FSSC 22000 V7 Goes Green: New Food Loss & Packaging Rules for USA
FSSC 22000 V7 Goes Green: New Food Loss & Packaging Rules for USA
- Published
- Reading time
- — min
/
in
Food Safety/
by
iasisoBy Dr. C.D. Mohana Priya | ISO 22000:2018 Lead Auditor & Laboratory Quality Tutor
FSSC 22000 Version 7 adds two new sustainability requirements that directly affect food manufacturers in the USA: formal Food Loss & Waste management expectations and “Save Food Packaging” design-principle requirements, both of which are new compared to Version 6. This guide explains what those changes mean in practice, how they fit into the broader FSSC 22000 scheme, and what US-based certified and certifying organizations should do to prepare before their next audit.
Key Changes at a Glance
- Version 7 introduces Food Loss & Waste management expectations that were not part of Version 6.
- New “Save Food Packaging” design-principle requirements push packaging decisions toward sustainable design.
- PRP references also move from ISO/TS 22002-x to the newer ISO 22002-x:2025 series alongside this update.
- US sites already certified move to Version 7 at their next surveillance or recertification audit.
- FSSC has published a transition timeline; confirm exact cascade dates with your certification body.
- Version 6 certificates remain valid and auditable in the USA during the official transition window.
- Auditors will expect documented evidence of food loss and packaging practices, not just a written policy.
What the New Sustainability Requirements in FSSC 22000 Version 7 Actually Cover
Version 7 formally introduces Food Loss & Waste management expectations, asking certified organizations to identify, measure, and actively work to reduce food loss across their operations rather than treat it as an informal operational side effect. This sits alongside, and is separate from, the scheme’s existing food safety requirements, meaning it is assessed as its own set of expectations rather than folded quietly into general PRP compliance.
The second addition, Save Food Packaging design-principle requirements, pushes packaging decisions toward choices that protect food safety while reducing unnecessary material, supporting recyclability, and avoiding packaging that contributes disproportionately to waste. For US manufacturers that already navigate FDA packaging and labeling rules, this is an additional lens on packaging decisions rather than a conflicting one.
Neither requirement exists in Version 6. They arrive alongside the broader Version 7 update, which also moves PRP references to the ISO 22002-x:2025 series and updates auditor qualification requirements to align with the GFSI Benchmarking Requirements version 2024, so sustainability is one part of a wider refresh rather than a standalone add-on.
For a US site, the practical takeaway is that these are audited, evidence-based requirements, not voluntary best-practice suggestions layered on top of the certificate. Once your site transitions to Version 7, an auditor will expect to see the same kind of documented objectives, ownership, and monitoring for food loss and packaging that already applies to established food safety clauses.
Why FSSC Added Sustainability Now: GFSI, ISO 22000, and Industry Direction
FSSC 22000 is built on the ISO 22000 food safety management standard and benchmarked against GFSI requirements, which means the scheme evolves alongside both ISO’s periodic standard revisions and GFSI’s own benchmarking cycle. Sustainability has become a mainstream expectation from retailers, regulators, and buyers across the US food supply chain, and building Food Loss & Waste and packaging expectations directly into FSSC 22000 keeps the scheme aligned with where the industry is actually moving.
This is not the first time FSSC has expanded scope beyond narrow food safety hazards; the scheme has always combined ISO 22000’s hazard-based approach with additional FSSC-specific requirements layered on top. The sustainability clauses extend that same pattern, adding measurable, auditable expectations rather than vague sustainability language that would be difficult for an auditor to assess consistently.
For US organizations, this also means sustainability claims that may already appear in corporate reporting or customer communications now have a formal certification touchpoint, which can strengthen those claims when they are backed by an FSSC 22000 Version 7 certificate rather than left as unverified marketing statements.
It also reflects how FSSC 22000 has always worked: ISO 22000 provides the food safety hazard management backbone, while FSSC layers additional, more specific requirements on top through its GFSI-benchmarked scheme document. Sustainability is simply the newest layer added to that structure, following the same pattern the scheme has used for PRP references and additional requirements since it was first developed.
What US Food Manufacturers Should Do to Prepare
Start by mapping current food loss data. Most US sites already track some waste and yield figures for cost-control reasons; the work here is turning that informal tracking into a documented Food Loss & Waste management process with defined ownership, reduction goals, and a way to demonstrate progress to an auditor.
Next, review packaging specifications against the Save Food Packaging design principles. This usually means a conversation between quality, packaging engineering, and procurement teams about material choice, recyclability, and whether packaging is sized and designed to protect the product without generating unnecessary waste. Document the rationale behind current packaging decisions even where no changes are needed, since auditors will want to see that the decision was made deliberately.
Finally, confirm your transition date with your certification body rather than assuming a single published cutover applies to your site. Because Version 6 certificates remain valid and auditable during the transition window, there is time to build these processes properly rather than rush documentation together right before an audit.
It also helps to loop in operations and site leadership early rather than treating sustainability as a quality-department-only initiative. Food loss data usually lives with production and inventory teams, and packaging design decisions usually involve procurement and engineering, so cross-functional input tends to produce stronger, more auditable evidence than a policy written by the quality team in isolation.
Common Mistakes US Sites Make With the Sustainability Update
The most common mistake is treating the sustainability requirements as a corporate social responsibility exercise disconnected from the certification audit. Food Loss & Waste and Save Food Packaging are formal Version 7 requirements, and auditors will expect the same kind of documented evidence, ownership, and measurable objectives they expect for any other clause in the scheme.
A second mistake is assuming existing sustainability initiatives automatically satisfy the new requirements. A general corporate sustainability program may cover similar ground, but it needs to be explicitly connected to the FSSC 22000 management system, with clear links to food loss data and packaging design decisions, for an auditor to credit it as compliance.
A third mistake is delaying action until a firm cutover date is announced. Because exact cascade dates vary and should be confirmed with your certification body, waiting for a single universal deadline risks leaving preparation until too close to your actual scheduled audit.
