ISO 22000 (FSMS) Certification
ISO 22000 certification shows buyers that your food business runs a documented food safety management system, checked by an accredited certification body. It suits manufacturers, processors, packers, caterers and exporters. The current standard is ISO 22000:2018, and the certificate runs on a three-year cycle with yearly surveillance audits.
What it is
ISO 22000 is an international standard for a food safety management system (FSMS). It sets out how a food business identifies hazards, controls them and proves the controls work. It wraps HACCP-style hazard analysis and prerequisite programmes (PRPs), such as cleaning, pest control and supplier checks, inside a management system with roles, records, internal audits and management review.
The current version is ISO 22000:2018, the second edition, published in June 2018 by the International Organization for Standardization. Amendment 1 of 2024 added climate action changes. ISO does not issue certificates. An independent certification body audits you. In India, NABCB (the National Accreditation Board for Certification Bodies, part of the Quality Council of India) accredits these bodies against ISO/IEC 17021-1.
Who it applies to
ISO 22000 is voluntary in India. What is compulsory is your FSSAI licence or registration under Section 31 of the Food Safety and Standards Act, 2006. The certificate sits on top of that licence; it never replaces it.
You make or process food
Dairy units, flour and spice mills, bakeries, snack makers, ready-to-eat kitchens, beverage plants and meat or fish processors.
You supply the food chain
Packaging makers, ingredient suppliers, cold stores, warehouses and food transporters. Big brands often want an FSMS certificate before they onboard a vendor. Think of a carton maker in Faridabad’s industrial area supplying a biscuit brand: the brand’s vendor audit asks for it.
You sell to large buyers or export
Exporters (agri-food ones often also hold an APEDA registration), hotel and airline caterers, and anyone answering a tender or a retail-chain audit. Here the buyer decides which certificate is enough.
Why it matters
Win buyer and tender approvals
Many procurement teams shortlist only vendors with an accredited food safety certificate. One certificate answers pages of vendor questions.
Catch hazards before customers do
Hazard analysis makes you find the weak point, such as an allergen mix-up, before it reaches a customer.
Face FSSAI inspections with records ready
Your records already show cleaning, calibration, pest control and traceability when an FSSAI food safety officer visits.
ISO 22000 or FSSC 22000?
Start with ISO 22000
The base standard, accepted by most domestic buyers, tenders and many export customers.
Step up to FSSC 22000
A certification scheme built on ISO 22000 plus sector PRP standards from the ISO 22002 series and extra scheme rules. It is recognised by the Global Food Safety Initiative (GFSI).
Let the buyer decide
Ask your buyer in writing. Here is the catch: a Faridabad namkeen maker can finish ISO 22000 and then learn that its new retail buyer wants a GFSI-recognised scheme. Asking first means you plan for FSSC 22000 from day one, and nothing is wasted.
Documents required
Legal and business records
- FSSAI licence or registration
- Certificate of incorporation, partnership deed or GST registration
- Factory licence and pollution consent, where they apply
- Site layout and process flow diagrams
Food safety system records
- Food safety policy and objectives
- Scope of certification (products, processes, sites)
- Hazard analysis, HACCP plan and OPRP list
- PRP records: cleaning, pest control, water, personal hygiene
Evidence the system runs
- Water and product test reports from an accredited laboratory
- Calibration records of instruments
- Training records of food handlers
- Internal audit report and management review minutes
How it works
Check your scope and your buyer’s demand
We fix the products, processes and sites in scope, and confirm whether your buyer wants ISO 22000 or a GFSI scheme.
Run a gap check against the standard
We walk your site, compare it with each clause of ISO 22000:2018 and give you a written list of what is missing.
Build the documents and records
We draft the manual, procedures and HACCP worksheets with your team. Your own food safety team leads the hazard analysis.
Hold the internal audit and management review
Both are required before certification. We help you plan the audit and minute the review.
Choose an accredited certification body
We help you compare NABCB-accredited or other IAF-recognised bodies whose scope covers your food category. You sign the contract with the body directly.
Face the Stage 1 and Stage 2 audits
Stage 1 reviews documents and readiness; Stage 2 tests the system on the floor. We help close any non-conformities.
Keep the certificate alive
After certification we track the surveillance dates, update records when your products or premises change, and keep your FSSAI compliance in step. Need ISO 9001 or another standard alongside? Our ISO certification support covers those too.
