RISK ASSESSMENT · LAYOUT AND ZONING

Factory Layout and Hygienic Zoning Risk Assessment: How to Defend Your Zones to an Auditor

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 15 min read

Layout, product flow and segregation is clause 4.3 of BRCGS Global Standard Food Safety Issue 9, published on 1 August 2022, and one of the twelve fundamental requirements, so a major against its statement of intent costs certification and forces a further full audit. Zoning is an argument, and the Layout and Hygienic Zoning Risk Assessment Template (RA08) at R690 is where you write it down.

What do BRCGS and FSSC 22000 actually require on layout and zoning?

BRCGS Global Standard Food Safety Issue 9 places layout, product flow and segregation at clause 4.3, and clause 4.3 is one of the twelve fundamental requirements, so a major non-conformity against its statement of intent is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified. FSSC 22000 Version 7 takes a different route: the layout requirement arrives through the sector prerequisite standard, ISO 22002-1:2025 for food manufacturing, rather than through ISO 22000:2018 itself.

That difference matters when you write the assessment. Paraphrasing clause 4.3 rather than quoting it, BRCGS asks the site to define its production risk zones on a plan, to control the movement of personnel, raw materials, packaging, rework, product and waste so that the risk of contamination is prevented, and to provide enough space and separation for the operation to run hygienically. The subclause numbering is in your own copy of the Standard. What an auditor tests is whether the plan and the factory agree.

ISO 22002-1:2025, published in July 2025 as part of the restructuring that also produced the new common baseline ISO 22002-100:2025, places the layout of premises and workspace, including hygienic zoning and personnel flow, inside the prerequisite programmes. Under FSSC 22000 Version 7 that standard is the source of the requirement rather than optional reading, and our FSSC 22000 Version 7 guide for South Africa sets out how the three parts of the scheme fit together.

South African law adds a floor rather than a zoning scheme. R638 of 2018, Government Notice R.638 in Government Gazette 41730 of 22 June 2018, under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, never uses the phrase high care. Its regulation 5, paraphrased, requires smooth, cleanable, non absorbent wall, floor and ceiling surfaces, effective ventilation, artificial illumination of at least 200 lux, approved waste water disposal, and food handling areas with no direct connection to spaces where fumes, dust or other impurities could reach food. That last point is a zoning requirement in everything but name.

What is the difference between low risk, high care and high risk zones?

The zones describe how badly it ends if contamination reaches product. BRCGS Issue 9 names high risk, high care and ambient high care as its production risk zones, above low risk and enclosed product areas. High risk is for chilled ready to eat product that supports pathogen growth, gets no further treatment, and has had a full pathogen reduction step applied to every component. High care sits below it, and ambient high care covers shelf stable ready to eat product.

The three variables that drive the classification are always the same: whether the product is ready to eat, whether it is open to the room after the last step that kills pathogens, and whether the product supports the growth of those pathogens across its shelf life. A chilled cooked meat sliced and packed in the open supports growth and gets no further treatment, so it sits at the top. A biscuit baked, cooled and wrapped in an enclosed line does not, so it does not.

Two cautions on that table. It is a starting point for your own assessment, not a specification, and the boundary between high care and high risk is the single decision auditors most often push back on. Get it wrong in the generous direction and you carry cost you do not need. Get it wrong in the other direction and you have a fundamental non conformance and a product argument at the same time.

How do you decide which zone a production area belongs to?

BRCGS Issue 9 names the zones but leaves the assignment to you, so work forward through the process, not backward from the building. Find the last lethality step, then ask of every area downstream: is the product ready to eat, is it open to the room, does it support pathogen growth? Three yes answers mean high care or high risk, and the split turns on whether every component has had a full pathogen reduction step.

