A buyer has just asked for FSSC 22000, and your team are looking at you for the plan. You’ve already got HACCP, a raft of procedures, and retail audits under your belt. So why does FSSC 22000 feel like a bigger step than yet another customer standard?
Because it is a system certification that has to work every day, for your whole operation, not just on audit week. The good news: there’s a clear, practical way to get there without drowning in paperwork.
What FSSC 22000 actually covers (and what it doesn’t)
FSSC 22000 brings three pieces together. First, ISO 22000 sets the framework for your food safety management system: context, leadership, planning, support, operations, performance and improvement. Second, a prerequisite programme (PRP) standard covers the nuts and bolts by sector—cleaning, construction, pest control, maintenance, and so on. Depending on your scope, that might be ISO/TS 22002‑1 for food manufacturing, 22002‑4 for packaging, or another relevant part. Third, FSSC adds its own specific requirements on topics like food defence, food fraud, allergen management and product labelling.
It’s certification of your management system and processes, not your products. The certificate is tied to a defined site and scope. If you outsource steps—say, external warehousing or a contract pasteuriser—your controls over those services are in scope too.
If you’re weighing up which scheme suits your customers, or want a concise view of the route to audit, our FSSC 22000 certification page summarises the essentials.
Set your scope and map your processes
Before you draft a single new procedure, fix your scope. What products, processes and services are you certifying? Where are the physical boundaries? Which activities are outsourced? A tight, accurate scope avoids arguments later, and prevents you biting off more than you can chew in year one.
Then map the process flow from intake to despatch. Build in rework loops, by-products, waste, utilities, and transport. In audits, we often see flow diagrams that miss rework or external storage. Those omissions create gaps—especially for traceability, allergen control, and temperature management.
Walk the process with the team. Challenge assumptions. On one fish processor’s audit, a production supervisor flagged that night shift moved thawed product between chillers using open bins, which the day shift never did. It wasn’t in the flow, and it introduced an unassessed contamination risk. That’s exactly the sort of reality check you need early.
Build the core: HACCP within the ISO 22000 structure
ISO 22000 weaves HACCP into the Plan–Do–Check–Act cycle. The hazard analysis is yours—not a borrowed template. Be specific to your raw materials, equipment, staff skills, environment and intended use. Use current data, including complaints, micro trends, and supplier nonconformities.
Be clear and consistent on how you distinguish PRPs, operational PRPs and CCPs. Auditors don’t look for a particular number of CCPs; we look for a logical method and consistent application. For example, a bakery may have no CCPs but several OPRPs around allergen changeovers and sieving. A ready-to-eat salad site may have a CCP on final wash concentration and OPRPs for environmental monitoring and segregation.
Validation and verification often trip teams up. If you rely on metal detection, where’s the evidence your chosen ferrous/non‑ferrous/stainless standards and aperture sizes achieve the intended control on your actual products? If you sanitise with peracetic acid, who proved the contact time works at your water temperature? And after go‑live, how do you verify these controls keep working? That’s where monitoring records, trend analysis and maintenance history come in.
The extras FSSC adds
FSSC’s additional requirements are not bolt-ons; they’re integral. Expect to show:
Food defence: a documented threat assessment and site plan. We’ll ask how you control contractor access, how you secure chemical stores, and how tamper-evident seals are checked. One site had a well-written plan, but no one had updated the visitor process after a reception refit—deliveries were bypassing checks entirely.
Food fraud (vulnerability) assessment: assess economically motivated risks in your supply chain and define mitigation. This is not just for olive oil and honey. We’ve seen spice blends, minced meat, and even packaging inks merit review. Keep the assessment live: when markets move, re‑rate the risk.
Allergens and labelling: manage cross-contact and prove your labels are right, every time. During one audit, a major nonconformity arose because a graphics update swapped a nut warning panel between SKUs. The artwork check existed, but there was no second-person verification before print release.
Environmental monitoring where hygienically appropriate: define zones, sites, methods, and response plans. Don’t copy a dairy plan if you’re a dry nuts packer; target your risks. If a Listeria swab is positive in a high-care area, show us the containment, deep clean, resampling and product disposition trail.
Procured services and equipment: from pest contractors to rented tankers, you’re expected to control and evaluate them. Calibration of thermometers, validation of heat-sealers, potable water certificates—these are routine evidence points in FSSC audits.
