Clause 5.3, management of allergens, is one of the twelve fundamental requirements of the BRCGS Global Standard Food Safety Issue 9. A failure against any fundamental requirement ends the audit. Not a minor. Not a major with 28 days to close. The audit stops, and with it the certificate your customers’ supplier approval depends on.
Almost every certificated site has a documented allergen procedure. Very few can produce the evidence behind it. That gap — procedure without proof — is where allergen non-conformities are raised.
This article sets out the evidence package a GFSI-benchmarked audit interrogates — what the auditor asks, the document that answers it, who owns it — fixes the 2026 scheme version position, and covers the two Codex texts behind every scheme’s allergen clause, both amended in 2026.
Close the gap: Advanced Allergen Management & Validation — R3,450, about approximately 40 hours, self-paced, built around the evidence an auditor asks for. All courses.
Which food safety scheme version applies in 2026?
As at September 2026: BRCGS Food Safety is still Issue 9. FSSC 22000 Version 7 was published in May 2026, with Version 6 audits permitted until 30 April 2027. SQF is still audited to Edition 9, with Edition 10 effective not before 1 January 2027. IFS Food is Version 8, mandatory since 1 January 2024.
| Scheme, standard or regulation | Version that applies | Status and key dates |
|---|---|---|
| BRCGS Global Standard Food Safety | Issue 9 | Published 1 August 2022 and still current. Issue 10 had not been released as at September 2026. Clause 5.3 is one of twelve fundamental requirements. |
| FSSC 22000 | Version 7 | Published May 2026. Version 6 audits permitted until 30 April 2027; Version 7 upgrade audit window 1 May 2027 – 30 April 2028. Certificates issue only once the certification body completes upgrade administration on the FSSC platform. |
| SQF | Edition 9 | Still the audited edition. Edition 10 published 4 March 2026, effective not before 1 January 2027. |
| IFS Food | Version 8 | Mandatory since 1 January 2024. |
| Precautionary labelling tool | VITAL 4.0 | Released 28 August 2024 by the Allergen Bureau. Moved to ED05 reference doses, replacing VITAL 3.0’s ED01 basis; ED01 values remain options in the Action Level Grid. |
| South Africa | R146 of 2010 R638 of 2018 |
Both in force under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 — R146 for labelling (eight allergen groupings plus sulphites), R638 for general hygiene of premises and transport. Draft R3337, published for comment in late 2023, is not yet in force. |
If your gap analysis was written against FSSC 22000 Version 6, it is a transition document now, not a compliance document. And do not build your allergen file against a BRCGS Issue 10 that does not exist.
Is BRCGS clause 5.3 a fundamental requirement?
Yes. Clause 5.3, management of allergens, is designated a fundamental requirement in BRCGS Global Standard Food Safety Issue 9. Issue 9 identifies twelve fundamental requirements, and a failure against any one of them ends the audit rather than generating a correctable non-conformity.
That designation is why allergen management deserves disproportionate preparation effort. A drainage detail or calibration gap is recoverable inside the normal corrective action window. A fundamental failure is not: the site loses the audit outcome and re-enters the process, while explaining the delay to customers whose approval is conditional on certification.
The other GFSI-benchmarked schemes weight allergen management heavily too, but BRCGS makes the consequence explicit, which makes it the most useful lens for the file.
Are the Codex texts auditable, and what do they say?
No, not directly. Neither Codex text is a certification standard, and an auditor cannot raise a non-conformity against one. CXC 80-2020 is a code of practice whose dominant modal verb is “should”. But the GFSI-benchmarked schemes are built on Codex and auditors do reference these texts — so know what they contain.
- CXC 80-2020, the Code of Practice on Food Allergen Management for Food Business Operators, adopted 2020 and amended 2026 — the amendment touching only the Introduction, 2.1 and 2.3. Its Section 5.7.1 lists records that “could include”, the weakest modal available, so that list is not a mandatory document set.
- CXS 1-1985, the General Standard for the Labelling of Pre-packaged Foods, amended 2026 to add an annex on precautionary allergen labelling. This is where the allergen list, emphasis rules, exemptions and reference doses sit.