A fourth mistake is treating the two new clauses as a one-time documentation exercise rather than an ongoing management process. Auditors will look for evidence that food loss data and packaging decisions are reviewed and updated over time, similar to how other continuous-improvement elements of the food safety management system are expected to function, not a policy written once and left unchanged.
How IAS Training Prepares Your Team for the Version 7 Sustainability Clauses
Because Food Loss & Waste and Save Food Packaging are new subject areas rather than refinements of existing PRP clauses, most teams benefit from structured training that walks through exactly what evidence an auditor will look for, rather than trying to interpret the scheme text alone.
We recommend that USA-based quality and food safety teams explore our FSSC 22000 Lead Auditor and Internal Auditor Training programs so both lead auditors and internal auditors understand how the sustainability clauses fit alongside the updated PRP references and auditor competence requirements in a single Version 7 audit.
If your organization operates multiple sites or wants the full context before choosing a specific course, our complete FSSC 22000 Version 7 guide covers every Version 7 change in one place, which is a useful starting point for planning training across a broader US site network.
FSSC 22000 Version 6 vs Version 7: Sustainability Requirements at a Glance
| Aspect | Version 6 | Version 7 |
|---|---|---|
| Food Loss & Waste management | No dedicated requirement | Formal expectation to identify, measure, and reduce food loss |
| Packaging design | General food-safe packaging expectations only | Adds Save Food Packaging design-principle requirements |
| PRP standard references | ISO/TS 22002-x series | ISO 22002-x:2025 series |
| Certification path for existing US sites | N/A | Transition occurs at the next scheduled surveillance or recertification audit |
| Certificate validity during transition | N/A | Version 6 certificates remain valid and auditable throughout the transition window |
Note: exact FSSC 22000 Version 6 to Version 7 transition/cascade dates should be confirmed directly with your certification body.
About the author
Dr. C.D. Mohana Priya is a molecular geneticist, Associate Professor (Research) at Sri Ramachandra Institute of Higher Education and Research, Chennai, and an ISO 22000:2018 Lead Auditor, ISO 9001:2015 Lead Auditor and ISO 15189:2022 Internal Auditor. With 15+ years spanning laboratory quality management, food-safety systems and management-system training, she brings a scientific, standards-based rigor to FSSC 22000 auditor education.
Frequently Asked Questions
What is the Food Loss & Waste requirement in FSSC 22000 Version 7?
It is a new Version 7 expectation that certified organizations identify, measure, and actively work to reduce food loss across their operations, with documented evidence rather than an informal practice.
What does “Save Food Packaging” mean in FSSC 22000 Version 7?
It refers to new design-principle requirements pushing packaging decisions toward choices that protect food safety while reducing unnecessary material and supporting more sustainable packaging design.
Do US-certified sites need a new audit for the sustainability requirements?
No. Already-certified US sites pick up the new sustainability requirements at their next scheduled surveillance or recertification audit rather than through a separate certification process.
Is this sustainability update mandatory for FSSC 22000 certification in the USA?
Yes. Food Loss & Waste management and Save Food Packaging are formal Version 7 scheme requirements, not optional guidance, once your site transitions from Version 6.
When will my US site need to meet the new sustainability requirements?
FSSC has published a transition timeline, but exact cascade dates vary, so confirm your specific transition date directly with your certification body.
Share this entry
- Share on Facebook
- Share on Twitter
- Share on WhatsApp
- Share on Pinterest
- Share on LinkedIn
- Share on Tumblr
- Share on Vk
- Share on Reddit
- Share by Mail
https://ias-certification.com/wp-content/uploads/2026/09/us-fssc-22000-v7-food-loss-packaging.jpg
466
700
iasiso
https://ias-certification.com/wp-content/uploads/2025/05/IAS-Logo-2.webp
iasiso
2026-09-03 05:29:18
2026-11-05 10:04:34
FSSC 22000 V7 Goes Green: New Food Loss & Packaging Rules for USA
Contact Us
ISO 22000: Auditing Food Fraud and Authenticity
ISO 22000 Food Fraud and Authenticity: How Auditors Assess Your FSMS
Food fraud is the economically motivated adulteration, substitution, mislabelling, or counterfeiting of food, and while base ISO 22000:2018 does not mandate a full food fraud program, GFSI-recognized schemes built on it — notably FSSC 22000 — require a documented food fraud vulnerability assessment and mitigation plan that auditors verify. For food businesses, understanding where food safety management ends and food fraud prevention begins is essential to passing an audit and protecting product authenticity across the supply chain.
- Published
- Reading time
- — min
This guide explains what food fraud and authenticity mean in practice, how they differ from food defense, where they fit within ISO 22000 and FSSC 22000, and exactly what an auditor examines when assessing your controls.
What Food Fraud and Authenticity Mean
Food fraud is a deliberate act carried out for economic gain. Someone dilutes, substitutes, mislabels, or counterfeits a product to increase profit or reduce cost, usually without regard to whether the result is safe. Common forms include:
- Dilution — extending a genuine ingredient with a cheaper substance (for example, adding water or a filler to a concentrate).
- Substitution — replacing a high-value ingredient with a lower-value one, such as swapping one fish species or oil for another.
- Mislabelling — making false claims about origin, species, grade, or production method.
- Counterfeiting — copying a brand, packaging, or certification to pass off an imitation as genuine.
Authenticity is the flip side of fraud. It is the assurance that a product is genuinely what it claims to be — that its stated origin, species, composition, and processing method are true. When authenticity controls are strong, fraudulent product is far harder to introduce and far easier to detect.
Both concepts matter because food fraud can be a safety hazard as well as a commercial and reputational one. An undeclared substitution may introduce an allergen or a contaminant that the food safety management system (FSMS) was never designed to catch.
Food Fraud vs Food Defense (VACCP vs TACCP)
These two terms are frequently confused, and auditors expect organizations to distinguish them clearly.
