FSSC 22000 Version 7 Additional Requirements Applicability: Which Ones Actually Apply to You

Home / Guides / Additional requirements applicability

FSSC 22000 · VERSION 7.0 · FOOD CHAIN CATEGORIES

By Mthokozisi Nkosi, founder of ASC Food Safety Consultants. FSSC 22000 and BRCGS Lead Auditor, SAATCA registered R638:2018 Lead Implementer, HPCSA registered Environmental Health Practitioner, MSc International Public Health. Published 18 September 2026.

How do you work out FSSC 22000 Version 7 additional requirements applicability?

You read the scope in the heading of the requirement, then you read the scope of every sub requirement inside it, and you resolve both against the food chain category on your certificate. That is the whole method, and it is the step most sites skip. They read the eighteen requirements as a list of eighteen things to do.

Part 2 section 2.1 sets the three sets of audit criteria: ISO 22000:2018, the relevant PRP standard for the sector as referenced in Part 1 Table 1, and the FSSC 22000 additional requirements. Only the third set is scoped by category in its heading, which is why applicability errors cluster there.

The errors run both ways and both cost money. Build a programme nobody asked for and you create records you now have to maintain and be audited against. Miss one you were scoped into and you get a finding, and under Part 3 section 6.2 there is no soft landing, because the Scheme does not allow Opportunities for Improvement.

What are the food chain categories, and where are they written down?

In Part 1 section 3, which sets out the food chain (sub)categories in Table 1, aligned with the categories defined in ISO 22003-1:2022, with sub(sub)categories in Table 1.1 for those with a wide range of technologies.

Table 1 gives each category its description and normative documents in one row. BIII is pre-process handling of plant products. C is food manufacturing. D is feed and animal food. E is catering. F splits into FI retail and wholesale and FII brokering and trading. G is transport and storage. I is packaging material. K is bio and chemicals.

Table 1.1 then subdivides. CI splits into four, from red and white meat to egg products. CIV splits into six, from thermal and pressure processed products at CIV-1 to beverages at CIV-6. I splits into five by material. Those sub(sub)categories matter for audit scope and duration; the additional requirements are almost never scoped that deep. If you have not yet mapped what changed at Version 7.0 and what you have to do about it, start there.

Does a requirement scoped to C reach all five C subcategories?

Yes, and this is the single most useful sentence in this guide. Part 1 section 3.2 is headed Food Manufacturing (Category C) and states that food chain category C involves the following food processing activities, then lists them (a) to (e): C0 conversion of animal carcasses, CI processing of perishable animal products, CII processing of perishable plant based products, CIII processing of perishable animal and plant products, CIV processing of ambient stable products.

So when a heading says BIII, C, I and K, the C is not shorthand for chilled. It is the whole of category C. A dry pasta plant in CIV, a slaughterhouse in C0 and a sandwich factory in CIII are all inside it. Section 3.2 also closes a gap that catches specialist manufacturers: foods for special dietary needs and for special medical purposes, where legally classified as food in the country of manufacture, sit under category C.

Worked example one: does 2.5.7 Environmental Monitoring apply to you?

If your category is BIII, any C subcategory, I or K, yes. Requirement 2.5.7 is headed Environmental Monitoring (Food Chain (Sub)Categories BIII, C, I & K) and asks for four things: a risk based programme for the relevant pathogens, spoilage and indicator organisms; a documented procedure for evaluating the effectiveness of all controls on preventing contamination from the manufacturing environment, including at a minimum the microbiological controls present; monitoring data including regular trend analysis; and an annual review for continued effectiveness and suitability.

The annual review carries five named triggers that bring it forward: significant changes to products, processes or legislation; when no positive testing results have been obtained over an extended period; a trend in out of specification microbiological results linked to environmental monitoring; a repeat detection of pathogens during routine monitoring; and alerts, recalls or withdrawals relating to your products.

Read the second trigger again, because it reverses the instinct of most quality managers. A long run of clean results is a reason to review the programme, not a reason to be pleased with it. If you never find anything, the programme is probably sampling the wrong places. We have written separately on building an environmental monitoring programme that finds a resident Listeria strain.

The applicability mistake here is the ambient site. A South African biscuit or dry spice plant in CIV reads the words environmental monitoring, thinks of chilled ready to eat, and decides the requirement is for somebody else. The organisms and the sampling plan will look nothing like a chilled plant’s, but the programme, the procedure, the trend data and the annual review are all required.