Two things to know before quoting either. CXC 80-2020’s Introduction states that treatments lethal for pathogenic microorganisms, such as heating, high pressure processing, etc. “generally do not destroy allergenic proteins”, and that protein-degrading processes such as enzymatic or acid hydrolysis “should not be relied upon to eliminate or completely destroy allergenic proteins” — which kills the “we cook it” defence. How to quote that without overstating it is covered in why processing does not destroy food allergens. Second, the code’s scope expressly excludes hypersensitivities of non-immunological aetiology, naming lactose intolerance and sulphite sensitivity — even though CXS 1-1985 separately requires sulphite declaration.
The Codex two-tier allergen list — and the soy trap
The Codex allergen list is no longer one flat list. CXS 1-1985 Section 4.2.1.4 is the mandatory tier, which “shall always be declared”. Section 4.2.1.5 is a second list that “may also be required” regionally or nationally, based on available risk assessment data. Sesame is in the mandatory tier. Soy is not.
| Tier | Foods and ingredients | Specified names |
|---|---|---|
| 4.2.1.4 — mandatory “shall always be declared as allergenic foods using the specified name in addition to or as part of the ingredient name” |
Cereals containing gluten (wheat and other Triticum species; rye and other Secale species; barley and other Hordeum species and products thereof); crustacea; eggs; fish; peanuts; milk; sesame; and six specific tree nuts — almond, cashew, hazelnut, pecan, pistachio, walnut, each named by binomial species in the standard | Wheat, Rye, Barley, Crustacea, Egg, Fish, Peanut, Milk, Sesame, Almond, Cashew, Hazelnut, Pecan, Pistachio, Walnut. In addition to wheat, rye and barley, the word “gluten” may be used. |
| 4.2.1.5 — discretionary “may also be required”, and “shall be based on available risk assessment data for the respective population(s)” |
Buckwheat; celery; oats and other Avena species; lupin; mustard; soybean; and three further tree nuts — Brazil nut, macadamia, pine nut | Buckwheat, Celery, Oats, Lupin, Mustard, Soy, Brazil nut, Macadamia, Pine nut |
| 4.2.1.7 — separate provision | Sulphite at 10 mg/kg or more, on a sulphur dioxide (SO2) equivalents basis. Not in either allergen table. | “sulphite” or “sulfite” |
Three traps. Soy sits in the discretionary tier while sesame is mandatory — the reverse of what most practitioners assume. Tree nuts are named by species, not as a category, so “tree nuts” on artwork no longer maps to the standard. And sulphite is not an allergen under Codex at all.
None of it displaces national law. A South African site is bound by R146 of 2010: eight allergen groupings plus sulphites, with allergens identifiable by common names inside compound ingredients and derivatives — “whey (cow’s milk)”, not “whey”. Draft R3337 would tighten declaration rules, add gluten-free claim requirements and require sulphite declaration at or above 10 ppm, but is not yet in force. Codex is the reference framework; R146 is binding. Export destinations add their own: 14 allergens under Regulation (EU) No 1169/2011, and the US “Big Nine” since the FASTER Act added sesame.
Codex label emphasis, “contains” statements and the exemption traps
Allergen emphasis is mandatory under CXS 1-1985 Section 8.3.1: the specified name “shall be declared in a clear and distinct manner such as through the use of font type, style or colour that contrasts from the surrounding text”. No font size is prescribed — anyone quoting you a minimum point size is not quoting the standard.
- 8.3.2 — ingredient list, separate statement, or both is set by the competent authority, not by you. Under 8.3.2.1 a separate statement “shall commence with the word ‘contains’ (or equivalent word)” and sit directly under or close to the ingredient list.
- 8.3.2.2 — the most commonly missed provision here. Where a separate statement is used, every specified name “must be declared in the statement even if that specified name is already shown in the list of ingredients”. Note the modal: must. A “contains” line that omits an allergen because it appears in the ingredient list does not meet the provision.
- 8.3.3 — a food with no ingredient list must still declare the specified names in a separate statement, except single-ingredient foods where the allergen is in the name of the food (8.3.4).
Three Codex exemption traps
Every allergen exemption in CXS 1-1985 is narrower than operators assume, two of them expressly exclude allergens, and none can be self-certified by the site.
