FSSC 22000

Certification scheme for food safety systems of

Food manufacturing
based on
ISO 22000: 2005 and BSI-PAS 220: 2008

PART II

REQUIREMENTS AND REGULATIONS

FOR PROVIDING CERTIFICATION
CERTIFICATION

Foundation for Food Safety Certification

Gorinchem, the Netherlands: January 2009

© Foundation for Food Safety Certification 15 May 2009 Page 1 of 20

 Part II Requirements and regulations for providing certification

CONTENT

1. INTRODUCTION ....................................................................................... 3

2. REQUIREMENTS FOR CERTIFICATION......................................................... 5

2.1 Requirements ..................................................................................... 5

2.2 Additional requirements ..................................................................... 5
2.3 Accreditation ...................................................................................... 5
2.4 Guidance ............................................................................................ 5

3. REGULATIONS FOR CERTIFICATION BODIES............................................... 5

Appendix II A: Additional requirements ...................................................... 10

Appendix II B: Format of the audit report of PRP’s ...................................... 15

© Foundation for Food Safety Certification 15 May 2009 Page 2 of 20

 Part II Requirements and regulations for providing certification

1. INTRODUCTION

Purpose

This part of the scheme stipulates the requirements for certification bodies (CB’s)
and their personnel and the way they shall perform assessments and certification. It
shall be used by the CB that wishes to grant certificates in conformance with this
scheme. It consists of:
• the requirements for the CB and the certification process and
• the regulations and rules for the assignment and authorization of the CB to
offer certification against the criteria of this scheme.

Standards and technical specifications

The requirements for certification to this scheme are for the most part based on existing
standards and specifications for providing certification. The normative requirements for
the food manufacturing organisation to gain certification are the food safety
management system requirements of ISO 22000, the detailed requirements for the
prerequisite programmes (PRP’s) for food manufacturing of BSI-PAS220 and a number of
additional requirements as specified in section 3 of Part I.
Food safety management systems should, like other quality management systems be
certified according to the requirements of the ISO standard for the certification of
management systems, ISO/IEC 17021. To promote the harmonized certification of food
safety management systems, ISO developed the Technical Specification ISO/TS 22003.
This TS elaborates on ISO/IEC 17021 and contains detailed rules for the assessment of
food safety management systems. Therefore, ISO/TS 22003 (and ISO/IEC 17021 when
22003 refers to this) is considered to be the appropriate standard to assess and certify
ISO 22000 food safety management systems.
The requirements for assessment and certification in ISO/TS 22003 also includes
the assessment of (PRP’s). However, the requirements for the PRP’s are not
specified in ISO 22000 and in ISO 22003 there are no specific conditions for the
evaluation and reporting of these process conditions. For the assessment and
certification of product and process conditions like PRP’s, ISO developed the
standard ISO Guide 65. It is therefore appropriate that the CB’s also use ISO Guide
65 for the development and implementation of their certification system and the
assessment of the detailed normative requirements of BSI-PAS 220.

© Foundation for Food Safety Certification 15 May 2009 Page 3 of 20

 Part II Requirements and regulations for providing certification

Additional requirements

To meet the needs of the key stakeholders and/or to ensure an adequate and
uniformed assessment and certification of the food safety systems, specific
requirements for certification are included in this scheme. They may be an
elaboration of the clauses in ISO/TS 22003 and ISO Guide 65 or additional
requirements and are included in the section “Additional requirements”. When it
appears from the review of the scheme by the Board or when the Board decides in
one of its three yearly meetings that the requirements given in the standards need
to be amended or appended, these changes are also included in this section.

© Foundation for Food Safety Certification 15 May 2009 Page 4 of 20

 Part II Requirements and regulations for providing certification

2. REQUIREMENTS FOR CERTIFICATION

2.1 Requirements

Certification system
The requirements for the development and implementation of the certification
system are laid down in:
• ISO Guide 65 along with the IAF Guidance on ISO Guide 65 and
• the additional requirements of ISO/TS 22003 and ISO/IEC17021 including the
sections of ISO 9011 to which is referred in ISO/TS 22003 and
ISO/IEC17021along with the IAF Guidance on ISO Guide 62.

Criteria for providing certification

The normative requirements for providing certification of the organisation are
specified in Part I, section 3.

