Iso 22003-1-2022
Iso 22003-1-2022
Iso 22003-1-2022
STANDARD 22003-1
First edition
2022-06
Food safety —
Part 1:
Requirements for bodies providing
audit and certification of food safety
management systems
Sécurité des denrées alimentaires —
Partie 1: Exigences pour les organismes procédant à l'audit et à la
certification de systèmes de management de la sécurité des denrées
alimentaires
Reference number
ISO 22003-1:2022(E)
© ISO 2022
ISO 22003-1:2022(E)
Contents Page
Foreword......................................................................................................................................................................................................................................... iv
Introduction..................................................................................................................................................................................................................................v
1 Scope.................................................................................................................................................................................................................................. 1
2 Normative references...................................................................................................................................................................................... 1
3 Terms and definitions..................................................................................................................................................................................... 2
4 Principles...................................................................................................................................................................................................................... 2
5 General requirements..................................................................................................................................................................................... 2
6 Structural requirements.............................................................................................................................................................................. 2
7 Resource requirements................................................................................................................................................................................. 2
7.1 Competence of personnel............................................................................................................................................................... 2
7.1.1 General considerations.................................................................................................................................................. 2
7.1.2 Determination of competence criteria............................................................................................................ 2
7.1.3 Evaluation processes....................................................................................................................................................... 3
7.1.4 Other considerations....................................................................................................................................................... 3
7.2 Personnel involved in the certification activities..................................................................................................... 3
7.3 Use of individual external auditors and external technical experts....................................................... 3
7.4 Personnel records................................................................................................................................................................................. 3
7.5 Outsourcing................................................................................................................................................................................................ 3
8 Information requirements......................................................................................................................................................................... 3
9 Process requirements..................................................................................................................................................................................... 4
9.1 Pre-certification activities............................................................................................................................................................ 4
9.1.1 Application................................................................................................................................................................................ 4
9.1.2 Application review............................................................................................................................................................. 4
9.1.3 Audit programme............................................................................................................................................................... 4
9.1.4 Determining audit time................................................................................................................................................. 4
9.1.5 Multi-site sampling............................................................................................................................................................ 5
9.1.6 Multiple management systems standards.................................................................................................... 7
9.2 Planning audit.......................................................................................................................................................................................... 7
9.3 Initial certification............................................................................................................................................................................... 7
9.4 Conducting audits................................................................................................................................................................................. 8
9.5 Certification decision......................................................................................................................................................................... 8
9.6 Maintaining certification............................................................................................................................................................... 8
9.7 Appeals........................................................................................................................................................................................................... 8
9.8 Complaints.................................................................................................................................................................................................. 8
9.9 Client records............................................................................................................................................................................................ 9
10 Management system requirements for certification bodies................................................................................. 9
Annex A (normative) Classification of food chain categories................................................................................................. 10
Annex B (normative) Minimum audit duration...................................................................................................................................... 14
Annex C (normative) Required food safety management system knowledge and skills to
determine competence................................................................................................................................................................................ 18
Annex D (informative) Guidance on generic certification functions.............................................................................. 22
Bibliography.............................................................................................................................................................................................................................. 26
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 34, Food products, Subcommittee SC 17,
Management systems for food safety, in collaboration with the ISO Committee on conformity assessment
(CASCO).
This first edition cancels and replaces ISO/TS 22003:2013, which has been technically revised
throughout.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
Introduction
Certification of the food safety management system (FSMS) of an organization is one means of providing
assurance that the organization has implemented a system for the management of food safety in line
with its policy and the internationally accepted principles of food safety.
Requirements for an FSMS can originate from a number of sources. This document has been developed
to assist in the certification of FSMS that fulfil the requirements of ISO 22000. The contents of this
document can also be used to support certification of FSMS that are based on other sets of specified
FSMS requirements.
This document is intended for use, in combination with ISO/IEC 17021-1:2015, by bodies that carry out
audit and certification of FSMS. It provides generic requirements for such bodies, who are referred to
as “certification bodies”. This wording is not intended to be an obstacle to the use of this document by
bodies with other designations that undertake activities covered by the scope of this document. This
document is intended to be used by anybody involved in the assessment of FSMS.
Certification activities involve the audit of an organization’s FSMS. The form of attestation of conformity
of an organization’s FSMS to a specific FSMS standard (e.g. ISO 22000) or other specified requirements
is normally a certification document or a certificate.
It is for the organization seeking certification to develop its own management systems and, other
than where relevant legislative requirements specify to the contrary, it is for the organization to
decide how the various components of these will be arranged. The degree of integration between the
various management system components will vary from organization to organization. It is therefore
appropriate for certification bodies that operate in accordance with this document to take into account
the culture and practices of their clients with respect to the integration of their FSMS within the wider
organization.
This document was developed in conjunction with ISO 22003-2, which is used in combination with
ISO/IEC 17065.
In this document, the following verbal forms are used:
— “shall” indicates a requirement;
— “should” indicates a recommendation;
— “may” indicates a permission;
— “can” indicates a possibility or a capability.
Food safety —
Part 1:
Requirements for bodies providing audit and certification
of food safety management systems
1 Scope
This document specifies the requirements for the audit and certification of a food safety management
system (FSMS) complying with the requirements given in ISO 22000 (or other specified FSMS
requirements). It also provides the necessary information and confidence to customers about the way
certification of their suppliers has been granted.
Certification of FSMS is a third-party conformity assessment activity (as described in
ISO/IEC 17000:2020, 4.3), and bodies performing this activity are third-party conformity assessment
bodies.
NOTE 1 In this document, the terms “product” and “service” are used separately (in contrast with the
definition of “product” given in ISO/IEC 17000).
NOTE 2 This document can be used as a criteria document for the accreditation or peer assessment of
certification bodies which seek to be recognized as being competent to certify that an FSMS complies with
ISO 22000 or other sets of specified FSMS requirements. It is also intended to be used as a criteria document
by regulatory authorities and industry consortia which engage in direct recognition of certification bodies
to certify that an FSMS complies with ISO 22000. Some of its requirements can also be useful to other parties
involved in the conformity assessment of such certification bodies, and in the conformity assessment of bodies
that undertake to certify the compliance of FSMS with criteria additional to, or other than, those in ISO 22000.
FSMS certification does not attest to the safety or fitness of the products of an organization within
the food chain. However, an FSMS requires an organization to meet all applicable food-safety-related
statutory and regulatory requirements through its management system.
NOTE 3 Certification of an FSMS according to ISO 22000 is a management system certification, not a product
certification.
Other FSMS users can use the concepts and requirements of this document provided that the
requirements are adapted as necessary.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17000, Conformity assessment — Vocabulary and general principles
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification
of management systems — Part 1: Requirements
ISO 22000, Food safety management systems — Requirements for any organization in the food chain
3.2
hazard analysis and critical control points study
HACCP study
hazard analysis for a family of products/processes/services with similar hazards and similar processes
and technology (e.g. production, packaging, storage or implementation of services)
4 Principles
The principles of ISO/IEC 17021-1:2015, Clause 4, are the basis for the subsequent specific performance
and descriptive requirements in this document. This document does not set specific requirements
to address all issues related to audit and certification process. These principles should be applied as
guidance for the decisions that sometimes need to be made for unanticipated situations. Principles are
not requirements.
5 General requirements
ISO/IEC 17021-1:2015, Clause 5, shall be followed.
6 Structural requirements
ISO/IEC 17021-1:2015, Clause 6, shall be followed.
7 Resource requirements
The competence criteria, specifying required knowledge and skills, in Annex C shall apply.
NOTE 1 Annex D provides guidance to the certification body on many of the generic certification functions
identified in ISO/IEC 17021-1:2015, Annex A, for which competence criteria need to be determined for personnel
involved in the audit and certification of an FSMS.
NOTE 2 Qualification(s) and experience can be used as part of the criteria; however, competence is not
based on these alone, as it is important to ensure that a person can demonstrate the ability to apply the specific
knowledge and skills that one would expect a person to have after completing a qualification or having a certain
amount of industry experience.
7.5 Outsourcing
ISO/IEC 17021-1:2015, 7.5, shall be followed.
