Krolda
Early access

FSSC 22000: Food Safety System Certification 22000

FSSC 22000 is a GFSI-recognised certification scheme built on top of ISO 22000, which is what makes it different from the other recognised schemes: a site already running an ISO management system recognises its structure immediately, and a site certified to ISO 22000 alone is not GFSI-recognised.

What it is
Certification scheme
Published by
Foundation FSSC
GFSI recognised
Yes
When it started
2009
Where it is used
Global manufacturing, strongest where ISO management systems are already in place
Issue Krolda maps
v6

What FSSC 22000 is

Article updated 2026-10-18. The product mapping issue and its check date are stated separately below.

FSSC 22000 is published by the Foundation FSSC, a Dutch non-profit. Its three components are ISO 22000 for the food safety management system, the prerequisite programme specification assigned to the site's sector, and additional FSSC requirements. The scheme version matters: Version 7 uses the ISO 22002-x:2025 series, replacing the earlier ISO/TS specifications used in Version 6.

The prerequisite programme specification depends on the sector. Food manufacturing, animal food, catering, transport and storage, packaging manufacturing and several others each have their own, and a certificate names the applicable one.

Because ISO 22000 follows the harmonised structure common to ISO management system standards, FSSC 22000 sits naturally alongside ISO 9001 and other ISO certifications, and a site holding several of them can run one integrated management system and one internal audit programme.

The Foundation publishes the full scheme document free of charge, which is unusual among certification schemes and is the reason Krolda is able to map it in full. The copyright remains with the Foundation and the text is not reproduced on this site.

The three documents it is assembled from

FSSC 22000 is not a standard written from scratch. It is a certification scheme that combines three things, and understanding which part a requirement comes from is most of understanding the scheme.

The first is ISO 22000, which supplies the food safety management system. The second is the prerequisite programme specification assigned to the food-chain category in the applicable scheme version. Version 7 refers to the ISO 22002-x:2025 series; an older Version 6 document may instead refer to ISO/TS specifications. The third is the Foundation's additional FSSC requirements, including food defense, food fraud mitigation, allergen management and environmental monitoring. Read all three layers against the same scheme version.

This is why a site can hold ISO 22000 and still have real work to do for FSSC 22000. The management system is already there; the prerequisite specification and the additional requirements are the gap.

FSSC 22000 versus ISO 22000: check the customer's requirement

ISO 22000 is a management system standard. It requires the organisation to determine its own prerequisite programmes appropriate to its operation, without specifying them. That is deliberate and is what lets one standard cover a farm, a factory and a caterer.

An ISO 22000 certificate does not by itself demonstrate FSSC 22000 certification. FSSC adds the specified prerequisite programme and its own requirements. Whether a customer accepts a certificate depends on that customer's supplier conditions: ask which scheme, activity and site scope they require rather than assuming every retailer makes the same demand.

The scheme family and its scopes

The scheme's food-chain categories determine which activities can be certified and which prerequisite programme specification applies. Check the category table in the version governing the audit. A certificate for one activity or site does not establish coverage of a different activity or location.

Because the scheme is assembled rather than authored, its version numbering refers to the FSSC scheme rather than to ISO 22000 underneath it. A change of scheme version can therefore alter the additional requirements while the ISO standard beneath is unchanged, which is the usual source of confusion when a site is told it must move version but sees nothing different in its management system standard.

Version 7 and a practical certification preparation check

Foundation FSSC published Version 7 in May 2026. Its updated prerequisite programme references mean that an old checklist should not be relabelled as a Version 7 assessment. Use the Foundation's scheme documents and ask the licensed certification body which version and transition arrangements apply to the planned audit. Krolda's mapped issue remains v6, shown below; this article's update does not claim that its product mapping has been upgraded.

Start a preparation record with the legal entity, physical site, activities and intended certification scope. List the three applicable document layers and their editions. Then connect each identified gap to the site's existing procedure, the operational record that demonstrates it, an owner and a review date. This working list is a preparation aid, not a replacement for the scheme or an auditor's decision.

For example, a procedure can explain how a check should work while a completed record shows whether it happened. Keep the controlled procedure and its completed evidence distinct, and record how an unresolved finding will be followed through. Before choosing software, try that evidence path on a real site record and check that the reviewer can trace it back to the original document.

Check a certificate in the official FSSC database

Use Foundation FSSC's Public Register to look up an organisation by its name or COID, the certified organisation identification code. Compare the organisation and site, certification status, scope and validity information with the certificate you were given. The Foundation also advises checking the certification and accreditation bodies against its official listings. If a certificate cannot be located, ask the Foundation to help verify it; absence alone should not be presented as proof of fraud.

Keep the date of the check and the record used for a supplier decision. Krolda's article is a guide to the verification path, not a substitute register and not a statement that a particular supplier is certified.

Primary sources: Foundation FSSC scheme documents, Version 7 changes and certification preparation. Verify certificates through the official Public Register and its certificate verification guidance.

How certification works

A site is audited by a certification body licensed by the Foundation FSSC and accredited to ISO/IEC 17021 for the scheme. Certification covers an initial audit, then surveillance audits within the certificate cycle, with a proportion of audits unannounced.

Because the scheme is built on ISO 22000, the audit covers management system requirements such as context, leadership, planning and improvement alongside the operational food safety requirements, which is a heavier documentation load than some other schemes at the management system end and a lighter one at the prescriptive end.

GFSI recognition

FSSC 22000 is a GFSI-recognised certification programme. ISO 22000 on its own is not.

GFSI does not certify anybody and there is no GFSI certificate. What GFSI recognition actually means.

Where this meets United States regulation

A site selling into the United States is held to 21 CFR whether or not it holds a certification. These are the parts that bear on FSSC 22000, reproduced in full on this site because title 21 is United States public domain.

What goes wrong in practice

Certification is a statement about a system on the day it was audited. FDA recall records are what happened afterwards, across the whole industry, and these are the hazards that appear most often in the records a plan built to FSSC 22000 is meant to control.

What Krolda does with FSSC 22000

The Foundation publishes the full scheme free, so Krolda maps FSSC 22000 in full: every requirement, by clause identifier. The text itself is the Foundation's copyright and is not reproduced here.

Krolda maps v6, checked against the owner’s own publication on 2026-09-13. Issues and editions change and this page does not claim to know which is current: Foundation FSSC publishes that.

Questions

What is the difference between FSSC 22000 and ISO 22000?
ISO 22000 is the food safety management system standard. FSSC 22000 adds the prerequisite programme specification assigned to the site's category and additional scheme requirements. The applicable prerequisite reference depends on the scheme version; Version 7 uses ISO 22002-x:2025. Check the customer's required scheme and scope, because ISO 22000 certification alone is not FSSC 22000 certification.
Is the FSSC 22000 scheme free to read?
Yes. The Foundation FSSC publishes the full scheme document free of charge, without registration, which is unusual among certification schemes. The copyright remains with the Foundation, so the text is not reproduced on this site, but it can be read at fssc.com.
Which prerequisite programme specification applies?
Check the category and normative-reference table in the applicable FSSC scheme version. Version 7 uses the ISO 22002-x:2025 series rather than simply carrying forward the older ISO/TS references. Confirm the site's activities and audit scope with the licensed certification body.

The other standards

A FSSC 22000 audit asks for the evidence behind each clause, and finding it is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.