FSSC 22000 Additional Requirements: All 18 Groups Explained

FSSC 22000 additional requirements are the layer that makes the scheme different from ISO 22000, and they are where most certification projects spend their time. Part 2 clause 2.5 sets out 18 requirement groups containing 66 individually lettered requirements, and an organisation moving up from ISO 22000 typically has nothing at all for most of them.

This is the complete list, what each group demands, and — the part that decides how large your project is — which food chain categories carry it.

What this guide covers

• All 18 FSSC 22000 additional requirements groups
• Which FSSC 22000 additional requirements actually apply to you
• The FSSC 22000 additional requirements that catch ISO 22000 sites
• The FSSC 22000 additional requirements with the most detail
• FSSC 22000 additional requirements that are pure administration
• How the FSSC 22000 additional requirements attach to ISO 22000
• Building the FSSC 22000 additional requirements without wasting effort
• Evidence the FSSC 22000 additional requirements expect you to hold
• What good implementation of the FSSC 22000 additional requirements looks like
• Frequently asked questions on FSSC 22000 additional requirements
• The point to take away

All 18 FSSC 22000 additional requirements groups

Which FSSC 22000 additional requirements actually apply to you

Eight of the 18 groups are scoped to particular food chain categories by their own heading. Five more say “all food chain categories” while carrying category-conditional requirements inside them — 2.5.1 has four such items, and 2.5.3, 2.5.4, 2.5.6 and 2.5.10 have one each.

So thirteen of the eighteen carry some conditionality. Determining which FSSC 22000 additional requirements you carry, before writing anything, is the single highest-value hour in the project. Get it wrong in either direction and it costs: adopt a group you do not carry and you owe evidence an auditor will ask for; skip one you do carry and it is a nonconformity.

The FSSC 22000 additional requirements that catch ISO 22000 sites

Food safety and quality culture (2.5.8). Senior management must set culture objectives addressing communication, training, employee feedback and engagement, and performance measurement — across all sections of the organisation affecting food safety and quality, not just production. Objectives need a documented plan with targets and timelines, feeding management review.

Quality control (2.5.9). Item (a) alone requires a quality policy and quality objectives, quality parameters for every product in scope, product release addressing quality control and testing, quality results analysed into management review, and quality elements inside the internal audit scope — that last one a genuine widening of ISO 22000 clause 9.2. Items (b) and (c) then add quantity control for unit, weight and volume, with calibration and verification of the equipment used for it, and line start-up and change-over procedures that ensure the previous run’s packaging and labelling have been removed from the line.

Food fraud (2.5.4) and food defence (2.5.3). Two separate disciplines with different motivations, requiring different assessments and different plans. Both carry a named competence requirement for the personnel who produce them.

Environmental monitoring (2.5.7). Not just a sampling schedule but a documented procedure evaluating the effectiveness of all controls preventing contamination from the manufacturing environment, with trended data and five defined review triggers.

The FSSC 22000 additional requirements with the most detail

Allergen management (2.5.6) is the largest group at eight lettered items: a list of every allergen handled on site, a risk assessment covering all cross-contamination sources, control measures, validation and risk-based verification testing, rules on precautionary labelling, training in two distinct forms, an annual review with defined triggers, and a conditional not-applicable provision for feed and pet food.

Product design and development (2.5.13) runs to seven items covering FSMS impact and hazard analysis update, process flow impact on new and existing products, resource and training needs, equipment requirements, shelf-life trials with ongoing verification, cooking instruction validation, and packaging design principles.

Labelling and printed materials (2.5.2) looks small at four items until you read item (d), which sets six named artwork and print controls — artwork approval, change and obsolescence management, print run approval against a master sample, in-run error detection, segregation of print variants, and reconciliation of unused printed product.

FSSC 22000 additional requirements that are pure administration

Two of the FSSC 22000 additional requirements are not about food safety at all, and both are easy to fail.

Logo use (2.5.5). The logo may be used only in marketing material. It may never appear on a product, its labelling, its packaging, or on certificates of analysis or conformance — nor anywhere implying the Foundation approves a product, process or service, nor where scope exclusions apply. Certificates of analysis are the easiest place to breach it without noticing, because they are produced by the laboratory rather than by marketing.

Communication (2.5.17). The certification body must be told within three working days of the commencement of serious events — not of your investigation concluding. That covers force majeure, natural and man-made disasters, malicious hacking, public recalls, regulator-imposed action, legal proceedings, fraud and corruption. Three working days is short enough that it needs a named escalation route agreed in advance, not a decision taken at the time.

