ISO 22000 Surveillance and Renewal: What Auditors Recheck Every Year

Your ISO 22000 certificate arrived, the frame went up on the wall, and the buyer who asked for it placed the order. Job done? Not quite. The certificate lasts three years, and the certification body comes back every year to check that the system behind it is still alive. A surveillance audit in year one, another in year two, then a full recertification audit before the certificate expires. Miss one of those visits, or treat them as formalities, and the certificate you paid for can be suspended — sometimes without a second warning.

The short answer: an ISO 22000 certificate is valid for three years. In years one and two, your certification body runs a surveillance audit — a sampling check of your food safety management system. In year three, a full recertification audit decides whether you get a fresh three-year certificate. The expiry date is fixed at issue, and nothing moves it.

The three-year cycle at a glance

Every accredited ISO 22000 certificate runs on the same clock, set by ISO/IEC 17021-1, the standard that governs how certification bodies audit. It looks like this:

When	What happens	How deep it goes
Year 0 — certification	Stage 1 document review, then the Stage 2 on-site audit. Pass both and the certificate is issued.	Full system, every clause and every process in scope.
Year 1 — surveillance 1	First surveillance audit, no later than 12 months after the last day of your Stage 2 audit.	Sampled checks: part of the system, not all of it.
Year 2 — surveillance 2	Second surveillance audit, at least one in each calendar year.	Sampled checks again, covering different ground from year one.
Year 3 — recertification	Full recertification audit, completed before the certificate expires.	Full system again, like Stage 2 — but usually shorter, because the certification body already knows your business.

One date matters more than any other in this table: the expiry date printed on the certificate. It was fixed on the day the certificate was issued, and a late surveillance audit does not push it back. It only squeezes the time left for recertification. Think of it like a train ticket with a fixed date — arriving late at the station does not change the departure time.

What a surveillance audit actually checks

A surveillance audit is not a smaller version of the Stage 2 audit. It is a different kind of visit. The auditor samples parts of the system to confirm it is still working, rather than re-examining everything. Here is what they recheck, in a food business.

Your HACCP plan is still valid. The auditor reads the hazard analysis and the HACCP plan against what actually happens on the floor. New product? New ingredient? New supplier? Any of those can change a hazard, and the plan has to show it kept up. A plan that still describes last year's product range is the most common finding I see in surveillance audits.

CCP monitoring records tell a straight story. Critical control point logs — cooking temperatures, chilling times, metal detection checks — get read for gaps, not just for the numbers. Missing entries, the same handwriting for a whole week, corrections with no initials: all of it gets noticed. The auditor is checking whether monitoring really happens, or whether the records are filled in the night before the audit.

Prerequisite programmes still work. Cleaning schedules, pest control, personal hygiene, maintenance, supplier approval — the PRPs that keep the plant in a fit state. The auditor walks the floor and compares it with the programme. A pest-control log with no follow-up on a sighting, or a cleaning schedule nobody signed for a month, counts against you.

Traceability still works in practice. Expect a traceability test: pick a finished batch and trace it back to the raw material lot, or pick a raw material lot and trace it forward to every finished batch it went into. The auditor times it. If it takes your team a day of digging through registers, that is a finding.

Internal audit and management review happened — and meant something. Every surveillance audit looks at your own internal audit results, the management review meeting minutes, and what you did about the issues they raised. An internal audit that found nothing, three years running, is not a badge of honour. Auditors read it as a programme that is not looking hard enough.

Corrective actions from the last audit are closed — properly. Every nonconformity from the previous visit gets revisited. The auditor checks not just that you did something, but that it worked. A corrective action that was never verified, or one that fixed the symptom and left the cause alone, gets re-raised. And an unresolved minor nonconformity can be escalated to a major one at the next visit.

Complaints and recalls. Customer complaints, any product recall or withdrawal, and how you handled them. A recall that was handled well and documented honestly is not a black mark. A complaint that was never logged is.

If you want the full list of what your system should hold, the ISO 22000 documents checklist we published earlier in this series covers every document and record an auditor asks for — the same set a surveillance auditor works from.

What happens when the auditor finds something

Findings come in two sizes, and the difference matters.

A minor nonconformity is a single lapse in an otherwise working system — one unsigned cleaning record, one missed calibration date. You agree a corrective-action plan with the auditor, fix it, and send the evidence. The fix gets verified at the next visit, or by document review if the certification body asks for it.

A major nonconformity is a breakdown — the system failed at a point that matters for food safety. A CCP with no monitoring for a month. A hazard nobody assessed. A recall procedure that nobody could follow. For a major finding, the certification body sets a deadline to close it, usually around 90 days. Miss that deadline and the certificate can be suspended. The 90 days is the usual practice of certification bodies, not a number written in the standard itself — your own certification body's letter is the one that counts.

