FSSC 22000 unannounced audits: the rules and the planning
The FSSC 22000 unannounced audit explained: which surveillance audit, blackout days, refusals, Version 7 transition and a planner's checklist.
Key takeaways
- At least one surveillance audit in every 3-year period must be unannounced; initial certification audits never are.
- Surveillance audits must fall within the calendar year, and the first cannot be more than 12 months after the initial certification decision.
- Blackout days are agreed in advance, the audit runs in normal operating hours and the facility inspection starts within 1 hour of arrival.
- From 1 May 2027 audits are Version 7 upgrade audits, which can also be the unannounced audit if one is due.
An FSSC 22000 unannounced audit is a surveillance audit carried out without telling the certified organisation the date. Under Part 3 of the Scheme (Version 6, clause 5.4), each organisation must have at least one unannounced surveillance audit after initial certification and within every 3-year period after that. Initial audits cannot be unannounced, and refusing entry leads to suspension within 3 working days.
What is an FSSC 22000 unannounced audit?
An FSSC 22000 unannounced audit is a full surveillance audit where the certification body decides the date and does not tell the organisation beforehand. The audit plan is not shared until the opening meeting. All Scheme requirements are assessed, including production or service processes in operation, so the visit has to fall on a day when the site is actually producing.
The rules are in Part 3 of the FSSC 22000 Scheme, clause 5.4. Version 6 (April 2023) is the version audited until 30 April 2027. Version 7 was published on 1 May 2026 and keeps the same core requirement. Check the current Scheme documents and Board of Stakeholders decisions on fssc.com before changing your procedure.
Frequency
At least one surveillance audit unannounced after initial certification and within each 3-year period.
No notice
The site is not told the date, and the audit plan is shared at the opening meeting.
Hours
Normal operating hours, with consideration of all shifts.
Start
The facility inspection begins within 1 hour of the auditor arriving.
Which audit in the FSSC 22000 certification cycle is unannounced?
The certification cycle is 3 years: initial certification, two surveillance audits and a recertification audit. The requirement attaches to surveillance audits, so in practice the certification body picks surveillance 1 or surveillance 2 in each cycle. Organisations can volunteer for more: once certified, they may choose to have all audits, surveillance and recertification, unannounced.
Surveillance audits must take place within the calendar year, and the first surveillance audit cannot be more than 12 months after the initial certification decision date. Recertification should preferably happen at least 3 months before expiry. See surveillance audit frequency and timing for the general ISO/IEC 17021-1 rules underneath.
- Initial auditStage 1 and stage 2, always announced
- Surveillance 1Calendar year, max 12 months after decision
- Surveillance 2Calendar year; often the unannounced one
- RecertificationPreferably 3 months before expiry
How do you choose between surveillance 1 and surveillance 2?
Worked example: an organisation's initial certification decision is dated 10 March 2026. Surveillance 1 must take place in 2027 and no later than 10 March 2027, which leaves roughly ten weeks of calendar year to work with. Surveillance 2 can fall anywhere in 2028. Choosing surveillance 2 for the unannounced audit gives the planner a whole year of possible dates to fit around blackout days and auditor capacity.
The opposite case: if the decision was dated in November, surveillance 1 has most of a calendar year available and is a sensible unannounced slot. Whichever you choose, record the decision on the audit programme at the start of the cycle so it is not lost when the file changes hands.
| Audit | Calendar year | Latest date | Unannounced fit |
|---|---|---|---|
| Surveillance 1 | 2027 | 10 March 2027 | Tight: about ten weeks of dates |
| Surveillance 2 | 2028 | 31 December 2028 | Good: a full calendar year |
| Recertification | 2029 | Before expiry | Only if the site volunteers |
What are FSSC 22000 blackout days?
Clause 5.4.2 allows blackout days to be agreed in advance between the certification body and the certified organisation. BRCGS and IFS both publish a 10-day ceiling. For FSSC 22000, read the current clause and any Foundation guidance, then document your own limit and a rule for what counts as a valid reason, so every planner applies the same test. Planned shutdowns and periods without production are the usual examples.
