ISO 22000 surveillance and recertification: the three-year cycle, and what each audit expects of a food safety system

The ISO 22000 certification cycle and who sets it

A certificate runs for three years, provided every audit in between happens on time. The audit rhythm comes not from ISO 22000 but from ISO/IEC 17021-1, with ISO 22003-1:2022 adding the requirements specific to food safety management systems. The clock starts at the certification decision, not the last day of Stage 2.

Within that period the body plans a surveillance audit at least once each calendar year apart from the recertification year, and the first of them may not fall more than 12 months after the decision. Sterling does not certify: your accredited certification body sets the audit programme, conducts every visit and decides whether the certificate continues.

The three-year cycle, year by year

Audit time for each visit is set under ISO 22003-1 from the food chain category, the number of HACCP studies, the effective number of employees and the sites. Surveillance visits are shorter; recertification is recalculated on current figures.

What does an ISO 22000 surveillance audit cover?

Surveillance is a sample, not a repeat of Stage 2. ISO/IEC 17021-1 fixes a core for every visit: internal audit and management review, action on earlier findings, complaints, progress on objectives and improvement, continued operational control, changes, and use of the certificate and marks. Beyond it, the auditor samples, usually on the floor.

Findings are graded exactly as at Stage 2, and a major left open past the body's deadline can lead to suspension. ISO 22000 nonconformities: major, minor and how to close them covers the response.

What happens at recertification?

In year three the certification body steps back from sampling and asks whether the food safety management system still works as a whole. After reviewing both surveillance reports, it audits whether the system stayed effective through change, whether top management remains committed and whether the system achieves its intended outcomes. In food, the telling question is whether the hazard analysis kept pace with three years of new materials, recipes, equipment and requirements. Where the change is significant, the body may add a Stage 1.

Treat the expiry date as fixed. If the audit is incomplete, or a major nonconformity has not been corrected and verified by then, the certificate is not extended. The body can restore certification within six months once the outstanding work is done; beyond that, at least a Stage 2 audit is needed. Book the visit early enough to leave room for a correction, and the new certificate can run on from the old one.

Which changes must be reported to the certification body?

The certification agreement you signed obliges you to inform the body, without delay, of changes that may affect the system's ability to keep meeting the standard. ISO/IEC 17021-1 names five kinds; in a food business they tend to look like this:

• Legal status or ownership: a sale, merger or new operating entity.
• Organisation and management: a new general manager or food safety team leader.
• Address and sites: a new factory, warehouse or kitchen, or a site moved or closed.
• Scope of operations: a new product category, a new process such as high-pressure processing or ready-to-eat lines, or a process outsourced to a co-packer.
• Major changes to the system and processes: a new line, a major rebuild, or a change in how allergens are handled across the site.

Recalls and serious food safety incidents are not on that list, but many certification agreements require prompt notice of them: write your agreement's rule into the recall procedure. Adding a site or product needs a scope extension, which the body may audit during surveillance; ISO 22000 scope: sites, products and processes, and the mistakes that cost you explains how scope is worded.

Keeping the food safety system alive between audits

Surveillance auditors compare dates. A hazard analysis untouched since Stage 2 or a mock recall run the week before the visit shows a system that sleeps between audits. ISO 22000 expects the food safety team to keep PRP and plan information current, analyse verification results and update the system as knowledge changes. Sterling's recommended rhythm for a single site, our practice rather than a requirement:

• Monthly: verification results reviewed for trends; complaints and supplier issues reviewed by the food safety team.
• Quarterly: a slice of the internal audit programme; a PRP inspection against the applicable ISO 22002 part; a management review agenda that decides.
• Twice a year: a food safety team updating meeting on products, suppliers, hazards and legislation; calibration status checked.
• Annually: a timed mock recall, revalidation of control measures where anything changed, refresher hygiene training and an emergency response test.

See also ISO 22000 internal audit: PRPs and the hazard control plan, ISO 22000 management review: inputs, outputs and the record and Prerequisite programmes and ISO 22002-1: what a plant needs.

The next edition of ISO 22000 and your cycle

Certificates are issued today against ISO 22000:2018, and Amendment 1:2024 is audited with it: expect a surveillance auditor to ask how you decided whether climate change is a relevant issue for your system. A third edition is in preparation. The draft international standard, ISO/DIS 22000, completed its ballot in July 2026, but ISO has published neither the new edition nor a date for it, and no transition period has been set.

Once it is published, transition requirements issued through Global ACI will set the deadline and state whether the transition audit can be combined with a surveillance or recertification visit already in your cycle. Draft content can still change, so do not rebuild around it early.

Sterling's Sustain™ support after certification

Sustain™ is how Sterling stays with you once the certificate is issued. As confirmed in your proposal, it covers verification reviews, internal audits, mock recalls, refresher training and future scheme or edition changes.

ISO 22000 surveillance and recertification: questions buyers ask