- Food fraud is economically motivated. The intent is financial gain, and the tool used to manage it is a food fraud vulnerability assessment — sometimes called VACCP (Vulnerability Assessment and Critical Control Points). It leads to a mitigation or prevention plan.
- Food defense addresses intentional, malicious contamination — deliberate harm, sabotage, or terrorism. The tool used to manage it is a threat assessment, sometimes called TACCP (Threat Assessment and Critical Control Points).
Both sit alongside — but are distinct from — the HACCP hazard analysis, which addresses unintentional biological, chemical, and physical hazards. A mature food safety program treats all three as complementary layers.
How Food Fraud and Authenticity Fit ISO 22000 and FSSC 22000
This is where accuracy matters most, because the requirements differ depending on which scheme you certify against.
ISO 22000:2018 is the international FSMS standard. It builds on HACCP principles and prerequisite programs (PRPs) and uses risk-based thinking throughout. However, base ISO 22000:2018 does not by itself mandate a dedicated food fraud vulnerability assessment or a formal food defense program. Organizations certified only to ISO 22000 may address fraud through general risk management, but the standard does not prescribe a full program.
FSSC 22000 is a GFSI-recognized certification scheme built on ISO 22000 plus sector-specific prerequisite programs and additional requirements. Unlike base ISO 22000, FSSC 22000 does require certified organizations to conduct and document:
- A food fraud vulnerability assessment and a corresponding mitigation plan, and
- A food defense threat assessment and plan.
Other GFSI-recognized schemes (such as BRCGS and SQF) carry comparable requirements. So when a client asks whether they “need” a food fraud program, the honest answer is: it depends on the scheme. If your customers or markets expect GFSI recognition — and many retailers do — FSSC 22000 and its food fraud and food defense requirements are typically the relevant benchmark.
For a foundation in the underlying methodology, many organizations first establish HACCP certification and strong ISO 22000 certification before layering on GFSI-scheme requirements.
The Food Fraud Vulnerability Assessment
The vulnerability assessment is the analytical core of any credible food fraud program. Its purpose is to identify where in your materials, products, and supply chain fraud is most likely to occur, and how significant the impact would be. A practical assessment typically works through the following steps:
- Map materials and products. List raw materials, ingredients, packaging, and finished products, along with their suppliers and supply routes.
- Assess vulnerability factors. For each material, consider the drivers of fraud — price volatility, complexity of the supply chain, ease of adulteration, history of fraud in that commodity, geographic and economic pressures, and the reliability of the supplier.
- Evaluate opportunity and detectability. Determine how easy it would be to introduce fraud and how likely existing controls are to catch it.
- Prioritize the risks. Rank materials so that mitigation effort focuses where vulnerability is highest.
- Build the mitigation plan. Assign specific, proportionate controls to significant vulnerabilities — for example, supplier approval and audits, certificates of analysis, mass-balance checks, authenticity testing, and tighter specifications.
- Review and update. Reassess when suppliers, materials, markets, or fraud intelligence change, and at planned intervals.
The output is not a one-off document. It is a living assessment supported by a mitigation plan that names the controls, the owners, and the verification activities that keep fraud out.
What an Auditor Checks
When an auditor assesses food fraud and authenticity controls — most rigorously under FSSC 22000 or another GFSI scheme — they are looking for evidence that the program is real, current, and effective rather than a paper exercise. Expect the auditor to review:
- The vulnerability assessment itself — its scope, methodology, and whether it covers all relevant materials and products.
- The mitigation plan — whether identified vulnerabilities are matched to proportionate, documented controls with clear responsibility.
- Supplier controls — approval processes, supplier questionnaires and audits, specifications, and how supply chain changes are managed.
- Testing and verification — authenticity or species testing, certificates of analysis, mass-balance reconciliation, and traceability exercises that confirm what is claimed.
- Records and traceability — the ability to trace a product one step back and one step forward, and to demonstrate that controls were actually performed.
- Review and improvement — evidence that the assessment is reviewed after incidents, intelligence changes, or at defined intervals.
Auditors also check that food fraud and food defense are addressed as distinct topics, that responsibilities are assigned, and that staff understand the difference between fraud, defense, and conventional food safety hazards. A clear understanding of the ISO audit procedure helps organizations prepare the right records in advance, and companies that want this expertise in-house often send their audit leads through ISO 22000 lead auditor training.
Building Resilience Against Food Fraud
Passing the audit is the minimum; the goal is genuine resilience. Organizations that manage fraud well tend to share several habits:
- Supply chain transparency. They know their suppliers, their suppliers’ suppliers where it matters, and the routes their materials travel. Shorter, better-understood chains are harder to compromise.
- Intelligence-led review. They monitor commodity-specific fraud trends and adjust their vulnerability assessment as risks shift, rather than treating it as an annual formality.
- Layered verification. They combine documentary checks (certificates, specifications) with physical and analytical checks (testing, mass balance) so a single weak control does not expose the whole system.
- Robust prerequisite programs. Strong PRPs and good manufacturing practices reduce opportunity throughout the operation. Facilities pursuing cGMP certification often find these foundations reinforce fraud controls.
- A culture of authenticity. Staff at every level understand why authenticity matters and feel able to raise concerns.
Resilience is built through continual improvement — the same plan-do-check-act discipline that underpins the wider FSMS. Each incident, near miss, or audit finding becomes an input to a stronger next cycle.
How IAS Supports Your Certification
Integrated Assessment Services (IAS) certifies organizations to ISO 22000 and related food safety standards, helping food businesses demonstrate that their management systems — including their approach to food fraud and authenticity — meet recognized requirements. Through structured, independent auditing, IAS helps organizations confirm that their vulnerability assessments, mitigation plans, supplier controls, and verification records stand up to scrutiny.
IAS also offers practitioner training, including ISO 22000 internal auditor training, so that internal teams can build and maintain these programs with confidence. You can review upcoming courses on the training schedule, explore the full range of standards on the ISO certification hub, or contact us to discuss certification for your organization. IAS has a formal group-company association with Empowering Assurance Systems (EAS), which provides certification and inspection services internationally.