Suspension is not the end of the road, but it is a public problem. While a certificate is suspended, you cannot claim certification, and buyers who check will find out. A suspended certificate that is not restored gets withdrawn, and withdrawal means starting over with a fresh Stage 1 and Stage 2 audit — at full initial cost and effort.

What if you miss a surveillance audit?

This is the mistake that catches small food businesses most often. The audit date slips because production is busy, the food safety team leader is on leave, or the certification body's email went to someone who left. The audit does not happen. And the certificate does not wait.

Certification bodies plan surveillance audits months ahead, and they chase the date. One certification body's published procedure puts it bluntly: if the client does not confirm the surveillance date within seven days of the due date, a suspension letter goes out, and a cancellation letter follows. Other bodies run their own versions of the same rule, but the direction is identical everywhere — a missed surveillance audit moves the certificate toward suspension, not toward a quiet extension.

Two things make this worse than it sounds. First, the expiry date never moves. A surveillance audit that happens three months late does not buy you three more months at the end. Second, the gap shows up in the recertification audit. The auditor at year three sees a system that went unexamined for longer than it should have, and audits accordingly.

The fix is boring and it works: put the surveillance due date in the same place as your FSSAI licence renewal and your GST returns, and name one person who owns it. If the date needs to move, tell the certification body early. A rescheduled audit is a conversation. A missed one is a letter.

The recertification audit in year three

Recertification is not a surveillance audit with a bigger name. It is a full re-evaluation of the whole food safety management system, in the same shape as the original Stage 2 audit. The auditor re-examines every clause, every process in scope, and the three years of history since the first certificate — including how you handled every finding along the way.

It is usually shorter than the initial audit, because the certification body already holds your records, your nonconformity history and your scope. But shorter does not mean easier. Three years of drift show up here: the HACCP plan that never caught up with a new product line, the supplier list that nobody pruned, the PRP that quietly stopped being followed when the person who ran it left.

Start preparation three to six months before expiry. That is enough time to run a full internal audit across the whole system, hold a proper management review, close the findings it produces, and still have evidence — not promises — to show the auditor. The audit itself should finish before the expiry date, not after it. If the recertification audit runs past expiry, there is no certificate to renew. You would be starting a fresh certification cycle instead.

One more thing to do in that window: tell your certification body about changes. A new site, a new product category, a new process — scope changes should be reported, not discovered by the auditor on the day. A scope change found during the audit can extend the audit, and in some cases it has to be handled as a separate exercise.

ISO 22000 vs FSSC 22000 after year one

If you hold FSSC 22000 rather than ISO 22000 alone, one rule changes the feel of the cycle. FSSC 22000 requires at least one unannounced surveillance audit in every three-year cycle. The certification body turns up without telling you the date. Refusing entry leads to suspension within three working days. The requirement sits in Part 3 of the scheme, clause 5.4, and Version 7 — published 1 May 2026 — keeps it.

The timing matters right now. FSSC 22000 Version 6 audits run only until 30 April 2027. Upgrade audits to Version 7 run from 1 May 2027 to 30 April 2028, and they happen at your next scheduled surveillance or recertification audit — so an unannounced surveillance due in the upgrade year can become an unannounced upgrade audit. Certificates that are not upgraded are removed from the FSSC public register on 30 June 2028, according to certification-body guidance. If your next surveillance falls in that window, ask your certification body now whether it will be an upgrade audit, so nobody is surprised on the day.

The full comparison — what FSSC 22000 adds, who asks for it, and whether it is worth the extra cost — is in our ISO 22000 vs FSSC 22000 guide. The short version: ISO 22000 alone is always announced. FSSC 22000 keeps you honest on a random Tuesday.

What staying certified costs

Nobody publishes a fixed tariff for surveillance and recertification audits, and any article that quotes one is guessing. Certification bodies price on scope, sites, headcount and audit days, and the numbers move. What is safe to say is this: a surveillance audit costs less than the initial certification, because it samples the system instead of examining all of it and takes fewer audit days. Recertification costs more than a surveillance audit and less than starting from scratch, because the certification body already knows your system. Ask your certification body for the quote when you book — get it in writing, for each year of the cycle, so the cost is planned rather than discovered.

Our own consultancy prices stay the same across the cycle. ComplyKart's ISO 22000 consultancy is ₹12,999 for the Standard tier and ₹24,999 for the Growth tier, and certification-body audit fees are extra at actuals — the same basis as the initial certification. If you want the current tiers and what each one covers, the ISO 22000 certification page carries them, and the ISO 22000 cost guide breaks down where every rupee goes.

