Food safety culture: what auditors look for and how to show it under FSSC 22000

What does food safety culture mean in FSSC 22000?

Food safety culture is the set of shared attitudes and habits that decide how people on a site behave towards food safety when a procedure does not spell out the answer. In FSSC 22000 it is also a written obligation. Version 7 of the scheme, published by Foundation FSSC on 1 May 2026, lists food safety and quality culture as additional requirement 2.5.8, one of eighteen topics that sit on top of ISO 22000:2018 and the prerequisite programme standards.

That combination matters. A certification body cannot audit an attitude directly, but it can audit whether management has set objectives for culture, written a plan to reach them, carried out that plan and checked the result. It can also see, on the floor, whether the behaviour the plan promises is really there.

The scheme adds the word quality for a reason. The same habits that stop a foreign body reaching a customer also stop a wrong label, an underweight pack or a missed change-over check, so the plan is expected to serve both. For the full set of eighteen topics, see our guide FSSC 22000 additional requirements explained, one by one.

What the scheme requires you to have

Requirement 2.5.8 is short, and its brevity is often misread as leniency. It sets four expectations. Management sets objectives for food safety and quality culture. The organisation keeps a documented culture plan. That plan carries targets and timelines, so progress can be checked. And the plan addresses, at a minimum, communication, training, employee feedback and engagement, and performance measurement.

The requirement also connects to the rest of the system. ISO 22000 already expects top management to demonstrate leadership and commitment and to review the system at planned intervals. A culture plan that never reaches the management review agenda, or that sets objectives unconnected to the food safety policy, sits apart from the system it is meant to strengthen.

What auditors look for

Culture is not a separate audit day. It is tested throughout the visit, and under the scheme every surveillance audit is a full system audit that covers all requirements, so the culture plan is examined every year rather than once per cycle.

The plan and its logic

The auditor reads the objectives, the targets and the dates, then asks how they were chosen. A plan built on a measured starting point, such as a staff survey or a count of near-miss reports, reads very differently from one that lists generic intentions.

People on the line

Interviews with operators, supervisors and cleaners are where most culture findings begin. An auditor may ask what an operator would do if a metal detector reject bin were full, whether they would stop the line for a torn glove, or when they last reported something. Hesitant or contradictory answers tell the auditor more than any poster.

Behaviour nobody prepared

At least one surveillance audit in each three-year cycle is unannounced, and it opens with an inspection of the production facilities that starts within an hour of the auditor arriving. Hand washing at the entrance, doors propped open, a supervisor walking past an uncovered ingredient: these are culture evidence, gathered before anyone has had time to tidy up. Our guide The unannounced audit: how to be ready on any day covers that visit in detail.

Consistency between records and reality

Finally, the auditor compares. If the plan claims open reporting but the near-miss log is empty for six months, or training records are complete while an operator cannot explain an allergen change-over, the gap between document and practice becomes the finding.

How to show food safety culture: a working example

Consider a mid-sized snack manufacturer in the Philippines, running three shifts and certified to FSSC 22000 for two years. Its first culture plan listed values and a poster campaign; the certification body raised a minor nonconformity because the plan had no measurable targets. The food safety team rebuilt it in four steps.

1. Measure the starting point. A short anonymous survey across all three shifts, plus a count of near-miss reports and a review of internal audit findings linked to behaviour. The survey showed night-shift staff were far less confident about stopping the line.
2. Set a few objectives. Management chose three: raise night-shift confidence in stopping the line, double the monthly number of near-miss reports within six months, and bring every supervisor through a coaching session on food safety conversations by a set date.
3. Assign actions to the four elements. Communication meant a two-minute food safety point at every shift handover, in Filipino and English. Training meant supervisor coaching and a practical line-stop drill. Feedback meant a visible board showing each report and its outcome. Measurement meant a monthly indicator pack for the management meeting.
4. Measure again and review. The survey was repeated after six months and the results discussed at management review, with the next targets set from what had and had not moved.

At the next surveillance audit the auditor asked two night-shift operators about stopping the line, then checked the near-miss board and the review minutes. The story held together, and no culture finding was raised. A spice processor in India or a beverage plant in the UAE would change the indicators, not the method.

What goes wrong, and why

• A values statement presented as a plan. Words such as commitment and excellence with no targets, dates or owners do not meet a requirement that asks for targets and timelines.
• No baseline. Without a first measurement, a site cannot show improvement, and the auditor has no way to judge whether a target was ambitious or trivial.
• A survey that nobody acts on. Collecting feedback and then changing nothing damages the culture it was meant to measure, and staff say so in interviews.
• Culture owned by the quality department alone. When production managers cannot describe the plan, the auditor concludes that leadership has delegated it away.
• Indicators that punish reporting. Targets such as zero incidents can quietly discourage people from raising concerns. Leading indicators, such as reports made or drills completed, usually tell a truer story.

Culture beyond the certificate

FSSC 22000 is not alone in asking for this. The Global Food Safety Initiative, which benchmarks certification programmes, has published a position paper titled A Culture of Food Safety, and released version 2.0 of that paper in March 2026 with a refined framework. Foundation FSSC has also published its own guidance document on food safety and quality culture. Both help when designing a plan, but the certification body audits against the scheme text.

It helps to keep expectations realistic. A certificate confirms that a licensed, accredited certification body found the requirements met on the days it audited; it does not certify that a culture is strong. Sterling does not certify either. The plan earns its keep between audits, through faster escalation and people who treat food safety as their own job. Training is one of the four elements, and our guide FSSC 22000 training: who needs what sets out which roles need which courses.

Food safety culture: questions buyers ask