Frequently Asked Questions
Does ISO 22000:2018 require a food fraud vulnerability assessment?
What is the difference between food fraud and food defense?
What is a food fraud vulnerability assessment?
What does an auditor check for food fraud and authenticity?
What does food authenticity mean?
Is food fraud a food safety issue or only a commercial one?
Contact Us
HACCP Certification Cost
HACCP Certification Cost in USA: A Complete Guide
- Published
- Reading time
- — min
Need a straight answer about HACCP certification cost at your own site? Tell us what you make, where you make it and how many shifts you run, and we will scope it properly. Start with HACCP certification in the USA, read the IAS blog on what certification costs or contact the IAS team.
Nobody searches for HACCP certification cost out of curiosity. They search because a buyer, a retailer, a co-packer or an insurer has asked for the certificate, and somebody has to put a number in a budget line. This guide will not print that number. It does something more useful. It shows you what the number is made of, which parts you control, and which parts are set by the shape of your own operation.
That is not evasion. A certification quote is built from your facts, not from a rate card. Two bakeries on the same street can sit far apart because one runs a single shift and one product family, while the other runs three shifts, two buildings and a co-manufacturing agreement. A published figure would be wrong for almost everyone who read it.
✓ IAS is accredited by UQAS | ✓ Food safety audits by sector-experienced auditors | ✓ Clear scoping before any proposal | ✓ Training and certification under one roof
Why this HACCP certification cost guide contains no price figures
Certification is priced from effort, and effort is estimated from evidence about your business. Before anyone can quote, they need your scope, your process count, your site count, your headcount across shifts, and the hazard profile of what you handle. Change any of those and the effort changes with it.
You will find pages online that publish a range. Treat them carefully. A range wide enough to be honest is too wide to budget against. A range narrow enough to budget against is hiding assumptions about size and risk that probably do not match yours. The rest of this guide is about the drivers behind the cost of HACCP certification instead, and the same logic runs through every ISO certification in the USA scheme we audit. Read it with a pen.
Who IAS is, and who assesses IAS
Integrated Assessment Services, trading as IAS, audits and certifies management systems, and food safety sits alongside the other system certification schemes it runs. When IAS audits your food safety system and issues a certificate, that certificate carries weight only if someone independent has checked that IAS itself works properly. That is what accreditation is for.
IAS is accredited by UQAS. UQAS assesses IAS against the requirements that apply to certification bodies: auditor competence, impartiality, how decisions are made, how complaints are handled, and how certificates are granted, suspended and withdrawn. It is a recurring assessment, not a one-time stamp.
One point deserves saying plainly, because it is often blurred. Accreditation is an assessment of IAS. It is not a recommendation of any certified food business. Your certificate says your system was audited and found to conform. It does not say an accreditation body examined your business or approved your products.
Why this belongs on a cost page: accreditation is part of what you are buying. An audit run under an accredited scheme has rules about auditor qualification, audit planning, evidence and decision review. Those rules take time, and time is the main input to price. An unaccredited certificate is cheaper because less happens.
The scope decision that sets the size of everything
Scope is the largest single lever on cost, and it is decided before any auditor arrives.
Scope answers three questions. Which products or product families are covered? Which processes, from intake to dispatch? Which physical locations? Every yes adds hazard analysis work, adds documents, adds records to sample and adds audit hours.
The common mistake is scoping wide to impress a customer. A scope covering every line you have ever run, including the seasonal one you make twice a year, costs more to prepare, more to audit and more to maintain. Scope what you genuinely sell today.
The opposite mistake is scoping so narrow that the certificate does not satisfy the buyer who triggered all this. Read their request carefully. If they named a product, a facility or a process, your scope statement must cover it in words they will recognize.
What actually drives HACCP certification cost
Nothing in this table is a price. Every row is a question a scoping conversation will ask, and why the answer moves effort up or down.
| Driver | Why it moves effort | What pushes it upward |
|---|---|---|
| Scope breadth | Each product family carries its own hazard analysis and records | Many unrelated product types on one certificate |
| Number of sites | Each location needs its own evidence and usually its own visit | Multiple plants, separate warehouses, off-site storage |
| Process complexity | More steps means more hazards to analyze and more controls to verify | Thermal processing, allergens, raw and ready-to-eat under one roof |
| Hazard profile | Higher-risk categories demand deeper verification | Ready-to-eat, vulnerable-consumer products, allergen claims |
| Headcount and shifts | Auditors sample people and practice, not just paper | Several shifts, high turnover, agency labor |
| System maturity | A system already running generates its own evidence | Starting from nothing, or from a folder nobody opens |
| Internal capability | Someone in-house who understands the system shortens everything | No trained internal auditor, no named HACCP team leader |
| Corrective action load | Findings must be closed and the evidence reviewed | Major nonconformities at the certification audit |
| Travel and access | Auditor time on the road is still auditor time | Remote sites, restricted access windows, seasonal shutdowns |
Read the right-hand column as a checklist. Most of it is within your control, and several rows can be improved before you request a proposal. The same drivers shape effort on adjacent schemes too, which is why the cGMP certification and product certification pages describe scoping in much the same terms.
Preparation is where most of the effort sits
This surprises people. The audit is the visible event, so it gets the attention. But for a business starting without a working system, the larger share of total effort goes into preparation, and most of that is your own people’s time.
Preparation means writing prerequisite programs that describe what you actually do. It means a HACCP team with real authority. It means doing the hazard analysis honestly, identifying critical control points, setting limits you can hold, and building monitoring a supervisor can run on a busy Friday. Then it means running the system long enough to produce records.
That last part is the one people skip, and the most expensive thing to skip. An auditor needs evidence that the system has operated, not only that it has been written. A system switched on the week before the audit has nothing to show. Our guide to HACCP certification requirements sets out what must exist before you book anything, and how to get HACCP certification walks the sequence in order.
