Last updated 7 October 2026
Swab each site as often as its residual risk demands. Score every site for probability and severity after the controls that exist today, then read the rating into a frequency: Critical daily, High weekly, Medium monthly, Low-Med quarterly and Low twice a year. Sample about three hours into production, take at least five food contact and five non food contact sites per event, and rotate shifts and days.
A hygiene supervisor takes 25 Listeria spp. sponges every Tuesday at 10h00 from the same 18 sites. The list came from a previous auditor and nobody can say why those sites, or why weekly. At the next FSSC 22000 audit the first question is “show me the risk assessment behind this frequency”, and there is none. This article is that risk assessment, step by step.
Practical Pathogen Environmental Monitoring (EMP) and Surface Swabbing walks you through scoring every site, reading the band into a frequency and fitting the schedule to a real swab budget. You finish with a scored risk register and schedule you keep. About 9 hours, R1 750.
Is there a fixed swabbing frequency in South African law?
No. R638 sets a limit on cleaned food contact surfaces and says nothing about how often you look for pathogens. The frequency is yours to set, and the schemes expect you to justify it by risk.
Regulation 6(4)(b)(i) of R638 is the one microbiological number in South African food hygiene law: not more than 100 viable microorganisms per square centimetre on a cleaned food contact surface, by the SANS 5763 swab technique. That is a cleaning verification requirement. The duty to look for Listeria comes from elsewhere: FSSC 22000 Version 7 clause 2.5.7 asks for a risk based programme, BRCGS Issue 9 clause 4.11.8 asks for a defined test frequency within a risk based programme, and Codex CXG 61 Annex I section D says frequency should be higher where the risk of contaminating ready-to-eat food is greater and should reflect the site’s own history of Listeria findings.
How do you score a sampling site on the 5 x 5 matrix?
Give each site a probability from 1 to 5 and a severity from 1 to 5, before controls and again after them. Probability comes from the niche and the history. Severity comes from the product and the zone.
The register works one line per zone, site and organism, with the hazard, the source and a risk owner named by role. It is the 5 x 5 method of the ASC RA19 Environmental Monitoring Risk Assessment, the structure the course builder exports.
| Score | Probability | Severity |
|---|---|---|
| 1 | Rare, unlikely to occur | No food safety impact |
| 2 | Possible, once in one to five years | Minor, monitor only |
| 3 | Occasional, a few times a year | Potential food safety issue |
| 4 | Likely, about monthly | Serious food safety issue |
| 5 | Almost certain, weekly or every batch | Critical or systemic failure |
For probability, ask whether the site is a niche (wet after cleaning, hollow, cracked, a drain, a belt underside) and what its history is. A wet hollow leg with a positive last year is a 4 or 5 before controls. A dry, open surface with no history is a 1 or 2.
For severity, think about the consumer. Listeria monocytogenes on a Zone 1 surface after the cook, in a product that supports growth with no further kill step, is a 5. The same organism on a Zone 2 frame is a 4. Zone 3 floors and drains carry a 3, and Zone 4 a 2 or a 3.
Then the rule most registers break. Controls reduce probability, not severity. Cleaning changes how often Listeria is on the belt. It does not change what Listeria does to a pregnant woman. Keep the residual severity equal to the inherent severity unless a control physically removes the consequence, and count only controls that exist today, are written down and are verified. A planned control does not lower the score.
Which sampling frequency does each risk band set?
