The auditor puts his bag down in the banqueting kitchen and asks to see the prerequisite programme documentation. The food safety manager hands over a manual written for a factory: zoning, air handling, a swabbing schedule for a high care area that this hotel does not have. Nothing in it is wrong. Almost none of it is what a category E audit is conducted against.
In short
- Catering and food service sit in food chain category E. A category E FSSC 22000 Version 7 audit is conducted against four documents, not one.
- Those four are ISO 22000:2018, ISO 22002-100:2025, ISO 22002-2:2025 and the FSSC 22000 Version 7 additional requirements.
- ISO 22002-2 is the catering prerequisite specification. It sits on top of ISO 22002-100, it does not replace it, and it is written for kitchens rather than production halls.
- Not every additional requirement reaches category E. Environmental monitoring under 2.5.7 does not. Management of services and purchased materials does, and 2.5.18 applies in a way that catches hotel groups off guard.
- The FSSC 22000 Version 7 for Catering and Food Service course (R5 500) is one complete course: ISO 22000, the shared prerequisite programmes and the two documents specific to category E, with nothing to buy first.
What category E actually covers
Food chain category E is catering: food prepared and served directly to the consumer, or prepared for consumption away from the point of production. Hotels, contract caterers, hospital and mine kitchens, airline catering units, restaurant groups and central production kitchens serving their own outlets all land here. The distinction that matters is who eats the food. A central kitchen that cooks, chills and ships to its own restaurants is category E. The same kitchen selling chilled meals to a retailer under the retailer name is manufacturing, and the audit changes.
Sites get this wrong in both directions. A hotel group applying for certification against the manufacturing requirements buys itself controls it will never be asked for and will not maintain. A central production unit certifying as catering when it supplies third parties discovers the gap at the certification audit, not before.
The four documents a category E audit is conducted against
FSSC 22000 is not a standard in its own right. It is a scheme that binds three things together and adds a fourth. For category E that means:
- ISO 22000:2018: the management system. Hazard analysis, the plan-do-check-act structure, interested parties, the operational control decision between a CCP and an OPRP. This part is identical whatever category you are in.
- ISO 22002-100:2025: the prerequisite programme requirements shared across the whole food, feed and packaging supply chain. Cleaning, pest management, personnel hygiene, maintenance, utilities, waste.
- ISO 22002-2:2025: the catering layer. What a kitchen has to do on top of the shared PRPs, written for service environments.
- The FSSC 22000 Version 7 additional requirements: eighteen of them, of which a defined subset applies to category E.
An auditor works through all four. A site that has read only the scheme document, or only ISO 22000, is preparing against a quarter of the evidence it will be asked for.
Where the catering PRP layer differs from a factory programme
ISO 22002-100:2025 still requires you to work in a clean environment, maintain your equipment and control your suppliers. What ISO 22002-2 changes is the shape of the risk. In a factory the hazard concentrates in a long production run with a validated kill step. In a kitchen it concentrates in time and temperature across many small batches, in hot holding, in cooling cooked food, in cross contamination during service, and in the fact that the people handling ready to eat food are also the people clearing plates.
Practical consequences show up quickly. Hot holding and cooling records carry weight a factory would give to a CCP log. Service equipment, from bain-maries to buffet sneeze guards, becomes part of the hygiene programme rather than an afterthought. Allergen control moves from a labelled pack to a verbal exchange between a server and a guest, which has to be trained and evidenced. Waste and plate return become a contamination route that a factory simply does not have.
Which additional requirements reach a kitchen
This is where most preparation time is wasted or misspent. The additional requirements are not applied in full to every category, and knowing which ones fall away is as valuable as knowing which ones apply.
Environmental monitoring under 2.5.7 does not reach category E. Sites spend money building swabbing programmes they will never be audited against. That does not mean a kitchen may be dirty: ISO 22002-100 still requires a clean environment and verification that cleaning works. It means the specific scheme requirement for an environmental monitoring programme is not the thing you will be assessed on.
2.5.18 does reach category E, and it catches hotel groups in particular, because its central function applies to a group in a way it never applies to a single factory. Management of services and purchased materials reaches you through one sub requirement rather than the whole clause, which changes what you have to document about your suppliers.
Getting this map right before the audit is the difference between a focused three months of preparation and a scattered year of it.
The course this article comes from
FSSC 22000 Version 7 for Catering and Food Service
Twenty four lessons across four modules that work through ISO 22002-2:2025 clause by clause and take every one of the eighteen additional requirements at its real category E scope, quoting the clause, naming the documented information it demands and the toolkit document that holds it. Eight games and knowledge checks, a graded final assessment in two parts, a 70 percent pass mark, three attempts, and a written explanation with every question.
R5 500 self-paced, certificate on completion
See the course →How the course is put together
The catering course used to teach only the documents specific to category E and assume you already held the two underneath. It no longer works that way. ISO 22000:2018, the shared prerequisite programmes of ISO 22002-100:2025 and ISO 22002-2:2025, the catering layer are all taught inside the one course, in that order, so the sequence now sits in the syllabus instead of across three separate enrolments.
There is nothing to buy first and nothing to unlock. One enrolment at R5 500 covers the management system, the prerequisite programmes, the sector layer and the FSSC 22000 Version 7 additional requirements at category E scope, and you work through it at your own pace. Bought as three separate courses the same ground used to cost R8 300.
Common questions
Is a hotel kitchen category E or category C?
Category E, provided the food is served to the consumer rather than supplied to another business for onward sale. A hotel that also runs a bakery selling packaged loaves to a retailer has two scopes and needs to say so.
Does ISO 22002-2:2025 replace ISO 22002-100:2025?
No. ISO 22002-100 holds the requirements common to the whole supply chain and ISO 22002-2 adds the catering specific layer on top. You are audited against both.
Do we need an environmental monitoring programme for FSSC 22000 catering certification?
Additional requirement 2.5.7 does not extend to category E, so you will not be audited against the scheme requirement for one. You must still verify that your cleaning is effective under ISO 22002-100.
How long does the course take?
It is self-paced. Most delegates finish the catering course in around ten hours of study, and there is no separate prerequisite course to add to that.
Is the certificate verifiable?
Yes. Every ASC certificate carries a unique certificate number and a QR code that resolves to a verification page on this site showing the learner name, course and completion date, so an auditor or employer can confirm it against our records rather than the document in front of them.