How the FSSC 22000 additional requirements attach to ISO 22000

Almost every one is written as an addition to a named ISO 22000 clause, and that clause continues to apply in full. Requirement 2.5.1(a) adds to clause 7.1.6. Requirement 2.5.2(a) adds to clause 8.5.1.3. Requirement 2.5.12 adds to clause 8.8.1. Satisfying the addition does not discharge the underlying clause.

This is why a document set built only around the Additional Requirements fails as badly as one built only around ISO 22000. Both layers are audited, and so is the prerequisite layer between them. Our FSSC 22000 vs ISO 22000 comparison sets out how the three fit together.

Building the FSSC 22000 additional requirements without wasting effort

1. Determine your food chain categories first.
2. Work the 18 groups against those categories and record which you carry.
3. Record the reasoning for every group you decide does not apply — an unrecorded exclusion is a nonconformity.
4. For each group you carry, work item by item through the lettered requirements rather than by group title. A title tells you the topic; only the lettered item tells you the scope.
5. Widen the internal audit programme to cover the quality elements.
6. Check that every requirement naming an ISO 22000 clause is answered at both layers.

Step 4 matters more than it sounds. Requirement 2.5.6 carries eight lettered items behind the words “management of allergens”; requirement 2.5.2(d) carries six separate print controls behind the words “printed materials”. Reading group titles produces a plausible system that fails on detail.

The FSSC 22000 Toolkit covers all 66 lettered requirements across 40 documents in its Additional Requirements section, and its build fails if any one of the 66 is left without a document — a check that is run rather than a claim that is made.

Evidence the FSSC 22000 additional requirements expect you to hold

Each group produces records as well as procedures, and the records are what an auditor samples. A short list of the ones sites most often lack:

• Laboratory competence evidence — accreditation schedules showing the specific method and matrix, or proficiency testing results. Accreditation is not scope-blind.
• Mass balance for every product claim — input of the claimed material reconciled against output carrying the claim, over a defined period.
• Allergen verification testing at a risk-based frequency wherever products of differing allergen profile share a production area, trended and fed into the annual review.
• Culture measures across every function, with a baseline, a target and a date.
• Print reconciliation — quantity issued against used, rejected, returned and destroyed, within a defined tolerance.
• Serious event notification log, showing the working days elapsed between commencement and notification.
• Environmental monitoring trends by zone, distinguishing Zone 1 findings from Zone 3, because they mean different things.

None of those is produced by writing a procedure. Each needs the process running for long enough to generate a trend, which is why the FSSC 22000 additional requirements reward starting early rather than starting thoroughly.

What good implementation of the FSSC 22000 additional requirements looks like

The sites that pass cleanly share a pattern. They determined applicability first and wrote it down, including the negatives. They read the lettered items rather than the group headings. They gave the culture and quality groups to owners outside the food safety team, because those groups need decisions the food safety team cannot make alone. And they started collecting evidence months before the audit, because trends cannot be manufactured retrospectively.

The sites that struggle usually did the opposite in one specific way: they bought or wrote a complete document set covering all 18 groups, adopted none of it operationally, and arrived at the audit with 40 procedures and no records.

Two groups have guides of their own: food safety culture and food fraud and food defense.

>Frequently asked questions on FSSC 22000 additional requirements

Where can I read the FSSC 22000 additional requirements myself?

Part 2 of the Scheme, published free by the Foundation at fssc.com. Clause 2.5 is around ten pages and worth reading in full before you buy anything, including from us.

Do all 66 lettered requirements apply to every site?

No. The 66 FSSC 22000 additional requirements sit inside 18 groups, and thirteen of those groups carry some category conditionality. A typical manufacturer carries most of them; a broker in subcategory FII carries markedly fewer and has no prerequisite programme standard at all.

Did Version 7 change the FSSC 22000 additional requirements?

The FSSC 22000 additional requirements group structure is stable, but Version 7 incorporated the reissued ISO 22002 series, which moved food defence and food fraud into the prerequisite standard as well. Both layers now apply to those two topics. See our Version 7 transition guide for the full change picture.

Which group takes the longest to implement?

Food safety and quality culture, usually — not because the documentation is heavy but because it requires measurement across functions outside the food safety team, and that is an organisational change rather than a writing task.

The point to take away

The FSSC 22000 additional requirements are not a bolt-on to a food safety system. They are a second and largely unfamiliar body of obligation covering culture, quality, fraud, defence, labelling, waste and communication — and they are the reason a GFSI-recognised certificate means more than an ISO 22000 one. Determine which you carry, work them item by item rather than by title, and the project becomes finite. For the wider scheme picture, start with our guide to FSSC 22000 certification.