The residual rating, probability times severity after controls, falls into one of five bands, and each band sets a routine frequency and a response.
| Residual rating | Band | Routine frequency | What the band requires |
|---|---|---|---|
| 20 to 25 | Critical | Daily | Immediate action. Decide whether product is affected and whether the activity may continue |
| 10 to 16 | High | Weekly | An action now, with a named owner, a target date and a report to senior management |
| 5 to 9 | Medium | Monthly | An action on the tracker with an owner and a target date |
| 3 to 4 | Low-Med | Quarterly | Control adequate. Confirm at the stated frequency |
| 1 to 2 | Low | Twice a year | Control adequate. Monitor and confirm at the annual review |
A worked line shows why wet chilled plants swab Zone 1 weekly. Listeria on the belts, slicer and filler after the cook: inherent probability 4, severity 5, rating 20, Critical. With a validated clean and disinfection, pre operational verification and dismantling of the slicer, probability drops to 2. Severity stays at 5. Residual 10, High, weekly. That is not a failed assessment. It is the reason the site swabs that zone every week. Daily lines are investigation lines, not routine ones.
How many swabs should you take at each sampling event?
At least five food contact and five non food contact sites per event, plus a share kept back for the sampler’s judgement on the day. Then check the total against the budget you can actually pay for.
The five plus five pattern comes from the FDA 2017 draft guidance for ready-to-eat foods. It means a Zone 1 result always has Zone 2 and Zone 3 results from the same day beside it, which is what makes a positive readable. One swab in five held back for judgement is a fair rule of thumb: the puddle that was not there last week, the guard that came off, the hose on the floor.
Count the load honestly. In the course’s first case pack, twelve sites on a chilled ready meals line score out as six weekly lines, three monthly lines, two quarterly and one twice a year. That is about seven routine swabs a week plus two judgement swabs, comfortably inside a budget of 25. The spare capacity goes to more Zone 1 and Zone 2 lines, because twelve lines for a 400 person plant is a starting list, not a programme.
Score 24 sites, build the four week schedule and test it against a 25 swab budget inside the course workshop, with every call marked the moment you submit. Nine hours, six modules, R1 750 once.
Not sure which course fits your job? WhatsApp ASC on +27 61 483 0381.
When in the shift should environmental swabs be taken?
About three hours into production for the pathogen programme. After cleaning and before start up for cleaning verification. They answer different questions, so they happen at different times.
Codex Annex I section E recommends sampling when any organism in a harbourage site has had time to spread, approximately three hours into processing, and rotating sampling across shifts and days. A Listeria spp. sponge taken straight after disinfection tells you almost nothing about a niche. A cleaning verification swab taken three hours into the run is not a cleaning verification swab.
Sponge size, broth and timing for both are in the surface swabbing guide. Keep separate records, even if one person takes both swabs.
How do you build the sampling rotation, step by step?
List every scored line, fix the weekly budget, fill the weeks with the weekly lines first and rotate the rest, then rotate the timing as well as the sites.
- List every line with its zone, scores, band and frequency. That list is the risk register.
- Fix the number of swabs you can take and pay for every week. Be honest about it.
- Fill each week with every weekly line first.
- Add the monthly lines on a four week rotation and spread the quarterly lines across the quarter.
- Top every event up to at least five food contact and five non food contact sites.
- Keep about one swab in five for the sampler’s judgement on the day.
- Rotate days and shifts, and sample about three hours into production.
- If the plan does not fit the budget, write the gap down and take it to management. Do not quietly drop lines.
Every line at Medium or above also carries an action on the tracker, with an owner and a target date: what will be done, not what already exists. In a wet ready-to-eat plant that tracker is never empty, and that is correct.
When should the sampling frequency change?
Whenever the data or the plant changes. An alert moves a site up one band, an action level positive starts vectoring and more frequent sampling, and FSSC 22000 sets five triggers for reviewing the whole programme.
The course uses three response levels. An alert is any Listeria spp. positive in Zone 3 or 4, or a zone hit rate that rises for three months in a row: intensified cleaning, vector swabs at the next event, and the site moves up one band. An action is a positive in Zone 1 or 2, or a second positive at the same Zone 3 site within 12 months: full investigation, daily sampling, and for Zone 1 a hold on product from that line. Escalation is Listeria monocytogenes confirmed on Zone 1 or the same typed strain more than once in 12 months. What happens in the first day after a positive is set out in a Listeria positive environmental swab: the first 24 hours.