Keep blackout days in the same place the scheduler reads from. A blackout agreed by email and never entered into the plan is how auditors end up at closed factories. For comparison, see BRCGS unannounced audit rules.
What happens if the site refuses the FSSC 22000 unannounced audit?
If the certified organisation refuses to take part in the unannounced audit, the certificate is suspended within 3 working days. If parts of the scope cannot be audited on the day, for example because a line is not running, a follow-up audit must be scheduled within 28 calendar days. Both outcomes create short-notice work, so planners need spare auditor capacity in the weeks after unannounced visits.
MythAn unannounced audit can be shortened because it is a surprise.
RealityIt is a full surveillance audit with the normal duration. See how FSSC 22000 audit duration is set.
MythThe initial audit can be unannounced to prove the system is real.
RealityInitial certification audits cannot be unannounced under the Scheme.
MythIf the line is down, the auditor just leaves out that part.
RealityParts not audited need a follow-up audit within 28 calendar days.
How does Version 7 affect unannounced audit planning?
Foundation FSSC's upgrade process sets the dates. Version 6 audits can continue until 30 April 2027. From 1 May 2027 until 30 April 2028, audits are Version 7 upgrade audits, carried out at the organisation's next scheduled surveillance or recertification audit. Upgrade audits may be announced, or unannounced if that is needed to meet the 3-yearly requirement.
That means an unannounced surveillance due in the upgrade year becomes an unannounced upgrade audit. The auditor must be qualified against the Version 7 (sub)categories, which UKAS notes may require requalification. Check that before you release the booking.
- 1 May 2026Version 7 publishedImplementation year begins; Version 6 audits continue.
- 30 April 2027Last Version 6 auditsAll audits from the next day are to Version 7.
- 1 May 2027 to 30 April 2028Upgrade auditsDone at the next surveillance or recertification; may be unannounced.
A planner's checklist for each unannounced visit
Use this list when you allocate an FSSC 22000 unannounced audit. It covers the items that most often cause late, wasted or invalid visits.
- ✓Unannounced audit recorded against surveillance 1 or 2 for this cycle
- ✓Calendar-year and 12-month limits checked for the chosen audit
- ✓Blackout days entered in the planning system
- ✓Shift patterns and production days confirmed so processes are running
- ✓Auditor qualified for the food chain (sub)category and Scheme version
- ✓Auditor within the rotation limit for this organisation
- ✓Date hidden from client portals and automatic emails
- ✓Capacity kept free for a follow-up within 28 calendar days
The rotation limit matters here: under Version 6, an auditor may not audit the same organisation for more than two 3-year cycles, or six years if they start mid-cycle. See auditor rotation rules.
ScheduleAI runs these checks on every allocation and shows the planner which rule excluded each auditor, so decisions can be explained at assessment.
Sites with more than one scheme
Many FSSC 22000 sites also hold BRCGS, IFS or customer standards. Each scheme counts its own unannounced requirement, with its own window. Combining them saves auditor days but needs the most restrictive window to lead. See planning across several GFSI schemes at one site.
See how ScheduleAI's audit scheduling software applies these rules across a whole programme in minutes.
ScheduleAI marks which surveillance audit in each FSSC 22000 cycle is unannounced, enforces calendar-year and 12-month limits, blackout days, category qualification and rotation, and keeps the date out of client communications until a planner releases it.
Book a demo Estimate your savingsQuestions
How often is an FSSC 22000 unannounced audit required?
At least one surveillance audit must be unannounced after initial certification and within each 3-year period after that (Version 6, Part 3, clause 5.4).
Can the recertification audit be unannounced?
Yes, voluntarily. Once certified, an organisation may choose to have all audits, including recertification, unannounced.
Are blackout days allowed in FSSC 22000?
Yes. Blackout days are agreed in advance between the certification body and the organisation.
What if the organisation refuses the unannounced audit?
The certificate is suspended within 3 working days.
Can a Version 7 upgrade audit be unannounced?
Yes. Foundation FSSC allows upgrade audits to be unannounced where that is needed to meet the 3-yearly unannounced requirement.
How does this compare with IFS?
IFS Food requires at least every third audit to be unannounced, in a window from 16 weeks before to 2 weeks after the due date. See IFS unannounced audits.