The FSSC 22000 audit process
In an FSSC 22000 audit, an accredited certification body checks whether your food safety system meets the three building blocks of the scheme: ISO 22000, the sector-specific PRPs and the 18 additional requirements. An initial certification consists of a stage 1 audit (document review) and a stage 2 audit (shop floor check). After that come annual surveillance audits and recertification after three years. You can find accredited certification bodies via the RvA (Dutch Accreditation Council) . The scheme is managed by Foundation FSSC .
FSSC 22000 has one key difference from ISO 22000 when it comes to audits. The unannounced audit is mandatory. At least once in every three-year cycle, the certification body visits your site without advance notice.
On this page
We cover all audit types, the mandatory unannounced audit, what an audit day looks like and what happens when there are findings.
Which audits are there, how often do they take place and what do they test?
Overview of audit typesWhen does the auditor arrive without warning?
The unannounced auditHow does a stage 2 audit run?
What an audit day looks like in practiceWhat are non-conformities and how do you resolve them?
Non-conformities and corrective actionsOverview of audit types
| Audit type | Announced? | Frequency | Focus |
|---|---|---|---|
| Stage 1 (initial) | Yes | Once, at certification | Document review |
| Stage 2 (initial) | Yes | Once, at certification | Shop floor, interviews, records |
| Surveillance audit | Yes or unannounced | Annual | How the system works in practice |
| Unannounced audit | No | At least once per three-year cycle | Day-to-day practice |
| Recertification | Yes | Every 3 years | Full system |
Initial audits (stage 1 and stage 2) and recertification audits are always announced. Only surveillance audits can be unannounced.
Stage 1: document review
During the stage 1 audit, the auditor checks whether your documentation is in order. This is a desk audit. It often takes place remotely, or on site shortly before stage 2.
The auditor assesses:
- scope and food chain category;
- hazard analysis and HACCP plan;
- PRP documentation for each sector specification;
- how the 18 additional requirements are covered;
- results of the internal audit and management review.
You call findings from stage 1 minor observations or major findings. You must demonstrably address major findings before stage 2.
Stage 2: shop floor audit
Stage 2 always takes place on site. The auditor walks through the production area, speaks to staff and checks whether practice matches the documented procedures.
A stage 2 audit at a medium-sized food company usually takes one to two days, depending on the complexity of the scope.
The unannounced audit: mandatory for FSSC 22000
This is the most discussed part of the FSSC audit regime. The rules are:
- At least one surveillance audit in every three-year cycle is unannounced.
- The certification body announces the unannounced audit on the day itself, or names a window of 9 months in which the visit takes place.
- The time window: at the earliest 3 months after the previous audit, and at the latest 12 months after the previous audit.
- Initial certification and recertification are always announced.
In practice, the certification body might say something like: “The unannounced audit will take place in the period from 1 September to 31 May.” You then know the auditor may call at any point in that window, or be at the door straight away. Some certification bodies call one hour in advance.
Example: a soup factory was certified in April 2024. The unannounced audit may take place from July 2024 to April 2025. On a Monday in November, the auditor turns up at the door without notice. They join the morning production run and check the cold storage temperature records from the previous week.
This differs fundamentally from ISO 22000, where an unannounced audit is not mandatory. Read more about that difference at FSSC 22000 vs ISO 22000.
What an audit day looks like in practice
A typical stage 2 audit day runs as follows:
- Opening: the auditor introduces themselves and discusses the programme for the day.
- Tour of production: inspection of hygiene, PRPs, labelling and working methods.
- Interviews with staff: questions about procedures, allergen management and reporting duties.
- Document review on site: records, logbooks, corrective action overviews.
- Closing meeting: the auditor shares findings and discusses any non-conformities.
Staff who cannot explain their own procedure are a common audit finding. Food safety knowledge should not sit only with the quality manager.
Non-conformities and corrective actions
An auditor recognises two types of findings:
| Finding type | What does it mean? | Time limit to fix |
|---|---|---|
| Minor non-conformity | Requirement not fully demonstrated, low risk | Usually 30 to 90 days |
| Major non-conformity | Requirement not met in a material way, serious risk | Show your approach before the certificate is issued or renewed |
For a major non-conformity, the certification body gives you the chance to submit an action plan and resolve the issue. Only then is the certificate issued or renewed. If you do not resolve it, the certification body suspends or withdraws the certificate.