Stage 1 and Stage 2 Audits Under ISO 22003-1 Clause 9.3

Certification Audit Structure and System Rationale

Under ISO 22003-1:2022 Clause 9.3, initial certification of a food safety management system (FSMS) requires a two-stage audit process. Stage 1 focuses on evaluating system design, preliminary documentation, prerequisite programmes (PRPs), and overall readiness for full evaluation. Stage 2 evaluates on-site operational implementation, process control, and practical effectiveness of the FSMS across all activities in scope.

This requirement applies to all applicant organizations across the food chain seeking third-party certification against ISO 22000. It establishes a standardized evaluation framework for certification bodies operating under ISO/IEC 17021-1 and ISO 22003-1.

The rationale behind dividing initial certification into two distinct stages is risk management and audit efficiency. Conducting a Stage 1 audit ensures significant system deficiencies or documentation gaps are identified before commencing Stage 2. This staged progression prevents organizations from undergoing resource-intensive Stage 2 operational assessments when foundational hazard controls or legal authorizations are missing.

Objectives, Location Requirements, and Scope Verification

Clause 9.3.2 specifies that the primary objective of Stage 1 is to provide a focus for planning Stage 2 by gaining an understanding of the FSMS and assessing client preparedness. During Stage 1, the audit team reviews whether the organization has identified appropriate PRPs, established adequate processes for hazard identification and assessment, and incorporated applicable legislation. The team also evaluates whether the FSMS is designed to achieve the food safety policy and whether communication arrangements are established.

Under Clause 9.3.5, Stage 1 audits must be carried out at client premises. In exceptional circumstances, such as remote locations or natural disasters, Stage 1 may take place off-site or remotely using information and communication technology (ICT), provided technical justification is documented. If any part of the FSMS audited during Stage 1 is determined to be fully implemented and conforming, Clause 9.3.5 permits not re-auditing that part during Stage 2, provided findings are recorded in the audit report.

Clause 9.1.2.2 requires certification bodies to define the certification scope using food chain categories and subcategories from Annex A. Under Clause 9.1.2.3, the defined scope must identify site-specific categories, describe main process activities, and must not be misleading, exclude activities influencing end product safety, or contain promotional claims.

Example

A meat processing facility applying for ISO 22000 certification under food chain subcategory CI undergoes a Stage 1 audit. The certification body auditor reviews the hazard control plan, PRP documentation, and regulatory slaughter permits on-site. The auditor identifies that validation data for a carcass chilling CCP critical limit is incomplete, raising a Stage 1 finding.

The organization resolves the validation gap within four months and proceeds to Stage 2 within the mandatory six-month window defined in Clause 9.3.6. During Stage 2, the audit team evaluates operational CCP monitoring and carcass temperature records on the processing floor. Because hazard analysis documentation was confirmed during Stage 1, the audit team focuses on operational implementation and recommends certification.

Execution Steps and Auditor Verification Matrix

Quality managers and internal auditors must implement a structured approach when preparing for initial certification audits. Following a systematic five-step procedure ensures operational readiness across both audit stages:

• Submit application details under Clause 9.1.1, defining products, process lines, employee full-time equivalents, and food chain subcategories.
• Host the on-site Stage 1 audit under Clause 9.3.2 and Clause 9.3.5, providing documentation for PRPs, hazard analysis, statutory authorizations, and communication channels.
• Address all Stage 1 findings and system weaknesses identified in the Stage 1 report prior to scheduling the Stage 2 audit.
• Schedule and execute the Stage 2 on-site audit within six months of Stage 1 completion in accordance with Clause 9.3.6.
• Demonstrate operational effectiveness during Stage 2 across all shift operations, ensuring at least fifty percent of total audit time is spent auditing operational food safety planning under Annex B.

Before your audit

• Confirm that all food chain categories and subcategories defined under Annex A match actual site processing activities.
• Ensure statutory licenses, regulatory authorizations, and legal permits are current and accessible for auditor review.
• Verify that prerequisite programmes and hazard control plans are fully documented and approved by the food safety team.
• Check that validation evidence for all CCP critical limits and OPRP action criteria is compiled and documented.
• Review Stage 1 audit findings to ensure every identified concern or documentation gap is resolved before Stage 2.
• Schedule the Stage 2 audit to occur within six months of the completed Stage 1 audit to satisfy Clause 9.3.6.
• Confirm operational staff and CCP operators across all shifts are prepared for on-site Stage 2 interviews.

Questions people ask

Can a Stage 1 audit under ISO 22003-1 be conducted entirely off-site or remotely?

Under Clause 9.3.5, Stage 1 audits must be carried out at client premises. All or part of Stage 1 may take place off-site or remotely using ICT only in exceptional circumstances, such as remote locations, and must be fully justified with documented evidence.

What happens if the interval between Stage 1 and Stage 2 exceeds six months?

Clause 9.3.6 mandates that the interval between Stage 1 and Stage 2 shall not be longer than six months. If the six-month time frame is exceeded, Stage 1 must be repeated before the organization can proceed to Stage 2.

Does an auditor re-audit during Stage 2 elements that were evaluated during Stage 1?

Under Clause 9.3.5 Note 2, any part of the FSMS audited during Stage 1 determined to be fully implemented and conforming does not necessarily need re-auditing during Stage 2. Findings establishing conformity must be documented in the Stage 1 audit report.

How is audit duration calculated for Stage 1 and Stage 2 audits under ISO 22003-1?

Under Annex B, audit duration is calculated using food chain categories, HACCP study counts, and employee numbers. Total calculated initial audit duration includes both Stage 1 and Stage 2, with at least fifty percent of total audit time dedicated to operational food safety planning and PRP implementation.

Reference documents

• DS/EN ISO 22000:2018, Food safety management systems — Requirements for any organization in the food chain
• DS/ISO 22003-1:2022, Food safety — Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022, Food safety — Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system