FSSC 22000 training and courses: which training is mandatory?
The FSSC 22000 scheme does not require a course for every organisation. Course hours only appear in clause 2.5.18.2 of version 7, for internal auditors in multi-site certification. In addition, all employees must receive training on allergens (2.5.6), and someone with demonstrable knowledge must prepare the food defence and food fraud plans. Anything else you need follows from the requirements of the scheme and the audit process.
Many providers sell an FSSC 22000 course as a compulsory part. That is only true in the situations below. The rest is a choice you make because it helps you, for example for the step-by-step plan.
The hours and clauses on this page come from version 7 (May 2026). Version 6 remains the audit framework until 30 April 2027. Ask your certification body which version applies to your audit. If it is version 6, check the hours in that scheme text.
What does the scheme require for every organisation?
The scheme names three places where training or knowledge is a requirement. They apply to all organisations, including those with one site.
| Clause | What it requires | Example |
|---|---|---|
| 2.5.6 f | All employees receive training in allergen awareness, plus specific training on the control measures in their own work area | An employee at the filling machine learns which allergens occur on their line and how to clean the line during a product changeover |
| 2.5.3 a and 2.5.4 a | The food defence plan and the food fraud plan are made and maintained by people with suitable knowledge and competence | The quality manager has completed training on vulnerability assessment, or the organisation hires someone in |
| 2.5.8 | Training is one of the four components of your food safety and quality culture plan | An annual plan with induction programmes and a toolbox meeting each quarter |
No fixed number of hours is stated. The auditor assesses whether the training suits the risk. Evidence consists of attendance lists, tests and a training matrix.
ISO 22000 itself also requires that employees who affect food safety are competent and that you can demonstrate this. That applies to the HACCP team too. You choose which course suits that purpose.
When do course hours apply?
Only in multi-site certification. This concerns organisations with a central function and multiple sites in the food chain categories BIII, E, F and G. The central function must then have an internal auditor team that meets the requirements of clause 2.5.18.2. The certification body assesses this every year during the audit.
| Role | Training | Minimum | Clause |
|---|---|---|---|
| Lead auditor for internal FSSC 22000 audits | Lead auditor course for a food safety management system (FSMS), quality management system (QMS) or FSSC 22000 | 40 hours | 2.5.18.2 c i |
| Other internal auditors | Internal audit course on audit principles, practice and techniques, which can also be given internally by the qualified lead auditor | 16 hours | 2.5.18.2 c ii |
| All internal auditors | FSSC scheme course on ISO 22000, the sector-specific PRPs (ISO 22002-x) and the additional requirements | 8 hours | 2.5.18.2 c iii |
Besides the courses, there are requirements for experience and education. An internal auditor needs two years of full-time work experience in the food industry, of which at least one year is with their own organisation. In addition, a higher education qualification is required. Without one, five years of work experience in production, transport, storage, retail, inspection or enforcement is needed.
The internal audit reports receive a technical review by the central function. Auditors and reviewers are assessed and calibrated every year (2.5.18.2 d and e). The central function must be independent of the sites it checks (5.3.3).
Example: a caterer with six kitchens has a head office as its central function. The head office has three internal auditors. The quality manager takes the lead auditor course (40 hours), and the other two take the internal audit course (16 hours). All three follow an 8-hour scheme course. Together that is 72 hours of audit training plus 24 hours of scheme course.
Do you have a single site? Then a course is a choice
For an organisation with one site, the scheme does not state hours for the internal audit. The internal audit itself is mandatory. It follows from ISO 22000, and you must be able to show that the auditors are competent and impartial.
A course can still be sensible. The quality manager who carries out the audit often benefits from an internal audit course. Anyone working with the scheme for the first time learns a lot from a scheme course on the additional requirements. But the auditor cannot say you should have taken one. They look at the result: does your internal audit find the nonconformities?
More on how to set up a good internal audit is on internal audit. If you want to become an auditor yourself, read becoming an ISO auditor.
What requirements apply to the certification body’s auditors?
The certification body’s auditors have a more demanding training. Clause 3.5.1 of version 7 (Part 4, for certification bodies) includes:
- a lead auditor course of at least 40 hours, externally recognised by a competent body such as CQI/IRCA (the Chartered Quality Institute and its auditor registration body);
- HACCP training of at least 16 hours;
- an ISO 22000 course of at least 8 hours, unless it was already part of the lead auditor course;
- 2 hours of food defence training and 2 hours of food fraud training;
- training in ISO 22002-100 and the relevant parts of ISO 22002 of at least 3 hours;
- the mandatory training from Foundation FSSC itself, and a final examination for the courses.
As an organisation, you do not have to obtain this yourself. It does help when choosing a certification body: ask which training their auditors have in your category. See also choosing a certification body.
Which training is sensible in practice?
This is not a requirement of the scheme, but practical advice. Choose based on your situation.
| Situation | What makes sense | Why |
|---|---|---|
| You start from zero with an FSSC system | Scheme course for the quality manager | You learn what ISO 22000, the PRPs and the additional requirements ask for |
| You are making the HACCP plan for the first time | HACCP course for the HACCP team | The plan is the core of your system |
| You have production with allergens | Allergen training for all employees | This is mandatory under 2.5.6 f |
| You need to make a food defence or food fraud plan | A training on vulnerability assessment | The plan must be made by a competent person |
| Your internal audit is your first | Internal audit course | A good audit finds nonconformities before the certification body does |
Common mistakes
| Mistake | Consequence | What you do |
|---|---|---|
| Buying an audit course because a provider says it is mandatory | You pay for something the scheme does not require for a single site | First check whether you are multi-site |
| Not keeping evidence of allergen training | The auditor cannot see that 2.5.6 f has been met | Keep attendance lists and test results |
| Training only the quality manager | The requirement applies to all employees | Record per department who has completed what |
| Using the hours from a different version | The clauses and hours may differ | Ask your certification body which version applies |
What remains unconfirmed?
The hours come from version 7. If you still work with version 6, check the hours in that scheme text. If you use a course provider, ask which version of the scheme the course was made for.
Next steps
- The audit process for FSSC 22000
- Additional requirements: the 18 extra requirements
- Doing it yourself or hiring a consultant
- Frequently asked questions about FSSC 22000