Worked example two: does 2.5.14 Traceability reach anyone outside slaughter?

Requirement 2.5.14 reaches food chain subcategory C0 and nowhere else. Its heading reads Traceability (Food Chain Subcategory C0), and the requirement itself states that in addition to ISO 22000:2018 clause 8.3 the organization shall establish, implement and maintain appropriate procedures and systems to ensure the traceability of all edible parts of the carcass is maintained until the carcass is deemed fit for human consumption, including blood for human consumption.

This is the narrowest scope in the whole of section 2.5, and a useful calibration point: if a requirement can be written for one subcategory, the category list in a heading is deliberate rather than decorative. A CI plant buying in primal cuts is not in C0 and does not carry 2.5.14. It still carries ISO 22000:2018 clause 8.3 in full.

Worked example three: does 2.5.18 multi-site reach a manufacturer with five plants?

Requirement 2.5.18 is headed Requirements for Organization with Multi-Site Certification (Food Chain (Sub)Categories BIII, E, F & G). Category C is not in that list, and the reason is in Part 3. Section 5.3.1 (c) states that multi-site certification, including sampling, is only allowed for BIII pre-process handling of plant products, E catering and food service, FI retail and wholesale, FII brokering, trading and e-commerce, and G transport and storage services.

So a food manufacturer with plants in Johannesburg, Cape Town and Gqeberha cannot certify them as one multi-site organization, and 2.5.18 has nothing to say to it. Each site holds its own certificate. The central function still matters, because Part 3 section 6.2 says nonconformities raised at a head office audit are assumed to affect the equivalent procedures at all sites.

Where 2.5.18 does apply, the internal audit rules in 2.5.18.2 are specific. The central function establishes the audit procedure and programme covering the management system, the central function and all sites; internal auditors are independent of the areas they audit and are assigned by the central function; and auditor competence is fixed, with a 40 hour FSMS, QMS or FSSC 22000 lead auditor course for the lead auditor and a 16 hour internal auditor course for the rest of the team.

Worked example four: why do 2.5.11 and its sub requirement (a) differ?

Requirement 2.5.11 is headed Hazard Control and Measures for Preventing Cross-Contamination (All Food Chain Categories, Excluding FII), and then it narrows internally four times. This is the pattern that catches people who read headings only.

Sub requirement (a) applies to BIII, C and I, and adds to ISO 22000:2018 clause 8.5.1.3 the duty to have specific requirements in place where packaging is used to impart or provide a functional effect on food, for example shelf life extension. Sub requirement (b) applies to subcategory C0 and adds to ISO 22002-1:2025 clause 12 specified requirements for an inspection process at lairage or at evisceration to ensure animals are fit for human consumption. Sub requirement (c) applies to category D and adds to ISO 22002-6:2025 clause 12 procedures for ingredients and additives with components that can adversely affect animal health. Sub requirement (d) returns to all categories excluding FII and covers foreign matter management, in addition to ISO 22000:2018 clause 8.2.4 (h).

That last one carries the record most sites are short of. It requires a risk assessment to determine the need and type of foreign body detection equipment, and states that where the organization deems no foreign body detection equipment is necessary, justification shall be maintained as documented information. Deciding you do not need a metal detector is allowed. Deciding it without writing down why is not.

What happens when you get applicability wrong?

One of two things, and neither is comfortable. Over-build and you create more surface area than the Scheme requires, and every extra procedure is auditable against itself, because an auditor holds you to the documented information you chose to create. A packaging manufacturer in category I that wrote a food loss and waste policy has given itself a programme 2.5.16 excludes it from.

Under-build and the finding is graded, not discussed. Part 3 section 6.1 (i) requires the auditor to report all nonconformities at all audits with a clear concise statement of the requirement, the nonconformity statement, the grade and the objective evidence. A missing environmental monitoring programme at a CIV site is not an observation.

The fix is a register, not a reading. One row per requirement from 2.5.1 to 2.5.18, one row per separately scoped sub requirement, your food chain category, the scope as written, and a yes or a no with the reason. Then the same discipline Part 3 section 6.1 (e) puts on the auditor: where something is not applicable, the justification is recorded. Once you know what applies, the next question is what record proves it, which is covered in the documented information Version 7 asks for and where sites fall short.

Questions people ask