Planning ISO 22000 certification for your food business?
Access Food Verification & Auditing Limited (AFVA) provides practical ISO 22000 gap assessments, food safety system development, HACCP support, internal audits and certification-readiness assistance across New Zealand.
Contact Access Food (AFVA) for ISO 22000 Support
Tell us about your products, site, employee numbers, current food safety system, customer requirements and target date. We can help define the scope before you request certification-body quotations.
ISO 22000 certification gives independent assurance that a food-chain organisation has implemented a food safety management system capable of controlling food safety hazards. In New Zealand, it can support customer confidence, supplier approval, tenders and international trade—but it does not replace Food Act registration, regulatory verification or an applicable Risk Management Programme.
A certification project normally involves selecting the correct standard, defining the certification scope, completing a gap assessment, building and implementing the system, collecting records, completing internal audits and management review, then undergoing Stage 1 and Stage 2 audits by an independent certification body.
This guide explains the ISO 22000 requirements, costs and certification process in New Zealand, including what affects the price, realistic timeframes, common gaps and how to avoid choosing the wrong scheme.
Quick answer: what may ISO 22000 certification cost in NZ?
For budgeting only, a prepared small single-site business may spend approximately NZ$10,000–$25,000 in the first year across system preparation and independent certification. A medium or less-prepared operation may spend around NZ$25,000–$60,000, while complex, high-risk or multi-site projects can exceed NZ$60,000. These are broad 2026 planning estimates—not fixed AFVA fees, ISO charges or certification-body prices. GST, travel, training, testing, facility upgrades and ongoing surveillance may be additional.
In this ISO 22000 NZ guide
- What ISO 22000 certification is
- Whether ISO 22000 is legally required in New Zealand
- ISO 22000 compared with FSSC 22000
- Main ISO 22000 requirements
- The Stage 1 and Stage 2 certification process
- Indicative ISO 22000 certification costs
- What affects the total price
- How long certification takes
- How to prepare for certification
- How AFVA can help
- Frequently asked questions
What Is ISO 22000 Certification?
ISO 22000:2018 is the international standard specifying requirements for a food safety management system, or FSMS. It combines management-system controls, prerequisite programmes, communication throughout the food chain and HACCP principles. The standard can be used by organisations of any size that are directly or indirectly involved in the food chain.
The current published edition is ISO 22000:2018 together with Amendment 1:2024 on climate-action changes. ISO also has a revision under development, so businesses beginning a new project in 2026 should confirm the applicable edition and any future transition arrangements with their selected certification body.
Certification is voluntary unless it has become a contractual requirement through a customer, tender, owner or supply agreement. ISO itself does not audit companies or issue certificates. As the ISO certification guidance explains, certification is carried out by an external certification body.
| Organisation type | Why ISO 22000 may be relevant | Typical scope considerations |
|---|---|---|
| Food manufacturer | Customer approval, export growth, structured hazard control and stronger management oversight. | Product families, lines, shifts, outsourced processes, storage and dispatch. |
| Importer, distributor or warehouse | Supplier controls, traceability, cold-chain management and customer assurance. | Imported-food duties, transport, third-party storage, relabelling and recall responsibilities. |
| Caterer or food-service provider | Tender requirements, consistency across operations and control of vulnerable-consumer risks. | Central kitchens, service sites, menu changes, allergen controls and distribution. |
| Packaging, equipment or service supplier | Demonstrating control of food-chain hazards and strengthening manufacturer supplier approval. | Food-contact risks, maintenance, chemicals, pest control, cleaning or technical services. |
Is ISO 22000 a Legal Requirement in New Zealand?
ISO 22000 certification is generally not a New Zealand legal requirement. It is a voluntary third-party certification that may be requested commercially. A food business must still identify and meet its applicable legal obligations under the Food Act 2014, Animal Products Act 1999, Australia New Zealand Food Standards Code, import rules, export requirements and any other relevant legislation.