1. Fix the last kill step for every product familyCooking, retorting, pasteurisation, frying, baking, acidification or a validated antimicrobial treatment. If a product family has none, everything after intake is exposure.
2. Mark every point of exposure after itCooling, slicing, dicing, weighing, hand packing, rework addition, filling, sealing, sampling and any quality check that opens the pack.
3. Test growth support against the declared shelf lifeWater activity, pH, preservatives, packaging atmosphere and chill temperature together, not one at a time. This is where the Microbiological Contamination Risk Assessment (RA14), R690, feeds directly into the zoning decision.
4. Assign the zone to the area, not to the machineA zone is a defined piece of floor with a boundary you can point at. If you cannot draw a line around it, you have not assigned a zone.
5. Write the reason next to the assignmentOne or two sentences per area, naming the product, the exposure and the growth conclusion. This is the paragraph the auditor reads first.
6. Record the constraints you could not removeShared corridors, a single goods door, a drain that runs the wrong way. Naming a constraint and controlling it is a defence. Hiding it is a finding.

How do you draw and colour code a process flow and zoning plan?

Clause 4.3 of BRCGS Issue 9 needs two drawings that agree: a process flow diagram from intake to despatch, and a scaled site plan with the zone boundaries and the flows drawn on it. No standard mandates colour, but it is the fastest way to make the plan readable in the ninety seconds an auditor will give it. Use one colour per zone and one line style per flow.

The process flow diagram is a food safety document, so it must be verified on site and signed. Walk it during production with the drawing in your hand and correct it against what is actually happening, including the steps nobody wrote down: the rework loop, the sampling point, the hold area, the place where a pallet waits because the lift is busy. Our guide to what a HACCP plan is and what it must contain covers the study these diagrams sit inside.

• One colour per zone, applied consistently, with a legend printed on the plan itself
• Product flow, personnel flow, packaging flow, waste flow and rework flow each on their own line style, with arrows showing direction
• Every door, hatch, opening and roller shutter on the boundary shown and numbered
• Hand wash stations, boot washes, changing rooms and barrier positions plotted, not described in text
• Drains plotted with the direction of fall marked, and interceptors and traps shown
• Air handling units, supply and extract points, and the direction of pressure differential shown
• Every environmental monitoring site numbered on the same drawing, using the same numbers as the sampling plan
• A revision number, a date, an author and an approval on the drawing, because an undated plan is an uncontrolled document

If your site plan, your process flow diagram and your environmental monitoring map disagree with one another, at least two of them are wrong and the auditor will find out which.

Physical or procedural segregation: which one will an auditor accept?

ISO 22002-1:2025 does not choose for you: both are legitimate, and the higher the risk the harder a procedural argument becomes. Physical segregation separates in space: a wall, a door, a barrier, a separate room or a separate building. Procedural segregation separates in time or by dedication: sequencing raw before ready to eat, dedicated equipment, dedicated staff, cleaning between changeovers. For chilled ready to eat product, expect to defend a procedural case hard.

The honest comparison is that procedural segregation is cheaper to install and far more expensive to sustain, because it has to work on the worst Friday of the year and not only on audit day. When a site tells me it separates raw and ready to eat by time, my first question is what happened on the last day production overran, and my second is whether the changeover clean was verified or simply signed.

Where procedure is the only option, make the verification carry the weight. Swab at the changeover, hold the results, trend them, and connect them to the Cleaning and Disinfection Risk Assessment (RA03), R690, and the Allergen Management Risk Assessment (RA17), R690, so the segregation claim and the cleaning validation say the same thing.

How do you justify personnel flow, changing and cross over points?

ISO 22002-1:2025 puts personnel flow inside the prerequisite programmes, and people are the highest volume traffic across your zone boundaries, as well as the only traffic that argues back. The rule is one direction of travel from lower zones to higher zones through a controlled barrier, and no casual return. Every crossing needs a named barrier, a defined change, a hand hygiene step in the right sequence, and supervision. A boundary nobody polices is a line on a drawing.

