ISO 22000 audit process
An ISO 22000 audit checks whether your food safety management system (FSMS) is not only documented, but also demonstrably working on the shop floor. The standard is published by ISO . For the HACCP context, see the NVWA (Netherlands Food and Consumer Product Safety Authority) . Certification runs through accredited certification bodies under the RvA (Dutch Accreditation Council) .
Auditors look especially closely at hazard control, traceability, corrective actions and how procedures translate into daily practice.
The ISO 22000 audit process in brief
| Component | What happens? | Result |
|---|---|---|
| Stage 1 | FSMS design and document review | Go/no-go for stage 2 |
| Stage 2 | Practical test of implementation | Certification recommendation |
| Surveillance | Annual follow-up audit | Certificate maintained |
| Recertification | Full reassessment in year 3 | Certificate extended |
The ISO 22000 audit step by step
Stage 1: document and system review
The auditor checks whether your system is logical, complete and ready for audit:
- scope, context and governance;
- HACCP study and PRP design;
- procedures for deviations, recalls and improvement actions;
- internal audit and management review.
Outcome: findings you resolve before stage 2.
Stage 2: implementation in practice
Here the auditor checks whether processes actually work:
- are monitoring and verification activities carried out;
- are the CCP/OPRP controls demonstrably effective;
- are employees competent and aware;
- do traceability and recall processes work in practice.
Outcome: a certification recommendation, with any nonconformities.
Annual surveillance
After certification, an annual check follows on critical areas and on follow-up of earlier findings.
Recertification
In year 3, a full reassessment takes place to extend the certificate. For how long the certificate is valid exactly and when you need to plan, read the page on certificate validity. If you want to move to a different certification body in the meantime, see transferring your certificate.
Finding types in the ISO 22000 audit
We explain the deadlines and the difference between major and minor nonconformities on the page on major and minor nonconformities.
| Finding type | Meaning | Effect |
|---|---|---|
| Major nonconformity | Fundamental gap in design or implementation | Certification postponed |
| Minor nonconformity | Deviation with limited impact | Corrective action plan required |
| Observation | Opportunity for improvement without a formal nonconformity | No direct blockage |
ISO 22000 audit readiness checklist
A more detailed checklist, per component with the evidence the auditor wants to see, is on the ISO 22000 checklist.
| Checkpoint | Why it matters | Read more |
|---|---|---|
| Scope and product scope clear | Basis for defining the audit | Step-by-step plan |
| HACCP and PRPs demonstrably up to date | Core of food safety control | HACCP and PRPs |
| Monitoring and verification in order | Evidence that it works in practice | Requirements of the standard |
| Traceability tested | Crucial for incident response | Requirements of the standard |
| Internal audit and management review | Mandatory clauses of the standard | Step-by-step plan |
Common mistakes in the ISO 22000 audit
- Strong documents, but insufficient implementation on the shop floor.
- HACCP analysis not updated after process changes.
- Incomplete recording of deviations and corrective actions.
- Recall process not practised or not sufficiently traceable.