ISO 22002 Prerequisite Programmes: The 2025 Reissue Explained

ISO 22002 prerequisite programmes were reissued in 2025, and the change is larger than a routine edition update. The series was restructured, the numbering moved, and most of the guidance still circulating online describes a version that has been withdrawn.

If your prerequisite programmes were written against the old ISO/TS 22002 series, they now reference a structure that no longer exists.

What this guide covers

• What the ISO 22002 prerequisite programmes series is for
• The 2025 restructure of ISO 22002 prerequisite programmes
• The renumbering trap
• Food defence and food fraud moved into the ISO 22002 prerequisite programmes
• Other changes worth knowing
• Keying your ISO 22002 prerequisite programmes to something stable
• Do you need to buy the ISO 22002 prerequisite programmes standards?
• What to do now
• How the prerequisite layer is audited
• The areas that most often fail
• Frequently asked questions on ISO 22002 prerequisite programmes
• The short version

What the ISO 22002 prerequisite programmes series is for

Prerequisite programmes are the conditions that make hazard control possible — buildings, utilities, cleaning, pest control, personal hygiene, cross-contamination prevention. They are not the hazard control plan. A hazard the prerequisite programmes do not adequately control gets escalated to an operational PRP or a critical control point.

ISO 22000 clause 8.2 requires them. Clause 8.2.4 lists twelve considerations when establishing them. But note the wording of clause 8.2.3 carefully: the organisation should consider the applicable part of the ISO 22002 series. Should, not shall.

It is the FSSC 22000 Scheme, in Part 2 clause 2.4, that makes the applicable ISO 22002 prerequisite programmes part mandatory. Never write that ISO 22000 requires ISO 22002 — it does not.

The 2025 restructure of ISO 22002 prerequisite programmes

Before 2025 the series was a set of parallel sector documents, each repeating a large body of common material. Training, cleaning and pest control appeared in ISO/TS 22002-1, again in -2, again in -4, and so on.

The 2025 reissue consolidated that. A new common part now carries the ISO 22002 prerequisite programmes shared across the food, feed and packaging supply chain, and the sector-specific parts sit on top of it carrying only what is genuinely sector-specific.

Part 7 is new in the 2025 series. Subcategory FII — brokering and trading without physical handling — carries no ISO 22002 prerequisite programmes part at all.

The renumbering trap

This is the part to be careful about, and it cannot be worked around by inference.

The FSSC Scheme cites ISO 22002-1:2025 clause 10 for the procurement of animals, fish and seafood, and clause 12 for inspection at lairage and evisceration. Under the withdrawn ISO/TS 22002-1:2009, clause 10 was measures for prevention of cross-contamination and clause 12 was pest control.

So the numbering has definitively moved, and it has moved by more than an offset. Anyone renumbering their ISO 22002 prerequisite programmes documents by assumption — or working from a summary article rather than the standard — will produce a document set that cites the wrong clauses with complete confidence. An auditor holding the current standard will find it immediately.

The only safe route is to map clause by clause from your own licensed copies. It is an afternoon of work and it is not optional.

Food defence and food fraud moved into the ISO 22002 prerequisite programmes

The change with the widest reach. Food defence and food fraud prevention now sit inside the common part of the ISO 22002 prerequisite programmes series, at clauses 16.2 and 16.3 respectively — the two clause numbers the FSSC Scheme states directly, and therefore the only two safe to cite.

They also remain FSSC Additional Requirements. Both layers apply. Practically that means a threat assessment and a vulnerability assessment are no longer annual bolt-ons: they are prerequisite programme content with Additional Requirement obligations layered on top, including a named competence requirement for whoever produces each plan.

Our separate guide covers all 18 Additional Requirement groups in detail.

Other changes worth knowing

Beyond the restructure, the 2025 ISO 22002 prerequisite programmes carry a set of substantive shifts:

• Sustainability and digital traceability became mandatory considerations rather than optional ones.
• Terminology was modernised — “cleaning and disinfection” rather than “cleaning and sanitizing”, and waste handling now sits alongside food loss and waste management and recycling.
• Controls became more explicit in several areas including allergen control, zoning, cleaning in place, drainage, migration, incoming materials, sharps and rework.
• Rework remains in the sector-specific part rather than moving to the common one.
• Product recall no longer appears as a standalone clause in the food manufacturing part.

Requirements largely moved rather than disappeared. That is reassuring for content and unhelpful for citations, which is exactly why the mapping exercise matters.

Keying your ISO 22002 prerequisite programmes to something stable

There is a practical technique worth knowing if you are building documentation now and cannot yet obtain every standard.

ISO 22000 clause 8.2.4 lists twelve prerequisite programme considerations — construction and layout of buildings and associated utilities; premises layout, zoning, workspace and employee facilities; supplies of air, water, energy and other utilities; pest control, waste and sewage disposal; equipment suitability and accessibility for cleaning and maintenance; supplier approval and assurance; reception, storage, dispatch, transportation and handling; measures for prevention of cross-contamination; cleaning and disinfecting; personal hygiene; product information and consumer awareness; and others as appropriate.

Those twelve are stable, they come from a standard you need anyway, and every ISO 22002 prerequisite programmes clause maps onto one of them. Structuring your documents by domain and mapping the clause numbers in afterwards is more robust than structuring by clause number and rebuilding when the standard is revised.

The FSSC 22000 Toolkit is built exactly that way — its prerequisite programme section is keyed to ISO 22000 clause 8.2.4 (a) to (l) with the ISO 22002 domains named, and it ships two worksheets for completing the clause mapping from your own licensed copies.

Do you need to buy the ISO 22002 prerequisite programmes standards?

Yes, if you are certifying to FSSC 22000 in any category other than FII. The FSSC Scheme documents are free from the Foundation at fssc.com, but ISO 22000 and the ISO 22002 series are licensed ISO standards sold by ISO and by national standards bodies.

You need two: the common part, and the sector part for your food chain category. A site holding more than one category may need more than one sector part.

What to do now

1. Confirm your food chain category, which decides which sector part applies.
2. Obtain licensed copies of ISO 22002-100 and your sector part.
3. Map every clause of both onto your existing documents, recording gaps.
4. Update the citations in your prerequisite programme documents.
5. Check the food defence and food fraud documents answer both layers.
6. Re-run your internal audit against the new structure before your certification body does.

Step 3 is the whole job. Steps 4 to 6 fall out of it.

How the prerequisite layer is audited

Prerequisite programmes absorb a disproportionate share of the audit, and the Scheme is explicit about why. At least 50% of the total audit duration must be spent auditing operational food safety planning and the implementation of prerequisite programmes and control measures — including walking the facilities, running traceability exercises and reviewing the relevant records.

That means the auditor is on the floor for at least half the visit, looking at the things the prerequisite layer governs: fabric condition, drainage, zoning in practice, cleaning standards under and behind equipment, pest device placement against the map, personal hygiene compliance on the shift that is actually running.

There is also a separate Additional Requirement — clause 2.5.12 — obliging routine site inspections and PRP checks to verify that the site inside and out, the production environment and the processing equipment stay in a condition suitable for food safety. The frequency and content must be risk-based with defined sampling criteria, and linked to the relevant technical specification.

The practical consequence: a document set describing excellent prerequisite programmes, with no monthly inspection records behind it, fails on the floor rather than at the desk. Prerequisite programmes are verified by evidence of operation, not by the quality of the procedure.

The areas that most often fail

The prerequisite findings worth self-checking before an auditor does are the recurring ones: temporary repairs that quietly became permanent, open pest contractor recommendations tracked as advisory notes rather than as actions, drainage running from a less clean area toward a cleaner one, colour-coding that exists on a poster but not in practice, and the workshop and spares store left off the inspection schedule entirely.

None of those is a knowledge problem. Each is a maintenance-of-attention problem, which is what prerequisite programmes are actually for.

Your food chain category decides which sector part applies, and food fraud and food defense now sit in the common part as well.

>Frequently asked questions on ISO 22002 prerequisite programmes

Are the old ISO/TS 22002 parts still valid?

Not for FSSC 22000 Version 7. The Scheme’s normative documents name the 2025 editions, and your audit is against those. Documents still citing the withdrawn TS series will be read as out of date.

Which ISO 22002 prerequisite programmes part do we need?

The common part plus the sector part matching your food chain category, per the table above. If you hold more than one category — a manufacturer that also provides third-party storage, for example — you may need more than one sector part.

Can I find the 2025 clause numbers online?

You will find summaries listing topic areas, and they are useful for orientation. What you will not reliably find is a clause-by-clause mapping, and the summaries do not agree with each other on numbering. Since the FSSC Scheme itself cites clause numbers that meant something different in the withdrawn edition, do not build citations from secondary sources.

Does the restructure mean rewriting our prerequisite programmes?

Usually not. Most requirements moved rather than changed, so the content of your ISO 22002 prerequisite programmes documents largely survives. What changes is the citations, the structure, and a handful of areas where controls became more explicit — allergens, zoning, cleaning in place, rework and sharps in particular.

The short version

The 2025 ISO 22002 prerequisite programmes series is a better-organised set of standards with one significant trap: the numbering moved and it moved unpredictably. Buy the two parts you need, map them against what you already hold, and resist the temptation to renumber from a summary. For how the prerequisite layer sits within the wider scheme, see our guides to FSSC 22000 certification and the Version 7 transition.