A business operating under a Food Control Plan or National Programme must still maintain its registration and complete regulatory verification. An animal-product operation may still need a registered Risk Management Programme and verification. ISO certification does not transfer those duties to the certification body.
| Requirement | Purpose | Who assesses it |
|---|---|---|
| Food Act registration and verification | Confirms the business operates under the applicable Food Control Plan or National Programme. | Registration authority and recognised verifier. |
| RMP registration and verification | Manages hazards and regulatory outcomes for applicable animal-product operations. | MPI-recognised evaluators or verifiers as applicable. |
| ISO 22000 certification | Independent certification of the organisation’s food safety management system against ISO 22000. | Independent certification body. |
| Customer or retailer standard | Meets a contractual supplier-approval or market-access requirement. | Customer, approved auditor or scheme certification body. |
MPI states that HACCP is used within New Zealand risk-based programmes. Review MPI’s guidance on using HACCP and confirm your legal pathway separately from the ISO project.
ISO 22000 vs FSSC 22000: Confirm What Your Customer Requires
ISO 22000 and FSSC 22000 are related, but the certificates are not interchangeable. FSSC 22000 incorporates ISO 22000, sector-specific prerequisite-programme requirements and additional scheme requirements. The FSSC 22000 scheme guidance states that FSSC 22000 is recognised by the Global Food Safety Initiative, while ISO 22000 alone is not.
| Comparison | ISO 22000 | FSSC 22000 |
|---|---|---|
| Core basis | International food safety management system standard. | Certification scheme incorporating ISO 22000 plus specified PRPs and additional requirements. |
| GFSI recognition | ISO 22000 alone is not a GFSI-recognised certification programme. | The applicable FSSC scheme version may be GFSI-recognised for defined scopes. |
| Customer acceptance | May satisfy customers seeking an ISO-based FSMS certificate. | Often selected where the buyer requires a GFSI-recognised scheme. |
| Implementation scope | Must meet ISO 22000 and applicable legal, customer and organisational requirements. | Adds scheme-specific and sector PRP requirements, normally increasing preparation and audit scope. |
Avoid an expensive scheme-selection mistake
Ask the customer to confirm the exact accepted standard, scheme version, product category, accreditation expectation and deadline in writing. “ISO certified,” “GFSI approved” and “food safety certified” can mean different things. Do not assume ISO 22000 will satisfy a requirement for FSSC 22000, BRCGS, SQF or another named scheme.
What Are the Main ISO 22000 Requirements?
Certification requires more than writing a manual. The organisation must establish, implement, maintain and improve an effective FSMS, and it must produce objective evidence that the system works. The following summary does not replace the copyrighted standard.
| Requirement area | What the business must establish | Typical evidence |
|---|---|---|
| Context and scope | Relevant internal and external issues, interested parties, FSMS boundaries and an appropriate certification scope. | Context review, interested-party register, legal register, site and process scope. |
| Leadership | Management accountability, food safety policy, roles, responsibilities and support for the FSMS. | Policy, objectives, organisation chart, responsibilities, resources and management involvement. |
| Planning and support | Actions for risks and opportunities, measurable objectives, competence, awareness, communication and controlled documented information. | Risk register, objectives, training records, communication plans and document control. |
| Prerequisite programmes | Suitable hygienic and operational conditions for the products, processes, facility and food-chain position. | Cleaning, pest control, maintenance, supplier approval, allergen, personal hygiene, storage and waste controls. |
| Hazard control | Product and process information, flow diagrams, hazard analysis, control-measure selection, validated critical limits or action criteria, monitoring and corrective action. | HACCP studies, CCP or OPRP records, scientific references, trials, validation and verification results. |
| Traceability and emergencies | Traceability, emergency preparedness, withdrawal and recall controls, and management of potentially unsafe product. | Trace exercises, mock recalls, incident records, contact lists, stock reconciliation and disposition decisions. |
| Performance evaluation | Monitoring, measurement, analysis, evaluation, internal audits and management review. | Trend analysis, verification schedules, audit reports, corrective actions and management-review minutes. |
| Improvement | Control of nonconformities, root-cause analysis, corrective action, updating of the FSMS and continual improvement. | Incident investigations, action plans, effectiveness checks and controlled system updates. |
The 2024 climate amendment also requires the organisation to determine whether climate change is a relevant issue and recognises that interested parties may have climate-related requirements. The response should be proportionate and connected to the organisation’s context, supply continuity, utilities, raw materials, logistics, food safety risks and stakeholder expectations.
