ISO 22000 guide
ISO 22000 timeline: how long certification takes, stage by stage
Clause by clause: ISO 22000:2018 requirements: every clause explained →
How long each stage of ISO 22000 certification takes, from gap analysis and PRP upgrades to validation, the operating period and the Stage 1 and Stage 2 audits, what moves each one, and a worked calendar for a bakery.
Key points
- Most food businesses reach an ISO 22000 certificate in four to nine months from the gap analysis. Plants with a working HACCP plan sit at the short end; those needing building works or a first real hazard analysis, at the long end.
- The longest single block is not writing documents. It is the operating period, when monitoring, verification, calibration and traceability records build up over enough production for an auditor to judge them.
- Prerequisite programme upgrades, the food safety team's hazard analysis and the documentation can run side by side; validation, the operating period and the internal audit cannot be compressed in the same way.
- The certification body has its own lead times. Apply while implementation is still under way, so the Stage 1 and Stage 2 dates are fixed before the system is ready rather than after.
How long ISO 22000 certification takes, in one answer
Plan on four to nine months from the start of the gap analysis to the certification decision. The spread inside that range comes from three things: the physical condition of the site, the number of products and process flows to analyse, and whether production runs all year or only in season.
What cannot be shortened is the proof. Every realistic calendar is built backwards from the evidence the Stage 2 auditor will test on the floor. The figures on this page are Sterling's experience-based estimates, not rules set by the standard or by any certification body.
Stage by stage: durations and what moves them
Durations are elapsed time for a single site, not effort, and several rows overlap.
| Stage | Typical range (Sterling estimate) | What lengthens or shortens it |
|---|---|---|
| Gap analysis | 1 to 3 weeks | Access to the plant on production days and the state of the existing HACCP study |
| PRP upgrades | 2 to 12 weeks, sometimes longer | Infrastructure works (drainage, flooring, segregation, pest proofing) and contractor and approval times |
| HACCP team and hazard analysis | 3 to 8 weeks | The number of product lines and flow diagrams, how quickly the team can verify flows on site, and the quality of supplier and raw material information |
| Hazard control plan and validation | 3 to 10 weeks | Whether critical limits rest on published guidance or need testing or challenge studies, and laboratory turnaround |
| Documentation | 3 to 8 weeks, in parallel | How much existing material can be kept, and whether the system is set up in Effivity from the start or migrated later |
| Operating period with records | 8 to 12 weeks as a practical minimum | Production frequency, seasonal lines, the verification schedule and a timed traceability and mock recall test |
| Internal audit and management review | 2 to 4 weeks | Auditor availability and independence, the number of PRPs and plan elements to sample, and time to close the internal findings |
| Stage 1 readiness review | Booked 4 to 8 weeks after application | The certification body's auditor calendar for your food chain category and language |
| Stage 2 certification audit | Usually 3 to 6 weeks after Stage 1 | Time needed to act on Stage 1 concerns, and whether the lines in scope will be running on the audit dates |
| Certificate | 2 to 6 weeks after Stage 2 | The number and grade of nonconformities, how fast evidence of closure is submitted, and the certification body's decision process |
What runs in parallel, and what has to wait
A well-run project uses the waiting time. While a contractor re-lays a floor, the food safety team can draw and verify flow diagrams; while samples are at the laboratory, the documents and training can be completed. Awareness training for line staff runs alongside everything, because the people who fill in the monitoring records must understand them before the operating period starts.
Three things have a fixed order. The hazard analysis comes before the decision on which control measures become OPRPs and which become CCPs. Validation of those control measures comes before relying on them in daily production. And the internal audit and management review come after enough records exist to audit and review. The detail of how the plan itself is built belongs to our guide on hazard analysis, OPRPs and CCPs; the order of phases and owners is set out in the ISO 22000 implementation plan.
The operating period before Stage 2
ISO 22000 does not state a minimum number of weeks, and certification bodies express their expectations in different ways. What they share is a test: at Stage 2 the auditor must be able to sample monitoring records for PRPs, OPRPs and CCPs across real production, see calibration and verification results and what was done with them, follow a lot from incoming material to dispatched product, and review at least one completed internal audit and management review.
In Sterling's experience, eight to twelve weeks of production under the validated plan is the practical minimum for a plant running most days,. It should include a timed, recorded traceability exercise and mock recall. Ask your certification body what it expects; its answer sets your date.
Seasonal and campaign production
Where a product is made only in certain months, such as a festive bakery range or a fruit juice campaign, the hazard analysis still has to cover it, and the certification body will usually want to see the processes in scope operating. Schedule Stage 2 while those lines run, or agree with the certification body how the seasonal product will be assessed.
