ISO 22000 is a standard. FSSC 22000 is a certification scheme that uses ISO 22000 as one of its parts and adds more. A company can be certified to one or the other, and the difference changes the audit, the paperwork and who accepts the certificate.
Last reviewed: 17 October 2026. Facts checked. We opened web search results on FSSC 22000 version 6: the FSSC site's version 6 FAQ and Annex 5 on ICT use, and an AIB International page. They confirm that version 6 fits integrated management systems because it follows the harmonised structure, that it adds requirements on quality control and quality culture, and that the minimum reporting time was increased to at least one auditor day (eight working hours). We did not find the prerequisite programme requirements or the full list of additions, and we did not open the scheme document or ISO 22000. Check the current scheme version on the FSSC website, because schemes are revised. We do not state scheme fees or audit-day tables.
ISO 22000 in brief
ISO 22000 sets requirements for a food safety management system: hazard analysis, control measures, communication along the food chain and the management system elements around them. Our ISO 22000 audit guide covers it, and the HACCP audit checklist covers the hazard control method it builds on.
What FSSC 22000 is
FSSC 22000 is a scheme operated by a foundation of that name. Certification under it draws on ISO 22000 for the management system, a technical specification for prerequisite programmes suited to the sector, and additional scheme requirements. As understood from the sources, the scheme is recognised by the Global Food Safety Initiative (GFSI), a benchmarking body that many large food buyers use to decide which certifications they accept. Confirm the current recognition status for your version on the GFSI and FSSC sites.
That recognition is the reason most companies choose it. Retailers and multinational manufacturers often ask suppliers for a GFSI-recognised certificate. An ISO 22000 certificate alone may not satisfy such a buyer.
What the scheme adds
From the sources we saw and general understanding:
- Sector-specific prerequisite programmes. Cleaning, pest control, building layout and similar basics, specified for the type of food business. The sources we opened did not give detail, so check the scheme document for your category.
- Additional scheme requirements. Version 6 is described as adding quality control and quality culture requirements.
- Rules on how the certification body audits. For instance, how remote methods may be used. The FSSC material describes the use of ICT as voluntary and agreed in advance, and a fully remote audit as a narrow option available only in specific circumstances under an addendum.
- Reporting and notification duties. Scheme-level expectations, such as notifying the certification body of certain events. Details are in the scheme documents.
What this means for the audit
| Question | ISO 22000 certification | FSSC 22000 certification |
|---|---|---|
| Certification body | Accredited body | Body licensed by the scheme owner and accredited |
| Audit content | The standard | The standard plus scheme requirements |
| Buyer acceptance | Varies | Often accepted where GFSI recognition is required |
| Audit rules | Certification body rules | Scheme rules on top |
An internal audit programme for an FSSC site therefore needs a checklist that covers the scheme requirements as well as the standard. An internal audit against ISO 22000 alone can look clean while missing scheme-specific points.
Typical areas an auditor will walk
- Hazard analysis and its currency. Does it reflect the actual products and lines, and has it changed when they did?
- Prerequisite programmes in practice. Walk the plant. Check the pest control records against what you see.
- Food defence and food fraud. Many schemes expect these considered; check the current scheme text for the specific wording.
- Supplier approval and traceability. Pick a finished product lot and trace back to raw materials and forward to customers. Time how long it takes.
- Allergen control. Changeovers, labelling and cleaning verification.
- Management commitment. See auditing top management.
- Corrective action and complaints. Are they analysed and closed?
For Indian food businesses, remember that statutory food safety licensing and rules apply regardless of any certificate. We have not quoted regulation here; check the current rules for your business type.
Choosing between them
- If a buyer names FSSC 22000 or another GFSI-recognised scheme, the choice is made.
- If the aim is to build a food safety system and no buyer demands it, ISO 22000 may be enough as a first step. Moving to the scheme later is easier when the base system exists.
- Ask certification bodies about their licence for the scheme and the food category you operate in.
Integration with other systems
The sources describe version 6 as suited to integrated systems because it uses the same high-level structure as other management system standards. A company with ISO 9001 and ISO 14001 can integrate; see integrated management system audits for how.
An invented example
A spice exporter holds ISO 22000. A European retailer's new supplier requirements ask for a GFSI-recognised certificate. The exporter's own audit finds its system mostly meets the standard but lacks documented checks on a few scheme-specific topics and has no formal quality culture activities. It spends the next quarter closing those gaps, schedules a combined audit with its certification body and keeps both systems in one set of documents.
The takeaway
ISO 22000 is the base; FSSC 22000 is the base plus a scheme that big buyers recognise. Pick by who needs to accept the certificate, and audit against the scheme document, not only the standard.
Last reviewed: 17 October 2026. Facts checked. Opened: web search results on FSSC 22000 version 6 (FSSC FAQ, FSSC Annex 5, AIB International), secondary summaries. Could not open: the FSSC scheme document, ISO 22000 or ISO/TS 22002, GFSI pages; prerequisite programme details, the full version 6 additions and the current GFSI recognition status are unverified.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error