Multi-site certification — the central function and internal auditors

Plain-language summary

For multi-site organisations (BIII, E, F, G): a resourced central function, an annual internal audit programme covering every site, and internal auditors who meet defined experience, education and training criteria.

What the clause is really asking

When several sites sit on one certificate, the scheme relies on your internal audits to cover what the certification body only samples. The central function must provide sufficient resources and define roles for management, internal auditors, the technical reviewers of internal audits and other key FSMS personnel. It must establish an internal audit procedure and programme covering the management system, the central function and all sites at least annually or more often on risk, with auditors assigned centrally and independent of the areas they audit, and with the effectiveness of corrective actions demonstrated. Internal auditors must meet minimum criteria assessed by the CB every year: two years' full-time food-industry experience including one in the organisation; a higher-education course or five years' relevant experience; and training — a 40-hour FSMS, QMS or FSSC 22000 lead auditor course for the internal lead auditor, a 16-hour internal auditor course for the other team members, and at least 8 hours of scheme training covering ISO 22000, the sector ISO 22002-x standard and the additional requirements. Audit reports get an impartial technical review, and auditors and reviewers are performance-monitored and calibrated annually.

What auditors look for

Auditors examine the central function's audit programme against the site list, pull the internal auditors' competence files and check the course hours, and read a sample of internal audit reports for the technical review sign-off and the evidence that corrective actions worked.

Typical evidence

Central function roles and resources; internal audit procedure and programme covering every site annually; auditor independence assignments; auditor competence files (experience, education, 40 h / 16 h / 8 h training); technical review records; annual performance monitoring and calibration records; corrective action effectiveness evidence

How to comply — recommendations

Keep one competence file per internal auditor with the hours evidenced by certificates, and a calibration session each year where auditors grade the same evidence. Plan the programme from the site list so nobody is missed, and make the technical review a signed step before a report is issued.

Common nonconformities

A site not audited in the year; auditors auditing their own site; auditors without the required course hours; no technical review of reports; corrective action closed without evidence of effectiveness

Resources for this clause

• ArticleFSSC 22000 Version 7 explained: what changed, the dates that matter, and how to prepare for the upgrade audit
• Free downloadFSSC 22000 V7 Gap ChecklistEvery change from FSSC 22000 Version 6 to Version 7 as a tracked project — V6 audits end on 30 April 2027, and this is the file that gets a site to its upgrade audit with the evidence ready.
• Free masterclass · ~18 minFSSC 22000 V7 MasterclassV6 audits end 30 April 2027. Every V7 change clause by clause — the new ISO 22002 family, allergen testing, culture evidence, fraud/defence competence, food loss & waste targets — and a 90-day plan.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.