ISO 22000 certification cost: what moves the price, and how to control it

Three buckets, and only two of them arrive as invoices

A food business asking what ISO 22000 costs is really asking about three budgets. They come from different parties and move for different reasons, so keep them apart from the first conversation.

Internal effort is the bucket nobody invoices and almost everybody underestimates. The food safety team builds and defends the hazard analysis; supervisors learn to complete monitoring records at the time, on the line; quality staff run verification, calibration and mock recalls. None of it can be outsourced entirely, because the auditor interviews the people who run the process.

Consulting support is optional. Where you use it, the fee pays for the gap analysis, system design, food safety team workshops, training, internal audit, management review and preparation for the certification body. Its size depends on how much has to be built and how much of the building your team carries.

Certification body fees pay for independent assessment: the application review, the Stage 1 readiness review, the Stage 2 audit on site, the decision, then surveillance and recertification. The quote is built mainly from auditor days, plus travel and any fixed charges. A body is paying for time, not selling a certificate, so a quote with suspiciously few days deserves a question rather than a signature.

What sets the certification body's audit days

Accredited bodies certifying food safety management systems work to ISO 22003-1, which does not leave audit time to negotiation. The basic duration is assembled from three elements you can check before any quote arrives.

• Food chain category. Each category, from processing through catering, storage and packaging, carries its own starting time, reflecting its complexity and risk. A processor of perishable animal products does not start where a dry warehouse does.
• Number of HACCP studies. A study broadly corresponds to a family of products with similar hazards and processing. Each additional study adds time.
• Number of employees. People working in scope, counted as full-time equivalents and including shift and seasonal workers, add time in bands.

Additional sites add their own time, with multi-site reductions allowed only within set limits, and preparation and reporting sit on top. FSSC 22000 adds time for its scheme requirements and an unannounced audit; our guide HACCP vs ISO 22000 vs FSSC 22000: which one, and when compares the options.

Because the calculation is standardised, two accredited bodies quoting for the same plant should arrive at similar days. Where they do not, ask each to show the category, HACCP studies and headcount it used. The difference is usually a misread scope or a body cutting time it is not entitled to cut.

What moves the consulting effort

The state of your prerequisite programmes

Cleaning, pest control, hygiene, maintenance, allergen management and water control are the foundation the hazard analysis relies on. Where they already run with records, the job is alignment with the applicable ISO 22002 part and your legal requirements. Where they exist only as intentions, they must be designed, trained and run first. Our guide Prerequisite programmes and ISO 22002-1: what a plant needs explains the content.

The existing HACCP plan

A validated plan the team can defend shortens the project considerably. A plan copied from a template usually has to be rebuilt from product descriptions and flow diagrams upwards, because the auditor will test whether limits were validated or borrowed.

Product lines and process flows

Every product family needs a description, a verified flow diagram and a hazard analysis. More lines, flows and shifts mean more workshops, more records and more people to train.

Design™ or Drive™

Sterling offers two alternative levels of support. With Design™, your team implements using Sterling's structure, workshops, templates and coaching, which needs less consultant time. With Drive™, Sterling consultants take on the agreed consulting and documentation work alongside your process owners. You choose one; they are not steps in sequence. Neither changes the certification body's audit days.

The real expense: works, testing and validation

The costs that surprise food businesses appear once the gap analysis and hazard analysis show what the plant actually needs.

Infrastructure and PRP upgrades. Damaged floors and walls, unsealed openings, poor segregation of raw and cooked areas, misplaced handwashing points or unsuitable storage are physical problems no document fixes. Where works are needed they often exceed every other budget line, and they take time to schedule around production.

Laboratory testing. Environmental swabbing, water analysis, product testing and allergen verification add running costs. External results should come from a laboratory that can demonstrate competence, usually through accreditation to ISO/IEC 17025.

Validation of control measures. Before a critical limit or action criterion is relied on, the food safety team must show the control measure works. Sometimes scientific literature is enough; sometimes a heat penetration, shelf-life or challenge study is needed, with calibrated monitoring equipment behind it. Our guide Hazard analysis, OPRPs and CCPs: the hazard control plan covers the method.

Cost factors and how to keep them under control

Budget for the three-year cycle, not only the first year

A certificate stays valid for its three years only if it is maintained. Surveillance audits follow in the intervening years and a recertification audit covers the whole system before expiry, each with auditor days and travel behind it. Your own running costs continue too: verification, calibration, testing, internal audits, management reviews, mock recalls and refresher training. Our guide ISO 22000 surveillance and recertification: the three-year cycle explains each visit.

Ask every certification body to quote the full cycle, with the days, travel basis and fixed charges for each audit.

Mistakes that make ISO 22000 more expensive

• Choosing on the lowest quote. Fewer days than the rules allow, or a body without accreditation for food safety management systems, produces a certificate your retailer may reject. Check accreditation with the accreditation body, which should be recognised through the Global ACI arrangement that replaced the IAF MLA and ILAC MRA on 1 January 2026. See Choosing an ISO 22000 certification body.
• Leaving works out of the budget. Approving fees while the premises need repairs just moves the cost into a delayed audit.
• Comparing consulting quotes on price alone. A lower figure often means a template pack and less time with your food safety team, which shows at Stage 2.
• Reusing an unvalidated HACCP plan. It seems cheaper until the auditor asks where the critical limits came from.
• Ignoring years two and three. A cheap first year with expensive surveillance terms is not a saving.

ISO 22000 cost: questions buyers ask