ISO 22000 Certification Process in New Zealand
The exact process varies by certification body, but accredited management-system certification normally follows a defined sequence. BSI’s New Zealand system-certification process, for example, identifies Stage 1 and Stage 2 audits before certification.
| Stage | What happens | Key output |
|---|---|---|
| 1. Define the objective | Confirm why certification is needed, which products and sites are included, and whether ISO 22000 or another scheme is required. | Confirmed standard, scope and target date. |
| 2. Gap assessment | Compare current practices, documents, site conditions and records with the standard. | Prioritised implementation plan and budget. |
| 3. Develop and implement | Build missing FSMS processes, improve PRPs, complete HACCP work, train staff and operate the system. | Implemented controls and objective records. |
| 4. Internal assurance | Complete the internal audit, management review, verification activities and corrective actions. | Evidence that the organisation checks and improves its own system. |
| 5. Select certification body | Request comparable quotations and confirm accreditation, food-chain scope, audit time, travel and ongoing fees. | Contract and scheduled audit programme. |
| 6. Stage 1 audit | The auditor reviews scope, readiness, key documents, site-specific conditions and preparedness for Stage 2. | Stage 1 report and readiness issues. |
| 7. Stage 2 audit | The certification audit evaluates implementation and effectiveness through interviews, observation, records and sampling. | Audit report and any nonconformities. |
| 8. Corrective action and decision | The business corrects findings and submits evidence. The certification body independently reviews the audit and makes the certification decision. | Certificate when requirements are satisfied. |
| 9. Maintain certification | Continue operating and improving the FSMS, complete surveillance audits and undergo recertification at the end of the cycle. | Ongoing certificate validity. |
A certificate is not normally issued immediately after the onsite audit. Audit findings must be addressed as required, the auditor’s recommendation is reviewed, and the certification body completes an independent certification decision. A consultant cannot make that decision.
How Much Does ISO 22000 Certification Cost in New Zealand?
There is no universal ISO 22000 certification fee. ISO does not set certification prices, and certification bodies calculate audit time using information about the organisation, food-chain category, hazards, employee numbers, sites, processes, shifts and complexity. Consultancy and certification must be quoted separately.
| Cost component | Indicative NZ budget | What may be included |
|---|---|---|
| Gap assessment and project planning | NZ$1,500–$5,000+ | Document review, site assessment, scheme confirmation and prioritised action plan. |
| System development and implementation support | NZ$5,000–$25,000+ | FSMS design, HACCP, procedures, forms, training, implementation meetings and corrective actions. Complex projects may exceed this range. |
| Initial certification: Stage 1 and Stage 2 | NZ$6,000–$18,000+ | Application, audit planning, Stage 1, Stage 2, report and certification decision for a smaller single-site scope. Larger or multi-site audits may cost substantially more. |
| Training and internal audit | NZ$1,500–$8,000+ | Awareness, HACCP, internal-auditor training or an independent readiness audit. |
| Testing, validation and facility improvements | Project-specific | Laboratory tests, shelf-life studies, process validation, calibration, equipment, repairs, hygienic-design upgrades or IT systems. |
| Annual surveillance audit | NZ$3,000–$10,000+ | Ongoing certification audit, report, review and administration. Travel and follow-up may be separate. |
| Three-year recertification | NZ$5,000–$15,000+ | Recertification audit and decision. Actual duration depends on the maintained scope, performance and complexity. |
Important pricing note
These are broad 2026 budgeting estimates only. They are not an AFVA price list, a government tariff or a certification quotation. Request written proposals from suitable certification bodies and confirm GST, audit days, travel, administration, corrective-action review, scope changes, surveillance and recertification. A low initial quote can be misleading if ongoing charges are excluded.
What Affects ISO 22000 Certification Cost?
The largest drivers are the required audit time and the amount of implementation work needed before certification. Important factors include:
- number of employees, shifts and seasonal workers;
- number and location of sites and whether central functions are separate;
- food-chain category, product risks and process complexity;
- number of product families, lines and outsourced processes;
- current maturity of HACCP, prerequisite programmes and management-system controls;
- quality of existing specifications, validation, testing and records;
- need for site upgrades, new equipment, software or laboratory work;
- travel, accommodation and auditor availability;
- integrated certification with ISO 9001 or another management-system standard;
- corrective-action follow-up or additional audit time; and
- future changes to the scope, sites, products or standard edition.