2.2 Additional requirements

Additional requirements for the development and implementation of the
certification system are specified in Appendix II, A.

2.3 Accreditation
The CB shall have an accreditation for the standard ISO/IEC Guide 65 and the additional
requirements as specified in the sections 2.1 and 2.2.
The requirements for providing accreditation to the CB’s and for the accreditation
body are dealt with in Part III.

2.4 Guidance

1. ISO 19011
Extensive guidance on the basic requirements for auditing, the managing of the
audit programme, the planning and conducting of the audits and the competences
of the auditors is given in ISO 19011.

2. Audit report of PRP’s

In clause 7 of Section 2.2 (Appendix II A) requirements are specified for the report of
the audit of the food safety system. For the report of the audit of the PRP’s, specific
requirements are stipulated in this clause. The audit report of the PRP’s shall be
included as an appendix to the main audit report. A format of the audit report of the
PRP’s is given in the Appendix II B.
Note: this guidance is given as a means of meeting requirements in Sections 2.1 and
2.2; the relevant guidelines shall be observed or shall be met in an equivalent way.

© Foundation for Food Safety Certification 15 May 2009 Page 5 of 20

 Part II Requirements and regulations for providing certification

3. REGULATIONS FOR CERTIFICATION BODIES

Application

When applying for association with the Foundation, the certification body (CB) must
specify the required category or categories and sector(s), related to its competence
and experience. The applicant CB will agree to meet all applicable requirements of
this scheme. The CB will be given written authorization enabling it to use the
scheme for certification.

Accreditation

A contract with the CB will only be signed up after it has been accredited. The CB
shall be accredited in accordance with the requirements of the scheme FSSC 22000.
CB’s which have applied for accreditation or for extension of their scope of
accreditation to this scheme may certify within the applied scope for a maximum of
one year without being accredited, subject to a provisional contract with the
Foundation. The application for accreditation or for extension of their scope of
accreditation shall be demonstrated with a written confirmation of the accreditation
body (AB).

Application fee

An application fee has to be paid to the Foundation before this authorization will be
given.

Design of the certificate

The design of the certificate will be similar to the certificates that are issued by the
awarding CB. Notwithstanding this, the certificates shall include the following
information:
• name and address of the organisation (site) which food safety system is
certified;
• period of validity;
• relevant signatures and positions of signatories;
• scope, expressed in terms of categories, sectors, products and sites;
• logo of the accreditation body;
• date of the certificate
• date of the audit
• date of the certification decision

© Foundation for Food Safety Certification 15 May 2009 Page 6 of 20

 Part II Requirements and regulations for providing certification

Furthermore, the certificate shall contain the following standard text:

Certificate given to [name organisation on audited location]. The [name of the CB]
has determined that the [scope] comply with the requirements for a food safety
system certification as specified in the scheme FSSC 22000 of [date of most recent
version].

Certification logo

Organisations may not display the FSSC 22000 certification logo or mention
possession of a FSSC 22000 certificate on their products. The logo (copyright) is
allowed to be used on the issued certificates if the certification is conducted
according all requirements in this scheme.

Implementation new requirements

In the event of the relevant documents in the FSSC 22000 scheme being changed,
organisations will be given 6 months’ time of grace to adapt to the implementation
of the new requirements, unless the legal regulations stipulate a different transition
period.

Changes in the certification scheme

New information or changes with regards to the requirements in the FSSC 22000
scheme shall be communicated by the CB’s to those parties involved, such as
certificate holders and auditors (auditors and experts), within a period of 2 months.

Interpretation of the
the FSSC 22000 scheme

If required by CB’s or by organisations, the Board can be called to intervene in the

event of different opinions in the interpretation of the certification scheme. The
Board shall have authority to intervene with individual disputes or appeals. The
appeal regulations of the CB are applicable to these disputes or appeals.

Full application of the FSCC 22000 certification scheme

The certification bodies are responsible for the full application of the certification
scheme and have to observe the regulations and directives issued by the Board.

© Foundation for Food Safety Certification 15 May 2009 Page 7 of 20

 Part II Requirements and regulations for providing certification

Harmonization
Harmonization process

The CB is obliged to participate in consultations on the interpretation of the scheme.