Who does the work matters too. In-house effort consumes hours but builds knowledge that stays. Consultant effort is faster but leaves less behind unless you insist on handover. Training sits between the two: HACCP training in the USA and internal auditor training put the capability inside your building, which lowers what you spend in every later year. Teams that also run a food safety management system often add ISO 22000 internal auditor training, or ISO 22000 lead auditor training for the person who will own the program.
The audit stages you are paying for
A certification audit is not one visit. Understanding the stages shows where effort accumulates.
You scope and apply. The certification body reviews your documented system and says whether it is ready. An on-site audit examines the system in operation, sampling records, watching practice and interviewing people at every level. Findings are raised and you close them with evidence. An independent reviewer inside the certification body then makes the decision — the auditor does not grant the certificate. Surveillance then keeps it alive. The certification process page sets out the full sequence, and the audit procedure page explains how the audit is conducted.
Each stage has a cost consequence. A documentation review that returns significant gaps means rework before anyone travels. Findings mean time closing them and time reviewing the closures. Unready systems consume more of everyone’s hours.
Who does what, and who pays for it
Confusion about responsibility creates unplanned cost. This is the split.
| Activity | Your organization | Certification body |
|---|---|---|
| Defining scope | Proposes what to cover, supplies the facts | Confirms it is auditable and states it on the certificate |
| Hazard analysis and CCPs | Owns it entirely | Audits it, cannot write it for you |
| Procedures and records | Owns it entirely | Reviews the documented system |
| Training your team | Arranges and pays for it | Delivers training as a separate service |
| Running the system before audit | Owns it entirely | Requires evidence that it ran |
| Audit planning | Provides access and availability | Plans the audit, assigns competent auditors |
| Findings | Responds with root cause and correction | Raises and evaluates them |
| Closing findings | Supplies the corrective action evidence | Reviews, accepts or rejects the evidence |
| The certification decision | No role | Independent review and decision inside the body |
| Mark usage | Uses the mark correctly | Publishes the rules, monitors misuse |
| Maintaining the system between audits | Owns it entirely | Verifies it at surveillance |
The middle column carries the important lesson. A certification body cannot design your system and then audit it — impartiality rules forbid it. If you need someone to build the system, that is a separate engagement, budgeted separately. Mark usage also carries rules worth reading early; see the logo usage guideline.
Ready versus not ready
Most avoidable cost comes from arriving unready. Here is what each state looks like on the floor.
| Area | What ready looks like | What unready looks like |
|---|---|---|
| HACCP team | Named members, defined roles, a leader with authority | One person doing it alongside another full-time job |
| Hazard analysis | Written for your actual process, step by step | Copied from a template for a different product |
| Critical limits | Defensible, and achievable in real production | Numbers nobody on the floor recognizes |
| Monitoring | Logged at the stated frequency, signed, legible | Gaps on weekends and night shifts |
| Corrective actions | Recorded, including the decision on affected product | A note saying “fixed” with no product decision |
| Verification | Scheduled, performed, documented independently of monitoring | Planned but never done |
| Internal audit | Completed across the scope, findings closed | Not started, or done by the procedure’s author |
| Management review | Held, minuted, with decisions and owners | An email saying everything is fine |
| Staff awareness | Operators explain their own CCP without prompting | Only the quality manager can answer anything |
Every row on the right is a likely finding. Findings extend the audit, delay the certificate and consume your team’s time twice — during the audit, and again afterward.
What makes HACCP certification cost go up
Some increases are unavoidable because they reflect genuine complexity: multiple sites, higher-risk categories, allergen segregation, processes with several critical control points. If you run raw and ready-to-eat product in one building, the verification burden is real and preparation does not remove it.
Self-inflicted increases are different. Scoping wider than needed. Booking the audit before records exist. Losing your trained HACCP leader with no successor. Treating the system as a binder rather than a way of running the plant. Letting monitoring lapse between surveillance visits, so each one becomes a recovery exercise.
There is also the cost of switching. Changing certification bodies mid-cycle usually means a fresh certification audit rather than picking up the surveillance schedule. Choose deliberately the first time.
What you can do to bring it down
Scope tightly and honestly. Cover what you sell and what your customer asked about. Extend later when you need to.
Run the system before you book. Give it enough operating time to generate genuine records. This one decision removes more findings than anything else.
Build capability inside. A trained internal auditor and a competent team leader cut preparation time, cut findings and cut dependence on outside help every year afterward. The training schedule is the place to start, and the wider ISO training in the USA and GMP training listings show what else your team can pick up in the same trip.
Fix the obvious first. Audit yourself against the right-hand column above and close what you find. Fixing a gap yourself costs far less than fixing it under a finding.
Combine what can be combined. If you are also pursuing ISO 22000, FSSC 22000 or BRC or ISO 9001, say so at scoping. Shared documentation and coordinated visits reduce duplicated effort. Raise it early; combining is hard once the plans are written.
Budget HACCP certification cost for the cycle, not the event
A certificate is not a purchase. It is a cycle. Budgeting for the first audit alone is the most common planning error on a food safety program.
Across the certificate’s life, expect the initial certification work, surveillance at defined intervals, recertification at the end of the cycle, the internal cost of maintaining monitoring and verification, and training for new staff. If you run an environmental or occupational health and safety system as well, the ISO 14001 and ISO 45001 cycles follow the same rhythm and can be planned against the same calendar.
Then there are changes. A new line, a new site or a new product category may need the scope extended, and an extension is assessed on its own merits. Tell your certification body when material changes happen, not at the next surveillance visit. Late disclosure is more disruptive than early notice.
What a HACCP certificate is evidence of
Be precise about this, internally and with customers.
A HACCP certificate means that, on the audit dates, a competent auditor sampled your documented food safety system and its operation within the stated scope and found it conforming. It means an independent decision-maker inside the certification body reviewed that evidence and granted the certificate.