8 Information requirements
8.1 ISO/IEC 17021-1:2015, Clause 8, shall be followed except where as amended in 8.2, 8.3 and 8.4.
8.2 The certification documents shall identify in detail the categories and subcategories in Table A.1
to which the FSMS applies.
8.3 A certification body shall not authorize the use of the FSMS certification mark on the product
nor the product packaging. In the context of this document, product packaging referred to in
ISO/IEC 17021-1:2015, 8.3, shall cover all product packaging, both primary packaging (which contains
the product) and any outer or secondary packaging.
8.4 A certification body shall not permit the use of any statement on product packaging that the client
has a certified FSMS. This includes all product packaging, both primary packaging (which contains the
product) and any outer or secondary packaging.
9 Process requirements
9.1.1 Application
9.1.2.2 The certification body shall use Annex A to define the relevant scope for the organization
applying for certification. The scope statement shall:
— identify the category(s) or subcategory(s) in scope of certification for each site or sites;
— briefly describe the main types of activities/processes for the products and/or services that are
audited by the certifying body.
— be misleading;
— exclude activities, processes, products or services from the scope of certification when those
activities, processes, products or services can have an influence on the food safety of the end
products as defined by the legal responsibility of the organisations’ activities;
— include any promotional statements, brands or claims.
9.1.3.2 In addition, the certification body shall have a process for choosing the audit timing and season,
so that the audit team has the opportunity of auditing the organization operating on a representative
number of product lines and/or services covered by the scope of certification.
9.1.4.2 The certification body shall have documented procedures for determining audit time, and for
each client, the certification body shall determine the time needed to plan and accomplish a complete
and effective audit of the client’s FSMS. In determining the audit duration, the certification body shall
use the methodology described in Annex B. The audit time determined by the certification body, and
the justification for the determination, shall be recorded including justification for any reductions or
additions.
9.1.4.3 In determining and documenting audit time needed, the certification body shall determine:
9.1.5.3 The certification body shall demonstrate that the sampling of sites does not undermine
effective auditing. When multi-site sampling is undertaken, the certification body shall justify and
document the rationale based on the following conditions:
a) sites are operating under one centrally controlled and administered FSMS;
b) sites subject to sampling are similar (food chain subcategory, geographical location, processes and
technologies, size and complexity, regulatory and statutory requirements, customer requirements,
food safety hazards and control measures);
c) the central function is part of the organization, clearly identified and not subcontracted to an
external organization;
d) all sites have a legal or contractual link with the central function;
e) the central function has organizational authority to define, establish and maintain the FSMS;
f) all sites are subject to the organization’s internal audit programme and have been audited;
g) audit findings at a site are considered indicative of the entire FSMS and corrective actions are
implemented accordingly;
h) the central function is responsible for ensuring that outcomes of performance evaluation and
customer complaints from all sites are collected and analysed;
9.1.5.4 The use of multi-site sampling is permitted for categories A and B. Sampling may be applied
to multi-site organizations, with the minimum sample size being the square root of the total number
of sites: √(x), rounded up to the next whole number. The square root sample shall be taken per risk
category based on production complexity of the sites (e.g. open field plant production, perennial plant
production, indoor production, open field livestock production, indoor livestock production).
The use of multi-site sampling is permitted for categories F and G, and only for re-heating-type facilities
(e.g. event catering, coffee shops, pubs) for category E and only for facilities with limited preparation or
cooking (e.g. re-heating, frying) (see Table A.1). For organizations with 20 sites or fewer, all sites shall
be audited. For organizations with more than 20 sites, the minimum number of sites to be sampled shall
be 20 plus the square root of the total number of other sites: y = 20 + √(x – 20), rounded up to the next
whole number. This applies to the initial certification, to surveillance and to recertification audits.
The use of multi-site sampling is not permitted for any other categories identified in Annex A.
9.1.5.5 Where multi-site sampling is permitted, the certification body shall ensure (e.g. via
contractual arrangements) that the organization has conducted an internal audit for each site within
one year prior to certification and when applicable the effectiveness of corrective actions shall be
available. Following certification, the annual internal audit shall cover all sites of the organization
included in the certification scope of the multi-site organization and ongoing effectiveness of corrective
actions shall be demonstrated.