Once every year there will be a harmonization meeting. In principle a coordinating
officer represents the CB during this meeting. Cases will be brought in for
discussion. Each CB shall discuss the cases and the results in their own CB with their
auditors. A regulation can be set up for the harmonization process.

Annual fee for certified organisations

Organisations certified against this scheme will be charged by the CB for an annual
fee to the Foundation. The CB will address this obligation in the certification
agreement with the organisation. The Foundation will decide annually on the
amount of this fee. The CB’s will be charged annually (in the Month January) by the
Foundation for the total amount of fees of all certificates they have under contract
per 31 December of each year.

Certification agreement

The period of the certification agreement between the CB and the organisation shall
last for 3 years. Reassessment which takes place on expiration of these three years
is conducted in accordance with the requirements in the scheme FSSC 22000.

Register of certified organisations

The Foundation will keep a register with the names and certification information of
the certified organisations. This register will be made publicly available on the
website of the Foundation. The CB’s will submit the following information to the
Foundation in a format as agreed in the contract between the Foundation and the
CB:
• name and location of the certified organisation
• scope of the certification
• name of the certificate
• date of the initial certification
• expiry date of the certificate
• in case of suspension or withdrawal; the date of suspension or withdrawal
This information shall be submitted by the CB to the Foundation within 2 weeks
after the delivery of the audit. The CB shall agree in the certification agreement with
the organisation that this information will be submitted by the CB to the Foundation
and this information will be made public.

© Foundation for Food Safety Certification 15 May 2009 Page 8 of 20

 Part II Requirements and regulations for providing certification

Exchange of
of information

At least once per year, the CB’s are obliged to provide the Board with all relevant
information relating to the application and the functioning of the FSSC 22000
scheme. This information shall be made anonymous so that confidentiality with
respect to organisations is assured. The information of the preceding year is
provided to the Board in written format no later than March 1st.

Implementation of regulations

The CB’s are required to ensure that the regulations which are decided by the Board are
included in their existing system documentation within a period of two months.
Certification bodies are required to control these documents according to their own
document control procedures.

The Board of Stakeholders approved these regulations on [ ………….]

© Foundation for Food Safety Certification 15 May 2009 Page 9 of 20

 Part II Requirements and regulations for providing certification

Appendix II A

Additional requirements

Note: if an additional requirement refers to a subject that is also addressed in one

or more of the standards mentioned in section 2.1 of Part II, the applicable clause(s)
of these standard(s) is/are indicated in the reference at the end of the section with
the additional requirement.

1. Work experience of auditors

Concerning the requirements on work experience of the auditors in ISO 22003, clause
7.2.2.4, the following is added:
• The five years full time work experience in a food chain related industry, shall be
in the food manufacturing industry in the areas of processing, technology, raw
materials and /or products;
• The two years of full time work in quality assurance or food safety functions shall
be in the food manufacturing industry;
• The allowance to reduce the required five years of total work experience with one
year if the auditor has completed appropriate post secondary education, is not
applicable.
Reference: ISO Guide 65, clause 5.1.1, ISO 22003 clause 7.2.4.4 and ISO 19011
clause 7.3.2

2. Auditor training

Training programme
A training programme for each auditor will incorporate:
• an assessment of knowledge and skills for each field and sub field and
assignment of fields of evaluation,
• an assessment of knowledge of food safety, HACCP, PRP’s and to have
access to, and be able to apply relevant laws, regulations and codes,
• a period of supervised training to cover the assessment of food safety
management systems, PRP’s and HACCP, specific audit techniques and
specific category knowledge,
• a documented sign off of the satisfactory completion of the training
programme by the appointed supervisor,
• a plan for continued training to keep the auditors up to date with the best
practices and relevant regulatory and statutory developments in the sector(s)
where they perform audits,

© Foundation for Food Safety Certification 15 May 2009 Page 10 of 20

 Part II Requirements and regulations for providing certification

• instructions for the auditor to maintain written records of all relevant training
undertaken.
Reference: ISO 22003, clause 7.2.4 and ISO/IEC 17021, clause 7.2.8

Food safety training

The training in HACCP principles, hazard assessment and hazard analysis shall have a
duration of at least 2 days/16 h. The food safety management training shall also include
specific elements of the sector(s) in which the auditor conduct audits like raw materials,
processes, products, risks and legislation and prevailing code(s) of hygiene.
Reference: ISO 22003, clause 7.2.4.2

