FSSC 22000 step by step

1. Define the scope and food chain category

Decide which activities you want to certify and which food chain category you fall under. The category determines which PRP specification from the ISO/TS 22002 series applies to you and which additional requirements apply.

Example: a sauce producer falls under category C (food processing) with PRP specification ISO/TS 22002-1. A carrier of chilled products falls under category G with ISO/TS 22002-5.

Pitfall: choosing a scope that is too broad. If you certify a site that also does contract packaging for third parties, that can add a second category. Set the scope deliberately.

2. Gap analysis

Map out what you already have and what is still missing. Place your current HACCP system, procedures and documentation next to the three building blocks: the ISO 22000 requirements, the PRP specification and the 18 additional requirements. Do you need help with this step? Read what a consultant does and does not do on do it yourself or hire a consultant.

Example: a bakery already has a HACCP plan and cleaning protocols, but lacks a food fraud vulnerability assessment and a formal allergen management plan. Those gaps now go on the action list.

Pitfall: rushing through the gap analysis. Invest time here, because it determines your work plan for the coming months.

3. Set up PRPs and the hazard analysis

Set up the sector-specific PRPs based on the ISO/TS 22002 specification that matches your category. Combine this with an up-to-date hazard analysis: inventory biological, chemical and physical hazards, determine CCPs and OPRPs, and set limit values.

Example: a meat processor sets a core temperature of 72°C as a CCP in the pasteurisation process, with a digital log as the monitoring method.

Pitfall: treating PRPs and HACCP separately. They belong together: if a PRP fails, it affects the hazard analysis.

4. Implement the 18 additional requirements

Work the additional FSSC requirements into your system. The most labour-intensive are food fraud (vulnerability assessment and mitigation plan), food defence (plan against deliberate contamination), allergen management and food safety culture.

Example: a spice importer makes a food fraud vulnerability assessment per raw material. For basil from Morocco, the risk of dilution scores high; the measure is a supplier audit and sample analysis on receipt.

Pitfall: treating food fraud and food defence as a paper exercise. An auditor asks for evidence that measures are actually carried out, not only described.

5. Get documentation and records in order

Record everything the scheme requires: procedures, instructions, records and evidence. FSSC 22000 does not ask for a thick manual, but it does require consistent documentation that shows your system works.

Example: a completed temperature log for every cold room, a signed training record for each employee and a list of approved suppliers with the assessment date.

Pitfall: creating documentation that does not match practice. If the procedure says employees complete a checklist daily, but the records are empty, that will be noticed at stage 2.

6. Internal audit and management review

Carry out an internal audit across the whole system before the certification body arrives. Close with a management review: management evaluates performance, the results of the internal audit and the objectives. Whether your internal auditors need a course is covered on FSSC 22000 training.

Example: the quality manager walks through production with an audit checklist, notices that the allergen instruction on the floor is not up to date, and records a corrective action.

Pitfall: planning the internal audit too close to the stage 1 audit. You need time to correct findings.

7. Choose a certification body

Choose an accredited certification body. In the Netherlands, these are bodies accredited for FSSC 22000 by the RvA (Dutch Accreditation Council) . Well-known names include Kiwa, TÜV, DNV and Bureau Veritas.

Example: a dairy company requests quotes from three certification bodies and compares the price of stage 1 plus stage 2 and the sector knowledge of the lead auditor.

Pitfall: choosing on price alone. Sector experience of the auditor saves time during the audit and leads to fewer differences in interpretation.

8. Stage 1 audit (document review)

The certification body assesses your documentation: scope, hazard analysis, PRPs, additional requirements and internal audit results. This is a desk audit; the auditor does not necessarily have to be on site.

Example: at stage 1 the auditor notes that the food defence plan has no risk analysis per vulnerable zone. You address this before stage 2.

Pitfall: underestimating stage 1 findings. Take them seriously; unresolved major findings block your stage 2.

9. Stage 2 audit (shop floor)

The auditor visits your site and checks whether the system works in practice. They speak to employees on the floor, inspect the production environment and check records.

Example: the auditor asks an employee on the packaging line about the allergen instruction. The employee correctly explains which actions to take when an allergen changeover happens.

Pitfall: not informing employees about the audit. FSSC 22000 expects food safety to live in the organisation, not only within the quality department.

10. Certificate and annual surveillance

After a successful stage 2, you receive the FSSC 22000 certificate. It is valid for three years. Every year a surveillance audit follows. At least one of the surveillance audits in each cycle is unannounced. After three years, recertification follows. Read how to check the certificate before giving it to a customer or supplier on checking an FSSC 22000 certificate.

Example: in year 2 the certification body calls on a Tuesday to announce that the unannounced audit will take place the next morning. The system is working as usual at that moment: no special preparation is needed.

Pitfall: keeping the system up to standard only around planned audits. The unannounced audit tests how things are done every day.