ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
FSSC 22000 certification is the food industry’s most widely held GFSI-recognised scheme, and also one of the most widely misunderstood. It is not a standard. There is no document called “FSSC 22000” that you can buy, read cover to cover and implement. It is a certification scheme built from three separate normative layers, and a certificate depends on all three of them at once.
That structure is the single most useful thing to understand before you start, because it explains why most food safety documentation on the market only gets you a third of the way there.
Part 2 of the Scheme sets the audit requirements in three clauses, and each one points somewhere different.
| Layer | Source document | What it covers |
|---|---|---|
| Management system | ISO 22000:2018 | Context, leadership, planning, support, hazard control, performance evaluation, improvement |
| Prerequisite programmes | ISO 22002-100:2025 plus the sector part for your category | Buildings, utilities, cleaning, pest control, personal hygiene, cross-contamination |
| Additional Requirements | FSSC 22000 Scheme Part 2, clause 2.5 | 18 requirement groups containing 66 lettered requirements |
Parts 3, 4 and 5 of the Scheme exist too, but they bind licensed Certification Bodies and recognised Accreditation Bodies rather than you. Reading them is useful context; implementing them is not your job.
If you already hold ISO 22000, the management system layer will feel familiar and you may already satisfy most of it. The work is the other two layers, and it is substantial.
Sites moving from ISO 22000 to FSSC 22000 certification typically find they have nothing at all for food fraud mitigation, food safety and quality culture, quality control, environmental monitoring, food loss and waste, product design and development, equipment purchase specification, artwork and print control, logo use, or serious event notification. Each of those is an Additional Requirement group, and each carries its own documented information.
The same applies to HACCP. A working HACCP system is necessary and nowhere near sufficient — it sits inside clause 8.5 of one of the three layers.
Clause 2.5 contains 18 groups. Crucially, only some of them apply to everyone. Eight are scoped to particular food chain categories by their own heading, and five more say “all food chain categories” while carrying category-conditional requirements inside them.
That cuts both ways, and both directions cost money. Implementing a group your category does not carry commits you to evidence an auditor will then expect to see. Omitting one you do carry is a nonconformity. Determining your applicability before you write anything is the highest-value hour in the whole project.
The Scheme classifies organisations into 13 food chain (sub)categories, from BIII (pre-process handling of plant products) through the C range (food manufacturing) to K (bio/chemicals). Your category decides which prerequisite programme standard applies to you and which Additional Requirement groups you carry.
One example makes the point. Subcategory FII — brokering, trading and e-commerce without physical handling — carries no prerequisite programme standard at all. An FII organisation is audited against ISO 22000 and the Additional Requirements only. Applying a manufacturing PRP standard to a broker is wasted effort that an auditor will not thank you for.
Certification is granted by a Certification Body licensed by the Foundation and accredited for the Scheme. The CB calculates your audit duration from your full-time-equivalent headcount and your number of HACCP studies, documents that calculation, and provides it to you.
One provision is worth planning around: at least 50% of the total audit duration must be spent auditing operational food safety planning and the implementation of prerequisite programmes and control measures. That includes auditing the facilities, running traceability exercises and reviewing records. Expect the auditor on the floor for at least half the visit, and schedule production accordingly.
Audits also include an unannounced element across the certification cycle, so the practical standard is that your system is always in the state it would be in on an announced audit day.
It does not make you compliant by holding documents. The audit tests what you implement and can evidence. A complete document set that nobody operates fails, and it fails more visibly than an incomplete one, because every unused template is a claim you did not meet.
It also does not replace your legal obligations. Food law in your market of sale applies regardless, and the Scheme requires you to identify those requirements yourself.
The order matters more than the effort. Determine your food chain category first, then establish which normative documents apply to you, then determine which Additional Requirement groups you carry, then gap-analyse against that specific set. Only then start writing.
Teams that write documents first almost always produce a system built to the wrong requirement set, and discover it at the certification audit rather than at the desk.
The FSSC 22000 Toolkit is built on exactly that sequence — 111 templates arranged in the Scheme’s own three layers, with an applicability matrix that tells you which of the 18 groups your categories carry before you write a word.
Version 7.0 of the Scheme was published in May 2026, and it changes the picture for anyone certifying now. Audits against Version 6 may be delivered until 30 April 2027. Upgrade audits against Version 7 run from 1 May 2027 to 30 April 2028. Any certificate still on Version 6 after 30 June 2028 is withdrawn automatically.
If you are starting fresh today, build to Version 7 and skip the upgrade entirely. If you already hold a certificate, the transition is a project in its own right and the calendar is not generous.
The failures cluster, and almost none of them are about food safety knowledge. They are about evidence.
Records with unexplained gaps. A monitoring record with an empty box is read as a check that was not done. Where a check genuinely was not performed, record that it was not, and record what followed. An honest exception closes; a blank does not.
Applicability never determined. A site that implemented all 18 Additional Requirement groups without deciding which it carries has volunteered for evidence it does not owe, and usually cannot produce. The reverse — a group quietly skipped with no recorded reasoning — is a straightforward nonconformity.
Corrective actions closed on a promise. Correction and corrective action are different obligations. Fixing the instance is correction. Eliminating the cause, then verifying at an interval long enough for the evidence to mean something, is corrective action. Closing on the day the action was agreed is the tell that the two have been conflated — no cause is eliminated and verified in a single afternoon.
Internal audit that never covered quality. The Additional Requirements bring quality elements inside the internal audit scope. An internal audit programme built from ISO 22000 alone will not cover quality parameters, product release or quantity control, and that gap surfaces immediately.
Documents that were bought and never adopted. Templates still carrying square-bracket placeholders at the audit read as a purchase rather than a system. Every placeholder is a decision somebody still has to make, and FSSC 22000 certification tests decisions, not stationery.
None of these is difficult to avoid. All of them are difficult to fix in the fortnight before an audit, which is why FSSC 22000 certification rewards starting from the applicability determination rather than from the document library.
Partly. The FSSC Scheme documents themselves — Parts 1 to 5, the five Annexes, the Board of Stakeholders decision list and the Upgrade Process — are published free of charge by the Foundation at fssc.com. ISO 22000 and the applicable part of the ISO 22002 series are licensed ISO standards and you need your own copies.
For a site already running ISO 22000, working through the Additional Requirements layer typically takes a few months. Starting from nothing, plan a longer programme. Work backwards from a target audit date rather than forwards from today, because the Certification Body’s availability is a constraint you do not control.
Yes. The Scheme has been benchmarked and recognised by the Global Food Safety Initiative since February 2010, which is what most retailer supplier requirements point at. That recognition is the commercial reason most sites certify at all.
Frequently, and it is often missed. A manufacturer that also stores product for third parties needs Category G alongside its manufacturing category. One that also wholesales at the same site needs subcategory FI. Your applicability decisions must be taken against every category you claim, not just the primary one.
Related reading: the Version 7 transition, food chain categories, the 18 Additional Requirement groups and FSSC 22000 vs ISO 22000.
Start with the free Scheme documents and your own category determination. Those two things cost nothing and decide everything that follows. Once you know which of the 18 Additional Requirement groups you actually carry, the writing becomes a finite, scoped job rather than an open-ended one — and that is the difference between an FSSC 22000 certification project that lands and one that drifts.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026