Audit training
The training prescribed in section 7.2.4.3 of ISO 22003 shall also cover:
• audit techniques based on food safety systems as described in Part I of this
scheme,
• this scheme including the standards and technical specification to which is
referred.
The training in audit techniques shall have a duration of at least 1 week/40h.
Reference: ISO 22003, clauses 7.2.6. and 7.2.4.3

3. Audit experience

For a first or initial qualification the number of audit days stipulated in ISO 22003,
clause 7.2.4.5, shall be increased with three supervised audit days against this scheme.
For extension to a new category, the auditor shall in any case conduct a minimum of
four supervised on site external audits against this scheme in the new category. For
maintaining the qualification of auditor, the auditor shall perform in any case five on site
external audits or ten external audit days against this scheme per year in a number of
different organisations.
Reference: ISO 22003, clause 7.2.4.5

4. Defining the scope of the certification

See also “Scope” in “Features of the scheme”

When defining the scope, the CB shall for each location indicate the name of the food
sector(s) of the categories C,D, E or L and assign the following sectors:
• Egg products
• Produce (fresh fruits and vegetables)
• Dairy
• Meat products and preparations

© Foundation for Food Safety Certification 15 May 2009 Page 11 of 20

 Part II Requirements and regulations for providing certification

• Fish products and preparations

• Ambient stable hermetically sealed packs
• Ready to eat or heat foods
• Beverages
• Bakery and baked products
• Dried products
• Confectionery
• Snacks and Breakfast cereals
• Oils and fats
• Food ingredients
If a food product does not fit easily with these food sectors, the food sector shall be
clearly defined. Additional to the indication of the food sector, the specific product(s)
shall be indicated.
Reference: ISO Guide 65, clauses 4.3, 8.1.3. and 8.2.1. and ISO/TS 22003, clause 9.1.1

5. Determining audit time and audit reporting time

In determining the on site audit time as stipulated in ISO 22003, clause 9.1.4. and
Annex B, the CB shall add at least half to one audit day, depending of the size of
organization, for the audit of the establishment and implementation of the PRP’s as
stipulated in section 6 of this appendix.
For the completion of the audit report of the PRP as stipulated in section 7, half to
one additional day is typically required depending on size and complexity of the
organisation.
Reference: ISO/TS 22003, clauses 9.1.2 and 9.1.4 and Annex B

6. Requirements of the to audit of PRP’s

The CB shall assess whether the organisation has established and implemented and
maintains the necessary PRP’s according to the requirements of section 3.2 of Part I.
Of all requirements it shall be assessed to what extent the requirements are
fulfilled. The specific requirements for which the necessary PRP is not established or
is not effective in controlling the introduction of food safety hazards (as specified in
clause 7.2.1. of ISO22000) shall be identified.
Reference: ISO Guide 65, clause 4.3, ISO/TS 22003 clauses 9.2.3.1.1. and 9.2.3.1.2.,
9.2.3.1.4, 9.2.3.1.5 and 9.2.3.2

7. Requirements for the audit reports

General
Additional to the items for the audit and certification reports as stipulated in ISO/TS

© Foundation for Food Safety Certification 15 May 2009 Page 12 of 20

 Part II Requirements and regulations for providing certification

22003, clauses 9.1.7 and ISO/IEC1702, clauses 8.2.3, 9.2.3.1.2, the audit and
certification report shall identify the following:
• Name and description of the company to which the organisation belongs to
(name, legal entity and address of headquarters).
• Date of previous audit and name of CB conducting the previous audit
• Details of existing certificates.
• Overview of relevant changes to documentation, requirements, processes and
products since the last audit.
• Registered complaints on Food Safety and reports to concerning government.
• List of key personnel present at the audit.
• Names and signatures of the audit team members.
• Names, function and signatures of the representatives of the auditee.
• Description of the assessment of the identification by the organisation of the
food safety hazards to be controlled and the selection of the appropriate
(combinations of) control measures for relevant hazards in the operational
PRP’s or in the HACCP plan.
• The audit of the PRP requirements (specified in Part I, section 3.2) shall be
reported separately according to the requirements in section 8 “Audit report
of PRP’s” in this Annex and attached to the audit report.
• Results and the conclusions of the audit per clause of the normative standard
or technical specification (specified in Part I, section 3.1) and per additional
requirement (specified in Part I, section 3.3).
• Overview of nonconformities and minor nonconformities together with the
corresponding clause number of the normative standard or technical
specification (specified in Part I, section 3.1 and 3.2) or the number of the
additional requirement (specified in Part I, section 3.3).
• Expiry date of the certificate.
Reference: ISO Guide 65, clause 11.b, ISO/TS 22003, clauses 8, 9.1.7 and 9.2.3.1.4
and ISO/IEC 17021, clauses 8.2.3, 9.2.3.1.2 and 9.2.5.1