Two practical points that come up in almost every audit. First, maintenance is the traffic nobody assessed: a fitter walks from the workshop to a high risk filler with a toolbox, and the toolbox has been on a raw area floor. Either dedicate tools to the zone or define a decontamination step and record it. Second, decide what happens when somebody in the high zone needs the toilet, because the answer is either a full re change or an unwritten habit of walking through with the coat on.

Toilets and changing areas also carry a direct legal hook. R638 of 2018 regulation 5, paraphrased, requires that where a food handling area connects to a latrine or a changing area, that connection is through a properly ventilated lobby or self closing doors with mechanical extraction ventilation. That is a design requirement, not a housekeeping preference, and it applies whether or not you are certified to anything.

How should materials, packaging, rework and waste move between zones?

Clause 4.3 of BRCGS Issue 9 is a product flow clause, so materials must move forward through the zones and never backwards, and every item that crosses a boundary needs a defined transfer method. The four flows that cause the most trouble are outer packaging, rework, waste and cleaning equipment. Each of them travels against the grain of the process, and each of them arrives at the boundary carrying whatever it has touched on the way.

Outer packaging is the classic. Corrugate that has travelled on a truck, sat in a yard and been handled on a raw goods dock should not enter a high risk room on its original pallet. The usual controls are a debagging or decanting step at the boundary, transfer onto dedicated internal pallets or trolleys, and a defined hatch or airlock for the handover. Whatever you choose, it belongs on the plan with a number on it.

Rework is the flow most likely to break your zoning quietly. Product that has already been through a higher zone, taken out, held, and returned into the process can carry contamination in the opposite direction to your whole design. Define which rework may return, into which zone, at which step, within what time and under what storage conditions, and connect the decision to the Rework Risk Assessment (RA13), R690.

Waste and cleaning equipment complete the set. Waste should leave the higher zone on a dedicated route without ever passing back through it, using dedicated bins that do not travel between zones, and the Waste and Food Loss Management Risk Assessment (RA06), R690, is where that route is justified. Cleaning equipment is colour coded and stored inside the zone it serves, because a mop that visits three zones is a transfer mechanism with a handle on it.

Why does drainage direction decide whether your zoning argument holds?

Drains connect zones that your walls separate, and regulation 5 of R638 of 2018 sets only a structural floor, so the zoning consequence is yours to argue. Water carries contamination downhill and aerosols carry it upward, so a drain running from a raw area under a high risk room defeats every barrier you built. Drainage direction, capacity, trapping and cleanability belong on your zoning plan, and a zoning assessment that does not mention drainage is incomplete.

Design the fall so that water always moves from the highest care zone towards the lowest, never the reverse, and avoid shared runs between zones entirely where the building allows. Where a shared run cannot be avoided, the assessment has to name it, describe the trapping and non return arrangement, and explain how you verify that arrangement still works. R638 of 2018 requires waste water disposal by a method approved by the local authority, which is the legal minimum and not the design brief.

• Floors fall to drains without ponding, and the fall is checked, not assumed
• Drain runs are drawn on the plan with direction of flow, so a shared run between zones is visible rather than discovered
• Traps are present, water sealed and maintained, because a dry trap is an open pipe between two zones
• Drain cleaning uses dedicated tools stored separately, and the cleaning is verified rather than signed
• Drains are named environmental monitoring sites, which is where the Environmental Monitoring Risk Assessment (RA19), R690, and your zoning map have to line up
• Backflow and blockage incidents are recorded and investigated as zoning events, not as maintenance jobs

Do you need positive air pressure in high care and high risk?

Air must move from the highest care zone outwards, never inwards, which means positive pressure in high risk and high care relative to the areas around them. No certification scheme, BRCGS Issue 9 included, publishes a pascal figure, so any number you have seen comes from industry practice. You must produce your own design differential, the basis for it, a means of reading it, the readings and the action when it drifts.

Four things make an air argument hold together at audit. The supply air is filtered to a grade your assessment justifies for the zone. The intake is positioned away from contamination sources such as loading bays, drain vents and extraction discharges. The differential is measurable at the boundary, ideally with a permanent gauge rather than a hand held meter that lives in a drawer. And the system is verified on a defined schedule, with filter change records and differential logs to prove it.

Condensation is the failure that turns an air system into a hazard. Cold surfaces in a warm, humid room drip onto open product, and the drip carries whatever grew in the duct or on the ceiling. Treat condensate points as zoning findings, look at them together with the Utilities, Water, Air, Steam and Lighting Risk Assessment (RA09), R690, and remember that opening a door for ten minutes to cool a room reverses your pressure regime while it is open.

Worked example: zoning a chilled ready to eat site

A single site making cooked chilled sliced meat, a chilled salad with a raw vegetable component, and an ambient dry seasoning blend. One building, one goods door, three product families with three different answers. The table works each area through the same three questions and shows the BRCGS Issue 9 zone the answers produce, plus the boundary control that follows. Illustrative, to show the reasoning, not to be copied.

Two decisions in that table are the ones an auditor will test. The salad room is high care rather than high risk, because BRCGS reserves high risk for product where every component has received a full pathogen reduction step, and the washed raw vegetable has not. That is exactly why the wash water treatment becomes the control the whole zone leans on, and why it is monitored as a critical parameter rather than recorded as a routine check. The boundary for the cooked meat sits at the blast chiller discharge, not at the oven door, because that is where product first meets the room after the kill step.

The remaining problem on this site is the single goods door. That is a constraint, and the way to defend it is to name it, sequence deliveries so that raw material and packaging never arrive at the same time as despatch loading, clean the dock between the two, and monitor the dock as a Zone 4 environmental monitoring area, keeping that numbering separate from the BRCGS production risk zones on the layout drawing. Sites that write the constraint down and control it can defend it. Sites that draw a plan showing two doors that do not exist cannot.

What records does an auditor ask for on zoning?

An auditor testing clause 4.3 asks for the assessment, the plan, and the evidence that the plan is being lived. In practice that is six things: the layout and zoning risk assessment, a current controlled site plan, a verified process flow diagram, the boundary control records, the verification evidence from environmental monitoring and cleaning, and the change control record showing that layout changes were assessed before they happened.

The last row is the one that costs sites the most. A layout change assessed after it was made is not change control, and the date on the document tells the auditor exactly what happened. Build the trigger into your management of change procedure so that moving a machine requires a zoning sign off before the fitters arrive. Our BRCGS Issue 9 audit preparation countdown and complete guide to food hygiene audits set out how this evidence is examined on the day.

Where zoning arguments fail, and how to fix them without rebuilding

Zoning arguments rarely fail on the concept. They fail on six recurring details, and because clause 4.3 of BRCGS Issue 9 is a fundamental every one of them counts: a plan that no longer matches the building, a boundary nobody polices, maintenance and contractor traffic outside the rules, a drain or duct that crosses a wall, rework travelling backwards, and a layout change made before it was assessed. All six close without capital, provided you close them honestly.

Start with a walk. Take the current plan into the factory during production, mark every difference in red, and treat the marked drawing as your gap list. On a typical site that walk takes two hours and produces between eight and twenty differences, most of them added by projects that were never fed back into the drawing. Correcting the plan is free and it removes the finding an auditor is most likely to open with.

Then fix the traffic rules for the people who are not production staff. Write the maintenance entry rule, the contractor rule, the visitor rule and the cleaning team rule, brief them, and record the briefing. Sites often have excellent operator discipline and no rule at all for the fitter with the toolbox, which is the crossing most likely to move contamination between zones.

Where a genuine physical problem exists, a shared drain run, a single corridor, a door that has to stay open for airflow, the defence is compensation plus evidence. Name the constraint in the assessment, describe the additional controls, and monitor the point. That combination is defensible. What is not defensible is silence, and it is worth remembering that section 61 of the Consumer Protection Act 68 of 2008 imposes liability for harm caused by unsafe goods irrespective of negligence, so the commercial consequence of a zoning failure does not depend on your certificate.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.