9.1.5.6 Where multi-site sampling is permitted, the certification body shall define and utilize a
sampling programme to ensure an effective audit of the FSMS where the following conditions apply.
a) At least annually, an audit of the central function for the FSMS shall be performed by the certification
body prior to the sampled site audits.
b) At least annually, audits shall be performed by the certification body on the required number of
sampled sites.
c) Audit findings of the sampled sites shall be assessed to ascertain if these indicate an overall FSMS
deficiency and therefore can be applicable to some or all other sites.
d) Where audit findings of the sampled sites are considered indicative of the entire FSMS, corrective
actions shall be implemented accordingly.
e) For organizations with 20 sites or fewer, all sites shall be audited.
The certification body shall increase the size of sample or terminate the site sampling where the FSMS
subject to certification does not indicate the ability to achieve the intended results.
9.1.5.7 The sample shall be partly selective and partly random and shall result in a representative
range of different sites being selected, ensuring all processes covered by the scope of certification will
be audited.
At least 25 % of the sample shall be selected at random. The remainder shall be selected so that the
differences among the sites selected over the period of validity of the certification are as large as
possible.
The site selection shall consider, among others, the following aspects:
a) results of internal audits, management reviews or previous audits;
b) records of complaints, product withdrawals/recalls, and other relevant aspects of corrective
action;
c) variations in the site characteristics;
d) other relevant changes since the last audit.
9.1.5.8 If any site has a major nonconformity and satisfactory corrective action have not been
implemented in the agreed time frame, certification shall not be granted or maintained for the whole
multi-site organization pending satisfactory corrective action.
9.1.5.9 The certification body shall identify and include in the scope of certification the processes of
the FSMS implemented at each sampled site.
9.3.2 The objectives of stage 1 are to provide a focus for the planning of stage 2 of the initial audit by
gaining an understanding of the organization’s FSMS and the organization’s state of preparedness for
stage 2 by reviewing the extent to which:
a) the organization has identified PRPs that are appropriate to the business (e.g. regulatory, statutory,
customer and certification scheme requirements);
b) the FSMS includes adequate processes and methods for the identification and assessment of
the organization’s food safety hazards, and subsequent selection and categorization of control
measures (combinations);
c) the FSMS includes adequate processes and methods for the identification and implementation of
relevant food safety legislation;
d) the FSMS is designed to achieve the organization’s food safety policy;
e) the FSMS implementation programme justifies proceeding to stage 2;
f) the validation of control measures, verification of activities and improvement programmes conform
to the requirements of the FSMS standard;
g) the FSMS documents and arrangements are in place to communicate internally and with relevant
suppliers, customers and interested parties;
h) there is any additional documentation which needs to be reviewed and/or information which needs
to be obtained in advance.
9.3.3 Where an organization has implemented externally developed elements of a FSMS, stage 1 shall
review the documentation included in the FSMS to determine if the combination of control measures:
9.3.4 The availability of relevant authorizations shall be checked when collecting the information
regarding the compliance to regulatory aspects.
9.3.5 For FSMS, stage 1 shall be carried out at the client’s premises in order to achieve the objectives
stated above. In exceptional circumstances or events, all or part of stage 1 can take place off-site or
remotely through the use of ICT and shall be fully justified. The evidence demonstrating that stage 1
objectives are fully achieved shall be provided.
NOTE 1 Exceptional circumstances or events can include a very remote location, a natural disaster, a
pandemic, a short seasonal production and other special situations.
NOTE 2 Any part of the FSMS that is audited during the stage 1 audit, and determined to be fully implemented,
effective and in conformity with requirements, does not necessarily need to be re-audited during stage 2. In this
case, the audit report includes these findings and clearly states that conformity has been established during the
stage 1 of the audit.
9.3.6 The interval between stage 1 and stage 2 shall not be longer than six months. Stage 1 shall be
repeated if a longer interval is needed.
9.6.2 Where the certification body conducts unannounced audits as part of surveillance activities,
the certification body shall describe and make known in advance to the certified clients the conditions
under which such audits will be organized and conducted.