How Long Does ISO 22000 Certification Take?
A well-prepared small business with a mature HACCP system may be ready in approximately three to six months. A business building its FSMS from an early stage may require six to twelve months. Complex sites, construction projects, new production lines or businesses needing extensive validation may take longer.
The business needs enough operating evidence to demonstrate implementation. Policies and procedures written immediately before the audit are not enough if staff cannot explain them, records are incomplete, internal audits have not tested the system, management review has not occurred or critical controls lack validation.
Stage 1 and Stage 2 are normally separated so readiness issues can be resolved, but the interval depends on the certification body and the significance of the gaps. Certification may also be delayed while nonconformities are corrected and evidence is reviewed.
How to Prepare for the ISO 22000 Certification Audit
- Buy or obtain authorised access to the applicable standard. Do not rely only on internet summaries.
- Confirm the certification scheme and scope. Include the correct legal entity, address, products, processes and sites.
- Appoint a competent internal project leader. Management must remain accountable even when a consultant assists.
- Complete a structured gap assessment. Include site conditions, documents, practices, records and staff understanding.
- Strengthen prerequisite programmes. Cleaning, maintenance, pest control, allergen management, supplier approval and personal hygiene must work in practice.
- Review the HACCP system. Verify flow diagrams onsite, update hazard analysis and ensure control measures, limits, action criteria and monitoring are justified.
- Validate safety controls. Obtain scientific, technical or trial evidence before relying on critical limits and operational controls.
- Train staff and collect records. Employees must understand the controls relevant to their work and consistently complete required evidence.
- Test traceability and recall. Reconcile materials, packaging, work in progress, finished product, dispatch and remaining stock.
- Complete a full internal audit and management review. Close identified problems and check that corrective actions are effective.
- Conduct a readiness review. Sample actual records and interview staff in the same way an external auditor may.
- Plan for findings. Assign resources so root causes, corrections and corrective actions can be completed within the certification body’s deadlines.
Common gaps found before certification
- the proposed certificate scope does not match actual operations;
- legal and customer requirements are incomplete or not kept current;
- HACCP flow diagrams omit rework, delays, storage, cooling or outsourced steps;
- hazard analysis decisions and CCP or OPRP classifications are not technically justified;
- critical limits, shelf life or cleaning controls lack validation;
- supplier approval relies only on a questionnaire with no risk-based review;
- allergen, environmental monitoring or foreign-material controls do not match the site risk;
- traceability exercises do not reconcile quantities or meet customer timeframes;
- internal audits check documents but not implementation and effectiveness;
- corrective actions address the immediate problem but not the root cause; and
- management review records do not show meaningful decisions, resources or follow-up.
How to Choose an ISO 22000 Certification Body in New Zealand
Ask whether the certification body is accredited for ISO 22000 and for your applicable food-chain category. Accreditation is separate from certification: an accreditation body assesses the competence and impartiality of the certification body. The JASANZ register and certification information can help businesses understand accredited certification and check relevant providers.
Request at least two comparable quotations and ask each provider to identify:
- the exact standard, edition, food-chain category and proposed certificate scope;
- accreditation details and where the certificate can be verified;
- Stage 1 and Stage 2 audit duration;
- which audit activities will be onsite, remote or hybrid;
- travel, administration and corrective-action review charges;
- annual surveillance and three-year recertification costs;
- rules for scope extensions, extra sites and transfers;
- auditor competence and availability for your sector; and
- certificate-mark and logo-use rules.
Do not describe the business as “certified by ISO.” ISO does not issue certificates, and the ISO logo must not be used to imply certification. Follow the certification body’s approved wording and mark-use conditions.
How AFVA Can Help With ISO 22000 Certification Preparation
Access Food Verification & Auditing Limited supports New Zealand food businesses preparing for ISO 22000 and other food safety standards. The work is tailored to the products, processes, site risks, existing system and certification objective.