Audit report of PRP’s

The report of the audit of the establishment and implementation of the PRP’s in
accordance with clause 6 of this Section, shall be separate and included as an
appendix to the main report. It must show that all requirements specified in Part I,
section 3.2 are assessed. The requirements for which the necessary PRP is not
established or is not effective in controlling the introduction of food safety hazards
(as specified in clause 7.2.1. of ISO22000) shall be indicated. In section 2.3 if this
Part II a format of the separate audit report of the PRP’s is given.
Reference:
Reference ISO Guide 65, clause 11.b and ISO/TS 22003, clauses 8, 9.1.7 and
9.2.3.1.4 and ISO/IEC1702, clause 8.2.3, 9.2.3.1.2 and 9.2.5.1.

© Foundation for Food Safety Certification 15 May 2009 Page 13 of 20

 Part II Requirements and regulations for providing certification

8. Criteria for nonconformities and certification decision

The CB is required to establish and maintain criteria as a reference against which a

nonconformity and minor nonconformity is determined, in accordance with the
definitions in this scheme.
Food manufacturing organisations can only qualify for granting certification on the
basis of this scheme if:
- the CB has not revealed any outstanding nonconformities and
- the CB has reviewed and accepted the planned corrections and corrective actions
for minor nonconformities.
Reference: ISO/IEC17021, clause 9.1.9, 9.1.15 and 9.2.5.2 and ISO 19011, clause
6.2.2.

9. Requirements of the surveillance audits

During the surveillance activities and surveillance audit the effectiveness of the food
safety management system and the compliance with the requirements of ISO 22000,
PAS 220 and the additional requirements of this scheme (section 3.3 of Part 1) will
be reviewed. This shall include an examination of the food safety management
system documentation on the registration of changes and of the internal
communication of changes in the production process, the (origin of) raw materials,
the products and product characteristics or in the context in which the food safety
system is operating (e.g. changes in legislation, codes of practices, customer
requirements) in the period after the previous audit. If any changes are identified by
this examination or otherwise, the surveillance audit shall include a full assessment
and reporting of the assessment of:
• the documentation requirements, specifically clauses 4.2.1. and 7.3.1 of ISO
22000 and clause 1 of Section 3.3 (Appendix I A) of Part I of this scheme,
• the establishment and implementation of the PRP’s,
• the hazard analyses and the operational PRP’s and CCP’s.
For the audit of the establishment and implementation of the PRP’s and the audit
report, the “Requirements of the audit of PRP’s” in section 6 of this appendix and
the clauses in the “Requirements for the audit reports” in section 7 of this appendix,
are also applicable.
Reference: ISO/IEC 17021, clauses 9.3.1and 9.3.2.1.g.

© Foundation for Food Safety Certification 15 May 2009 Page 14 of 20

 Part II Requirements and regulations for providing certification

Appendix II B

Format of the audit report of PRP’s

Reference: ISO Guide 65, clause 11.b and ISO/TS 22003, clauses 8, 9.1.7 and
9.2.3.1.4 and ISO/IEC1702, clauses 8.2.3, 9.2.3.1.2 and 9.2.5.1.

General information
For the requirements for general information in the audit report see ISO/IEC 1702,
clause 8.2.3 and relevant items Appendix II, A, section 7 “Requirements for the audit
reports” In the audit report of PRP’s reference can be made to corresponding
information in the main audit report.

Results and conclusion of the audit of PRP’s

Information on assessment per item.
The number of the items refer to the sections of BSI-PAS220. For each item shall be
referred to the requirements of BSI-PAS 220 and to the requirements of applicable
legislation, recognized sector codes and customer requirements.

