ISO 22000 Certification in USA

Few organizations set out wanting a food safety management system certificate for its own sake. A retailer asks. A distributor sends a supplier questionnaire. A co-packing customer updates its approved supplier list and a line on the form says “third-party FSMS certification.” That is usually how ISO 22000 certification lands on someone’s desk.

This page explains what the standard asks for, what an IAS audit looks at, and what the certificate does and does not say about your operation. It sits behind the main ISO 22000 service page for the USA and sticks to the mechanics — records, prerequisite programs, verification evidence — because that is where audits are won or lost.

What ISO 22000 asks of a food business

ISO 22000 is the international standard for a food safety management system. It applies along the whole chain: growers, processors, manufacturers, packers, storage and distribution, retail, catering, and the companies that supply equipment, packaging, cleaning chemicals and ingredients.

The standard combines three things that many plants already do separately. It takes hazard analysis and critical control point thinking, wraps it in a management system with policy, objectives and review, and requires prerequisite programs to be defined, applied and verified rather than assumed.

The practical effect is that informal practice has to become documented practice. A supervisor who “always checks the metal detector at start-up” needs a check record with a rejection test, a result and a name.

Who IAS is, and who accredits IAS

Integrated Assessment Services (IAS) is the certification body that carries out the audit and issues the certificate. IAS is accredited by UQAS. That accreditation is an independent assessment of IAS — of its impartiality arrangements, auditor competence, audit time decisions, decision-making separation and record control.

Say that plainly, because it is often misunderstood: accreditation is an assessment of the certification body, not an endorsement of any certified organization. UQAS does not audit your plant, does not review your hazard analysis and does not vouch for your product. It assesses whether IAS is competent to make certification decisions and consistent in how it makes them.

You can read more about the organization on the IAS about us page, and about how certification decisions are structured in the certification process.

What ISO 22000 certification covers on your site

A certificate is a statement about a system, on a defined scope, at a point in time. It is worth being precise about the boundary, because customers sometimes read more into it than it carries.

Certification is not a guarantee of product safety, and it is not a substitute for your own controls, your own testing or your own recall readiness. An audit samples. It looks at selected records, selected lines, selected shifts. A clean audit means nothing contradicting the standard was found in that sample.

Prerequisite programs: where most gaps show up

Prerequisite programs (PRPs) are the basic conditions that make hazard control possible. Cleaning and sanitation. Pest control. Personal hygiene and gowning. Water and air quality. Maintenance and lubricant control. Glass and brittle plastic. Allergen segregation. Waste handling. Supplier approval. Chemical storage.

The common failure is not absence. It is that PRPs exist as documents nobody verifies. There is a sanitation schedule, but no record of a completed verification swab or a visual sign-off by someone other than the person who cleaned. There is a pest control contract, but no review of trend data and no action on a device that catches repeatedly.

Auditors look for the loop: the program, the monitoring, the verification by a second party, and evidence that findings changed something. A program without that loop is a leaflet. Sites that want supervisors to understand the hygiene conditions underneath these programs often send them to GMP training or cGMP internal auditor training before the system work starts.

Verification records an auditor will ask for

This is the section worth rehearsing before an audit. The difference between a smooth audit and a difficult one is usually record quality, not intent.

Two details reliably cause findings. First, certificates of analysis that arrive and are filed without anyone comparing the result to the agreed specification. Second, traceability exercises that trace forward but never reconcile quantity — what was made, what shipped, what remains.

The ISO 22000 certification pathway, from application to certificate

The route is predictable. Knowing the order helps you avoid the classic mistake of booking a stage 2 audit before internal audits have actually run.

Stage 1 is a readiness review. The assessor looks at documented information, scope, hazard analysis, PRP list, internal audit and management review, and confirms the site is ready to be audited properly. It is diagnostic. Findings here are normal and are cheaper to fix than findings at stage 2.

