How to get ISO 22000 certification in 2026: the full roadmap

ISO 22000 is the international standard for food safety management systems (FSMS), in the edition currently in force, published in 2018. A voluntary scheme, it addresses every link in the food chain — processing, contract catering, transport, packaging, animal feed. Here is the complete path to the certificate, from the initial decision to the surveillance cycle.

Before starting: validate the objective and the scope

First question: what should the certificate achieve? To reassure industrial customers, structure your food safety management or support exports, ISO 22000 fits. To get products listed by major retailers, especially under private label, buyers most often require a GFSI-recognised scheme — IFS Food, BRCGS or FSSC 22000, the latter being built precisely on ISO 22000. Our dedicated page on GFSI-recognised schemes covers that family; either way, the work described here remains the foundation.

Second question: what scope? A single site, one product range, or the whole company. A narrower scope reduces audit days and preparation workload, but limits the commercial use of the certificate.

Step 1 — start from the regulatory baseline

Contrary to a widespread belief, certification does not create your hygiene obligations: they already exist. Regulation (EC) No 852/2004 requires every food business operator to run procedures based on HACCP principles — in France they sit inside the PMS (plan de maîtrise sanitaire, the sanitary control plan); see our HACCP and PMS page. The initial gap analysis therefore compares your reality with the standard’s requirements: PRPs genuinely applied, hazard analysis up to date, traceability tested, records kept. This diagnosis sizes the whole project.

Step 2 — build the management system

The core of the work goes beyond the HACCP binder:

• the food safety policy and measurable objectives, carried by top management — a full block of requirements, checked in audit interviews;
• the prerequisite programmes (PRPs): premises, cleaning, pest control, staff hygiene, maintenance, drawing on the ISO/TS 22002 technical specification for your sector;
• the hazard analysis following the Codex Alimentarius HACCP method, with control measures classified as CCPs (critical limits, monitoring, immediate corrections) or operational PRPs;
• traceability and emergency preparedness: traceability and withdrawal/recall exercises actually performed, not merely written up;
• communication, internal and external: what each person must report, and organised exchanges with suppliers, customers and authorities.

A survey of certified companies by Sara Teixeira and Paulo Sampaio, published in 2013 in Total Quality Management & Business Excellence, shows that the observed benefits — better process control, stronger customer confidence — are driven by the seriousness of implementation far more than by the certificate itself (see the study). Building a system your teams actually live is not a nicety: it is what the auditor assesses.

Step 3 — run the system before the audit

Classic mistake: calling the certification body as soon as the documentation is ready. A management system can only be audited once it has operated. Before the audit, you must be able to show:

1. real monitoring records for CCPs and PRPs (temperature logs, incoming-goods checks, cleaning verifications);
2. a complete traceability exercise, from a finished-product batch back to raw materials and forward to recipients;
3. an internal audit covering the whole scope;
4. a management review whose minutes contain decisions.

This running-in phase cannot be compressed: build it into the schedule from day one.

Step 4 — the two-stage certification audit

As with the other certifiable management standards, the initial audit has two stages: a readiness review (documentation, scope, system maturity), then the full on-site audit — interviews with management and operators, shop-floor observation, examination of records and of the improvement loop. Nonconformities do not necessarily prevent certification: they call for an action plan whose adequacy conditions the issue of the certificate.

Choosing the certification body deserves genuine competition: the number of audit days is framed by accreditation rules (ISO 22003-1, based among other things on headcount, the number of HACCP studies and the food chain category), but daily rates vary — our article on the real cost of ISO 22000 certification breaks down the budget.

On the day, prepare your teams for three key moments: the management interview (policy, objectives, resources), the tracking of one production flow from receipt to dispatch — auditors often pick a real batch and unwind its traceability — and the questions put directly to operators: what do you do if the critical limit is exceeded? Who do you report an anomaly to? A living system shows in those answers, not in the thickness of the binder.

After the certificate: the three-year cycle

The certificate is valid for three years, with annual surveillance audits followed by a renewal audit. Surveillance focuses on the treatment of previous nonconformities, the continuity of internal audits and management reviews, and change management — new product, new process, regulatory change. A system shelved after the initial audit is spotted at the first surveillance, and can cost you a suspended certificate — our article on renewing and maintaining ISO 22000 certification details this cycle.

One last landmark: ISO 22000 neither absorbs nor replaces your regulatory obligations, which remain enforced by the French DDPP (departmental food-safety authority) — our article does “HACCP certification” exist? untangles the two registers precisely.

Take action

Browse the full ISO 22000 certification page: scope, step-by-step process, frequently asked questions and a free ebook to frame your project. Within minutes you will know whether the standard matches your need — and what to start on this week.