FSSC 22000 Version 7 clause 2.5.7 (d) also requires a review of the programme at least once a year and whenever one of five triggers fires: a significant change to products, processes or legislation, no positive results over an extended period, a trend in out of specification product results linked to the environment, a repeat pathogen detection in routine monitoring, and an alert, recall or withdrawal. Each review should end with the register re-scored and the schedule rebuilt, which is how an environmental monitoring programme that finds a resident strain keeps working.
Frequently asked questions
How often should you take environmental swabs?
As often as each site’s residual risk demands. Read the residual 5 x 5 rating into a frequency: Critical daily, High weekly, Medium monthly, Low-Med quarterly and Low twice a year. In a wet chilled ready-to-eat plant most Zone 1 lines land in the High band and are swabbed weekly.
Is there a legal swabbing frequency in South Africa?
No. R638 regulation 6 sets a limit for cleaned food contact surfaces but no frequency for pathogen monitoring. FSSC 22000, BRCGS and Codex require a risk based frequency that you can justify.
How many swabs should you take per sampling event?
At least five food contact and five non food contact sites per event, the pattern in the FDA 2017 draft guidance for ready-to-eat foods. That way a Zone 1 result always has Zone 2 and Zone 3 context from the same day.
What time of day should environmental swabs be taken?
About three hours into production, which is the Codex Annex I figure. By then anything shedding from a harbourage site has had time to spread, so a Listeria spp. sponge taken straight after cleaning tells you very little.
Should a site be swabbed more often after a positive?
Yes. An alert moves the site up one band, and an action level positive starts vectoring and more frequent sampling until the site shows consecutive clean results.
What if we cannot afford the swabs the plan calls for?
Say so in writing. Fill the budget with the weekly lines first, then show management the gap between the plan and the budget, because a plan for 80 swabs run at 30 is a plan that does not exist.
Build a sampling plan you can defend line by line
Practical Pathogen Environmental Monitoring (EMP) and Surface Swabbing turns a walk and a zoned site list into a scored risk register, a frequency for every line and a schedule that fits your swab budget or shows management the gap. You build it in three workshop sittings and keep it.
R1 750 once, with lifetime access. No VAT is charged, so the price shown is the price paid. Teams of five or more: contact ASC for a team rate.
- Advanced Level 4, about 9 hours, six modules and 26 lessons, self paced on any phone
- 15 narrated videos, 22 original diagrams and 15 case study packs with model answers
- Scenario checks and a case study assessment in Modules 1 to 5, plus six timed games
- Four timed practical stages on the case plant, every one marked automatically the moment you submit
- The EMP Programme Builder, which exports your environmental monitoring risk assessment in the ASC RA19 structure to keep
- A certificate with your name, the course title, the code FS32-0401, the level and the date, with a QR code and verification number
- Is it for me? Yes if you set or defend swabbing frequencies as a QA, technical, hygiene or laboratory manager, or a food safety team member who answers for the programme at audit.
- How long does it take? About 9 hours, self paced on a phone. Most of the scoring work sits in the three workshop sittings of about an hour each.
- Will it work at my site? Yes. You can build the register for your own plant, or work on the case sites, which are training scenarios built from real audit patterns.
Want the laboratory side as well? How to read a food microbiology lab report is a good next read, and the Advanced Food Microbiology Course goes deeper into sampling plans and testing decisions.
Sources
- Codex Alimentarius CXG 61-2007, Guidelines on the Application of General Principles of Food Hygiene to the Control of Listeria monocytogenes in Foods, Annex I
- FSSC 22000 Version 7, clause 2.5.7 Environmental monitoring
- BRCGS Global Standard for Food Safety Issue 9, clause 4.11.8
- US FDA draft guidance, Control of Listeria monocytogenes in Ready-To-Eat Foods, 2017
- Regulation R638 of 2018, regulation 6(4)(b)(i)