It does not mean every batch you produce is safe. It does not cover every site or product you own — only what the scope states. It does not test your products, and it is not a product approval. It is not a guarantee of any outcome, and it does not replace your own controls between audits. An audit is a sample taken at a point in time. The safety of what leaves your dock each day is produced by your people, not by the certificate on the wall.
Say this plainly to your sales team, before they say something else to a customer.
On legal duties
This page makes no claim about the law in any country, state or municipality. It does not tell you what any regulator requires of your business, and nothing here should be read as a statement of your legal obligations.
Food businesses operate under rules that vary by jurisdiction, by product category and by sales channel. Certification and legal compliance are different things, and one does not stand in for the other. Take your legal duties to your own attorney or regulatory advisers and decide with them what applies. Use this page for what it is: an explanation of how certification effort is priced.
Get a scoped HACCP certification cost proposal instead of a guess. Send us your scope, sites, shifts and product families, and we will tell you what the work involves. Visit IAS, browse the IAS blog or get in touch.
Frequently asked questions
Why will nobody publish a HACCP certification cost or a fixed HACCP certification price?
Because effort is estimated from your facts — scope, sites, processes, shifts, hazard profile. A published figure would be wrong for most readers. A scoped proposal is built against your actual operation.
What information do I need before asking for a HACCP certification cost quote?
Your proposed scope in words, your product families, your site addresses, your process steps from intake to dispatch, your headcount across shifts, and whether a working system already exists.
Is preparation or the audit the bigger part of the effort?
For a business starting without a system, preparation usually dominates, and most of it is your own team’s hours. With a mature system already running, the balance shifts toward the audit and the surveillance cycle.
Can IAS build my HACCP system and then certify it?
No. Impartiality rules prevent a certification body from designing the system it audits. Building the system is a separate engagement with a separate provider.
Does IAS hold accreditation?
Yes. IAS is accredited by UQAS. That accreditation is an assessment of IAS as a certification body — its auditor competence, impartiality and decision-making. It is not an endorsement of any organization IAS certifies.
Will a bigger scope always raise HACCP certification cost?
More scope means more hazard analysis, more records and more audit coverage, so yes, effort rises. Scope what you sell and what your customer asked for, then extend when you need to.
What happens if the auditor raises findings?
You investigate the root cause, correct it and submit evidence. The certification body reviews that evidence before the decision. Findings are normal; a large number of them signals the system was audited before it was ready.
Does certification end once the certificate is issued?
No. Surveillance continues through the cycle and recertification follows at the end of it. A system that lapses between audits turns each surveillance visit into a recovery exercise.
Can HACCP be combined with other food safety certifications?
Often, yes. Sites pursuing ISO 22000 or FSSC 22000 share documentation and internal audit effort with HACCP. Raise it at scoping so audit plans can be coordinated from the start.
Does the certificate cover all my sites automatically?
No. Only what the scope states. Adding a site or a product category means the scope must be extended and assessed. Tell the certification body when the change happens.
Where can I read more before deciding?
Start with HACCP certification in the USA, then the general certification FAQ and what drives certification cost across schemes. If cGMP is on your list as well, the cGMP internal auditor training page explains how that capability is built in-house.
Contact Us
HACCP Certification Requirements
HACCP Certification Requirements: The 7 Principles, PRPs & Documentation
To meet HACCP certification requirements, a facility must build a food-safety plan on the seven Codex Alimentarius HACCP principles, supported by prerequisite programs (PRPs) such as GMPs and SSOPs, and back it with complete documentation and records. In practice, that means analyzing hazards, identifying and controlling critical control points (CCPs), setting critical limits, monitoring them, correcting deviations, verifying the system works, and keeping the records that prove it. This guide breaks down exactly what your organization needs in place before an audit — and how HACCP certification works with IAS.
- Published
- Reading time
- — min
If you are looking for the practical, end-to-end process of applying and getting certified, read our companion guide on how to get HACCP certification. This page stays focused on the requirements themselves.
What HACCP Certification Actually Certifies
HACCP (Hazard Analysis and Critical Control Points) is a systematic, preventive approach to food safety. Rather than relying on end-product testing, it identifies where hazards can occur in a process and builds controls at those points. Certification is issued to organizations and facilities — not to individuals — confirming that a food business operates a HACCP-based food safety system that conforms to recognized requirements.
Because HACCP is process-specific, requirements are always applied to your particular products, ingredients, and operations. A cannery, a seafood processor, and a ready-meal kitchen will each have different hazards and different critical control points, even though all follow the same seven principles.
Before an assessment, it helps to think of the requirements in three layers: the prerequisite programs that keep your environment safe, the seven-principle HACCP plan that controls process-specific hazards, and the documentation that proves both are working. An auditor looks for all three — a strong plan on paper is not enough if daily records or basic hygiene programs are missing.
Prerequisite Programs (PRPs): The Foundation Beneath HACCP
A common mistake is treating the seven principles as the whole system. They are not. HACCP sits on top of prerequisite programs (PRPs) — the basic operational and hygiene conditions that must already be working before a HACCP plan can be effective. Without solid PRPs, too many hazards would have to be managed as critical control points, and the plan becomes unmanageable.
Core prerequisite programs a facility is expected to have in place include:
- Good Manufacturing Practices (GMPs): overall conditions and practices for producing safe food, including facility design, equipment, and process controls. See our overview of cGMP certification.
- Sanitation Standard Operating Procedures (SSOPs): documented cleaning and sanitizing procedures for equipment, surfaces, and the environment.
- Pest control: a documented program to prevent and monitor for pests.
- Personal hygiene and training: handwashing, protective clothing, health and hygiene rules for staff.
- Supplier and raw-material control: approved suppliers and specifications for incoming materials.
- Traceability and recall: the ability to trace product one step forward and one step back, plus a tested recall/withdrawal plan.
- Maintenance and calibration: upkeep of equipment and calibration of monitoring devices such as thermometers.
- Waste management and water safety: control of waste streams and potable water use.
These programs create the stable, hygienic baseline that lets your HACCP team focus its critical limits and monitoring on the points that truly matter.
