FSSC 22000 Certification: Audits, Training & Certification Services

FSSC 22000 certification confirms that an organization's food safety management system meets the FSSC 22000 scheme: ISO 22000, the prerequisite programs (PRPs) for its sector and the FSSC 22000 additional requirements. A licensed, accredited certification body audits the site, and certified organizations are listed on the FSSC 22000 public register. The scheme is owned by Foundation FSSC, a non-profit foundation in the Netherlands.

Yes. FSSC 22000 has been GFSI-recognized since February 2010, and Version 6 is recognized against the GFSI Benchmarking Requirements 2020 for categories BIII, C0, CI–CIV, D, G, I and K. Certificates for catering (E), retail and wholesale (FI) and brokering and trading (FII) are accredited but not GFSI-recognized. Version 7 is being benchmarked against the GFSI 2024 requirements.

Version 6 is the version audited today; it was published in March 2023 and has been mandatory since April 1, 2024. Foundation FSSC published Version 7 on May 1, 2026. Version 6 audits continue until April 30, 2027, sites upgrade to Version 7 at their regular audit between May 1, 2027 and April 30, 2028, and any remaining Version 6 certificates are withdrawn after June 30, 2028. Read what's changing in Version 7.

Version 7 replaces the ISO/TS 22002 prerequisite programs and BSI/PAS 221 with the new ISO 22002-100:2025 plus a sector-specific part, including the new ISO 22002-7 for retail and wholesale. It aligns with the GFSI Benchmarking Requirements 2024, adds a traceability requirement for animal primary conversion (C0), extends PRP verification to catering and retail, and changes how audit time is calculated. There is no separate upgrade audit; the upgrade happens at your regular audit.

ISO 22000 is the international standard for food safety management systems. FSSC 22000 is a certification scheme built on it: it adds the sector PRP standard for your category and the FSSC 22000 additional requirements, such as food defense, food fraud, allergen management and food safety culture. ISO 22000 certification on its own isn't GFSI-recognized; FSSC 22000 is.

FSSC 22000 covers produce packing (BIII), food manufacturing (C0 and CI–CIV, including pet food), feed and animal food (D), catering (E), retail and wholesale (FI), brokering and trading (FII), transport and storage (G), food packaging (I) and biochemicals such as additives, vitamins and processing aids (K). Each category has its own PRP standard.

They are the scheme's own requirements in Part 2, section 2.5: management of services and purchased materials, labeling, food defense, food fraud mitigation, logo use, allergen management, environmental monitoring, food safety and quality culture, quality control, transport and storage, hazard control and cross-contamination, PRP verification, product design and development, health status, equipment management, food loss and waste, communication with the certification body, and multi-site requirements. Some apply only to certain categories.

Three years from the initial certification decision. A surveillance audit is required every calendar year, the first within 12 months of the certification decision, and at least one surveillance audit in each three-year cycle is unannounced. A recertification audit, ideally at least three months before expiry, renews the certificate for another three years.

Under Version 6, the certification body calculates the basic audit time from ISO 22003-1, based on employees and the number of HACCP studies, and adds 1.0 day (under 250 employees and 1–2 HACCP studies) or 1.5 days for the FSSC additional requirements. A full audit is at least 2 days, or 1.5 days for some very small sites and for brokers. Surveillance audits take one third, and recertification audits two thirds, of the basic time plus the FSSC time.

At least one surveillance audit in each three-year cycle must be unannounced, and the certification body chooses which. Initial audits are never unannounced. Certified sites can choose to have all surveillance and recertification audits unannounced. The facility inspection starts within one hour of the auditor's arrival, and refusing an unannounced audit leads to suspension.

For a minor, send evidence of correction, a root cause investigation and a corrective action plan; the certification body must approve it within 28 calendar days of the audit, and checks effectiveness at the next audit at the latest. A major must be closed within 28 calendar days, verified on site or by desk review; if the permanent fix takes longer, temporary controls must be accepted within those 28 days. Missing either deadline suspends the certificate.

The certificate is suspended within 3 working days for up to six months. You send the investigation and corrective action plan within 14 calendar days, and the certification body runs a separate full on-site audit between six weeks and six months later. If the issue isn't resolved within six months, the certificate is withdrawn. A critical at an initial certification audit means the audit is failed and repeated.

Partly. Initial Stage 2 audits are always on site. Surveillance and recertification audits can use the blended ICT audit approach: a remote document review and interviews plus an on-site part that is at least half of the audit time. Full remote audits are allowed only when a serious event prevents site access, and those certificates aren't GFSI-recognized.

The main cost is audit time: the basic time from ISO 22003-1 plus 1.0–1.5 days for the FSSC additional requirements, with a minimum of 2 days for most sites, plus reporting and travel. Foundation FSSC charges certification bodies €330 per audit report in 2026, and there are annual surveillance audits and a recertification audit in year three. Budget as well for training and any facility improvements. Call 1 (800) 477-0778 for a site-specific quote.

No. Certified organizations can use the FSSC 22000 logo only for marketing, such as printed matter, websites and promotional material. It can't appear on products, labels, packaging or certificates of analysis, or anywhere it implies FSSC 22000 approves a product.

All three are GFSI-recognized, so any of them can meet a customer's GFSI requirement. FSSC 22000 is a management system scheme built on ISO 22000, and its certification bodies are accredited to ISO/IEC 17021-1; SQF and BRCGS certification bodies are accredited to ISO/IEC 17065. FSSC 22000 doesn't grade sites, while BRCGS grades AA to D and SQF scores audits out of 100. Compare SQF certification and BRCGS certification, or read IFS vs FSSC 22000 vs BRCGS.

Yes, if your current certificate is valid and accredited; expired or suspended certificates can't be transferred. Kiwa's FSSC-licensed certification body carries out a pre-transfer review of your certificate, last audit report and open nonconformities, sometimes with a site visit, and the transfer must be completed before the certificate expires.

Kiwa ASI delivers FSSC 22000 certification in the United States as part of the Kiwa group. Certificates are issued by a Kiwa group certification body licensed by Foundation FSSC and accredited to ISO/IEC 17021-1 and ISO 22003-1. Kiwa ASI doesn't currently offer FSSC 22000 certification for feed (D) or catering (E). Training is delivered separately from certification.