Documentation that helps rather than hinders
Write for the people doing the work. Flowcharts by the line, short work instructions with photos, and simple checklists beat 20-page procedures nobody reads. Document control matters, but don’t make it a museum—build in ownership and review cycles that match how often processes change.
What do auditors usually ask to see? It varies by operation, but the following crop up on most visits:
- Approved supplier list with risk ratings, specs and ongoing performance review.
- Training records tied to job roles, with onboarding and refresher plans.
- Maintenance and cleaning schedules, methods, and verification results.
- Traceability coding rules and at least one successful mass-balance test.
- Calibration status for critical devices (thermometers, scales, metal detectors).
- Complaint handling, nonconformity logs, root-cause analysis and effectiveness checks.
- Change control for recipes, labels, equipment and software.
Keep records legible and retrievable. If you’re digital, test your backup and access controls. If you’re on paper, check that copies aren’t in a damp portacabin with fading ink. We’ve had to delay trace tests because the only readable batch code was on a box that had already gone to waste.
Internal audit, CAPA and management review that work
Internal audits are not a tick-and-flick exercise. Build a plan that covers the standard, your processes and previous issues. Mix clause-based and process-based audits. Talk to operators, don’t just check forms. If a sieve check is meant to be hourly, pick a day and follow it through in real time; you’ll learn more than from a file labelled “sieve checks”.
When you find a nonconformity, write it clearly, fix the immediate problem, then go after the cause. Five Why or a fishbone are fine if used properly. Avoid “retrained operator” as a default cause—why did the lapse happen, and what in the system allowed it? Close the loop by checking effectiveness. If foreign body complaints drop after you change supplier screening, show the data.
Management review should inform decisions, not simply recap. Include objectives, audit results, process performance, complaints and recalls, supplier issues, resource needs, changes, and opportunities for improvement. Bring data, trends and actions. A good review often unlocks investment for a crumbling floor or a second label verification camera because the risks and costs are laid out clearly.
Getting certified: timeline and the audit stages
Once your system has been running long enough to generate meaningful records, you can schedule certification. The process has two stages. Stage 1 checks readiness: scope, documentation, site conditions and your understanding of the requirements. Expect a review of your hazard analysis, PRPs, internal audit results, management review and legal/register coverage.
Stage 2 dives into implementation. We sample across shifts, processes and product lines. We’ll trace raw materials into finished product and back again. We’ll observe CCP/OPRP controls on the line, review maintenance and cleaning in practice, and test how you handle out‑of‑spec events. If you use external storage or haulage, we’ll want to see how that’s controlled and what evidence you get back.
Findings are graded by severity. Critical issues can stop certification; majors and minors require corrective action within set timeframes. What matters most is your response: a clear containment, a thoughtful root cause, and proof the fix works. One chilled dessert maker closed a major on allergen changeovers by redesigning the line layout, adding distinctive tool sets, and introducing rapid allergen swabs between runs—complaints and swab fails both dropped to zero in the following quarter.
After certification, surveillance audits check continuing conformity and improvement. Treat them as opportunities to test new controls, retire clunky ones, and bring in lessons from incidents or customer feedback. Every three years, you’ll have a recertification audit that’s broader in scope.
Real‑world pitfalls we see (and how to avoid them)
Artwork and label control: a glamorous new pack design is often rushed. Use formal change control, independent verification against specs, and line‑side checks with barcodes and vision systems where feasible.
Allergen cross‑contact in shared equipment: invest in cleanability studies and visual management. If you can’t achieve separation, rethink the production plan or challenge whether “may contain” claims are being used as a crutch.
Contractor management: a welding job in high-care scheduled for 6am often turns up at 2pm. Build a permit‑to‑work process, escorts, and hygiene revalidation before restart.
Water and compressed air: both are “ingredients” in many processes. Keep current potability certificates and point‑of‑use filtration checks. For compressed air, specify quality grades and test.
People and culture: posters don’t drive behaviour. Supervisors who ask for the right checks, praise good catches, and stop a line when something’s off—that’s culture. Measure it, talk about it, and invest in it.
If you want a straight, no‑jargon conversation about where you are and what an audit would look like at your site, get in touch with UKCTL. We’re happy to share what works, what doesn’t, and how to plan a certification journey that suits your operation and your customers.