FSSC 22000 v7 — transition deadlines and audit schedule. What you need to know to avoid losing your certificate

The publication of a new version of the standard means more to a certified organisation than simply a notice that ‘the requirements have changed’. Above all, it sets a specific clock ticking — with dates after which certification bodies will no longer audit against the old version, and deadlines by which organisations must undergo an audit under the new rules. Anyone who fails to keep on top of this risks their certificate becoming invalid at the worst possible moment – namely, during discussions with a client or a third-party audit by a retail chain.

Where do transition periods come from in the first place?

The FSSC Foundation, the organisation behind the FSSC 22000 certificate, like other organisations managing certification schemes (e.g. IFS or BRCGS), does not introduce a new version of the standard overnight for all participants in the system at the same time. Instead, it publishes an implementation timetable, which sets out the following in sequence:

• the date from which certification bodies may begin auditing against the new version,
• the date from which they are required to do so,
• the final date by which all certificates already issued under the old version will expire.

This approach makes organisational sense — certification bodies must first train their auditors, update their accreditation procedures and prepare the necessary documentation before they can begin assessing organisations against the new criteria. Organisations, in turn, need time to update their management systems before they are assessed against them during an audit.

Transition audit versus recertification audit — they are not the same thing

Many people responsible for a management system within an organisation confuse these two concepts, yet the difference has practical implications.

A transition audit primarily concerns sites that are already certified to a previous version of the standard—it is usually an additional element attached to the next scheduled surveillance or recertification audit—the certification body checks whether the site meets the new requirements and, on this basis, updates the certificate to the new version of the standard. This does not always require a separate visit; it often takes place ‘incidentally’ during the next scheduled audit, provided it falls within the timeframe set by the FSSC Foundation.

A recertification audit, on the other hand, is a full audit which takes place periodically (typically every three years) regardless of changes to the standard. If the facility’s recertification date falls within the transition period, the audit automatically includes an assessment against the new requirements — there is no need to arrange an additional visit.

The problem arises when the facility’s next scheduled audit falls after the final deadline, and the company has not planned anything extra — in which case the certificate may expire before an assessment against the new version can even take place.

What happens if an organisation fails to meet the deadline

In practice, the consequences of missing the transition deadline are severe:

• a certificate issued under the old version of the standard ceases to be recognised after the cut-off date — even if, formally, it has not yet ‘expired’ according to its original expiry date,
• the organisation is left without a valid certificate for a certain period, which, in dealings with retail chains and corporate customers, is often tantamount to the suspension of cooperation or the need for urgent clarification,
• returning to the status of ‘holding a valid certificate’ requires scheduling a new audit, which during a peak audit season (and such a period usually follows the publication of a new version of the standard) may mean waiting several weeks for an appointment with the certification body.

Certification bodies usually have tight schedules during the transition period — all sites under a given scheme must undergo the update within the same timeframe, so it is advisable to book audit dates in advance rather than waiting until the very last possible month.

Where to start this month

Rather than waiting for a reminder from the certification body, it’s worth going through a few steps yourself right now:

1. Check the date of your next audit in your company’s schedule — whether it’s a surveillance audit or recertification — and compare it with the final deadline set by the FSSC Foundation for the relevant version of the standard.
2. Contact your certification body and confirm whether the next audit will already include an assessment against the new version, or whether an additional audit date needs to be scheduled.
3. Carry out a preliminary gap analysis between your current system documentation and the new requirements — either on your own or with the help of an experienced partner in implementing food safety management systems— this allows you to estimate how much time and effort will realistically be needed to comply before the auditor visits your site.
4. Draw up an internal schedule with specific deadlines: updating documentation, team training, an internal audit to check readiness, and only then the external audit.
5. Do not leave zero margin for error — if something goes wrong (e.g. the auditor identifies a non-conformity requiring corrective action), you will need a time buffer to make the necessary corrections before the final deadline.

Summary

The update to the FSSC 22000 standard is not just a matter of substance — new requirements to be implemented — but also involves a strict formal timetable, failure to meet which could result in the organisation temporarily losing its certificate. It is worth checking now when your company’s next audit is due, consulting the certification body and planning your actions well in advance, rather than rushing under the pressure of an approaching deadline.