and decide whether the target is ISO 22000 on its own or FSSC 22000, which your retail customers may prefer. Identify the food chain category your activity falls into under ISO 22003-1, because it determines which auditors are qualified to visit you and how many days they need. The scope guide covers exclusions and wording.

Step 2: gap analysis

Sterling's gap analysis walks the plant with your team and compares what is there with ISO 22000: the existing HACCP study, the PRPs, line records, supplier approval and traceability. The output is a list of gaps with owners and dates. Our gap analysis guide describes the deliverables.

Step 3: put the PRPs and the hazard control plan into operation

This is the core of the project. PRPs such as cleaning, pest control, maintenance and hygiene are brought up to the applicable ISO 22002 part and local food law. The food safety team then prepares product descriptions, draws the flow diagrams and confirms them on the floor, analyses the hazards step by step and decides which control measures become OPRPs and which become CCPs. The hazard control plan guide and the prerequisite programmes guide explain the method.

Step 4: run production under the system and let records build up

A certification auditor tests whether the plan works on real batches. That needs monitoring records completed on the line at the time, calibrated thermometers and detectors, hold-and-release decisions and lot records linking raw material to dispatch. Allow at least two to three months of normal production, and longer if a product runs seasonally or only a few times a year.

Step 5: verify the system and run a mock recall

Verification asks whether the PRPs and the plan work: swab and product results, deviations and complaints, analysed by the food safety team. Run a timed mock recall from a finished lot back to ingredients and forward to customers.

Step 6: internal audit and management review

Complete one full internal audit covering the management clauses, the PRPs and the hazard control plan, by auditors who do not audit their own work, and close the findings with evidence. Then hold a management review that looks at the results and takes decisions. The internal audit and management review guides set out what each needs to contain.

Step 7: choosing an accredited certification body

Contact certification bodies while step 3 is under way, because qualified food auditors book up weeks ahead. Ask each one which accreditation body accredits it for ISO 22000, whether that accreditation covers your food chain category, and how many audit days it proposes for Stage 1, Stage 2 and each surveillance visit. Check the answers in the accreditation body's directory. A quote with far fewer days than the others is usually a shortened audit, not a better price. Our guide to choosing an ISO 22000 certification body compares quotes line by line.

Steps 8 and 9: the Stage 1 and Stage 2 audits

Stage 1 is the certification body's readiness review, and in food it normally takes place at the plant. The auditor confirms the scope and category, walks the site, reviews the PRPs, the hazard analysis and the hazard control plan, and checks that the internal audit and management review have happened. Concerns raised at Stage 1 have to be addressed before Stage 2, which usually follows a few weeks later.

Stage 2 examines the system while production runs: auditors observe the lines, interview operators, trace lots and follow deviations through to what happened to the product. Findings are graded as major or minor nonconformities or recorded as opportunities for improvement. The Stage 1 and Stage 2 guide covers the day-by-day detail and the questions asked on the floor.

Step 10: closing findings and the certification decision

For every nonconformity the organisation submits a correction, the root cause and a corrective action within the period the certification body sets. A major nonconformity has to be verified as closed, sometimes on a follow-up visit, before the certificate can be granted; a minor one is usually accepted on a credible plan and checked at the next audit. The decision is taken at the certification body by someone who was not on the audit team. The nonconformities guide covers the responses.

The certificate names the organisation, the sites, the scope and the standard, and is valid for three years provided surveillance is passed. It covers the management system, not products, so "ISO 22000 certified" on a pack is a misuse.

What happens after the ISO 22000 certificate is issued?

Surveillance audits follow every year, with the first due within twelve months of the decision, and a recertification audit before the certificate expires. Changes to products, lines, sites or ownership must be notified to the certification body. FSSC 22000 adds an unannounced audit within each cycle. The surveillance and recertification guide covers what each visit samples.

How long the ISO 22000 certification process takes

From scoping to the certification decision, most food businesses take four to nine months. The plant decides: sound PRPs and a validated HACCP study put you near the short end; building works or first-time validation, near the long end. The certification body adds its own scheduling lead time. The timeline guide gives stage-by-stage ranges and a worked calendar.

ISO 22000 certification process: questions buyers ask