ISO 22000 certificate: how long is it valid?
An ISO 22000 certificate is valid for three years. Within those three years, the certification body visits every year for a surveillance audit, and after three years a recertification follows. This is set out in the FSSC 22000 Scheme version 7 (May 2026) (FSSC = Food Safety System Certification), which adopts the three-year cycle from ISO/IEC 17021-1. The ISO 22000 standard itself does not set a period; that comes from the certification rules. For a certificate based purely on ISO 22000, this is the common practice, but the details (such as the six months below) appear only in the FSSC scheme. Ask your certification body for its own rules. You can find more about the whole process on the audit process page and the costs and timeline page.
Three years is the standard cycle. The certificate is issued in the name of your organisation and for a defined scope. If the scope or the site changes, the cycle may start again.
ISO 22000 certificate in brief
| Question | Answer |
|---|---|
| How long is it valid? | Up to three years from the certification decision |
| How often are you checked? | A surveillance audit every calendar year, in years 1 and 2 |
| When must you recertify? | Preferably at least three months before the expiry date |
| What if it expires? | Restoration within six months is possible, if the recertification is complete |
The three years at a glance
Your certificate starts with the initial certification: stage 1 and stage 2 of the audit. Two surveillance audits follow. You must pass both. A surveillance audit cannot be skipped or replaced by a recertification (FSSC v7, section 5.1).
The whole cycle matters. If you miss a surveillance audit or it is late, the certification body can suspend the certificate.
What you need to know about surveillance audits
- The first surveillance audit after initial certification takes place no later than twelve months after the certification decision.
- Each surveillance audit is a full system audit. The auditor does not only look at what you have changed since the last visit.
- Surveillance audits must fall within the calendar year. Plan them early in the year. If they are not carried out on time, the certificate is suspended.
Recertification: timing you need to know
You recertify at the end of the cycle. Preferably three months before the expiry date, so that the decision is in place on time. The FSSC scheme sets out the rules concretely:
| Situation | Result |
|---|---|
| Recertification complete before the expiry date, no more than six months earlier | New three-year cycle |
| Recertification more than six months before the expiry date | New cycle starts now; the validity of the old certificate is shortened |
| Certificate expired, but the work is nearly finished | Restoration within six months is possible, if the activities are completed |
| Certificate expired, work not finished | Full new initial audit (stages 1 and 2) |
Concrete example, fictional: a certificate is valid until 1 March 2029. You plan the recertification audit by the end of November 2028 at the latest. That leaves room for any corrections before the date.
Common misunderstandings
- “The certificate lasts forever.” No, it must be proven again every three years.
- “If the surveillance audit is later, it does not matter.” It must fall within the calendar year. Being late puts the certification at risk.
- “You can only recertify once it has expired.” Not at all. Planning early prevents a gap.
- “Once you have the certificate, you do not need to do anything else.” You must keep the system active every year. The surveillance audit checks whether you still do.
If you want to move the certificate to another certification body during the cycle, read transferring an ISO 22000 certificate. We explain the findings that come up during an audit on the page on major and minor nonconformities.
What does the auditor check at a surveillance audit?
The surveillance audit is not a repeat of the full certification. It is, however, a full system audit: all requirements of the scheme are covered. The auditor mainly looks at:
- whether changes since the previous audit have been reflected in the hazard analysis;
- whether the nonconformities from the previous audit have been resolved and the root cause addressed;
- whether internal audits and management review have been carried out as planned;
- whether the mandatory records are complete for the whole year, not only in the week before the audit.
What does a suspension mean?
If a certificate is suspended, you may no longer use it as evidence of food safety. The certification body writes to you and instructs you to inform your stakeholders, for example your customers. A suspension can therefore have immediate commercial consequences, even if the system works well in practice.
A suspension is usually temporary. It is lifted when the nonconformity has been resolved and the certification body has verified that. If this does not happen within six months, the certificate is withdrawn (FSSC v7, section 7.3). For the deadlines, see the page on major and minor nonconformities.
Planning by year of the cycle
| Moment | What you do | Goal |
|---|---|---|
| Year 1, before the first surveillance audit | Plan the internal audit and management review | Be ready for the first check |
| Years 1 and 2, every calendar year | Schedule the surveillance audit early in the year | Stay within the calendar year |
| Year 2, end of the year | Prepare recertification and check the scope | No surprises in the final year |
| Year 3, no later than three months before expiry | Complete the recertification audit | Start the new cycle on time |
This planning is a practical rule of thumb. You agree the exact dates with your certification body, which sets the audit programme.
Frequently asked questions about validity
Can I choose the date of recertification myself? You agree that with the certification body. It must still fit the rules: planning too early can shorten the validity of your current certificate.
Does the validity change if I extend the scope or move? An extension may require its own audit; ask your certification body. If you move to another site, the FSSC scheme requires at least a stage 2 audit and a new three-year cycle starts.
What if I still want to switch after a suspension? That is not possible while the certificate is suspended. The transfer can only start once the suspension has been lifted. See transferring a certificate.
More information
Official references
- FSSC 22000 Scheme Version 7.0 (May 2026) , section 5.1 on the three-year cycle and recertification
- ISO 22000:2018 - Food safety management systems