The certification body's lead times
The certification body works to its own calendar. After you apply, it reviews the application, calculates audit time under ISO 22003-1 from your food chain category, the number of HACCP studies, headcount and sites, and assigns auditors qualified for that category. Auditors qualified for your category and language are often booked weeks ahead.
Before signing, confirm that the certification body is accredited for food safety management systems by an accreditation body recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026. How to compare quotes and check accreditation is covered in choosing an ISO 22000 certification body, and what happens during each audit day in our guide to Stage 1 and Stage 2 audits.
A worked calendar: a mid-sized bakery, one site
The example is a plant of around 120 people on two shifts, making bread, rolls and cakes, with an old HACCP plan written for a customer audit. The cake line uses nuts, so allergen segregation is a known gap, and dispatch needs a new rapid-roll door.
| Month | Work under way | Milestone |
|---|---|---|
| 1 | Gap analysis; scope agreed; food safety team appointed; door and allergen works ordered | Prioritised action plan signed off |
| 2 | Flow diagrams verified; hazard analysis for all three lines; PRPs rewritten; application sent | Stage 1 and Stage 2 dates provisionally booked |
| 3 | Hazard control plan drafted; baking and cooling limits validated; detector and probes calibrated; allergen changeover validated; works completed | Validated plan issued for use |
| 4 to 5 | Operating period: monitoring, verification and calibration records in Effivity; awareness and role training completed | Timed traceability test and mock recall recorded |
| 6 | Internal audit across PRPs and the plan; findings closed; management review held | Stage 1 readiness review |
| 7 | Stage 1 concerns closed; production records continue | Stage 2 audit with all three lines running |
| 8 | Corrective actions for any nonconformities submitted and accepted | Certification decision |
Eight months is the middle of the range. Without the door and allergen works the same bakery could finish in six; a beverage plant adding a filling line mid-project, or whose main product runs only in summer, should plan for nine or more.
How to keep the calendar on track
Projects slip for predictable reasons: works approved late, a hazard analysis copied from an old study and then redone, or an audit date booked before anyone asked the certification body. Each is avoidable if the plan names an owner and a date from month one.
How Sterling plans ISO 22000 timelines
A dated plan from the gap analysis, built around the evidence the auditor will test.
Sterling's expert and experienced consultants build the calendar with your food safety team at the gap analysis and track it in Effivity, which is included with the engagement, at no additional cost. You choose the level of support: Design™, where your team implements with Sterling's structure, workshops and coaching, or Drive™, where Sterling consultants carry the agreed consulting and documentation work with your process owners. We ensure successful certification for our clients. The certificate is issued by the independent, accredited certification body you choose; Sterling does not certify.
Book a free discovery callISO 22000 timeline: questions buyers ask
Can a food business be certified in less than four months?
Occasionally, where a plant already runs a validated HACCP plan, sound PRPs and complete records. For most sites the operating period alone rules it out. An offer measured in days describes something other than accredited certification.
Do infrastructure works have to be finished before Stage 2?
Works that a PRP depends on should be complete, with the PRP operating and recorded, before Stage 2. If a large project cannot finish in time, raise the interim controls with the certification body before the audit; acceptance is its judgement.
Does FSSC 22000 take longer than ISO 22000?
Usually somewhat, because the scheme adds sector PRPs and its own requirements to ISO 22000, and the certification body applies scheme rules to the initial audit. Our HACCP vs ISO 22000 vs FSSC 22000 guide compares them.
How does having several sites change the timeline?
Each site needs its PRPs in place and its own records, and the certification body plans audit time for every site in scope. Sites with different products also need their own hazard analysis.
Can we add a product line after certification rather than delay the audit?
Yes. Many plants certify established lines first. The extension needs its own hazard analysis, validation and records and an audit by the certification body.
When should we apply to the certification body?
Once the gap analysis has produced a realistic plan, typically in the first two months. Applying at the end usually adds a wait of several weeks.
More ISO 22000 guides
Every guide in the ISO 22000 series is written for one question and links back to the hub for the whole picture.
- ISO 22000 certification cost: what moves the price
- ISO 22000 certification process, step by step
- HACCP vs ISO 22000 vs FSSC 22000: which one, and when
- Hazard analysis, OPRPs and CCPs: the hazard control plan
- Prerequisite programmes and ISO 22002-1: what a plant needs
- ISO 22000 requirements explained, clause by clause
- ISO 22000 certification in the Philippines
- ISO 22000 certification in the UAE and GCC
- ISO 22000 certification in the UK
- ISO 22000 training: who needs what, and the competence evidence
- ISO 22000 for logistics
- Verify a certificate
Keep exploring
Explore more about ISO 22000
Watch a video on how to implement ISO 22000 here.
Watch a video on ISO 22000 requirements here.
ISO 22000 resources
Services for ISO 22000
Talk to a consultant
Get a dated ISO 22000 plan built around your plant and your audit dates.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice