FSSC 22000 certificate: what does it say and how do you check it?
An FSSC 22000 certificate is reliable if the organisation appears on the public register of Foundation FSSC and the certification body is accredited to ISO/IEC 17021-1 and ISO 22003-1. You check this in five steps: the logo, the standard references, the certification body, the register and the QR code. Foundation FSSC lists the same checks in its guidance on authenticity . A PDF that looks professional proves nothing without a register check.
Use this page when you receive a certificate from a supplier or customer, or when you need to show one yourself. For a general ISO certificate, the method is largely the same. See checking an ISO certificate.
What does a valid certificate contain?
A complete FSSC 22000 certificate contains at least the details below. If one is missing, ask for it.
| Element | What you should see | Why it matters |
|---|---|---|
| Organisation | The correct legal name and every site address in scope | A site that is not listed is not covered by the certificate |
| Scope | A description of what is certified, with the food chain category (for example C for processing or G for storage and transport) | Only that category is covered |
| Standards | ISO 22000, the sector-specific PRP specification (ISO/TS 22002-x) and the FSSC scheme | Without these references, it is not an FSSC 22000 certificate |
| Scheme version | Version 6 or version 7 | Determines against which audit framework it was checked. See version 6 and 7 |
| Logo | The official FSSC logo. The certification body must place it on the certificate (Part 3, 7.2) | A different or missing logo is a red flag |
| COID and QR code | The Certified Organizations Identification Code (COID) and the QR code from the FSSC platform | You use these to look up the listing. They are mandatory on the certificate |
| Language | The certificate is in English, possibly with a translation of the scope alongside | It must match the register |
| Certification body and accreditation | The name of the certification body and of the accreditation body | Without accreditation, the certificate has not passed an independent check |
| Validity | The issue date and expiry date (three years minus one day after the first decision), plus the date of the last unannounced audit | An expired certificate is no longer valid, even if it was valid before |
In its check, Foundation FSSC mainly relies on the listing in the register. So it is best to check the expiry date and scope in the register itself, not only on the PDF.
The five check steps
Step 1: the logo
Compare the logo with the official logo. The certification body must place the logo on the certificate. The official colours are set out in version 7 (clause 2.5.5): green (PMS 348 U, RGB 33/132/85, HEX 218455) and grey (60 per cent black). A logo with different colours, a distorted letter or a homemade logo is a first red flag. You can read more about the logo at the FSSC logo.
Step 2: the standard references
Check that the certificate refers to ISO 22000, the sector-specific PRP specification and the FSSC scheme. These are the standards the auditor assessed. A certificate that refers only to ISO 22000 is not an FSSC 22000 certificate. You can read about the difference between the two on FSSC 22000 vs ISO 22000.
Step 3: the certification body and accreditation
Does the certificate name both the certification body and the accreditation body? Then look up the certification body in the register. An FSSC 22000 certificate may only be issued by a certification body that holds a licence from Foundation FSSC and is accredited to ISO/IEC 17021-1 and ISO 22003-1. You can find out how to check this, and which accreditation bodies exist, at choosing a certification body.
Step 4: the Public Register
The Public Register of Foundation FSSC is the most important check. This is how it works:
- Go to the register and search for the organisation’s company name. Foundation FSSC also mentions searching by COID in its guidance. We did not see that field on the register page itself.
- Open the listing if one exists.
- Compare the valid certificates, the scope and the food chain categories with what the certificate says.
- Is the organisation not listed? Then the certificate is not confirmed. Contact Foundation FSSC.
The register has filters for scheme, certificate status, country and scope. Use them if the name returns several sites or similar companies. The register is updated daily.
Step 5: the QR code
A current certificate shows a QR code and the COID (Part 3, 7.2). The QR code should link to the listing in the register. Scan it and check that the page really comes from fssc.com. Then compare the listing with the details on the PDF.
Common mistakes
Auditors and customers see these mistakes most often with certificates:
| Mistake | What is going on | What you do |
|---|---|---|
| Certificate checked only as a PDF | A forged or expired certificate often looks correct | Always do the register step |
| Logo on a product or packaging | Under version 7, neither the logo nor a reference to the certificate may appear on a product, label or packaging | Remove it. The logo is for marketing only |
| Scope broader than the certificate | The customer thinks all products are covered | Compare the scope and categories with your product range |
| Site not listed on the certificate | A new location is not automatically covered by the existing certificate | Have the scope extension recorded by the certification body |
| Confusion with an ISO 22000 certificate | An ISO 22000 certificate without an FSSC reference is not an FSSC 22000 certificate | Check the scheme name on the certificate and the scheme filter in the register |
What if the certificate is not in the register?
Then the register does not confirm the certificate. This could be an administrative delay, a wrong name or a forged document. Contact Foundation FSSC through the register and submit the document. Do not proceed with the customer or supplier until the question is answered. If you want to know how the certification itself works, see the page on the audit process.
A certificate is not valid forever
An FSSC 22000 certificate is valid for three years. A surveillance audit takes place every year in between, and recertification follows after three years. If an audit is missed, the certification body suspends the certificate. A paper certificate is therefore a snapshot. What counts is whether the organisation is still on the register with an active certificate.
| Moment | What happens | What you check |
|---|---|---|
| Issue | The certification body issues the certificate after a positive certification decision | Issue date, scope and standards on the certificate |
| Yearly | A surveillance audit checks whether the system continues to work. The first follows within 12 months of the certification decision | Whether the listing in the register is still active |
| After three years | Recertification with a full audit, preferably at least three months before the expiry date | Whether there is a new certificate with a new expiry date |
| On change | A new site or scope requires an extension | Whether the extension has been updated in the register |
Ask a supplier or customer for the current certificate, not last year’s. An old document in your file gives no certainty about today.
What do you do with a doubtful certificate?
Sometimes something does not add up, but you do not know what. Then follow this order:
- Ask the organisation directly for the certificate, with the QR code and the COID.
- Check it in the register and note the date of the check.
- Does the scope or site differ? Then ask the certification body for an explanation, not only the organisation itself.
- Is it still unclear? Report it to Foundation FSSC so they can investigate.
A sound system can be checked. An organisation that struggles with you checking its certificate is a signal to be careful.
Checking your own certificate
If you are certified yourself, follow the same five steps before you send the certificate to a customer. This prevents discussion and shows that your system matches the register. Also check that the listing in the register matches the sites and scope you give to the customer.
Your certificate belongs to the scheme you had audited. You can read which requirements apply on the scheme requirements and in the frequently asked questions about FSSC 22000.
Next steps
- The audit process: from stage 1 to surveillance
- Use of the logo: what is allowed and what is not
- GFSI recognition: what the certificate does and does not mean
- Frequently asked questions about FSSC 22000