+ = assessed; OK Result Identification of specific Details of NC

- = assessed; nonconformity requirement which is not or MNC
or minor nonconformity. fulfilled
Indicate:
NC = nonconformity
MNC = minor nonconformity
NA = not applicable

4. Construction and layout of buildings

4.1 General requirements
4.2 Environment
4.3 Locations of
establishments
Summary Construction and layout of buildings:

© Foundation for Food Safety Certification 15 May 2009 Page 15 of 20

 Part II Requirements and regulations for providing certification

5. Layout of premises workspace

5.1General requirements
5.2 Internal design, layout and
traffic patterns
5.3 Internal structures
5.4 Location of equipment
5.5 Laboratory facilities
5.6 Temporary/mobile
premises and vending
machines
5.7 Storage of food, packaging
materials, ingredients and non
food chemicals
Summary Layout of premises workspace:

6. Utilities – air, water, energy

6.1 General requirements
6.2 Water supply
6.3 Boiler chemicals
6.4 Air quality ventilation
6.5 Compressed air and other
gases
6.6 Lighting
Summary Utilities – air, water, energy:

7. Waste disposal
7.1 General requirements
7.2 Containers for waste and
inedible or hazardous
substances
7.3 Waste management and
removal

© Foundation for Food Safety Certification 15 May 2009 Page 16 of 20

 Part II Requirements and regulations for providing certification

7.4 Drains and drainage

Summary Waste disposal:

8. Equipment suitability, cleaning and maintenance

8.1 General requirements
8.2 Hygienic design
8.3 Product contact surfaces
8.4 Temperature control and
monitoring equipment
8.5 Cleaning plant, utensils
and equipment
8.6 Preventive and corrective
maintenance
Summary Equipment suitability, cleaning and maintenance:

9. Management of purchased materials

9.1 General requirements
9.2 Selection and management
of suppliers
9.3 Incoming material
requirements
(raw/ingredients/packaging)
Summary Management of purchased materials:

10.
10. Measures for prevention
prevention of cross contamination
10.1 General requirements
10.2 Microbiological cross
contamination
10.3 Allergen management
10.4 Physical contamination

© Foundation for Food Safety Certification 15 May 2009 Page 17 of 20

 Part II Requirements and regulations for providing certification

Summary Measures for prevention of cross contamination:

11.
11. Cleaning and sanitizing
11.1 General requirements
11.2 Cleaning and sanitizing
agents and tools
11.3 cleaning and sanitizing
programmes
11.4 Cleaning in place (CIP)
systems
11.5 Monitoring sanitation
effectiveness
Summary Cleaning and sanitizing:

12.
12. Pest control
12.1 General requirements
12.2 Pest control programmes
12.3 Preventing access
12.4 Harbourage and
infestations
12.5 Monitoring and detection
12.6 Eradication
Summary Peast control:

© Foundation for Food Safety Certification 15 May 2009 Page 18 of 20

 Part II Requirements and regulations for providing certification

13.
13. Personnel hygiene and employee facilities
13.1 General requirements
13.2 Personnel hygiene
facilities and toilets
13.3 Staff canteens and
designated eating areas
13.4 Work wear and protective
clothing
13.5 Health status
13.6 Illness and injuries
13.7 Personal cleanliness
13.8 Personal behaviour
13.9 Visitors
Summary Personnel hygiene and employee facilities:

14.
14. Rework
14.1 General requirements
14.2 Storage. identification
and traceability
14.3 Rework usage
Summary Rework:

15.
15. Product recall procedures
15.1 General requirements
15.2 Product recall
requirements
Summary Product recall procedures:

© Foundation for Food Safety Certification 15 May 2009 Page 19 of 20

 Part II Requirements and regulations for providing certification

16.
16. Warehousing
16.1 General requirements
16.2 Warehousing
requirements
16.3 Vehicles, conveyances
and containers
Summary Warehousing:

17.
17. Product information/consumer awareness
17.1 Product information
17.2 Labelling of pre-
packaged foods
Summary Product information/consumer awareness:

18.
18. Food defence,
defence, biovigilance and bioterrorism
18.1 General requirements
Access controls
Summary Food defence, biovigilance and bioterrorism:

Other items required by

applicable legislation,
legislation,
recognized sector codes and
customer requirements.
requirements.

© Foundation for Food Safety Certification 15 May 2009 Page 20 of 20