FSSC 22000 scheme requirements explained
One day on the layer above ISO 22000, which is where certified sites actually lose marks.
- Duration
- 1 day, 7 contact hours
- Level
- Implementation
- Scheme
- V7 published May 2026, transition from V6 under way
- Prerequisites
- Working knowledge of ISO 22000 and HACCP. Not entry level
- Assessment
- Gap analysis against a set of additional requirements, plus a 20-question check
- Certificate
- ITF certificate of completion
A one-day course on the FSSC 22000 certification scheme: how ISO 22000, the sector prerequisite standard and the FSSC additional requirements fit together, what the scheme audits, and how a site stays ready for an unannounced audit. Version 7 was published in May 2026, so we teach the version your next audit is against.
- 01 Enquiry
- 02 Needs analysis
- 03 Programme design
- 04 Scheduling
- 05 Delivery
- 06 Assessment
- 07 Certification
- 08 Records
FSSC 22000 scheme requirements explained sits at step 5 of the delivery cycle. You receive course materials and an attendance record.
Where certified sites actually lose marks
The ISO 22000 part of an FSSC system is usually mature. The additional requirements were bolted on, and that is where the findings are.
It makes sense when you look at the history. A site builds a food safety management system, gets it working, then a retailer asks for GFSI recognition and FSSC is chosen. The additional requirements arrive as a checklist to be satisfied rather than as controls to be designed, so each one gets a document and none of them get a process.
Food defence, food fraud vulnerability assessment and environmental monitoring are the three that come up most. Each produces a plan; each plan needs to be based on an assessment; each assessment needs to be reviewed. A plan with no assessment behind it reads as a template to any auditor who has seen more than a few.
Then there is the unannounced audit, which changes the whole posture. A site that is ready for a scheduled audit and not ready on a random Tuesday has a records problem, not a food safety problem, and the day spends real time on the difference.
What the seven hours cover
More than half of the seven hours go on the additional requirements, because that is where the work is. The requirement list and its numbering are taken from the scheme document for your version before the day, not from a summary.
| Session | What is covered | Time |
|---|---|---|
| What FSSC 22000 is | GFSI recognition, why a retailer asks for it, the scheme owner, and the certification chain from accreditation body down. | 0:45 |
| Scheme architecture | ISO 22000, plus the ISO 22002 prerequisite part for your food chain category, plus the FSSC additional requirements. | 0:45 |
| The additional requirements, in turn | Each requirement in the version your audit is against, read from the scheme document, with the evidence it produces. Food defence, food fraud and environmental monitoring get the longest time, because that is where findings cluster. | 3:45 |
| The audit | Scope, the unannounced audit regime, nonconformity grading and timescales, and what a critical finding does to a certificate. | 1:00 |
| Version transition planning | A gap-analysis method for the site, run against the version your next audit will be conducted under. | 0:45 |
The templates that close the gaps
An additional-requirements gap analysis template
One row per requirement, with the evidence column that makes a gap visible instead of arguable.
A food defence threat assessment template
Structured as an assessment that produces a plan, which is the order the scheme expects and the order most sites get backwards.
A food fraud vulnerability assessment template
Covering the supply chain as well as the site, because that is where the vulnerability usually sits.
The workbook
Each additional requirement with what it asks for and what evidence it produces.
A ITF certificate of completion
Per delegate, with the gap analysis assessment recorded.
What a coordinator can do afterwards
- 01
Explain the three scheme components and what each contributes
And answer the question a customer asks: what does FSSC give us that ISO 22000 does not.
- 02
Identify which ISO 22002 part applies to their category
Getting this wrong at the start means the whole prerequisite programme was built against the wrong document.
- 03
Run a food defence threat assessment and a food fraud vulnerability assessment
Assessment first, plan second, review scheduled. Templates provided and worked in the room.
- 04
Evidence food safety and quality culture
Not with a poster. Objectives, measures and review evidence, plus what auditors ask staff on the floor.
- 05
Keep a site ready for an unannounced audit
Which is a records discipline and a shift-handover discipline more than it is a food safety one.
- 06
Plan a version upgrade
Gap analysis, sequencing and the internal audit that has to run against the new version before the CB does.
Ready for the scheduled audit, not the next
A snack manufacturer in Dammam 2nd Industrial City supplies a GCC retail chain that requires FSSC 22000. The site passed its last scheduled audit, then took a major finding against environmental monitoring at an unannounced audit six months later.