And keep one boundary clear. ISO 22000 does not replace your FSSAI licence. The licence is mandatory under the Food Safety and Standards Act, 2006, and it runs on its own cycle — since 1 April 2026, Registration up to ₹1.5 crore turnover at ₹100 a year, State licence from ₹1.5 crore to ₹50 crore at ₹5,000 a year, and Central licence above ₹50 crore at ₹7,500 a year, with perpetual validity. An ISO 22000 certificate never substitutes for it, and a lapsed FSSAI licence will hurt you in a surveillance audit too, because the auditor checks legal compliance.

Five mistakes that lose certificates

1. Treating surveillance as a formality. The audit is a sampling exercise, not a courtesy visit. The auditor picks the areas they want, and a system that has been coasting for a year shows it in the first hour.

2. Letting the HACCP plan go stale. New product, new supplier, new process — if the hazard analysis did not move with it, the plan is wrong, and a wrong plan is a major finding waiting to happen.

3. Filling records the night before. Auditors read records the way a bank reads a passbook. Gaps, identical handwriting, backdated entries — they have seen all of it, and it turns a minor finding into a question about the whole system.

4. Closing corrective actions on paper only. "We told the team" is not a corrective action. If the fix did not change the process, the same finding comes back at the next audit, escalated.

5. Hiding changes from the certification body. A new site or a new product category found by the auditor on the day is worse than the same change reported three months earlier. Report it, and the audit plan adjusts. Hide it, and the audit extends — or the certificate's scope is questioned.

A simple year-by-year routine

You do not need a compliance department to stay certified. You need a routine, run by one named person, with dates that do not move.

Every month: review CCP monitoring records for gaps; check that corrective actions from the last internal audit are actually progressing; log every customer complaint the day it arrives.

Every quarter: food safety team meeting with minutes — review hazards, complaints, supplier issues, and any change in products or processes. Update the HACCP plan the same week a change is agreed, not at the next audit.

Every year: a full internal audit covering the whole system across the three-year cycle; a management review with real decisions in the minutes; a traceability test, timed, from both directions; and the surveillance audit itself, confirmed with the certification body at least two months ahead.

Three to six months before expiry: start recertification preparation. Full internal audit, management review, close the findings, report any scope changes, and book the recertification audit so it finishes before the expiry date.

The analogy that holds it all together is a health inspector's routine visit to a restaurant. The inspector checks the fridge temperatures, the pest-control log, and whether last visit's issues were fixed. That is a surveillance audit. Recertification is the full licence-renewal inspection, where every corner gets checked. Both exist for the same reason: the certificate on the wall is only as good as the system behind it, on an ordinary Tuesday, when nobody is watching.

Frequently asked questions

How long is an ISO 22000 certificate valid?
Three years from the date of issue, under ISO/IEC 17021-1. A surveillance audit runs in year one and year two, and a full recertification audit must be completed before the certificate expires.

What does an ISO 22000 surveillance audit check?
It samples the system: the HACCP plan and CCP monitoring records, prerequisite programme effectiveness, traceability, internal audit and management review results, corrective actions from the last audit, complaints and recalls, and any changes in products, suppliers or processes.

What happens if I miss an ISO 22000 surveillance audit?
The certification body can suspend the certificate, and a suspended certificate that is not restored is withdrawn. The expiry date does not move to make up for the missed audit, and a withdrawn certificate means starting over with a fresh Stage 1 and Stage 2 audit.

How much does ISO 22000 surveillance and recertification cost?
Certification bodies price on scope, sites and audit days, and no fixed tariff is published. A surveillance audit costs less than the initial certification because it samples the system. ComplyKart's consultancy is ₹12,999 (Standard) or ₹24,999 (Growth), with certification-body audit fees extra at actuals.

Is the ISO 22000 surveillance audit announced?
Yes, for ISO 22000 alone. The exception is FSSC 22000, which requires at least one unannounced surveillance audit in every three-year cycle — the certification body arrives without telling you the date.

Staying certified is not a separate project from running a food business. It is the same discipline, checked once a year by someone from outside. Keep the records honest, keep the HACCP plan current, keep the audit dates in the diary, and the certificate takes care of itself. If your surveillance audit is coming up and the system has drifted, that is the moment to fix it — not the week the auditor arrives. The compliance fee calculator can help you plan the costs, and for restaurants and cloud kitchens specifically, our ISO 22000 guide for restaurants and cloud kitchens covers the food-safety side in your setting.