- Derivative exemptions — 4.2.1.6. Competent authorities may exempt ingredients derived from the listed allergenic foods, and such exemptions “shall be subject to a risk assessment to establish the safety of the allergenic food derivative”. The standard never uses “highly refined” and names no exempted derivative. The exemption is the authority’s power, conditional on risk assessment — not a conclusion you reach from a commodity name.
- Processing aids and carry-over — 4.2.5.2. Additives carried over below a technological function, and processing aids, are exempt from the ingredient list — but “[t]he exemption does not apply to” those “that contain the foods and ingredients listed in Section 4.2.1.4, and where applicable Section 4.2.1.5, and subject to Section 4.2.1.6”. Closed for allergens, subject to the competent authority’s derivative-exemption power.
- Small packages — Section 6. Units under 10 cm² may escape the ingredient list, lot identification, date marking and instructions for use — but “[t]his exemption does not apply to the declaration of foods and ingredients listed in Section 4.2.1.4, Section 4.2.1.7 and where applicable Section 4.2.1.5”. That pack carries a separate “contains” statement instead.
The Codex PAL annex in one screen
The 2026 annex to CXS 1-1985 makes precautionary allergen labelling a last resort with a quantitative trigger. PAL “shall be restricted to” situations where unintended presence cannot be prevented or controlled by allergen management practices, and is defined as indicating a risk “that has been identified by a risk assessment”.
- 4.1 and 4.3 — allergen management practices under CXC 80-2020 “shall be implemented”, PAL use “shall be restricted” to what they cannot prevent or control, and PAL shall be used above the action level while it should not be used at or below. Preserve those modals: applying PAL above the action level is mandatory, refraining below it is a recommendation.
- Table A1 and Table A2 — A1 gives reference doses in mg of total protein for IgE-mediated allergy; Table A2 gives 4.0 mg of total gluten from all relevant sources for coeliac disease. The action level is a formula: reference dose divided by amount of food consumed in kg, preferably at the 50th percentile.
- 5.2 and 5.2.2 — PAL “shall appear as a separate statement directly under or in close proximity to the ingredient list” and “shall commence with the words ‘may contain’ (or equivalent words such as ‘may be present’, as determined by the competent authorities)”.
- 5.2.4 — PAL “shall be declared in a clear and distinct manner such as through the same font type, style or colour that contrast [sic] from the surrounding text”, and where both PAL and an allergen declaration appear “these shall be declared using the same clear and distinct manner”. You may not de-emphasise a “may contain” relative to a “contains”. Under 4.3.2, “gluten-free” “shall not be used” where a gluten PAL statement is necessary.
The full decision grid, and how the Codex tables sit alongside VITAL 4.0, is in our VITAL 4.0 precautionary labelling guide.
What does an auditor actually ask about allergens?
An allergen audit is not a document review. It is a chain of “show me” questions running from your raw material specifications to the label on the finished pack, failing at whichever link has a procedure but no evidence.
| What the auditor asks | The document that answers it | Owner |
|---|---|---|
| Show me every allergen on this site and where it is. | Allergen matrix and allergen map — raw materials, processing aids, carriers, lubricants, rework, packaging | QA manager |
| What is your allergen list based on? | Declaration scope mapped to R146 of 2010 and, where relevant, CXS 1-1985 4.2.1.4, 4.2.1.5 and 4.2.1.7, per market | Technical |
| Show me the risk assessment that decided this product needs a “may contain”. | Quantitative risk assessment with reference dose, reference amount, action level and calculated residual | QA manager |
| Prove your changeover clean removes the allergen, and why that is the worst case. | Cleaning validation report — three consecutive successful cleans on a documented worst case | Validation lead |
| Does your “contains” statement repeat every allergen, and is the emphasis specified? | Artwork specification and label proof check against CXS 1-1985 8.3.1 and 8.3.2.2 | Packaging / QA |
| Who granted the exemption for that refined derivative? | Competent-authority exemption evidence and its risk assessment, per CXS 1-1985 4.2.1.6 | Technical |
| Where does all this live as one system? | Allergen Management Master Plan | QA manager |
The allergen risk assessment — where sites fail
The most common allergen non-conformity is not a dirty line. It is a precautionary “may contain” with no risk assessment behind it. A blanket disclaimer is not a legal defence, and it does not even meet the Codex annex’s own definition of PAL, which requires a risk identified by a risk assessment.
