Effivity FSSC 22000 guide: the three parts of the scheme and every additional requirement in one system

Why FSSC 22000 asks more of the software than ISO 22000 does

FSSC 22000 is a scheme built from three normative documents, and a certification body licensed by Foundation FSSC audits all three together. An organisation that already keeps ISO 22000 in Effivity has the first part and most of the second in place. What it usually lacks is the third: a set of topics that ISO texts do not reach, each of which produces its own assessment, plan or register.

A food fraud assessment copied from a template, an allergen assessment last opened two years ago, swab results nobody trended: each passes a desk review and fails when an auditor asks who owns it and when it was last reviewed.

Effivity, used in 50+ countries, is Sterling's ISO and GRC software, and its food safety configuration is aligned with ISO 22000 and covers FSSC 22000. The scheme requires no software; what Effivity changes is that every element sits in one structure with its next review scheduled, so the system looks the same on an ordinary Tuesday as in an audit week.

Each scheme element and where it lives in Effivity

The table follows the scheme, not the ISO clause order. Forms inside each module are adapted to your site, category and products.

The context module holds the scope in the scheme's category language, and Customer Life Cycle Management holds complaints. What each additional requirement actually requires is set out in FSSC 22000 additional requirements explained, one by one; this guide deals only with where the evidence is kept.

What Sterling sets up in the first weeks

Configuration runs alongside the gap analysis, because several decisions that shape the system are made there. Effivity comes with pre-configured workflows; Sterling adapts them, form by form, to the site.

• Category first. The food chain category and sub-category decide which ISO 22002 part applies and which additional requirements bite.
• PRP inspections as checklists. Each prerequisite programme gets an inspection checklist with an owner and a frequency, written against ISO 22002-100 and your sector part rather than the retired technical specifications.
• Assessments with review dates. Food defence, food fraud and allergen assessments are held as records with named assessors and a scheduled review.
• A sampling plan for swabs. Where environmental monitoring applies, sampling points, organisms and frequencies are set up, and an out-of-limit result opens a nonconformity.
• People as users. Operators, supervisors and assessors get their own logins, so each record carries the name of whoever did the work.

A register is useless until a competent team has done the assessment; those workshops are covered in Food defence and food fraud assessments.

Records that are ready on any day of the year

Under the scheme, the site is not told the date of the unannounced audit, the plan is withheld until the opening meeting and the auditor begins with an inspection of the production facilities within an hour of arriving.

Effivity is cloud-based with a mobile app, so a PRP check or a swab result is logged at the point of work rather than written up later. Dashboards and escalation show a coordinator what is overdue before an auditor does. How to prepare people and premises for that visit is the subject of The unannounced audit: how to be ready on any day.

A worked trace: one positive swab

A routine environmental swab near a filler returns a positive for an indicator organism. The result is entered against its sampling point and opens a nonconformity owned by the hygiene lead. The correction is an intensified clean and repeat swabbing; the investigation finds a worn seal where water collected. The seal is replaced through the equipment record and swabbing at that point is increased. After several clean results the record is closed, and the trend for that zone goes to the next management review. An auditor who arrives unannounced a month later can follow the whole chain from one screen.

Moving to Version 7 in the same system

Foundation FSSC published Version 7 on 1 May 2026. Version 6 audits remain possible until 30 April 2027, and upgrade audits run from 1 May 2027 to 30 April 2028. The upgrade audit is a full audit against the new version, so every changed element needs evidence, not just a revised manual.

In Effivity the upgrade is handled as a set of controlled changes. PRP documents are revised against the ISO 22002-x:2025 series and the common baseline, with the change history showing what moved and why. Revised additional requirements become updated checklists, assessments or objectives, each with an owner and a date. The full list of changes is in FSSC 22000 Version 7: what changed.

What Effivity does not do

Effivity is your system, not the scheme's. The certification body uploads its audit report and related documents to the Foundation's Assurance Platform, and the Foundation publishes certificate status on its public register; neither is run from Effivity. The software also does not assess threats, decide whether an allergen label is justified, set limits or validate them. Those remain judgements for competent people, who must explain them to the auditor. Three habits undo the benefit:

• Assessments uploaded, not done. A downloaded food fraud template stored as an attachment is still a downloaded template.
• Swab results left as PDFs. Results that are attached but never entered cannot be trended, and the environmental monitoring requirement is about acting on trends.
• One site's structure copied to another. In a multi-site group, each site needs its own records under a central function, not a clone of the head office set-up.

Effivity for FSSC 22000: questions buyers ask