Certification and Audit Process for ISO 22000

In short: ISO 22000 certification follows a set path: a gap analysis, implementing the food safety management system, an internal audit, choosing an accredited certification body, and then a stage 1 (readiness) audit and stage 2 (main) audit before the certification decision. Once certified, you keep the certificate through regular surveillance audits and a recertification audit every three years.

Implementing ISO 22000, an internationally recognised standard for food safety management systems, is a significant step toward ensuring the safety and quality of food products. Once the system is in place, organisations can pursue ISO 22000 certification to demonstrate their commitment to food safety. This article provides a guide to the certification process and what to expect during an ISO 22000 audit.

1. Introduction to ISO 22000 certification

ISO 22000 certification is a formal recognition that an organisation’s food safety management system complies with the requirements of the ISO 22000 standard. The current edition is ISO 22000:2018. Certification provides confidence to customers, stakeholders, and regulatory authorities that the organisation has implemented effective controls and measures to ensure the safety of food products. If you are still building your system, start with our essential guide to implementing ISO 22000.

2. The certification process

The certification process typically involves the following steps:

1. Gap analysis: Conduct a thorough evaluation of the existing food safety management system against the requirements of ISO 22000. Identify any gaps and develop an action plan to address them.
2. System implementation: Implement the necessary changes and improvements based on the gap analysis findings and the requirements of ISO 22000.
3. Internal audit: Conduct an internal audit to assess the effectiveness of the implemented food safety management system and identify areas for improvement. A management review should also be completed before the certification audit.
4. Selection of a certification body: Choose an accredited certification body to conduct the ISO 22000 certification audit. In South Africa, check that the certification body is accredited by SANAS (or another accreditation body that is a signatory to the international recognition arrangements) and that it is recognised and respected in the food industry.
5. Stage 1 audit: The certification body will conduct an initial audit, known as the stage 1 audit. This audit focuses on reviewing the organisation’s documentation, processes, and preparedness for the stage 2 audit.
6. Stage 2 audit: The stage 2 audit is the main certification audit. It involves an on-site assessment of the organisation’s food safety management system to determine compliance with ISO 22000 requirements.
7. Certification decision: Based on the audit findings, the certification body will make a decision regarding ISO 22000 certification. If the organisation meets the requirements, they will be awarded the certification.

3. Preparing for the audit

To ensure a successful ISO 22000 audit, it is essential to be well-prepared. Consider the following steps:

• Review the requirements of ISO 22000 and ensure that the food safety management system aligns with these requirements.
• Conduct internal audits to identify any nonconformities or areas for improvement.
• Document all processes, procedures, and records related to the food safety management system. Our article on documentation and record keeping in ISO 22000 explains what is needed.
• Train employees on their roles and responsibilities in maintaining food safety.
• Establish a document control system to manage and update the necessary documentation.

For general audit preparation tips that apply to any ISO standard, see our guide to ISO audit preparation best practices.

4. The ISO 22000 audit

The ISO 22000 audit is a thorough assessment of the organisation’s food safety management system. It typically includes the following elements:

• Review of documentation: The auditor will examine the documented procedures, policies, and records related to the food safety management system.
• On-site inspection: The auditor will visit the organisation’s premises to assess the implementation of the system, including verifying compliance with food safety requirements, observing processes, and interviewing employees.
• Interviews: The auditor will conduct interviews with key personnel to evaluate their understanding of the food safety management system and their roles in maintaining food safety.
• Nonconformity identification: If any nonconformities are identified during the audit, they will be documented, and corrective actions will be required to address them.

5. Post-audit actions

After the ISO 22000 audit, the organisation should take the following actions:

• Corrective actions: Address any nonconformities identified during the audit and implement corrective actions to prevent their recurrence.
• Documentation updates: Update the food safety management system documentation to reflect any changes or improvements made based on the audit findings.
• Certification decision: The certification body will review the audit report and make a decision regarding ISO 22000 certification. If successful, the organisation will receive the certification.

6. Maintaining ISO 22000 certification

An ISO 22000 certificate is normally valid for three years. To maintain certification, organisations must:

• Conduct regular internal audits to assess the effectiveness of the food safety management system and identify areas for improvement.
• Participate in surveillance audits conducted by the certification body (usually once a year) to ensure ongoing compliance with ISO 22000 requirements, followed by a recertification audit before the certificate expires.
• Keep documentation up to date and maintain records of food safety-related activities.
• Continuously improve the food safety management system by addressing nonconformities, conducting management reviews, and implementing corrective actions.

7. Conclusion

Obtaining ISO 22000 certification is a significant achievement for organisations committed to food safety. By following the certification process and adequately preparing for the audit, organisations can demonstrate their dedication to delivering safe and high-quality food products. Continuous compliance, improvement, and vigilance are key to maintaining ISO 22000 certification and ensuring ongoing food safety excellence.

Frequently asked questions

How long does ISO 22000 certification take?

It depends on how developed your food safety system already is. Organisations with a working HACCP system and good prerequisite programmes usually get there faster than those starting from the beginning.

What is the difference between ISO 22000 and FSSC 22000?

FSSC 22000 is a certification scheme built on ISO 22000, with added prerequisite programme standards and scheme requirements. It is recognised by the Global Food Safety Initiative (GFSI), which is why many large retailers and manufacturers ask their suppliers for it.

Who can certify my organisation to ISO 22000 in South Africa?

An independent certification body, preferably one accredited by SANAS for ISO 22000. Consultants can help you prepare, but they cannot certify a system they helped to build.

What happens if the auditor finds a nonconformity?

You will be asked to correct it and show the corrective action taken within an agreed time. Major nonconformities must be closed before certification can be granted.