Depending on the agreed scope, AFVA can help with:
- scheme-selection and certification-scope review;
- ISO 22000 gap assessment and implementation planning;
- food safety policy, objectives, roles and FSMS structure;
- HACCP plan development and review;
- prerequisite-programme procedures and records;
- supplier approval, allergen, traceability and recall systems;
- validation and verification planning;
- training and implementation support;
- internal audits and supplier audits;
- management-review preparation;
- certification audit-readiness assessment; and
- corrective-action support following Stage 1 or Stage 2 findings.
Independence matters
AFVA can provide consultancy, gap assessment, internal-audit and readiness support within an agreed scope. Formal ISO 22000 certification must be completed by an independent certification body. No consultant can guarantee certification, and certification-body impartiality rules must be respected.
Prepare Your New Zealand Food Business for ISO 22000
Contact AFVA for an initial discussion about your products, current food safety system, certification scope, gaps and target timeframe.
Request ISO 22000 Support View Food Safety ConsultingFrequently Asked Questions
How much does ISO 22000 certification cost in New Zealand?
A prepared small single-site business may budget roughly NZ$10,000 to $25,000 for system preparation and initial certification, while medium or less-prepared businesses may spend NZ$25,000 to $60,000. Complex or multi-site projects may exceed NZ$60,000. These are broad planning estimates only; obtain separate written consultancy and certification quotations.
Is ISO 22000 certification mandatory in New Zealand?
Generally, no. ISO 22000 certification is voluntary, but a customer, retailer, tender or supply contract may require it. The business must still meet all applicable New Zealand registration, verification, RMP, labelling, import, export and food-safety obligations.
Does ISO 22000 replace a Food Control Plan or RMP?
No. ISO 22000 is a voluntary management-system certification. It does not replace a Food Act Food Control Plan or National Programme, an Animal Products Act Risk Management Programme, registration or regulatory verification.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the management-system standard. FSSC 22000 is a certification scheme that incorporates ISO 22000, specified prerequisite-programme requirements and additional scheme requirements. FSSC 22000 can be GFSI-recognised for applicable scopes; ISO 22000 alone is not.
How long does ISO 22000 certification take?
A prepared business may take approximately three to six months. A business developing a food safety management system from an early stage may need six to twelve months or longer, depending on site upgrades, validation, staff training, records and certification-body availability.
What happens during the Stage 1 audit?
Stage 1 reviews the proposed scope, key FSMS documentation, site conditions and readiness for Stage 2. The certification body identifies concerns that could affect preparedness, allowing the business to address them before the main certification audit.
What happens during the Stage 2 audit?
Stage 2 evaluates implementation and effectiveness. The auditor observes operations, interviews staff, samples records, checks legal and customer requirements, reviews HACCP and prerequisite programmes, and evaluates internal audit, management review and corrective action.
How long is an ISO 22000 certificate valid?
Management-system certification normally operates on a three-year cycle, subject to successful surveillance audits and continued conformity. A recertification audit is required before the cycle ends. Confirm the exact programme with the selected certification body.
Can a consultant issue an ISO 22000 certificate?
No. A consultant can help develop, implement, review or internally audit the FSMS, but formal certification and the certification decision must be completed independently by a competent certification body.
Can AFVA guarantee that my business will become certified?
No consultant should guarantee a certification result. AFVA can identify gaps, develop or review the system, train staff, conduct internal audits and support corrective actions, but the business must implement the FSMS and the certification body makes the independent decision.
Useful Official Resources
- ISO 22000:2018 overview and current status
- ISO 22000:2018 Amendment 1:2024
- ISO guidance explaining who performs certification
- JASANZ accreditation and certification information
- MPI guidance on using HACCP in a New Zealand food business
- Official FSSC 22000 scheme information
General information only: This article is not legal advice, certification advice or a quotation. Standards, scheme versions, customer requirements and certification arrangements can change. Costs are indicative 2026 planning ranges and vary by scope, complexity, location, readiness, provider and third-party services. Confirm current requirements with the relevant regulator, customer and accredited certification body.
Need Practical Food Safety Support for Your Business?
Contact us for free initial guidance. We provide practical, plain-English food safety support for New Zealand food businesses across all service areas.
This article provides general information only and is not a substitute for professional advice specific to your situation. Contact us for guidance based on your actual food activities and requirements.