Worked example — evidencing a PAL decision end to end
A biscuit line runs a milk-containing product, then one declaring no milk. The pack carries “may contain milk”. The auditor asks for the justification.
- Action level. Codex Table A1 gives milk a reference dose of 2.0 mg total protein, identical to VITAL 4.0’s ED05 value; the reference amount is 25 g. Codex form: 2.0 ÷ 0.025 = 80.0 mg/kg. VITAL form: 2.0 ÷ 25 × 1000 = 80.0 ppm. Same figure.
- Swab recovery study. 2.0 mg milk protein spiked onto a 100 cm² stainless coupon; measured 1.3 mg. Recovery (%) = (1.3 ÷ 2.0) × 100 = 65% — inside the 50–150% guidance window, so usable with correction.
- Worst-case swab after the validated changeover clean: 0.45 mg per 100 cm². Corrected = 0.45 ÷ 0.65 = 0.6923 mg per 100 cm².
- Surface residue = corrected concentration × total surface area ÷ swabbed area. Product-contact area 4.5 m² = 45,000 cm²: 0.6923 × 45,000 ÷ 100 = 311.5 mg (311.54 unrounded).
- Concentration in finished product = mass carried over ÷ batch mass. Batch 1,200 kg: 311.5 ÷ 1,200 = 0.2596 mg/kg = 0.26 ppm.
- Decision. 0.26 ppm against an action level of 80.0 ppm. The residual is not actionable, so Codex Annex 4.3 says PAL should not be used — a recommendation, not a prohibition — and the “may contain milk” should come off. It holds on the ED01 basis too, where the action level for the same serving is 0.2 ÷ 25 × 1000 = 8.0 ppm.
Six lines of arithmetic — and the difference between an auditor accepting your labelling decision and recording that you cannot substantiate it. Every step is worked, with the workbook that automates it, in the ASC allergen validation course.
Mid-article checkpoint. If you cannot reproduce that chain for every PAL statement on your packs, you have an evidence gap, not a documentation gap. Enrol in the advanced allergen validation programme — R3,450, nine modules, toolkit included.
Validation records — the single biggest evidence gap
Validation is documented evidence the cleaning procedure works, established by three consecutive successful cleans on a justified worst case. Verification is the ongoing routine check it still works. Monitoring is the real-time check the cycle ran as specified. Most sites hold monitoring records, call them validation, and cannot answer the next question.
A CIP record showing the cycle ran at the specified temperature, concentration, flow and time proves the validated clean was delivered, not that it works. CXC 80-2020 Section 6.2.1 puts it precisely: the validation process “should be specific to the allergen, process and product matrix combination”. Section 6.5 adds that where CIP is used there should be verification the system is effectively removing allergens, by testing rinse samples or swabs.
Worst case is not the line easiest to sample: selection is driven by the highest allergen protein load, the hardest geometry (dead legs, gaskets, valves, hoppers, augers), the longest run, the lowest-temperature or shortest cycle, and the highest fat matrix, because fat shields protein from detergent. Write that justification down, and build the verification schedule from risk — a schedule without a rationale is a calendar, not a control.
Three things that undo an otherwise good validation
- Visual inspection treated as sufficient. A prerequisite, never sufficient alone. Codex defines “visibly clean” as having no visible food, debris and other residues — a long way short of allergen-free.
- ATP bioluminescence or total-protein swabs used as allergen evidence. Both measure general soil and can never validate allergen removal.
- A method never validated in the matrix. Heat disrupts conformational epitopes but not linear ones, so processed and Maillard-modified matrices — glycated Ara h 2 among them — degrade ELISA recovery, and a sandwich ELISA on a hydrolysate is uninterpretable: use competitive ELISA or peptide LC–MS/MS. Lateral flow is a gatekeeper, not a quantitative result; PCR detects DNA, not protein. Codex expects a test fit for purpose for the targeted allergen — its own example is that a casein test should not be used where whey is the allergen of concern — validated for the matrix, with the limit of detection and specificity known. See why processing does not destroy allergens and our allergen cleaning validation guide.
