ISO 22000 clause 4.3: define an FSMS scope that follows the food
ISO 22000 clause 4.3 requires the organisation to determine the boundaries and applicability of its food safety management system. The scope identifies included products and services, processes and production sites. It also needs to include activities that can influence the food safety of the end products. A short scope statement must therefore rest on a sound understanding of the operation.
What clause 4.3 requires in practice
Clause 4.3 asks the organisation to decide the edges and the reach of its FSMS and to state them as a scope. The scope has to name the products and services, the processes and the production sites included. It also needs to cover any activity, process, product or service that is able to influence the safety of the end products, which prevents convenient omissions.
In deciding the scope, the organisation takes account of the context found under clause 4.1 and the party requirements found under clause 4.2. The result is held and maintained as documented information, so it must be available to those who need it and kept up to date.
The outputs are a written scope statement, supported by an understanding of the activities behind it. The clause does not prescribe a format, a diagram or a minimum length, but it does expect the wording to be specific enough to be tested against reality.
Follow the activities behind the proposed wording
Begin with what the organisation supplies and how it is produced or delivered. Identify receiving, handling, processing, storage, transport and relevant supporting activities. Consider the internal and external context and interested-party requirements established under clauses 4.1 and 4.2.
Use the exercise to expose interfaces. Cleaning, maintenance, contract packing or transport may influence food safety even if another team or provider performs the work. Describing the provider as external does not remove the need to address its effect through the FSMS. The scope and the controls over external provision need to tell a compatible story.
A practical activity map can help explain the boundary, but no particular diagram is mandated by this clause. Distinguish the organisation's responsibility from other parties' activities without treating that distinction as a reason to ignore a relevant dependency.
Keep the documented scope specific and credible
The scope must be available and maintained as documented information. Wording should allow a reader to understand the actual coverage. A corporate name alone is unlikely to describe a group that manufactures different products, operates several facilities and contracts some activities elsewhere.
Changes in products, services, sites or processes can require a scope review. Adding a satellite location while continuing to describe only the central facility can leave uncertainty about both implementation and external claims. Coordinate scope changes with planned FSMS changes and relevant technical reviews.
Why a truthful scope matters to the business
The scope is the sentence customers and certificate users rely on. If it is broader than the system actually operates, the business risks a misleading claim. If it is narrower than the real activities, a hazard may sit outside any control. Either way, trust is damaged and an audit becomes difficult. A clear scope also guides budgeting, since it tells management which sites, teams and providers need effort. For groups with several locations or outsourced steps, an accurate scope reduces internal disagreement over who is responsible. It is a small piece of writing with large consequences for reputation and for planning accuracy.
How to define a scope that follows the food
Work from the movement of food and information, and write the sentence last. One approach follows. Involve people who work the process, not only managers, since they know where food really goes.
- Walk the route of each product from receipt of materials to dispatch, noting every handling, storage, transport and support step.
- Mark which steps are performed by your own people, by contractors or by other sites.
- For each external step, decide how its influence on safety will be controlled, and make sure the scope and provider arrangements tell the same story.
- Draft a scope statement naming products, services, processes and sites in language a customer could understand.
- Challenge each exclusion by asking whether the excluded activity could influence the end product.
- Ask a few supervisors to describe what is covered and compare their answers to management's.
- Approve the statement, place it under document control and set triggers for review when products, sites or services change.
Illustrative catering example
A central kitchen supplies meals to several construction-site service points. The organisation maps preparation, dispatch, transport, receiving and service responsibilities. It identifies which arrangements it controls and how the service interfaces affect food safety.
A scope written only as “meal preparation at headquarters” would need careful challenge if the organisation also controls transport and service activities that influence its end products. The answer is a defensible description and suitable control, not silently deleting the inconvenient steps from the map.
Illustrative food-logistics example
A distributor stores and dispatches packaged food while an external provider maintains a traceability application. The food-chain scope concerns the distributor's storage and distribution service. The application and provider relationship can still influence the reliability of lot information and relevant product-control decisions.
This does not mean the software provider's unrelated development business automatically becomes an ISO 22000 food operation. The distributor identifies and manages the relevant service dependency through its FSMS and supplier arrangements.
Check scope claims against evidence
Compare the documented scope with contracts, product lists, locations and actual work. Ask supervisors to describe the activities covered and examine whether their understanding matches management's. Review excluded activities specifically where there is a potential influence on food safety.
Common mistakes include using a narrow site description while marketing group-wide certification, overlooking temporary operations and assuming shared corporate procedures prove consistent implementation everywhere. Certification applies to the assessed management-system scope and remains an independent body's decision; it is not a blanket approval of every product.
A useful scoping discussion also identifies what the organisation still needs to establish. Unresolved ownership, uncertain outsourced steps and incomplete product information should become actions before the boundary is treated as final.
Common nonconformities with clause 4.3
Scope findings are often easy to spot because they compare words with practice.
- A scope naming one site while products are also made or stored at another.
- A transport or storage step that influences the product but is missing from the stated coverage.
- Outsourced processing excluded without any explanation of how its influence is managed.
- A scope that has not been updated after a change in products or services.
- Marketing wording that implies wider coverage than the documented scope supports.
Frequently asked questions
Can we exclude an activity because a contractor performs it?
Not simply on that basis. Examine its influence on food safety and how the external provision and interface are controlled.
Must the scope be documented?
Yes. It needs to be available and maintained, with wording that identifies the relevant products, services, processes and sites.
Does a scope change only require editing the statement?
No. Consider affected resources, hazards, controls, communication and evaluation so the expanded or changed FSMS actually operates.
Agree boundaries before estimating the programme
Bring your product and site map to a Sterling scoping discussion. The resulting engagement can define implementation, evidence, learning and agreed Effivity ISO & GRC automation software support. Start shared learning with ISO 22000 Food Safety Awareness, and use clause 4 and the requirements hub to plan the next decisions.