Stage 2 is the implementation audit on site. Assessors follow processes, interview operators, watch a start-up check, pull records at random and test whether the system described on paper is the system running on the floor.

Nonconformities are then closed with evidence, not promises. An independent reviewer inside IAS — someone who did not audit you — checks the file before the certification decision is made. How the stages connect is described on the ISO audit procedure page.

Choosing between the schemes around ISO 22000

Customers name different schemes, and they are not interchangeable. Pick against the request you received, not against what sounds strongest.

FSSC 22000 also moves on its own schedule, and version 7 changed what sites report on food loss, waste and packaging — the note on FSSC 22000 version 7 sets out what that means in practice.

If you already run ISO 9001, the management clauses will feel familiar and internal audit planning can often be combined. Our ISO 9001 certification page covers that side, and auditors moving across both standards usually take ISO 9001 internal auditor training. The same combining logic applies if you hold ISO 14001 certification or ISO 45001 certification: one audit program can cover several systems without auditing the same evidence three times. For food fraud and authenticity controls, which increasingly appear in customer questionnaires, see the note on auditing food fraud and authenticity.

The three-year ISO 22000 certification cycle

Certification is not a single event. The certificate runs on a cycle, with surveillance audits between the initial audit and recertification.

Surveillance is narrower than the initial audit but not a formality. It typically looks at internal audit results, management review, complaints and corrective actions, changes to product or process, use of certification marks, and a sample of CCP and PRP records since the last visit. Recertification looks at the whole system again and considers performance across the full cycle.

Changes matter between visits. A new production line, a new allergen on site, a new high-risk ingredient or a move to a second facility should be reported rather than revealed at the next audit.

Getting the scope wording right

Scope is the most commercially important sentence on the certificate, and the one most often rushed. It names the activities, the product categories and the sites covered.

Write it the way your customer will read it. If the certificate says “manufacture of bakery products” but the customer buys frozen dough from a second site that was never audited, the certificate does not cover the purchase. Excluding a site to save time creates a problem later when a supplier questionnaire asks which facility produced the lot.

Certification marks have rules too. They belong on stationery and marketing, not on product or packaging in a way that implies product certification. What you may display is set out in the logo usage guideline.

Where ISO 22000 certification audits usually go wrong

Four patterns come up repeatedly.

• Internal audits run late or shallow. A single audit covering everything, a week before stage 2, with no findings. Auditors read that as a system nobody tested.
• Management review as a formality. Attendance recorded, decisions absent. The standard expects inputs, outputs, owners and dates.
• Hazard analysis copied from a template. Generic hazards for a generic plant, not the hazards of your ingredients, your layout and your flow.
• Validation confused with verification. Validation shows a control can work. Verification shows it did work. Both are needed, and they are separate records.

A fifth, quieter one: no evidence that the food safety team meets. The standard expects a multidisciplinary team, and an audit will ask who is on it and when they last sat down together.

Building internal capability

Two roles matter. Someone has to run internal audits competently, and someone has to understand the standard well enough to design the system rather than copy it.

Internal auditor training covers audit planning, evidence gathering, writing findings that identify a cause, and reporting in a way management can act on. Lead auditor training goes further into audit program management and team leadership. Both are available for ISO 22000 — internal auditor and lead auditor — and for FSSC 22000, at lead auditor and internal auditor level, where a GFSI-benchmarked scheme is required. Sites building hygiene fundamentals first often start with HACCP training before layering the management system on top.

Dates for public courses sit on the training schedule, and the wider ISO training range covers the other standards a food safety team is likely to meet.

A note on legal duties

Nothing on this page asserts what any country’s law requires. It describes a voluntary international standard and how a certification audit against it is run. Food businesses in the United States and elsewhere sit under their own statutory and regulatory obligations, and those obligations are not decided by a certificate. Whether ISO 22000 certification helps you meet any legal duty is a question for your own legal and regulatory advisers, who know your products, your sites and your markets. Nothing here is legal advice.

Frequently asked questions