Complaints, traceability and the Master Plan
CXC 80-2020 Section 5.8.1 expects a documented complaint procedure covering collection, investigation, analysis, record keeping and reporting to competent authorities where appropriate, with action decided on the risk to consumers together with the timeliness, motivation and plausibility of the complaint. Section 5.8 expects procedures that facilitate a one-step-back and one-step-forward traceability review in a food allergen incident.
If your mock recall has never been run on an allergen scenario, run one before the audit rather than during it.
The Master Plan is the single controlled document binding the programme together. It does not replace the underlying records — it indexes them, names who owns each, and shows the site treats allergen control as a system.
At minimum it should contain, or reference by document number: the allergen policy and declaration scope per market; the allergen matrix and site map; the quantitative risk assessment and PAL decision rule; the segregation and scheduling strategy; rework rules, like-into-like with traceability; cleaning validation reports and revalidation triggers; the verification schedule; label and artwork change control; the competence matrix; the incident and recall procedure with the mock recall record; and management review of allergen trends.
On competence: an attendance register is not a competence record. An auditor asks how you know the person who signed the changeover release understands the swab result — which needs assessed training mapped to role. The foundational Allergen Management in the Food Supply Chain course covers workforce awareness; Advanced Allergen Management & Validation covers technical competence for the people who own the evidence, with a 90-question proctored exam that produces an assessment record, not a certificate of attendance.
Frequently asked questions
Is BRCGS clause 5.3 a fundamental requirement?
Yes. Clause 5.3, management of allergens, is one of twelve fundamental requirements in BRCGS Global Standard Food Safety Issue 9. Failure against any fundamental ends the audit rather than producing a correctable non-conformity.
When must we upgrade to FSSC 22000 Version 7?
Version 7 was published in May 2026. Version 6 audits are permitted until 30 April 2027, and the upgrade audit window runs from 1 May 2027 to 30 April 2028. Certificates issue only once the certification body completes the upgrade administration on the FSSC platform.
Is soy a mandatory allergen declaration under Codex?
No. Under CXS 1-1985, soybean sits in Section 4.2.1.5, the discretionary tier that “may also be required” regionally or nationally based on risk assessment data, specified name “Soy”. Sesame is in the mandatory tier at 4.2.1.4. National law still governs: R146 of 2010 requires soybean declaration in South Africa.
Is CXC 80-2020 an auditable standard?
No. CXC 80-2020 is a code of practice, not a certification standard, and its dominant modal verb is “should”. An auditor cannot raise a non-conformity against it directly. It matters because the GFSI-benchmarked schemes are built on Codex and auditors reference it when testing a site’s reasoning.
What is the difference between allergen validation and verification?
Validation is documented evidence the cleaning procedure works, established by three consecutive successful cleans on a justified worst case. Verification is the ongoing check it still works. Monitoring is the real-time check the cycle ran as specified. A CIP parameter trace is monitoring, not validation.
Can we justify a “may contain” statement without a quantitative risk assessment?
No. The Codex annex defines PAL as indicating a risk identified by a risk assessment, and restricts its use to what allergen management practices cannot prevent or control. A blanket disclaimer without a documented assessment is not a legal defence.
Build the evidence package before the auditor arrives
Advanced Allergen Management & Validation: Scientific Principles, Risk Assessment and Cleaning Verification — R3,450, no VAT charged.
Nine modules, approximately 40 hours, self-paced, instructed by Mthokozisi Nkosi. Includes the ASC Allergen Validation Toolkit — an Excel workbook whose multi-framework risk assessment calculator switches between Codex Table A1/A2, VITAL 4.0 ED05, VITAL 3.0 ED01 and Netherlands ED05 reference doses, plus a swab recovery calculator, a result interpretation tool, an allergen matrix and a changeover risk assessment — and a document-controlled Cleaning Validation Protocol template. Assessment is a 90-question proctored exam at an 80% pass mark — 72 of 90 — in 150 minutes, with a certificate of competence on passing. FoodBev SETA accredited (587/00337/1900), HPCSA CPD accredited, SAATCA TC 065.
Evidence takes weeks to build and minutes to be found missing. Start now.
Enrol in Advanced Allergen Management & Validation → | Foundational allergen course | All courses
Related: Cleaning validation guide · VITAL 4.0 labelling · Processing and allergens