FSSC 22000 food defence and food fraud: how to do the assessments properly

What does FSSC 22000 require for food defence and food fraud?

FSSC 22000 food defence and food fraud requirements sit in Part 2 of the Version 7 scheme, published by Foundation FSSC on 1 May 2026, as additional requirements 2.5.3 (food defence) and 2.5.4 (food fraud mitigation). They sit on top of ISO 22000:2018 and the prerequisite programmes, and the licensed certification body audits them with everything else.

For both topics the scheme expects a documented assessment and a plan that follows from it, developed and maintained by personnel with appropriate knowledge and competence. In plain terms: find what applies to your site, decide what is significant, put mitigation in place with owners, and review it on a cycle and after change.

Version 7 also adopts ISO 22002-100:2025 as the common prerequisite baseline, and that standard carries its own heading on food defence and food fraud. A site certified to the scheme should therefore read the PRP expectations and the additional requirements together, so that site security and supplier controls are written once and referenced from both. The full list of eighteen additional requirements is covered in our guide FSSC 22000 additional requirements explained, one by one.

Food defence and food fraud: two different questions

The two assessments are often confused because both deal with deliberate acts. The motive is what separates them. Food defence is about intentional harm: a disgruntled employee, a contractor with a grievance, an intruder, someone making a point. Food fraud is about deception for gain: a supplier stretching an expensive ingredient with a cheaper one, a false origin claim, a counterfeit certificate of analysis.

How to run a food defence threat assessment

The scheme does not prescribe a scoring method, so Sterling's recommended approach below is one way of meeting it, not the language of the scheme.

Walk the site, not the drawing

Walk every route product takes, from goods-in to dispatch. Note each point where product, ingredients or packaging are open and reachable, such as tipping stations, mixing vessels, filling heads and bulk tanks, and who can reach it, when, and unseen or not.

Consider who could act

List everyone with access: staff, agency workers, night cleaners, contractors, drivers, visitors. The people already allowed inside matter as much as the perimeter fence.

Rate, decide and control

For each point, judge how accessible it is and how severe the consequence would be. The points that score high become the focus of the plan: lockable lids, tamper-evident seals on intermediate containers, restricted zones, two-person rules for sensitive additions, supervision of contractors, and a culture where staff challenge anyone out of place.

Plan for the event

The plan should say what happens if tampering is suspected: who is told, how product is held, and how the site links to its emergency response and recall procedures. Where an incident affects the food safety system, legality or the integrity of the certificate, the scheme’s communication requirement (2.5.17) asks the organisation to inform its certification body within three working days.

How to run a food fraud vulnerability assessment

Food fraud is assessed per material, not per room. Sterling’s recommended method groups raw materials, ingredients and packaging into families (for example: spices, oils, dairy proteins, juices, primary packaging) and asks the same questions of each.

• Has this material, or anything like it, been the subject of reported fraud?
• Is there an economic reason to cheat? High value, price spikes, shortages and premium claims such as origin, organic or species make fraud more attractive.
• How long and opaque is the supply chain? Brokers, blending stages and repacking all add places where substitution can hide.
• How easy would it be to detect? Some adulterants show up in routine tests; many do not.
• How well do you know the supplier? An audited producer is not a spot deal through a trader.

Vulnerable materials need mitigation in proportion: tighter specifications, authenticity testing, supplier audits, certificates checked against the batch, fewer intermediaries, or mass balance checks. These measures tie directly to the scheme’s requirement on services and purchased materials (2.5.1), so the supplier approval file and the fraud assessment should point to each other.

A worked example: a spice-blending site

The following is illustrative, not drawn from any client. A mid-sized site blends dried herbs and spices into seasonings for snack manufacturers. Its food safety team records both assessments in one register.

Each row carries a next review date. When the paprika supplier changes six months later, that row is reopened at once, not left for the annual review. That habit is what convinces an auditor, including on the unannounced visit covered in The unannounced audit: how to be ready on any day.

Why assessments fail at audit

The weakness auditors meet most often is an assessment that was downloaded rather than done. It names threats the site does not have, misses the ones it does, and nobody on the floor has seen it. Other patterns recur.

• One combined document that blurs defence and fraud, so neither question is answered properly.
• Every item scored medium, which signals that nobody made a decision.
• Controls listed that do not exist: a CCTV camera that has not recorded for months, a locked gate that stands open.
• No evidence that the authors have the competence the scheme requires, and no training record behind them.
• A review date that passed without a review, or a supplier change that never triggered one.

Competence for these roles is covered in FSSC 22000 training: who needs what, and how the registers are held in software is in Effivity for FSSC 22000: the guide.

FSSC 22000 food defence and food fraud: questions buyers ask