hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Two-minute brief

FSSC 22000 requirements explained: video brief

A two-minute brief on what an FSSC 22000 audit tests: three documents at once, mapped in plain language.

  • Two-minute brief
  • 2 min

Key takeaways

  • One audit covers ISO 22000, the ISO 22002 prerequisite programmes and the scheme's additional requirements.
  • The food chain category decides which requirements apply.
  • Additional requirements include food defence, food fraud, allergens and culture.
  • A timed mock recall is part of the evidence.
  • Primary production is outside the scheme.

Three documents tested in one audit

An FSSC 22000 audit tests three documents at once: ISO 22000:2018 clauses 4 to 10, the applicable ISO 22002 prerequisite programme standard together with ISO 22002-100, and Part 2 of the scheme, which lists the additional requirements. Several requirements apply only to certain categories, so each is checked against your category. This short film maps the three.

From ISO 22000, clauses 4 to 7, 9 and 10 provide the management system: scope and context, leadership and a food safety team, objectives and planned change, competence and documented information, internal audit, management review and improvement. Clause 8 provides the operation: prerequisite programmes, traceability and emergency response, hazard analysis, validated control measures, the hazard control plan with its operational prerequisite programmes and critical control points, monitoring, verification and control of unsafe product up to recall. In practice an auditor looks for flow diagrams confirmed on the floor, validated limits, monitoring recorded as the check is made and a timed mock recall.

Prerequisite programmes and additional requirements

The ISO 22002 standards set out the prerequisite programmes for the food, feed and packaging chain: the common baseline in ISO 22002-100 and the part for your category. The FSSC additional requirements then reach the topics the ISO texts do not, including food defence, food fraud mitigation, allergen management, environmental monitoring, food safety and quality culture and food loss and waste.

The scheme covers the food chain after primary production, from food and feed manufacturing to catering, retail, trading, transport and storage, packaging and biochemicals; farming sits outside it. Certification is audited and decided by a certification body licensed by Foundation FSSC and accredited for the scheme, and certificates are listed on the FSSC public register.

Many retailers and brand owners write GFSI-recognised certification into their supplier programmes, which is why the scheme, rather than ISO 22000 on its own, is often the certificate a buyer names.

FSSC 22000 at a glance

Purpose
GFSI-recognised certification of a food safety management system: ISO 22000, the ISO 22002 prerequisite programmes for your sector and the FSSC additional requirements, as one scheme
Relevant to
Food and feed manufacturers, packaging and (bio)chemical producers, caterers, retailers, brokers and traders, transport and storage providers
Edition
Version 7, published by Foundation FSSC on 1 May 2026. Version 6 audits are allowed until 30 April 2027; upgrade audits to Version 7 run from 1 May 2027 to 30 April 2028
Certification
Audited and decided by a certification body licensed by Foundation FSSC and accredited for the scheme; at least one surveillance audit per three-year cycle is unannounced; certificates are listed on the FSSC public register
Sterling's role
Gap analysis against all three components, PRPs and hazard control plan, the additional requirements built into daily routines, Effivity, training, internal audit and audit readiness, then Sustain™
Cost and timing
Total investment for an FSSC 22000 system depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months

FSSC 22000: the complete guide →

FSSC 22000: questions people ask

What is the difference between ISO 22000 and FSSC 22000?

ISO 22000 is a management system standard; FSSC 22000 is a certification scheme that uses it. An FSSC 22000 certificate means the organisation was audited against ISO 22000:2018, the ISO 22002 PRP standard for its category and the FSSC additional requirements, by a certification body licensed by Foundation FSSC, under the scheme's audit rules. ISO 22000 alone is not recognised by GFSI; FSSC 22000 is.

Is FSSC 22000 Version 7 recognised by GFSI?

FSSC 22000 has been benchmarked and recognised by GFSI since 2010, and Version 7 was written to align with the GFSI Benchmarking Requirements v2024. At the time of writing, GFSI's published list names FSSC 22000 Version 6 against its v2020 requirements; recognition of Version 7 is a matter for GFSI's benchmarking process, so check GFSI's list, or ask us, when a customer requirement turns on it.

Which food chain categories does the scheme cover?

Pre-process handling of plant products (BIII); animal primary conversion and the processing of perishable, mixed and ambient-stable products (C0 to CIV); feed and animal food (D); catering (E); retail, wholesale and e-commerce (FI); brokering and trading (FII); transport and storage (G); packaging material production (I); (bio)chemical production (K). GFSI's current recognition covers BIII, the C sub-categories, D, G, I and K; caterers, retailers and traders are certified under the scheme but sit outside that list at present.

What are the FSSC 22000 additional requirements?

Part 2 of the Version 7 scheme lists eighteen: management of services and purchased materials; product labelling and printed materials; food defence; food fraud mitigation; logo use; management of allergens; environmental monitoring; food safety and quality culture; quality control; transport, storage and warehousing; hazard control and measures for preventing cross-contamination; PRP verification; product design and development; traceability; equipment management; food loss and waste; communication requirements; and requirements for organisations with multi-site certification. Several apply only to particular categories.

What is the unannounced audit, and can we refuse a date?

After initial certification, at least one surveillance audit in each three-year period is unannounced. The site is not told the date, the plan is shared at the opening meeting and the auditor begins with an inspection of production within an hour of arriving. Blackout days are agreed with the certification body in advance; refusing the audit leads to suspension within three working days. The initial certification audit is always announced.

More FSSC 22000 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on FSSC 22000

Start with the FSSC 22000 page, or go straight to the guide you need.

On the FSSC 22000 page

Guides

Often combined with FSSC 22000

More videos: Food safety and agriculture

All videos

Talk to a consultant

Plan your FSSC 22000 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice