[Geef de tekst op] [Geef de tekst op] [Geef de tekst op]

FSSC 22000 V5 FSMA PCHF ADDENDUM

Version 1 | February 2020

CONTENTS

1 Introduction ............................................................................................................................. 3
1.1 Aim ............................................................................................................................................ 3
1.2 Relevance ................................................................................................................................. 4
1.3 How to use this document ........................................................................................................ 4
1.4 Auditor requirements ................................................................................................................ 5
1.5 FSSC 22000 FSMA PCHF Addendum report .......................................................................... 5

2 Subpart A – General Provisions - PCQI .................................................................................. 5

3 Subpart B - Current Good Manufacturing Practice.............................................................. 6

4 Subpart C - Hazard Analysis and Risk-Based Preventive Controls ..................................... 6

4.1 Food Safety Plan ...................................................................................................................... 6
4.2 Hazard Analysis ........................................................................................................................ 8
4.3 Risk based Preventive Controls ............................................................................................... 8
4.4 Recall plan ................................................................................................................................ 9
4.5 Verification .............................................................................................................................. 10
4.6 Validation ................................................................................................................................ 12

5 Subpart F - Requirements Applying to Records ................................................................. 12

6 Subpart G - Supply Chain Program ...................................................................................... 13

7 References ............................................................................................................................. 15

Annex 1 - FSSC 22000 V5 FSMA PCHF Report Addendum .......................................................... 16

Version 1 | February 2020 1 of 24

Copyright © 2020, Foundation FSSC 22000

The information provided in this document is strictly for information only. It does not constitute
legal or regulatory advice. FSSC 22000, it's officers, directors, employees, agents, (including those
who participated, reviewed, and/or contributed to the content of this material) make no
representations or warranties as to the accuracy or completeness of the information. This
information was developed based upon publicly available information from public regulatory
information and sources. Readers are encouraged to obtain independent legal advice /regulatory
advice for specific application of regulations to their specific Organizations/facilities/ products.

All rights reserved. No part of this publication may be reproduced and/or published in any form,
by means of printed matters, photocopy, microfilm, recording or any other method or technology,
without written approval by the Foundation FSSC 22000.

Foundation FSSC 22000

P.O. Box 693
4200 AR Gorinchem, The Netherlands
Phone +31 183 645028
Website: www.fssc22000.com
Email: [email protected]

Version 1 | February 2020 2 of 24

1 INTRODUCTION
1.1 AIM
This document replaces the previously published FSSC 22000 FSMA Addendum for Human Food
(July 2018) which was produced to help FSSC 22000 certified companies bridge the gaps between
the requirements of the FSSC 22000 Food Safety Management System and the FSMA Preventive
Controls Rule for Human Food (PCHF). The current document is based on an updated GAP analysis
between the FSMA PCHF Updated Template and FSSC 22000 Version 5 which was published in
May 2019 to accommodate the revision of ISO 22000 in 2018. This updated alignment is published
as FDA PCHF Human Food comparison to FSSC 22000 V5.xls on www.fssc22000.com.

FSSC 22000 is a GFSI benchmarked certification program which defines the requirements of a risk-
based food safety management systems audit. It incorporates the requirements of the ISO 22000:
2018 Food Safety Management System, scope specific Pre-Requisite Programs, which in the case
of human food manufacture is ISO/TS 22002-1: 2009, and the FSSC additional requirements.

ISO 22000 was revised in 2018 to meet the challenge of global food safety and changing regulatory
requirements. It now aligns with other international management systems through its high-level
structure (HLS) and includes improved definitions of hazard control measures and detailed
explanation of risk management. The revised GAP analysis (FDA PCHF Human Food comparison
to FSSC 22000 V5.xls) illustrates how FSSC 22000 V5, with ISO 22000:2018 and the updated
additional requirements of FSSC 22000, aligns more closely to the requirements of the FSMA PCHF,
closing many of the gaps originally identified. Differences that are identified relate either to
differences in terminology or to requirements that are less detailed in FSSC 22000 compared to
the specific requirements of the PCHF.

It is anticipated that this document will help companies understand the requirements of the PCHF
rules as well as illustrate how FSSC 22000 certification can achieve and demonstrate compliance.
Further it is hoped that by supplementing the FSSC 22000 audit with the additional information
required by the FSMA PCHF, that an accredited FSSC 22000 program can be used to fulfil the
supplier verification requirements of the FSMA PCHF and FSVP (Foreign Supplier Verification
Program) regulations.

Supplier Verification is required as part of the FSMA defined Supply Chain Program and verification
activities described in the PCHF and FSVP rules include the option of using an annual onsite third-
party audit to ensure adequate control of the hazards and implementation of the PCHF. When
used for verification purposes, the FSSC22000 audit together with the FSMA Addendum Report
can be used to demonstrate compliance towards the PCHF rule and to include a review of the
supplier’s written HACCP plan or Food Safety Plan and their implementation for the hazard(s)
being controlled.

In order to support the use of FSSC 22000 as an applicable audit, an Audit Report is provided in
Annex 1 (FSSC 22000 V5 FSMA PCHF Addendum Report). This addendum report shall be completed
at the time of the FSSC 22000 annual audit to attest to observance of the PCHF requirements,
provide a review of the hazard control plan, an assessment of the preventive controls applied by
the auditee and deliver a means of sharing this information required for the supplier verification
process.

Version 1 | February 2020 3 of 24

The FSSC 22000 V5 FSMA PCHF Addendum Report in Annex 1 shall be completed in conjunction
to the on-site FSSC 22000 audit and shared with the final report as required.

For more information on ISO 22000:2018 please refer to the standard at www.ISO.org and to the
Guidance Document: ISO 22000 Interpretation avalable for download at www.FSSC22000.com
The chapters in this addendum relate to the Subparts of Title 21 of the Code of Federal Regulation
Part 117 - Current Good Manufacturing Practice, Hazard Analysis and Risk-Based Preventive
Controls for Human Food (FSMA- PCHF).

1.2 RELEVANCE
This document refers to the requirements as laid out in Title 21 of the Code of Federal Regulation
PART 117—CURRENT GOOD MANUFACTURING PRACTICE, HAZARD ANALYSIS, AND RISK–BASED
PREVENTIVE CONTROLS FOR HUMAN FOOD (PCHF Rule)

The relevant parts are as follows:

Subpart A General Provisions Relevant

Subpart B Current Good Manufacturing Practice Relevant

Subpart C Hazard Analysis and Risk Based Relevant

Preventive Controls

Subpart D Modified Requirements Not relevant

Subpart E Withdrawal of a Qualified Facility Not relevant

Exemption

Subpart F Requirements Applying to Records that Relevant

must be established and maintained

Subpart G Supply Chain Program Relevant

1.3 HOW TO USE THIS DOCUMENT

a) Users of this document should be familiar with the FSMA PCHF requirements and be
approved as a Preventive Controls Qualified Individual (PCQI) level or equivalent (either
through recognised FSPCA PCQI training or otherwise).
b) This document provides a voluntary overview of the regulatory requirements that are
either additional or more specific than those of FSSC 22000 as identified in the more
detailed comparison (FDA PCHF Human Food comparison to V5.xls).
c) The current scope of the review is limited to the manufacture of human food as regulated
by the FSMA PCHF. This review does not apply to other regulations of FSMA: such as the
foreign supplier verification (FSVP), sanitary transport or intentional adulteration rules.
d) The review of the requirements can only be conducted by FSSC 22000 licensed CB’s in
conjunction with an FSSC 22000 audit. The additional review is voluntary and shall be as
agreed between the CB and the relevant organization.
e) The duration of the additional review depends on the size and complexity of the
organization and is at the discretion of the CB. A suggestion of 2-4 hours is made.

Version 1 | February 2020 4 of 24

f) The FSSC 22000 V5 FSMA PCHF Addendum Report provided in Annex 1 is intended to help
FSSC 22000 certified organizations demonstrate that they have integrated the
requirements of the FSMA PCHF Rule into their Food Safety Management System (FSMS).
g) The information provided in the Addendum Report is strictly for information only. It does
not constitute legal or regulatory advice. FSSC 22000 makes no warranties as to the
accuracy or completeness of the information.

1.4 AUDITOR REQUIREMENTS

a) The CB shall qualify auditors for conducting the review of the additional FSMA
requirements.
b) The qualification requirements include:
 The auditor is qualified to conduct FSSC 22000 certification audits for human food
as described in the FSSC 22000 Additional Requirements.
 The auditor shall have appropriate competence to effectively examine the
implementation of the FSMA PCHF (CFR Title 21 part 117), understands the
contents of this document and the application of the FSSC 22000 V5 FSMA PCHF
Addendum Report.
 The CB shall upload records of appropriate training and briefing in the FSSC 22000
auditor database as evidence that the auditor requirements are met.
 Training and/or briefing shall be done by a person with demonstrable knowledge
of the FSMA PCHF rule (e.g. a PCQI or a FSMA PCHF or FSVP Lead Instructor).

1.5 FSSC 22000 FSMA PCHF ADDENDUM REPORT

a) After completing the review of the requirements contained in this document, the auditor
shall complete the Addendum Report provided in Annex 1.
b) The FSSC 22000 V5 FSMA PCHF Addendum Report shows that the additional FSMA
requirements have been reviewed based on sampling and any findings observed by the
auditor. The final report shall document the root cause analysis and the corrective action
plan that has been or will be undertaken by the organization.
c) The final report shall be issued no later than 3 months from the last day of the audit.
d) The Addendum Report shall be uploaded by the CB in the FSSC 22000 Portal in addition to
the regular FSSC 22000 audit report.

2 SUBPART A – GENERAL PROVISIONS - PCQI

Subpart A of the PCHF Rule lays the foundation of the regulation by providing definitions and
interpretations of the terms that are used throughout the rule. In addition, it defines the required
responsibilities and competence of personnel of the organization.

Most of the requirements detailed in the PCHF Rule relating to responsible persons are included
in the Management, Leadership and Competence requirements of ISO 22000: 2018. One major
difference is that the PCHF defines the need for a Preventive Controls Qualified Individual (PCQI)
and Qualified Individuals (§117.3).

Version 1 | February 2020 5 of 24

FSSC 22000 does not define a PCQI, although it does define the need for a food safety team leader
with equivalent competencies and responsibilities.

Organizations seeking FSMA compliance should ensure that they have identified and appointed
personnel with the responsibilities and competence that comply with § 117.1 and § 117.3 of the
PCHF Rule and that individuals have identified with appropriate competency that can undertake
the role and responsibility equivalent to that of a PCQI.

§ 117.1 Applicability and Status

Defined as the Owner, agent or operator in charge, who has legal responsibility for the
site, and who must sign and date the food safety plan:
a) Upon initial completion and
b) Upon any modification.

§ 117.3 Definitions
Preventive controls qualified individual (PCQI): means a qualified individual who has
successfully completed training in the development and application of risk-based
preventive controls at least equivalent to that received under a standardized curriculum
recognized as adequate by FDA or is otherwise qualified through job experience to develop
and apply a food safety system.

Qualified individual (QI): a person who has the education, training, or experience (or a
combination thereof) necessary to manufacture, process, pack, or hold clean and safe food
as appropriate to the individual's assigned duties. A qualified individual may be, but is not
required to be, an employee of the establishment.

3 SUBPART B - CURRENT GOOD MANUFACTURING PRACTICE

The PCHF Rule includes updated requirements for current Good Manufacturing Practice (cGMP’s)
under Subpart B. These requirements are met, for the most part, by the Pre-Requisite Programs
ISO/TS 22002-1: 2009 which are incorporated as part of FSSC 22000 Version 5.
Organizations seeking FSMA compliance should be knowledgeable of the specific GMP
requirements that apply to their facility or process. These elements should be incorporated into
their food safety program as appropriate.

4 SUBPART C - HAZARD ANALYSIS AND RISK-BASED PREVENTIVE

CONTROLS
4.1 FOOD SAFETY PLAN
While the control of the food safety hazards is a major part of the intention of both FSSC 22000
and the FDA PCHF, there is difference in terminology in the way the 2 approaches are defined.
The PCHF Rule (Subpart C) requires that a facility has a written food safety plan that describes how
hazards are identified, assessed and controlled by the Hazard Analysis and Risk-based Preventive
Controls (HARPC) system.

Version 1 | February 2020 6 of 24

In FSSC 22000, ISO 22000:2018 requires a documented hazard control plan and describes how a
hazard analysis is to be conducted, for hazards to be identified, evaluated and controlled. This is
implemented as part of a Food Safety Management System (FSMS).
FSMA PCHF categorizes the types of controls that should be used to control the hazards as
Preventive Controls. ISO 22000: 2018 describes critical control points (CCP’s), operational
prerequisite programs (OPRP’s) and PRP’s to control the hazards to the acceptable level.
Organizations seeking FSMA compliance should ensure that their hazard control or food safety
plan is properly prepared, their PCQI or equivalent is identified, and that the appropriate
preventive controls employed as specified in §117.126 of the PCHF Rule are recognized.

Table 1 Comparison of Requirements; Hazard Control

PCHF: § 117.126 Food Safety plan FSSC 22000: ISO 22000:2018 - 5.3.2

(a) Requirement for a food safety plan. The food safety team leader shall be
(1) You must prepare, or have prepared, and responsible for:
implement a written food safety plan. a) ensuring the FSMS is established,
(2) The food safety plan must be prepared, or its implemented, maintained and updated;
preparation overseen, by one or more b) managing and organizing the work of the
preventive controls qualified individuals (PCQI). food safety team;
c) ensuring relevant training and
competencies for the food safety team (see
7.2);
d) reporting to top management on the
effectiveness and suitability of the FSMS

b) Contents of a food safety plan. The organization shall establish, implement

The written food safety plan must include: and maintain a hazard control plan.
(1) The written hazard analysis as
required by § 117.130(a)(2); The hazard control plan shall be maintained
(2) The written preventive controls as as documented information and shall
required by § 117.135(b); include the following information for
(3) The written supply-chain program as each control measure at each CCP or OPRP:
required by subpart G of this part; a) Food safety hazard(s) to be controlled at
(4) The written recall plan as required by the CCP or by the OPRP;
§ 117.139(a); and b) Critical limit(s) at CCP or action criteria for
(5) The written procedures for OPRP;
monitoring the implementation of the c) Monitoring procedure(s);
preventive controls as required by § d) Correction(s) to be made if critical limits or
117.145(a)(1); action criteria are not met;
(6) The written corrective action e) Responsibilities and authorities.
procedures as required by §
117.150(a)(1); and
(7) The written verification procedures
as required by § 117.165(b).
(c) Records.
The food safety plan required by this section is a
record that is subject to the requirements of
subpart F of this part.

Version 1 | February 2020 7 of 24

4.2 HAZARD ANALYSIS
Subpart C of the PCHF Rule specifies the scope of the hazard analysis and how it should be
conducted. This is similar to the way a hazard analysis is defined in FSSC 22000.
In FSSC 22000, ISO 22000:2018 defines a food safety hazard as a biological, chemical or physical
agent in food (3.18) with the potential to cause an adverse health effect.
It describes how a hazard analysis should be conducted and based on the preliminary information,
to determine the hazards that need to be controlled. The degree of control shall ensure food
safety and, where appropriate, a combination of control measures shall be used.
The Hazard analysis and control measures are documented as part of the FSMS of FSSC 22000.
Note: FSSC 22000 does not cite special requirements for Ready to Eat (RTE) foods to the same
degree as FSMA, but they would be covered and hazards controlled as part of the FSMS.

4.3 RISK BASED PREVENTIVE CONTROLS

A major difference between FSSC 22000 and the PCHF is in the use of terminology. PCHF calls for
controlling hazard with preventive controls. ISO 22000 calls for the control of hazards using CCP’s
and OPRP’s or a combination of both. The end result is the same.
In PCHF, the preventive controls include: Process controls, Food allergen controls, Sanitation
controls, Supply-chain controls and “any other type of preventive control such as the Recall
Procedure, labelling and the controls within the GMP’s. (See extract from §117.135 below)
In FSSC 22000:
 Process controls are OPRPs or control measures applied at CCPs, whose attributes meet
the requirements of the PCHF Rule;
 Food allergen controls include PRPs and OPRPs intended to reduce the likelihood of, or
control cross-contamination, and include labelling provisions for providing the customer
with relevant information for using the product;
 Sanitation controls are PRPs and OPRPs intended to prevent or reduce the likelihood of
product contamination from the process environment, equipment and personnel;
 Supply Chain controls include documentation of suppliers, raw materials, ingredients and
product-contact materials that shall be used as input for the hazard analysis. This
determines which hazards are to be controlled by the organization itself or by another part
of the supply chain.

Organizations seeking FSMA compliance should ensure that, PRPs, OPRPs, CCPs and labelling
provisions of meeting the requirements of Preventive Controls are identified and implemented
according to §117.135 of the PCHF Rule as described below for reference.

PCHF §117.135 Preventive controls

(a) (1) You must identify and implement preventive controls to provide assurances that any
hazards requiring a preventive control will be significantly minimized or prevented and the food
manufactured, processed, packed, or held by your facility will not be adulterated under section
402 of the Federal Food, Drug, and Cosmetic Act or misbranded under section 403(w) of the
Federal Food, Drug, and Cosmetic Act.
(2) Preventive controls required by paragraph (a)(1) of this section include:
(i) Controls at critical control points (CCPs), if there are any CCPs; and
(ii) Controls, other than those at CCPs, that are also appropriate for food safety.
(b) Preventive controls must be written.

Version 1 | February 2020 8 of 24

(c) Preventive controls include, as appropriate to the facility and the food:

(1) Process controls. Process controls include procedures, practices, and processes to ensure
the control of parameters during operations such as heat processing, acidifying, irradiating,
and refrigerating foods. Process controls must include, as appropriate to the nature of the
applicable control and its role in the facility's food safety system:
(i) Parameters associated with the control of the hazard; and

(ii) The maximum or minimum value, or combination of values, to which any biological,
chemical, or physical parameter must be controlled to significantly minimize or prevent a
hazard requiring a process control.

(2) Food allergen controls. Food allergen controls include procedures, practices, and
processes to control food allergens. Food allergen controls must include those procedures,
practices, and processes employed for:

(i) Ensuring protection of food from allergen cross-contact, including during storage,
handling, and use; and
(ii) Labeling the finished food, including ensuring that the finished food is not
misbranded under section 403(w) of the Federal Food, Drug, and Cosmetic Act.

(3) Sanitation controls. Sanitation controls include procedures, practices, and to ensure that
the facility is maintained in a sanitary condition adequate to significantly minimize or prevent
hazards such as environmental pathogens, biological hazards due to employee handling, and
food allergen hazards. Sanitation controls must include, as appropriate to the facility and the
food, procedures, practices, and processes for the:

(i) Cleanliness of food-contact surfaces, including food-contact surfaces of utensils and

equipment;
(ii) Prevention of allergen cross-contact and cross-contamination from insanitary objects
and from personnel to food, food packaging material, and other food-contact surfaces
and from raw product to processed product.

(4) Supply-chain controls. Supply-chain controls include the supply-chain program as

required by subpart G of this part.

(5) Recall plan. Recall plan as required by the PCHF Rule

(6) Other controls. Preventive controls include any other procedures, practices, and processes
necessary to satisfy the requirements of paragraph (a) of this section. Examples of other
controls include hygiene training and other current good manufacturing practices.

4.4 RECALL PLAN

The PCHF Rule requires that a recall plan is established and implemented for an adulterated,
misbranded or violative product to be removed from the market.
In FSSC 22000, ISO 22000 describes the procedures for “withdrawal/recall” for products that have
been identified as potentially unsafe.

Version 1 | February 2020 9 of 24

After a recall, the PCHF requires a re-analysis of the Food Safety Plan as mandatory. In ISO 22000,
the recall will be input into the regular management review of the FSMS.

4.5 VERIFICATION
The PCHF Rule specifies the verification activities that should be conducted to verify that Process,
Food allergen, Sanitation, Supply-chain and other Preventive Controls are operated as intended.
This compares to the requirements of FSSC 22000 which also calls for all controls (CCP’s and
OPRP’s) to be verified, monitored and documented as part of the FSMS.

The PCHF calls for:

 Monitoring of Preventive Controls (record review within 7 working days or within a
timeframe determined by the PCQI and communicated in advance)
 Corrective actions (record review within 7 working days)
 Environmental monitoring
 Product testing (record review within 7 working days)
 Supplier program records
 Calibration of equipment
 Internal and external audits
 Verification of the Food Safety Plan
 Other verification activities

The PCQI holds responsibility for the verification of the Food Safety Plan and based on the
outcome of verification, the Food Safety Plan needs to be updated at least every 3 years.

Although no timeline is specified in FSSC 22000, the Food Safety Management system is required
to be continually reviewed and updated. The timings specified above should be considered by a
company seeking FSMA compliance.

One area that is more detailed in PCHF than in FSSC 22000 is that covering the requirements for,
and specifications of, Environmental monitoring.
In PCHF this is an important means of verifying sanitation and cleaning programs.
FSSC 22000 V5 requires that an organization has in place a risk-based environmental monitoring
program and that is effective as a verification of sanitation controls, but the test requirements are
not specified in as much detail as they are in the PCHF Rule.
Similarly, when product testing is used as a verification procedure, the testing procedures are
defined in more detail in the PCHF. (See below for the specifications).

Organizations seeking FSMA compliance should ensure that they verify the effectiveness of their
food safety management system, including the hazard control plan, according to §117.155 and
§117.165 of the PCHF Rule.

Version 1 | February 2020 10 of 24

Table 2 Comparison of Requirements- Verification

PCHF: §117.165 Verification of FSSC 22000: Version 5 Requirements for

implementation and effectiveness Organisations to be audited
2.5.7 Environmental Monitoring (Food
Chain Categories C, I & K)

(3) Environmental monitoring, for an The organization shall have in place:

environmental pathogen or for an appropriate a) Risk-based environmental monitoring
indicator organism, if contamination of a program;
ready-to-eat food with an environmental
b) Documented procedure for the evaluation
pathogen is a hazard requiring a preventive
of the effectiveness of all controls on
control, by collecting and testing
environmental samples; and preventing contamination from the
manufacturing environment and this shall
(4) Review of the following records within the
include, at
specified timeframes, by (or under the
oversight of) a preventive controls qualified a minimum, the evaluation of microbiological
individual, to ensure that the records are and allergen controls present;
complete, the activities reflected in the records c) Data of the monitoring activities including
occurred in accordance with the food safety regular trend analysis.
plan, the preventive controls are effective, and
appropriate decisions were made about
corrective actions: (i) Records of monitoring
and corrective action records within 7 working
days after the records are created or within a
reasonable timeframe, provided that the
preventive controls qualified individual
prepares (or oversees the preparation of) a
written justification for a timeframe that
exceeds 7 working days.

In PCHF
(2) Product testing as required by paragraph (a)(2) of this section. Procedures for product testing
must:
(i) Be scientifically valid;
(ii) Identify the test microorganism(s) or other analyte(s);
(iii) Specify the procedures for identifying samples, including their relationship to specific
lots of product;
(iv) Include the procedures for sampling, including the number of samples and the
sampling frequency;
(v) Identify the test(s) conducted, including the analytical method(s) used;
(vi) Identify the laboratory conducting the testing; and
(vii) Include the corrective action procedures required by 117.150(a)(1).
(3) Environmental monitoring as required by paragraph (a)(3) of this section. Procedures for
environmental monitoring must:
(i) Be scientifically valid;
(ii) Identify the test microorganism(s);

Version 1 | February 2020 11 of 24

 (iii) Identify the locations from which samples will be collected and the number of sites to
be tested during routine environmental monitoring. The number and location of sampling
sites must be adequate to determine whether preventive controls are effective;
(iv) Identify the timing and frequency for collecting and testing samples. The timing and
frequency for collecting and testing samples must be adequate to determine whether
preventive controls are effective;
(v) Identify the test(s) conducted, including the analytical method(s) used;
(vi) Identify the laboratory conducting the testing; and(vii) Include the corrective action
procedures required by 117.150(a)(1).

4.6 VALIDATION
The PCHF Rule requires validation of certain preventive controls to provide objective and scientific
evidence that they can control the hazards they are intended to control.

In FSSC 22000, ISO 22000 requires that all control measures be validated to show that the selected
control measures can achieve the intended control of the significant food safety hazard(s). This
validation shall be done prior to implementation of control measure(s) and combinations of
control measures to be included in the hazard control plan and after any change therein.

5 SUBPART F - REQUIREMENTS APPLYING TO RECORDS

Subpart F of the PCHF Rule describes how all records that must be established and maintained.
For the most part, this is covered in FSSC 22000 with some slight differences.
In FSSC 22000, ISO 22000 requires documented information to be “created, updated, retained and
controlled whenever such documented information is required by statutory and regulatory
authorities or determined by the organization as being necessary for the effectiveness of the food
safety management system”. As such, FSSC 22000 requirements are largely comparable with the
PCHF Rule. However, retention time is not specified in FSSC 22000.
The PCHF rule requires documents to be retained for at least 2 years. Organizations seeking FSMA
compliance should ensure that documented information complies with §117.305 and §117.315
 The specific records requirements of the PCHF Rule cover:
o Monitoring records for all preventive controls
o Corrective action records
o Verification records, when required
o Validation
o Verification of monitoring and corrective action
o Calibration of monitoring and verification instruments
o Product testing
o Environmental monitoring
o Records reviews
o Reanalysis of the Food Safety Plan
o Supply-chain program and supporting documentation
o Training records, as appropriate
 Each record of the Food Safety Plan should include the following information:

Version 1 | February 2020 12 of 24

 o Name of record
o Name and location of facility
o Date and, when appropriate, time of activity documented
o Actual measurement or observation taken as applicable
o Product identification, if applicable
o Signature or initials of the person performing the monitoring activities
o Signature or initials of the person reviewing the record and date of the review
 Records required by the PCHF Rule are retained at the plant or facility for at least 2 years
after the date they were prepared

6 SUBPART G - SUPPLY CHAIN PROGRAM

An important subpart of the PCHF is the requirement to control hazards through a Supply Chain
Program which is described in Subpart G.
When a party in the food chain, other than the manufacturer, is responsible for controlling a
hazard, a supply chain preventive control must be implemented to provide evidence of how and
where the hazard is being controlled.

Section § 117.410 describes the general requirements applicable to a supply-chain program.

These include:
Using approved suppliers as required by § 117.420,
Conducting supplier verification activities as required by §§ 117.430 and 117.435
Documenting supplier verification activities as required by § 117.475; and
When applicable, verifying a supply-chain- applied control applied by an entity other than
the receiving facility’s supplier and documenting that verification as required by § 117.475,
or
obtaining documentation of an appropriate verification activity from another entity,
reviewing and assessing that documentation, and documenting the review and
assessment as required by § 117.475.

Many of these elements are met by the requirements of FSSC 22000 through the need for external
communication (ISO 22000:2018 4.2), the Selection and Management of Suppliers (ISO/TS 22002-
1: 9.2) and the Control of externally provided processes, products and services (ISO 22000:2018
7.1.6).

Both the PCHF and FSSC 22000 require that an organization maintains effective communications
with its suppliers and customers to identify who needs to be controlling the identified hazards.
Both require the evaluation and monitoring of providers and suppliers of products or services to
ensure that they do not pose a risk to the supply chain. Both PCHF and FSSC 22000 have the
flexibility to choose appropriate supplier verification procedures and both suggest onsite audits,
sampling and testing, and review of the supplier's safety records; as verification activities.

The PCHF has some additional specifications for the supply chain program.
It requires regular written assurance from stakeholders including customers, of hazard control
within the supply chain. This is not stipulated in FSSC 22000.

It also has specific and detailed requirements for when an onsite audit is used as verification of a
supplier and defines the information that is to be assessed, collected, documented and shared.

Version 1 | February 2020 13 of 24

An example of the information that is required from an onsite when used for supplier information
includes:

 A review of the facility’s Food Safety Plan must be performed and documented. The audit
report must consider whether the facility is in compliance with the applicable FDA food
safety regulations (e.g. PCHF);
 The audit report must document all hazards requiring a preventive Control (HRPCs) that
were determined by the facility’s hazard analysis. If the hazard analysis determined there
were no HRPCs, the audit report should state this;
 The audit report must summarize all preventive controls that correspond to each of the
HRPCs identified by the facility; and
 The auditor’s report must confirm implementation of preventive controls in the manner
specified in the Food Safety Plan. Specifically, the report should focus on the assessment
of critical limits/parameters, monitoring at intervals specified in the FSP, and reviewing
verification and corrective action records.

Confirmation of this information for companies using an FSSC 22000 onsite audit as a means of
supplier verification can be provided using the FSSC 22000 V5 FSMA PCHF Addendum Report in
Annex 1 of this document combined with the FSSC 22000 audit report.

An organization seeking FSMA compliance shall establish and implement a Supply Chain Program
in compliance with § 117.405, §117.410 and §117.430 of the PCHF Rule.

A supply chain program is not required in the following situations:

 The hazard analysis concludes that there are no hazards requiring a supply-chain-applied
control. An example might be that you determine and document that the type of food (e.g.,
raw agricultural commodities such as cocoa beans, coffee beans, and grains) could not be
consumed without application of an appropriate control.
 You control the hazards requiring a preventive control within your facility,
OR
 You rely on your customer to control the hazard, you identify for your customer that the
food has not been processed to control the hazard, and you have annual written assurance
from your customer that they are following procedures to do.

Obtaining written assurance from the customer is not specified in FSSC 22000. However, there is
a requirement to be aware of hazard control of your customer and recognition of the transparency
required by the regulatory requirements.

Version 1 | February 2020 14 of 24

7 REFERENCES
This scope of this comparison relates to FSSC 22000 V5 Certification for the Manufacture of
Human Food and includes the following three components:
1) ISO 22000:2018; (see www.iso.org)
2) ISO/TS 22002-1:2009 (see www.iso.org)
3) FSSC 22000 Version 5 Additional Requirements (www.fssc22000.com).

The text of the FSMA Preventive Controls Rule for Human Food (PCHF) Rule used in this
comparison is as found on https://www.ecfr.gov/cgi-bin/ECFR?page=browse (Title 21 part 117). A
GAP analysis of FSSC 22000 V 5 against the FSMA PCHF Requirements is available as FDA PCHF
Human Food comparison to V5.xls

The GAP analysis was conducted using AUDIT STANDARDS COMPARISON TO THE FDA
PREVENTIVE CONTROLS FOR HUMAN FOOD RULE https://www.fda.gov/media/111837/download

For guidance on the interpretation of ISO 22000: 2018 please refer to the standard at
www.ISO.org and to the Guidance Document: ISO 22000 Interpretation avalable for download at
www.FSSC2200.com

FDA Guidance documents can be found on:

https://www.fda.gov/Food/GuidanceRegulation/FSMA/default.htm
Where specific technical questions arise or specific interpretation of the law is needed, reference
should be made to the FDA Technical Assistance Network at www.fda.gov/fsma.

Version 1 | February 2020 15 of 24

ANNEX 1 - FSSC 22000 V5 FSMA PCHF REPORT ADDENDUM
This document provides a Voluntary Addendum to the FSSC 22000 Audit Report to provide
confirmation that attention was paid to the implementation of the FSMA Preventive Controls Rule
for Human Food (PCHF) requirements and shall be completed by a qualified auditor to document
the information required for supplier verification in the FSMA PCHF regulations. The Addendum
only addresses areas not specifically covered or not covered to the same extent as in FSSC22000
Version 5. The FSSC 22000 V5 FSMA PCHF Report Addendum should always be read in conjunction
with the FSSC 22000 Audit Report.

Organization name:
Address:

FSSC 22000 Certification scope:

Audit date(s):
Auditor name:
FSSC 22000 report reference:

1. Auditor Competency and qualification - (CFR Title 21 part 117)

The auditor is trained to a level that meets FSMA qualified auditor requirements and has
sufficient knowledge to effectively examine the implementation of the FSMA rule
Preventive Controls for Human Food
Yes /No 

Summary:

2. Trained PCQI (or equivalent)

The facility has a trained PCQI (or equivalent) to create and oversee implementation of the Food
Safety Plan(s)
Yes /No 

Summary:

3. PCHF Rule
The facility is accountable for compliance with the FSMA Rule Preventive Controls for Human
Food and the CB auditor has verified that the identified gaps included in this Addendum has
been addressed
Yes /No 

Summary:

Version 1 | February 2020 16 of 24

 4. Food Safety Plan – PCHF: § 117.126

The facility has prepared and implemented a written food safety plan.
Yes /No *

Summary:
List the written Food Safety Plans that have been reviewed to confirm that they meet the FSMA
Preventive Controls for Human Food regulation requirements in 21 CFR Part 117:

Preventative Controls - PCHF: § 117.135

(a)(1) The facility must identify and implement preventive controls to provide assurances that
any hazards requiring a preventive control will be significantly minimized or prevented and the
food manufactured, processed, packed, or held by your facility will not be adulterated under
section 402 of the Federal Food, Drug, and Cosmetic Act or misbranded under section 403(w) of
the Federal Food, Drug, and Cosmetic Act.
(2) Preventive controls required by paragraph (a)(1) of this section include:
(i) Controls at critical control points (CCPs), if there are any CCPs; and
(ii) Controls, other than those at CCPs, that are also appropriate for food safety."

Yes /No *

Summary:
List below all hazards requiring a preventive Control (HRPC) that were determined by the
facility’s hazard analysis – and the preventive controls employed:

Hazards Addressed Preventive Controls Type of Preventative

(HRPC Employed Control (process, allergen,
(Including Micro Species) sanitation or supply chain)

The auditor confirms that the above PCs have appropriate validation, monitoring, verification
(e.g. environmental monitoring) and corrective action procedures.
Yes /No *
If no, please comment: …..

Version 1 | February 2020 17 of 24

 The auditor confirms that the above PCs are being appropriately implemented and
documented. Yes /No  *

If no, please comment: …..

The Auditor has verified that preventive controls are effectively implemented through
following methods: (by records review and/or direct observation and/or employee interview
and/or other (describe)). Yes /No  *

Circumstances in which the owner, operator, or agent in charge of a manufacturing/

processing facility is not required to implement a preventive control: § 117.136

(4) The organization rely on their customer to provide assurance that the food will be processed
to control the identified hazard by an entity in the distribution chain subsequent to the customer
and the organization:
(i) Discloses in documents accompanying the food, in accordance with the practice of the trade,
that the food is ‘‘not processed to control [identified hazard]’’; and:
(5) have established, documented, and implemented a system that ensures control, at a
subsequent distribution step, of the hazards in the food product the organization distribute and
document the implementation of that system.
Yes /No * N/As 

(b) Documented Records of any circumstance, specified in paragraph (a) of this section, that
applies, including:
(1) A determination, in accordance with paragraph (a) of this section, that the type of food could
not be consumed without application of an appropriate control;
Yes /No * N/As 

(5) The system, in accordance with paragraph (a)(5) of this section, that ensures control, at a
subsequent distribution step, of the hazards in the food product distributed.
Yes /No * N/As 

Summary:

* § 117.136: If the hazard analysis determined there were no HRPCs, state that here:

Version 1 | February 2020 18 of 24

 Verification of implementation and effectiveness: § 117.165

(3) Environmental monitoring, for an environmental pathogen or for an appropriate indicator

organism, if contamination of a ready- to-eat food with an environmental pathogen is a hazard
requiring a preventive control, by collecting and testing environmental samples;
and"
(4) Review of the following records within the specified timeframes, by (or under the oversight
of) a preventive controls qualified individual, to ensure that the records are complete, the
activities reflected in the records occurred in accordance with the food safety plan, the
preventive controls are effective, and appropriate decisions were made about corrective
actions:
(i) Records of monitoring and corrective action records within 7 working days after the records
are created or within a reasonable timeframe, provided that the preventive controls qualified
individual prepares (or oversees the preparation of) a written justification for a timeframe that
exceeds 7 working days; and"
Yes /No 

"(2) Product testing as required by paragraph (a)(2) of this section.

Procedures for product testing must:
(i) Be scientifically valid;
(ii) Identify the test microorganism(s) or other analyte(s);
(iii) Specify the procedures for identifying samples, including their relationship to specific lots of
product; (iv) Include the procedures for sampling, including the number of samples and the
sampling frequency;
(v) Identify the test(s) conducted, including the analytical method(s) used;
(vi) Identify the laboratory conducting the testing;
Yes /No 

"(3) Environmental monitoring as required by paragraph (a)(3) of this section. Procedures for
environmental monitoring must:
(i) Be scientifically valid;
(ii) Identify the test microorganism(s);
(iii) Identify the locations from which samples will be collected and the number of sites to be
tested during routine environmental monitoring. The number and location of sampling sites
must be adequate to determine whether preventive controls are effective;
(iv) Identify the timing and frequency for collecting and testing samples. The timing and
frequency for collecting and testing samples must be adequate to determine whether
preventive controls are effective;
(v) Identify the test(s) conducted, including the analytical method(s) used;
(vi) Identify the laboratory conducting the testing;
Yes /No 

Summary:

Version 1 | February 2020 19 of 24

 Requirements applicable to a preventive controls qualified individual and a qualified
auditor: § 117.180

(8) Determination that re-analysis can be completed, and additional preventive controls
validated, as appropriate to the nature of the preventive control and its role in the facility’s food
safety system, in a timeframe that exceeds the first 90 calendar days of production of the
applicable food.
Yes /No 

Summary:

Additional requirements applying to the food safety plan: § 117.310

The owner, operator, or agent in charge of the facility must sign and date the food safety plan:
(a) Upon initial completion; and
(b) Upon any modification.
Yes /No 

Summary:

5. Requirements for record retention: § 117.315

(2) Records that a facility relies on during the 3- year period preceding the applicable calendar
year to support its status as a qualified facility must be retained at the facility as long as
necessary to support the status of a facility as a qualified facility during the applicable calendar
year.
Yes /No 

Summary:

6. General requirements applicable to a Supply-Chain Program: § 117.410

(2) Considering supplier performance can be limited to the supplier’s compliance history as
required by paragraph (d)(1)(iii)(B) of this section, if the supplier is:
(i) A qualified facility as defined by § 117.3;
(ii) A farm that grows produce and is not a covered farm under part 112 of this chapter in
accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5; or
(iii) A shell egg producer that is not subject to the requirements of part 118 of this chapter
because it has less than 3,000 laying hens."

(b) For the purposes of this subpart, a receiving facility may not accept any of the following as a
supplier verification activity:
(1) A determination by its supplier of the appropriate supplier verification activities for that
supplier;
(2) An audit conducted by its supplier;
(3) A review by its supplier of that supplier’s own relevant food safety records; or

Version 1 | February 2020 20 of 24

 (4) The conduct by its supplier of other appropriate supplier verification activities for that
supplier within the meaning of §117.410(b)(4)."

(c) The requirements of this section do not prohibit a receiving facility from relying on an audit
provided by its supplier when the audit of the supplier was conducted by a third-party qualified
auditor in accordance with §§117.430(f) and 117.435.
Yes /No 

Are third party audits used as part of supplier approval? If yes, then provide detail in the
summary section below.

Summary:

Conducting supplier verification activities for raw materials and other ingredients:
§ 117.430

(b)(1) Except as provided by paragraph (b)(2) of this section, when a hazard in a

raw material or other ingredient will be controlled by the supplier and is one for which there is
a reasonable probability that exposure to the hazard will result in serious adverse health
consequences or death to humans:
(i) The appropriate supplier verification activity is an onsite audit of the supplier;

Are any of the hazards controlled by the supplier classified as SAHCOHD hazards? If yes, specify
below:
(c) If a supplier is a qualified facility as defined by § 117.3, the receiving facility does not need to
comply with paragraphs (a) and (b) of this section if the receiving facility:
(1) Obtains written assurance that the supplier is a qualified facility as defined by § 117.3:
(i) Before first approving the supplier for an applicable calendar year; and
(ii) On an annual basis thereafter, by December 31 of each calendar year, for the following
calendar year; and"

(2) Obtains written assurance, at least every 2 years, that the supplier is producing the raw
material or other ingredient in compliance with applicable FDA food safety regulations (or, when
applicable, relevant laws and regulations of a country whose food safety system FDA has
officially recognized as comparable or has determined to be equivalent to that of the
United States).
Yes /No / N/A

(e) If a supplier is a shell egg producer that is not subject to the requirements of part 118 of this
chapter because it has less than 3,000 laying hens, the receiving facility does not need to comply
with paragraphs (a) and (b) of this section if the receiving facility:
(1) Obtains written assurance that the shell eggs produced by the supplier are not subject to
part 118 because the shell egg producer has less than 3,000 laying hens:
(i) Before first approving the supplier for an applicable calendar year; and
(ii) On an annual basis thereafter, by December 31 of each calendar year, for the following
calendar year; and

Version 1 | February 2020 21 of 24

 (2) Obtains written assurance, at least every 2 years, that the shell egg producer acknowledges
that its food is subject to section 402 of the Federal Food, Drug, and Cosmetic Act (or, when
applicable, that its food is subject to relevant laws and regulations of a country whose food
safety system FDA has officially recognized as comparable or has determined to be equivalent
to that of the United States).

(f) There must not be any financial conflicts of interests that influence the results of the
verification activities listed in § 117.410(b) and payment must not be related to the results of the
activity.
Yes / No / N/A

Summary:

Supplier Approval - Onsite audit: § 117.435

(2) For inspections conducted by the food safety authority of a country whose food safety
system FDA has officially recognized as comparable or determined to be equivalent, the food
that is the subject of the onsite audit must be within the scope of the official recognition or
equivalence determination, and the foreign supplier must be in, and under the regulatory
oversight of, such country.
(d) If the onsite audit is solely conducted to meet the requirements of this subpart by an audit
agent of a certification body that is accredited in accordance with regulations in part 1, subpart
M of this chapter, the audit is not subject to the requirements in those regulations.
Yes / No  / N/A 

Summary:

Supplier Approval - Records documenting the Supply- Chain Program: § 117.475

(12) The following documentation of an alternative verification activity for a supplier that is a
qualified facility (e.g. small business / income less than $500,000).
(i) The written assurance that the supplier is a qualified facility as defined by § 117.3, before
approving the supplier and on an annual basis thereafter; and
(ii) The written assurance that the supplier is producing the raw material or other ingredient in
compliance with applicable FDA food safety regulations (or, when applicable, relevant laws and
regulations of a country whose food safety system FDA has officially recognized as comparable
or has determined to be equivalent to that of the United States);
A facility that meets the definition of a “qualified facility” in part 117 or part 507 is subject to modified requirements in
21 CFR 117.201 or in 21 CFR 507.7 respectively. These modified requirements include the requirement that the facility
submit a form to FDA, attesting to its status as a qualified facility.

(13) The following documentation of an alternative verification activity for a supplier that is a
farm that supplies a raw material or other ingredient and is not a covered farm under part 112
of this chapter:
(i) The written assurance that supplier is not a covered farm under part 112 of this chapter in
accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5, before approving the
supplier and on an annual basis thereafter; and
(ii) The written assurance that the farm acknowledges that its food is subject to section 402 of
the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant

Version 1 | February 2020 22 of 24

 laws and regulations of a country whose food safety system FDA has officially recognized as
comparable or has determined to be equivalent to that of the United States);"
Yes /No  / N/A 

(14) The following documentation of an alternative verification activity for a supplier that is a
shell egg producer that is not subject to the requirements established in part 118 of this chapter
because it has less than 3,000 laying hens:
(i) The written assurance that the shell eggs provided by the supplier are not subject to part 118
of this chapter because the supplier has less than 3,000 laying hens, before approving the
supplier and on an annual basis thereafter; and
(ii) The written assurance that the shell egg producer acknowledges that its food is subject to
section 402 of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is
subject to relevant laws and regulations of a country whose safety system FDA has officially
recognized as comparable or has determined to be equivalent to that of the United States);
Yes /No  / N/A 

(15) The written results of an appropriate inspection of the supplier for compliance with
applicable FDA food safety regulations by FDA, by representatives of other Federal Agencies
(such as the United States Department of Agriculture), or by representatives from State, local,
tribal, or territorial agencies, or the food safety authority of another country when the results
of such an inspection is substituted for an onsite audit;
Yes /No  / N/A 

(18) When applicable, documentation of the receiving facility’s review and assessment of:
(i) Applicable documentation from an entity other than the receiving facility that written
procedures for receiving raw materials and other ingredients are being followed;
(ii) Applicable documentation, from an entity other than the receiving facility, of the
determination of the appropriate supplier verification activities for raw materials and other
ingredients;
(iii) Applicable documentation, from an entity other than the receiving facility, of conducting the
appropriate supplier verification activities for raw materials and other ingredients;
"(iv) Applicable documentation, from its supplier, of:
(A) The results of sampling and testing conducted by the supplier; or
(B) The results of an audit conducted by a third- party qualified auditor in accordance with §§
117.430(f) and 117.435; and
(v) Applicable documentation, from an entity other than the receiving facility, of verification
activities when a supply-chain-applied control is applied by an entity other than the receiving
facility’s supplier."
Yes /No  / N/A 

Summary:

Version 1 | February 2020 23 of 24

Conclusion:
The requirements of the FSSC 22000 V5 FSMA PCHF Addendum have been considered and met.

Yes  Yes, subject to closure of the significant deficiencies  No 

If no, please provide detail: …..

Significant deficiencies identified during the audit

Clause Detail of the deficiency Timeline Objective evidence Verified

for supplied and closed
corrective by auditor
action

Disclaimer
The information provided in this document is strictly for information only. It does not constitute legal or regulatory
compliance/advice. FSSC 22000 makes no warranties as to the accuracy or completeness of the information and this
addendum report should always be read in conjunction with the FSSC 22000 Audit Report.

Version 1 | February 2020 24 of 24