9.7 Appeals
ISO/IEC 17021-1:2015, 9.7, shall be followed.
9.8 Complaints
ISO/IEC 17021-1:2015, 9.8, shall be followed.
Annex A
(normative)
The certification body shall use Table A.1 for the following purposes:
a) to define the subcategory (or category if no subcategory) within which it wishes to operate;
b) to identify the subcategories (or category if no subcategory) to which the client’s scope will be
audited or certified;
c) to assess the auditor and audit team competence given in Annex C within a particular subcategory
of Table A1;
d) to define the audit duration in accordance with Annex B;
e) to identify the appropriate PRPs, if applicable.
The scope of one specific client organization may cover more than one subcategory or category.
NOTE Relevant activities within the category H “services”: for operators in the food chain, there are many
different types of services that can be provided or called upon. Some of these services can fall outside the scope
of a certification that includes FSMS. If the organization/service is susceptible to introduce a food safety hazard
within the food chain, the service provider and its operator(s) can be considered within the scope.
Where a scheme owner has established their own rules for determination for categories/subcategories,
the outcome of the scheme rules shall apply provided that the scheme rules are not less than those
required in this annex as a common basis.
Annex B
(normative)
where
TD is the basic site audit duration for (sub) category and scope of certification (includes one
HACCP study), in days;
If there are multiple categories or subcategories, use the category or subcategory with the highest
T D value to determine Ds. The combined parameters (HACCP study, FTE) for all the categories/
subcategories shall be used when calculating the audit duration.
When the scheme requirements encompass other interrelated elements [e.g. good agricultural practice
(GAP), agronomic] audited in conjunction with the FSMS, these shall be included in the minimum audit
duration.
The resulting audit duration using the factors in Clause B.2 and Table B.1 shall be justified and
documented.
A minimum 50 % of total audit duration shall be spent on auditing the operational food safety planning
and the implementation of PRPs and control measures.
NOTE 1 Operational food safety planning does not include activities related to FSMS development, training,
internal audit, management review and improvement.
In cases of a FSMS which is integrated with another relevant management system or food safety system
(FSS), a reduction in audit duration is possible. The combined audit duration shall be determined and
recorded as follows:
— calculate the audit duration for each scheme separately (including scheme restrictions and allowed
reductions);
— add the audit durations together;
— determine the degree of reduction considering a maximum of 20 % reduction can be made on the
combined duration. The reduction range based on integration is 0 % to 20 % determined by the
level of integration of overall business strategy, management reviews, approach to policy, objectives,
systems, processes, internal audits and effective corrective action to prevent reoccurrence.
NOTE 2 “Relevant management system” means a quality or food safety system which covers the same
processes, products and services.
Deviations from Table B.1 can be justified and shall be recorded, determined by factors such as maturity
of the management system, prior knowledge of client processes and systems (e.g. already certified by
same certification body to different scheme), client preparedness (e.g. already certified by a relevant
third-party scheme) and a high level of automation.
Annex C
(normative)
C.1 General
Table C.1 specifies the knowledge and skills that a certification body shall define for specific certification
functions. “X” indicates that the certification body shall define the criteria and depth of knowledge and
skills.
— multi-site sampling;
— chemical hazards;
— physical hazards;
— allergens; X X
— food defence;
— food fraud.
13. Ability to apply food chain (sub)category
X
practices and vocabulary in relation to:
— food chain relationships;
— common equipment;
— facility design;
— local terminology.
a For the team leader, the ability to understand the principles of audit duration calculation in order to alert the certification body in
case of significant change.
b It is not expected that the certification decision function requires competence specific to the food chain category.
Annex D
(informative)
D.1 General
This annex provides useful guidance to the certification body on many of the generic certification
functions identified in ISO/IEC 17021-1:2015, Annex A, for which competence criteria for personnel
involved in audit and certification of an FSMS should be determined.
D.5 Auditing
D.5.1 Conduct document review
— Obtain programme documentation.
— Review documentation against requirements.
— Verify the organization’s management system.
— Determine if the organization’s documents meet requirements or identify nonconformities.
— Establish investigative lines for the stage 2 audit.
— Confirm readiness for the stage 2 audit.
Bibliography