FSSC 22000 Unannounced Audit: Rules and Preparation 2026

The FSSC 22000 unannounced audit is the surveillance visit your certification body schedules without telling you the date, and every certified site must expect one in each three-year cycle. It is the moment when the documented system meets the real plant on an ordinary Tuesday, and it catches out sites that only prepare in the weeks before a known audit.

This guide explains the rule, what happens with blackout dates and refusals, how findings are graded and closed, and how to keep a site inspection-ready throughout the year. Details come from certification body guidance based on Version 6 of the scheme, and Version 7 is now being phased in, so confirm the current wording with your certification body. For the certification route as a whole, see our FSSC 22000 certification guide.

What the FSSC 22000 unannounced audit rule requires

Certification body guidance describes the requirement as at least one unannounced surveillance audit after the initial certification audit, and within each three-year period thereafter. The FSSC Version 7 FAQ reaffirms the principle: it notes that an upgrade audit against the new version may be announced, or unannounced if that is needed to meet the three-yearly unannounced audit requirement. Organisations may also choose to have all their surveillance and recertification audits unannounced, which some do to show maturity to customers.

Aspect	What to expect
Frequency	At least one unannounced surveillance audit in each three-year cycle
Notice	None, though the certification body may agree blackout dates in advance
Voluntary option	All surveillance and recertification audits can be unannounced
Refusal	Certificate suspended, and withdrawn if the audit does not take place within six months, according to one certification body’s guidance

Blackout dates for the FSSC 22000 unannounced audit

An unannounced audit can still respect genuine operating limits. Organisations may nominate blackout dates when an audit truly cannot take place, for example during a seasonal shutdown, a planned customer audit or a corporate internal audit. Certification bodies judge whether the request is reasonable, and there is no fixed minimum or maximum in the guidance we reviewed. Absences such as holidays or staff sickness are typically not acceptable reasons.

Be careful with the list. Every blackout date narrows the window in which the auditor can arrive, and a long list invites the certification body to question your intent. Keep it short, keep the reasons factual and keep evidence, such as the production calendar or the customer’s audit notice, ready to show.

What happens on arrival

The auditor arrives, usually at the start of a shift, and asks for the site’s food safety team leader or a deputy. Have a named person on every shift who knows the procedure: verify identification, notify the team leader, provide personal protective equipment and hygiene rules, and begin the opening meeting. Do not leave the auditor waiting in reception while managers scramble, since delay is noticed and it also disrupts the plan for the day. Check that gate and reception staff know who to call and that the site can produce records promptly.

Findings and timelines after the audit

Nonconformities are graded as minor, major or critical. Certification body guidance describes minor findings as not affecting the capability of the system, majors as affecting system capability or regulatory compliance, and criticals as significant failures with a food safety impact. Correction and closure timelines differ by grade: a critical finding usually brings a short deadline for evidence, a follow-up visit and possible suspension, while minor and major findings have a longer period. The exact numbers depend on the scheme version and your certification body’s procedure, so read the current rules and do not rely on a summary. Our guide to HACCP corrective action shows how to structure the root cause and corrective steps that auditors expect to see.

Keeping the site ready for an FSSC 22000 unannounced audit

Readiness is a habit, not a project. Build these into the annual cycle.

1. Run internal audits on a rolling basis. Cover every area over the year, on different days and shifts, including nights and weekends.
2. Keep records current. Monitoring logs, calibration, cleaning verification and training records should be completed in real time, not filled in later.
3. Test traceability and recall. A mock recall with a timed result shows whether the system works without notice.
4. Cover every shift. A trained deputy on each shift can host an auditor if the team leader is away.
5. Check the additional requirements. Scheme-specific items such as food defence, food fraud and allergen management must be in place. See FSSC 22000 additional requirements and food fraud and food defense.
6. Keep management review and food safety culture evidence ready. See food safety culture.
7. Prepare the arrival protocol. Reception, security and shift managers know who to call and what the auditor may ask for.

Common findings at an FSSC 22000 unannounced audit

• Records completed in bulk. Logs show identical entries or are signed after the event.
• Hygiene lapses on the floor. Handwashing, protective clothing and zoning rules are not followed when no visit is expected.
• Out-of-date procedures. The work instruction on the wall differs from the practice.
• Weak night and weekend coverage. The supervisor on duty cannot show how monitoring is done.
• Corrective actions left open. Actions from the last audit or from internal audits have no evidence.
• No trained deputy. Delays in receiving the auditor and locating records.

Training the team for an FSSC 22000 unannounced audit

Preparation is mostly people. Brief every supervisor on what an auditor will ask, where records are kept and how to answer honestly and briefly. Teach staff to answer only the question asked, to say “I will find out” when unsure and to call the food safety team leader, and never to alter or complete a record after the auditor has arrived. Run short drills once or twice a year in which a colleague from another site plays the auditor for an hour. Afterwards, list what went well and what needed a scramble, and fix those items. A team that has practised is calmer, and calm teams produce better evidence.

Management commitment

Senior managers set the tone. If they treat every visit as a crisis, staff learn to hide problems. If they treat findings as information, staff report them early. Make sure leaders know the FSSC 22000 unannounced audit could happen on any day, review internal audit results at management review and provide the time and budget for corrections. Auditors look for evidence of commitment, so a management review that discusses real data and real decisions is worth more than a polished policy.

A hypothetical example

A snack manufacturer running three shifts receives an unannounced surveillance audit at 06:15 on a Wednesday. The gate officer calls the shift manager, who calls the trained deputy for food safety, and the opening meeting begins within twenty minutes. The auditor asks to see the packaging area monitoring records for the last month and selects a batch to trace. The team produces the trace within the hour, and the mass balance closes. The auditor raises one minor finding on a cleaning verification log with a missing signature. The site submits its root cause and correction inside the deadline. The example is illustrative only.

Records the auditor will sample first

Auditors usually start with what is easy to check and hard to fake. Expect requests for the last three months of critical control point monitoring, the calibration certificates for the instruments behind them, the environmental monitoring results, pest control reports, cleaning and sanitation verification, supplier approval files and the training record for the person doing the task they observe. They will often ask to see the same record in two places, such as the log and the system that feeds it. Make sure the numbers agree, dates are plausible and corrections follow your own rules: a single line through the error, initials and date, and never correction fluid or overwriting. Keep the records for the retention period set in your own procedure.

Documents to have ready

Prepare a short pack that the shift manager can find quickly: the site map and process flow, the HACCP plan and hazard analysis, the list of prerequisite programmes, the last internal audit and management review, open corrective actions, the recall and traceability procedure, supplier approval records and the contact list. The FSSC 22000 Toolkit includes templates for these, which you can adapt to your site. For the scheme’s own information, see the FSSC 22000 Version 7 FAQ, and confirm the Version 7 rules with your certification body. Our note on FSSC 22000 Version 7 covers the changes in more detail.

FSSC 22000 unannounced audit FAQ

How often is an unannounced audit required?

At least one unannounced surveillance audit is expected in each three-year certification cycle, and organisations may choose to make all their surveillance audits unannounced.

Can I refuse an unannounced audit?

Refusal has serious consequences. Certification body guidance describes immediate suspension and possible withdrawal if the audit is not carried out within six months.

Can I set blackout dates?

Yes, for genuine reasons such as a seasonal shutdown or a planned customer audit, subject to the certification body’s agreement. Holidays and staff absence are normally not accepted.

Does the rule change under Version 7?

The principle of a three-yearly unannounced audit continues, but confirm the details in the Version 7 documents and with your certification body.