The coordinator asked for the day to be built around that finding, so we started there and worked outward. The gap analysis exercise ran against the site's own environmental monitoring programme, food defence plan and food fraud assessment.
The group found that the food defence plan had no vulnerability assessment behind it. The audit session covered what ready on any day means in records terms: which logs must be current at all times, and who checks them when the coordinator is on leave.
The site ended up holding a gap analysis against its own records, a food defence threat assessment template, a food fraud vulnerability assessment template, and a certificate per delegate.
Who carries the scheme
The person who owns the scheme
Food safety managers and FSSC coordinators at certified sites, or at sites in the middle of a first certification.
- Close the additional requirements properly rather than documentarily
- Run the gap analysis yourself before the CB does it for you
- Know what each requirement produces as evidence
Preparing for a scheme upgrade
QA managers facing a version transition who need to know what changed and what to do about it in what order.
- Build a transition plan against the correct version
- Sequence the internal audit so it precedes the CB visit
- Avoid rewriting parts of the system that did not change
Auditors covering FSSC scope
Internal auditors who audit the ISO 22000 part competently and have never been given the additional requirements as auditable content.
- Audit an additional requirement against evidence rather than a document
- Know the grading and timescale rules the scheme imposes
- Spot an assessment that was written backwards from its plan
Whoever owns the unannounced audit risk
Site and plant managers. An unannounced audit lands on whoever is on site that day, and the consequences of a critical finding are commercial.
- Understand what a critical finding does to a certificate and to a contract
- Know which readiness gaps are structural rather than tidying
- Set the internal expectations that survive a random Tuesday
Asked by certified sites
Which version do you teach?
The version your next audit is against. V7 was published in May 2026 and the transition from V6 is under way. Before your course we confirm the dates and the requirement list from the scheme document itself, then build the day on that version.
Can ITF certify us to FSSC 22000?
No. ITF does not certify anything. Certification comes from an accredited certification body.
What is the single most common FSSC finding?
In practice the additional requirements, because the ISO 22000 part is usually mature and the additional requirements were bolted on later. Food defence, food fraud and environmental monitoring are the usual gaps.
How do we evidence food safety culture?
Not with a poster. The course covers the objectives, measures and review evidence that satisfies the requirement, and what auditors actually ask staff on the floor when they are testing whether the culture claim is real.
Is the certificate recognised?
It is an ITF certificate of completion, and it records that the participant attended and met the assessment criteria on the day. It is not an accredited qualification. It is the kind of evidence a management system asks for under ISO 9001 clause 7.2 and its equivalents. If your buyer or regulator names a certificate issued under an accreditation scheme, tell us at enquiry and we will say plainly whether ours fits.
Can you run it in Arabic?
Yes. Arabic, English, or Arabic delivery with English material, which is the usual request for a mixed room. Confirm the language when you book, because it decides which trainer and which handouts are scheduled.
Do you come to our site?
Yes, and it is the default. On your site the exercises run on your own documents and processes, and the participants lose no travel time. We need a room, a screen, and the participants released from the floor for the whole session.
How many people can attend?
Awareness courses work up to about 20. Courses with assessed practical work cap at about 12 to 15, so every person does the exercise rather than watching it. These caps are our teaching judgement, not an external rule.
Who delivers it?
Practising auditors. The people teaching these courses spend their working weeks inside factories, warehouses, kitchens and offices carrying out audits, and the examples in the room come from that work. The standard every trainer meets is set out on the trainers page.
What if someone misses a day, or does not pass?
There is no certificate for partial attendance or a failed assessment. The participant can join the missed day or retake the assessment on a later run, and we tell you which person and why. We would rather report a gap than issue a record that says something untrue.
What sits underneath this
ISO 22000 food safety awareness
The management system component. A prerequisite for this day if the team has not had it.
Read moreImplementationHACCP, the Codex twelve steps
The hazard analysis the whole scheme is built on.
Read moreImplementationRoot cause analysis
What a scheme nonconformity response needs behind it to be accepted.
Read moreConsultFSSC 22000, built with you
When the additional requirements need designing into the site, not only teaching. ITF Consult.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Close the additional requirements
An FSSC gap is usually a documentation gap and a verification gap at the same time, and the site that finds them first keeps the certificate. Tell us your category, your version and your next audit window.