ISO 22003-1 vs ISO 22003-2: FSMS and FSS Certification Rules

Regulatory Restructuring, Systemic Rationale, and Affected Roles

The publication of DS/ISO 22003-1:2022 and DS/ISO 22003-2:2022 restructured the conformity assessment framework for global food safety certification. Replacing the former single ISO/TS 22003:2013 specification, this dual-part standard creates a clear boundary between management system certification and product, process, or service certification. Compliance leads, quality managers, and internal auditors must understand how these two standards dictate how certification bodies audit facilities and issue certificates.

The systemic rationale for splitting the standard stems from the distinct needs of international food chain stakeholders. Some organizations require accredited certification of their overarching Food Safety Management System (FSMS) to demonstrate management governance under standards like DS/EN ISO 22000:2018. Other organizations seek product certification under commercial or scheme-specific frameworks that evaluate a Food Safety System (FSS) alongside product compliance. Understanding which part governs a certification audit ensures accurate audit preparation, correct duration budgeting, and compliant mark usage.

Structural Architecture and Framework Comparison

DS/ISO 22003-1:2022 acts as a supplemental document to ISO/IEC 17021-1:2015, establishing requirements for bodies auditing and certifying an FSMS. Under Clause 3.1, an FSMS represents a complete management architecture that integrates organizational context, leadership, strategic planning, resource support, operational hazard control, performance evaluation, and continual improvement. The audit focuses on the organization's systemic capability to consistently meet statutory, regulatory, and customer requirements across its defined scope.

Conversely, DS/ISO 22003-2:2022 supplements ISO/IEC 17065:2012, setting rules for bodies evaluating and certifying products, processes, or services. Under Clause 3.1, an FSS comprises prerequisite programmes (PRPs) and control measures based on Codex principles of food hygiene, combined with specific management system elements such as management commitment, internal audits, and document control. An FSS may utilize generic hazard analyses developed by external scheme owners or competent authorities, provided the client organization tailors them to its specific process flow.

Technical Differences in Audit Time, Scope, and Packaging Marks

The technical execution of audits differs significantly between the two standards, particularly regarding audit duration calculations in Annex B. Under DS/ISO 22003-1:2022 Clause B.3.2, total initial audit duration (\(D_S\)) equals the sum of basic site duration (\(T_D\)), additional HACCP study days (\(T_H\)), and FTE employee time (\(T_\)). In contrast, DS/ISO 22003-2:2022 Clause B.3.3 halves this initial calculation for processing and service categories C through K, using the formula \(D_S = (T_D + T_H + T_) / 2\), subject to an absolute minimum of one audit day. For primary production categories A and B, DS/ISO 22003-2:2022 Clause B.3.2 sets a baseline of three hours for simple situations.

Both standards mandate in Annex B that at least 50% of total audit time must focus on operational food safety planning, PRPs, and live process control. However, rules regarding product packaging and certification marks diverge completely. DS/ISO 22003-1:2022 Clause 8.3 and Clause 8.4 strictly forbid placing FSMS certification marks or statement claims on primary or secondary product packaging, as management system certification does not attest to product safety. Under DS/ISO 22003-2:2022, because certification attaches to products, processes, or services, mark usage on packaging is governed by ISO/IEC 17065 and specific scheme owner rules.

Multi-site sampling regulations in Annex A and core clauses remain aligned across both standards. Sampling is permitted for Category A, Category B, Category E (limited to re-heating and frying), Category F, and Category G. Both standards strictly prohibit site sampling for Category C processing, Category D feed production, Category H services, Category I packaging manufacturing, Category J equipment production, and Category K biochemical manufacturing. Where sampling applies for Categories E, F, and G with more than 20 sites, both standards enforce the sample size formula \(y = 20 + \sqrt\).

What to do now

• Determine whether your organization holds or requires FSMS management system certification under DS/ISO 22003-1 or FSS product certification under DS/ISO 22003-2.
• Verify that product packaging and promotional materials do not display FSMS certification marks or statements if certified under DS/ISO 22003-1 per Clause 8.3.
• Recalculate external audit duration expectations using Annex B formulas to verify certification body fee quotes and resource allocations.
• Confirm that food chain subcategories are accurately defined in scope statements using Table A.1 across all operating sites.
• Audit central function oversight and internal audit records to ensure compliance with multi-site sampling conditions if operating multi-site networks.

Reference documents

• DS/EN ISO 22000:2018 Food safety management systems – Requirements for any organization in the food chain
• DS/ISO 22003-1:2022 Food safety – Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022 Food safety – Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system