The 7 HACCP Principles (Codex Alimentarius)
The seven principles are the heart of the HACCP certification requirements. A conforming plan addresses each one, in order.
1. Conduct a Hazard Analysis
Identify the biological, chemical, and physical hazards that could occur at each step of your process, from receiving raw materials through to distribution. For each hazard, assess how likely it is and how severe it would be, and describe the control measures that address it. This analysis is the evidence base for every decision that follows.
2. Determine the Critical Control Points (CCPs)
A critical control point is a step where control can be applied to prevent, eliminate, or reduce a hazard to an acceptable level. Examples include a cooking step that destroys pathogens, a metal-detection step, or a chilling step. Not every step is a CCP — the point is to identify the small number of steps where control is essential.
3. Establish Critical Limits
For each CCP, set a measurable critical limit that separates safe from unsafe. These are usually numeric — a minimum core cooking temperature and time, a pH threshold, a water-activity level, or a maximum metal-fragment size. Critical limits should be based on science, regulation, or validated data.
4. Establish Monitoring Procedures
Define how each CCP will be monitored to confirm it stays within its critical limit — what is measured, how, how often, and by whom. Monitoring must be reliable and timely enough to catch a loss of control before unsafe product reaches customers.
5. Establish Corrective Actions
Decide in advance what happens when monitoring shows a critical limit has not been met. Corrective actions cover both the affected product (isolate, evaluate, rework, or dispose) and the process (bring the CCP back under control and prevent recurrence). Each corrective action must be documented.
6. Establish Verification Procedures
Verification confirms the HACCP system is working as intended — separate from day-to-day monitoring. It can include reviewing records, calibrating instruments, testing product or the environment, and periodically reassessing (validating) the plan when products, processes, or regulations change.
7. Establish Documentation and Record-Keeping
The final principle ties the system together: maintain documentation of the plan and records that prove it operates. This is often what auditors scrutinize most closely, because records are the objective evidence that the other six principles are being applied every day.
Documentation and Records You Must Have in Place
To satisfy HACCP certification requirements, a facility typically maintains two layers of paperwork: the HACCP plan documents (what you intend to do) and the operating records (evidence of what you actually did).
Expected documentation includes:
- The HACCP plan itself, with scope, product descriptions, and intended use.
- A process flow diagram verified against the actual line, plus the hazard analysis worksheets.
- A CCP summary listing critical limits, monitoring, corrective actions, and verification for each CCP.
- Prerequisite program (PRP) procedures — GMPs, SSOPs, pest control, and the rest.
- Definition of the HACCP team and their responsibilities.
Expected records include:
- Monitoring records for every CCP (for example, cooking or cold-storage temperature logs).
- Corrective action records whenever a limit is exceeded.
- Verification and validation records, including audits and reviews.
- Calibration records for monitoring equipment.
- Training records for staff and the HACCP team.
- Traceability and recall test records.
Records should be legible, dated, signed or initialed, and retained for a defined period so they can be produced during an audit.
Who Needs HACCP and the US Regulatory Context
Many food businesses adopt HACCP voluntarily because customers, retailers, and export markets expect it. In several US sectors, however, HACCP-based controls are mandatory:
- Seafood and juice processing are regulated under FDA HACCP rules.
- Meat and poultry processing is regulated under USDA-FSIS, which requires HACCP systems in federally inspected establishments.
Typical organizations that pursue HACCP include food manufacturers and processors, packers, cold-storage and distribution operators, catering and food-service businesses, and suppliers to major retailers. If your customers audit their supply chain, a documented HACCP system is often a condition of doing business.
Even where HACCP is not legally required, a certified HACCP system demonstrates due diligence, supports compliance with broader food-safety expectations, and provides a strong foundation if you later pursue a full food safety management system such as ISO 22000 certification. For a wider view of management-system standards, see our ISO certification hub and our guide to general ISO certification requirements.
How IAS Certifies Your HACCP System
Integrated Assessment Services (IAS) assesses whether your organization’s HACCP system meets the applicable requirements. In broad terms, certification involves an application and review of your documented HACCP plan and PRPs, an on-site audit to confirm the system is implemented and effective, resolution of any findings, and issuing of the certificate — followed by periodic surveillance to confirm ongoing conformity. You can read the full certification process for details, and view upcoming courses on our training schedule if your team needs HACCP competency first.
IAS operates as part of a global network alongside its group company EAS, whose certification activities are JAS-ANZ-accredited and which is a CQI and IRCA Approved Training Partner for its applicable certified Lead Auditor courses. To scope your requirements or request a quote, contact us.
Frequently Asked Questions
What are the main HACCP certification requirements?
What are the 7 principles of HACCP?
What is the difference between PRPs and HACCP?
Is HACCP certification mandatory in the US?
Is HACCP certified to a person or to a company?
How is HACCP different from ISO 22000?
Contact Us
How to get HACCP Certification
How to Get HACCP Certification: A Step-by-Step Guide
To get HACCP certification, a food business must put working prerequisite programs in place, build and implement a HACCP plan based on the Codex Alimentarius seven principles, run an internal review, then pass an independent audit by an accredited certification body such as IAS. HACCP (Hazard Analysis and Critical Control Points) is a preventive food-safety management system, and certification is issued to an organization or facility, not to an individual. This guide walks you through the practical journey, one step at a time, so you know exactly what to do before you apply.
- Published
- Reading time
- — min
If you want the full breakdown of what the standard demands, read our companion guide on HACCP certification requirements, which covers the seven principles in depth. This page stays focused on the actions that get your facility certified.
Who Needs HACCP Certification?
HACCP applies to any organization that handles, processes, packs, stores, or distributes food and drink. In the United States, HACCP-based controls are mandated for certain sectors, including seafood, juice, and meat and poultry processors regulated by USDA FSIS. Many other food businesses pursue certification voluntarily because retailers, distributors, and export markets increasingly require documented food-safety controls before they will place an order.
