FSSC 22000 when the customer demands GFSI

The additional requirements are not philosophy. Food defence, food fraud mitigation, allergen management, environmental monitoring, hazard control and cross-contamination prevention, food safety and quality culture, quality control, equipment management, food loss and waste, and mandatory communication of serious events to your certification body. Each one needs a plan, an owner and records from the system in use.

The prerequisite standard is the other half of the surprise. ISO 22000 requires prerequisite programmes without specifying them. The ISO 22002 part that applies to your food chain category does specify them, in infrastructure terms, and a site that was built before anyone thought about it can find itself facing capital work rather than documentation.

Then there is the unannounced audit. Within the certification cycle, somebody arrives without notice. That single requirement changes how a plant has to run, because the evidence has to be in the building every day rather than assembled the week before a visit.

The management system is already there, so the work is the delta. We gap the site against the ISO 22002 part for its food chain category, then against the FSSC additional requirements, and keep the two lists apart because different people close them.

Each additional requirement gets an owner, a plan and records that start straight away: the food defence and food fraud assessments, the environmental monitoring programme, the allergen plan and the culture plan. Version 7 was published in May 2026 and the transition is under way, so the version that applies to the next audit is read from FSSC's own transition table.

Before the internal audit we walk the plant on a normal day with no notice, the way an unannounced auditor would. The manufacturer then books with a certification body of its choosing.