Timelines
Plan for a three-year cycle
Your certificate is valid for three years. Under ISO/IEC 17021-1, the cycle starts on the date of the certification decision.
Book the first surveillance within 12 months
The first surveillance audit falls no later than 12 months after the certification decision. After that, expect one at least once every calendar year, except in the recertification year.
Recertify before expiry
A recertification audit must be completed before the certificate expires. If it slips, the body can restore the certificate within six months only if the pending work is finished; otherwise at least a Stage 2 audit is repeated.
What happens if surveillance lapses
The body suspends your certificate
Under ISO/IEC 17021-1, the body must suspend certification if you do not allow surveillance or recertification audits at the required frequency, or if you fail certification requirements.
Suspension can turn into withdrawal
A suspension normally lasts no more than six months. If the issue is still open, the certificate is withdrawn or its scope is cut.
Buyers can see the status
Buyers can check accredited certificates. A withdrawn one can stop vendor approval, while your FSSAI duties continue.
Frequently asked questions
Is ISO 22000 certification mandatory in India?
No, ISO 22000 is voluntary. The legal requirement for a food business is an FSSAI licence or registration under Section 31 of the Food Safety and Standards Act, 2006. ISO 22000 is a buyer-driven certificate that sits on top of that licence. Exporters, caterers and vendors to large brands take it because customers ask for it. We can check whether your buyer actually needs it before you spend anything.
Who issues the ISO 22000 certificate?
An independent certification body issues it, not ISO and not the government. The certification body should be accredited, in India usually by NABCB under the Quality Council of India, and its scope must cover your food category. We check the accreditation before you sign any contract, so your buyers can rely on the certificate.
Which version of ISO 22000 applies now?
ISO 22000:2018 is the current edition, published in June 2018, with Amendment 1 of 2024 adding climate action changes. ISO lists a revision as under development, so a new edition may appear. We track the change and tell you when your system needs updating, so you are never caught at an audit with an outdated manual.
How long is an ISO 22000 certificate valid?
It is valid for three years from the certification decision, with the first surveillance audit within 12 months and later ones at least once every calendar year. A recertification audit before expiry renews the cycle. We keep these dates on our calendar and remind you well ahead, so the certificate does not lapse because a date was missed.
Does ISO 22000 replace my FSSAI licence?
No. Your FSSAI licence or registration is a legal requirement under Section 31 of the Food Safety and Standards Act, 2006, and ISO 22000 cannot replace it. The two work together: your FSMS logs also help during an FSSAI inspection. We also check that your licence category matches your real operations, so neither the auditor nor the inspector finds a gap.
What is the difference between ISO 22000 and HACCP?
HACCP is a method for controlling food hazards; ISO 22000 is a full management system that includes it. ISO 22000 adds prerequisite programmes, documented roles, communication along the food chain, internal audits and management review. A business already following HACCP has a head start. Many units move from a basic HACCP plan to ISO 22000 in one project, and we help map what you already have to each clause.
Is ISO 22000 enough for export buyers?
It depends on the buyer. Many importers accept ISO 22000 from an accredited body. Some large retailers and brands insist on a GFSI-recognised scheme such as FSSC 22000, which is built on ISO 22000 plus sector prerequisite programmes. Ask your buyer to confirm in writing. If they want FSSC 22000, the ISO 22000 work carries over, and we plan the project so you do the work only once.
What happens in the Stage 1 and Stage 2 audits?
Under ISO/IEC 17021-1, the first certification audit always runs in two stages. Stage 1 reviews your documents, scope and readiness, and points out gaps. Stage 2 checks on the shop floor that the system is actually followed and effective. Any non-conformities must be addressed to the body’s satisfaction before it decides on certification. We prepare your team for both stages and help you write clear corrective actions, so the findings close quickly.
Can a small unit or a home-based food business get ISO 22000?
Yes. ISO 22000 applies to any organisation in the food chain, whatever its size. A small bakery or spice unit can be certified if it holds FSSAI registration and actually runs the system it documents. We size the paperwork to your operation, so you are not buried in forms meant for a large plant.
What it costs
Our fee plus the government fee that applies to your case, quoted before you commit. Tell us the situation and we will price it exactly.
There is no government fee for ISO 22000 certification. The certification body charges its own audit fee, which depends on the number of sites, employees, HACCP studies and the food category. We help you compare quotations from accredited bodies before you choose.
Ready to begin?
Tell us what you make and who you sell to, and we will plan your ISO 22000 project, from gap check to the Stage 2 audit.