Manufacturers, restaurants, catering operations, cold-storage providers, and ingredient suppliers all commonly seek HACCP certification. If your customers ask for proof of a food-safety system, or you plan to export, certification is usually the fastest way to demonstrate compliance and win trust.
The Roadmap: How to Get HACCP Certification
Getting certified is a project with a clear sequence. Follow these steps in order and the audit at the end becomes a straightforward confirmation of work you have already done.
Step 1: Establish Your Prerequisite Programs (PRPs)
HACCP does not work in isolation. It sits on a foundation of prerequisite programs (PRPs) that control the basic hygienic conditions of your operation. These include Good Manufacturing Practices (GMPs) and Sanitation Standard Operating Procedures (SSOPs), and they cover things like facility layout, equipment maintenance, pest control, cleaning and sanitation, water quality, waste handling, and personnel hygiene.
Before you build a single critical control point, confirm that these programs are documented and genuinely running on the floor. Weak prerequisite programs are one of the most common reasons a HACCP plan later fails, because they force the plan to try to control hazards that basic hygiene should have handled first. Get the foundation solid and everything above it becomes simpler.
Step 2: Assemble Your HACCP Team
HACCP is a team effort, not a document written by one person. Bring together people who understand your products, your processes, and your equipment. A typical team includes production, quality assurance, sanitation, maintenance, and management, and it should have access to someone with HACCP training or food-safety expertise.
Give the team a clear leader, define its scope (which products and processes it will cover), and make sure it has the authority to make changes. If your team lacks formal HACCP knowledge, this is the point to close that gap. Structured training builds the shared vocabulary the team needs, and you can review upcoming courses on the IAS training schedule.
Step 3: Build Your HACCP Plan Using the Seven Principles
With the team in place, develop your HACCP plan. The plan is built on the seven Codex Alimentarius principles: conduct a hazard analysis, determine critical control points (CCPs), establish critical limits, establish monitoring procedures, establish corrective actions, establish verification procedures, and establish record-keeping and documentation.
Before applying those principles, the team should describe each product, identify its intended use, construct a process flow diagram, and verify that diagram on site. Then work through the seven principles for each product or process line. Rather than repeat the detail here, follow the HACCP certification requirements guide, which explains each principle and what auditors expect to see. The output of this step is a written, product-specific HACCP plan that identifies your hazards, your CCPs, and how you will control and document them.
Step 4: Implement the Plan and Train Your Staff
A plan on paper controls nothing. Roll it out on the production floor: set up the monitoring at each CCP, put the record forms into daily use, and make sure corrective actions are understood before they are ever needed. Everyone whose job touches a critical control point must know their role, what limits to hold, what to record, and what to do when something drifts out of range.
Train your workforce and keep evidence of that training. Auditors will look for staff who can explain the system in their own words, not just a binder in the office. Run the system for long enough to generate real records, usually several weeks to a few months, so you have proof that it works in practice.
Step 5: Conduct an Internal Review
Before you invite an external auditor, check your own system. An internal audit and a management review confirm that your HACCP plan is being followed, that monitoring records are complete, and that any deviations were handled correctly. This is also where you close gaps: fix missing records, tighten procedures that are not being followed, and verify that corrective actions are documented.
Treat the internal review as a dress rehearsal for certification. Finding and fixing problems yourself is far cheaper and faster than having an auditor find them for you.
Step 6: Choose a Certification Body
HACCP certification carries weight only when it is issued by a credible, accredited certification body. Look for a body with recognized accreditation, experience in your food sector, auditors who understand your processes, and transparent timelines and pricing. Independence matters too: the body that certifies you should not be the one that wrote your plan.
IAS is an established certification body serving food businesses across the United States. You can learn more about our HACCP certification service and how the overall certification process works before you apply. Choosing the right partner early prevents surprises later in the audit.
Step 7: Complete the Certification Audit
The certification audit is where an independent auditor evaluates your system. It typically runs in two stages. In the first stage, the auditor reviews your HACCP plan, prerequisite programs, and documentation to confirm you are ready. In the second stage, the auditor visits your facility, observes operations at your CCPs, interviews staff, and examines records to confirm the system is implemented and effective.
If the auditor raises nonconformities, you will be given time to correct them and provide evidence of the fix. Once the auditor is satisfied that your HACCP system meets the requirements, the certification body issues your HACCP certificate to the facility.
Step 8: Maintain and Verify Your Certification
Certification is not a one-time event. To keep it valid, you must keep the system running and demonstrate it at periodic surveillance audits. Continue monitoring your CCPs, keeping records, reviewing your plan whenever a product, process, ingredient, or regulation changes, and running your internal audits and management reviews on schedule.
Reassess the full HACCP plan at planned intervals and whenever a significant change occurs, so the system keeps pace with your operation. Consistent verification is what turns a certificate on the wall into genuine, ongoing food safety.
How Long Does It Take to Get HACCP Certified?
Timelines vary with the size and complexity of your business and how mature your systems already are. A small operation with solid prerequisite programs may be ready in a couple of months, while a larger multi-line facility building its system from scratch can take longer. The two biggest levers are the strength of your prerequisite programs and the time you allow the implemented system to generate records before the audit. Businesses that invest in training and a thorough internal review almost always reach certification faster and with fewer nonconformities.
How IAS Helps You Get Certified
IAS supports food businesses through the entire journey to HACCP certification. As an accredited certification body, we conduct the two-stage audit, issue certification to facilities that meet the requirements, and carry out the surveillance audits that keep your certificate valid. Our auditors bring food-sector experience, and our published training schedule helps your team build the HACCP knowledge the standard expects.
If your food-safety goals extend further, we also certify related standards such as ISO 22000 certification and cGMP certification, and you can explore our full ISO certification hub for other management-system standards. If you are new to certification generally, our guide on the ISO certification process explains how a management-system audit works from start to finish. IAS works alongside global partners including EAS to deliver internationally respected certification. When you are ready to begin, contact us to discuss your facility and get a clear path to certification.