DOCUMENT TOOLKITS · FSMS IMPLEMENTATION

Build a Food Safety Management System Without a Consultant

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

A certification ready food safety management system is a documented set of policies, procedures, work instructions, forms and risk assessments that answers every clause of your scheme. For an FSSC 22000 Version 7 food manufacturing site that runs to more than 260 documents. Written in house it takes months. An ASC toolkit at R6,350 supplies the writing, including one hour of premium consultation, and leaves you the implementing.

What a documented food safety management system actually contains

A documented food safety management system has five layers: policies that state intent, procedures that fix who does what, work instructions that show how a task is performed, forms and records that prove it happened, and risk assessments that justify each decision. ISO 22000:2018 and FSSC 22000 Version 7 both expect all five, indexed so an auditor can trace a clause to the document that answers it.

Most people who ask me for “the templates” are picturing a folder of blank forms. Forms are the thinnest layer and the one an auditor spends the least time on. What decides an audit is whether the layer above the forms holds together: whether your cleaning frequency has a written justification, whether your allergen controls follow from an allergen risk assessment rather than from habit, and whether the person who signs the record was trained on the procedure that requires it.

The layers multiply because most schemes are stacked. FSSC 22000 Version 7 is ISO 22000:2018, plus a sector prerequisite programme standard from the ISO 22002 series, plus the FSSC additional requirements, so three separate sources of requirement land on one documented system. The BRCGS Global Standard Food Safety Issue 9, published on 1 August 2022, works differently: nine sections and twelve fundamental requirements, where a major non-conformity against its statement of intent is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified. If your HACCP study is the only thing you have written down, read our explainer on what a HACCP plan is and what sits around it before you scope the work.

Document control sits underneath all five layers and gets less attention than it deserves. Every document needs a number, an owner, an issue date, a revision status and an approval, and every superseded version needs to be off the floor. Auditors test this cheaply, by asking an operator to produce the current version of one work instruction. If two versions are in circulation, the finding lands against the control of the system rather than against the subject of the document.

How many documents does a certification scheme really need?

No standard states a document count. Every clause must be addressed and every claim evidenced. As a working guide, the ASC ISO 22000:2018 food manufacturing toolkit at R5,900 holds 271 documents, the FSSC 22000 biochemicals toolkit at R6,350 holds 297, and the R638 aligned Basic Food Safety toolkit at R699 holds just over 40. The number moves with the scheme, the sector and the number of processes you run.

Four things drive the count. The first is the clause set itself, since a stacked scheme like FSSC 22000 carries more requirement sources than a single standard. The second is your sector prerequisite programme standard, because catering, transport and storage, packaging manufacturing and feed each carry different prerequisite content. The third is process variety: one product stream on one line needs far fewer work instructions than a site running chilled ready to eat, a dry blending hall and a co-packing service under one certificate. The fourth is how much of your justification is written down, which is where the risk assessment library sits.

A high count is not a virtue. I have seen sites carry twice the documents they could defend, and the excess became the finding, because a large share of them described practices the site had abandoned. Count the documents you could delete tomorrow without leaving a clause unanswered. That number is the one worth knowing. If your gap is narrower than a whole system, the ASC risk assessment packs at R690 each fill single subjects such as allergen management, environmental monitoring or cleaning and disinfection, each with a register, a procedure, a completion guide and a read me, mapped to BRCGS, IFS and SQF clauses.

One habit worth breaking early is writing a document per clause. Standards are written as requirement lists, not as filing structures, so a single well written traceability procedure can answer requirements sitting in three different sections of the same standard. The mapping runs the other way round: you write the document your operation needs, then record in the index which clauses it satisfies. Sites that mirror the clause structure end up with dozens of thin documents and no procedure anybody would actually follow.

The three ways to get one: write it yourself, hire a consultant, or start from a toolkit

Three routes exist. You write it in house, which costs no cash but takes a technically capable person months of protected time. You commission a consultant to write it, which is scoped and quoted as one project figure and buys you their judgement. Or you start from a toolkit priced between R699 and R8,720 and spend your time on personalisation and implementation instead of drafting.

I will be plain about what a toolkit does and does not do, because overselling it is how buyers end up disappointed at the audit. A toolkit removes the writing. It does not remove the implementing. Nobody can sell you records of a cleaning verification that has not happened yet, or a HACCP study built on a process flow only your team can draw. What you are buying is the several months of specialist drafting, the clause coverage and the structural consistency, so that your own time goes into the parts that are genuinely yours.

The in house route carries a cost that never appears on an invoice and is usually the largest one in the project. The person capable of writing the system is the person already running your verification, your complaints and your supplier approvals, so every week spent drafting is a week those areas are unattended. Then the audit date moves, and a moved audit date has its own commercial consequences with the customer who asked for the certificate in the first place.

Which food chain category are you, and why buyers pick the wrong one

Food chain category decides which part of the ISO 22002 series supplies your prerequisite programme content, so it decides which toolkit you buy. Category C is food manufacturing, D is feed and animal food, E is catering and food service, F is retail and wholesale, G is transport and storage, I is food packaging manufacturing and K is biochemicals. Buy for what you physically do, not for the industry you feel part of.

• Category C, food manufacturing. You process, blend, cook, pack or preserve food for sale. The largest toolkits sit here, and so do most of the prerequisite programme requirements.
• Category D, feed and animal food. Animal feed, pet food and feed ingredients. Different contamination profile, different traceability expectations, different prerequisite content from human food manufacturing.
• Category E, catering and food service. Central production kitchens, contract catering, restaurant groups, airline and institutional catering. A central production kitchen is E even when it looks like a small factory.
• Category F, retail and wholesale. Store and depot operations handling food you did not manufacture. In store bakeries and butcheries sit awkwardly here and need a scoped conversation.
• Category G, transport and storage. Third party cold stores, ambient warehousing, refrigerated distribution. This is the category most often bought wrong, because operators assume a food certificate means a manufacturing toolkit.
• Category I, food packaging manufacturing. You print, convert, mould or extrude packaging that will touch food. You are not a food manufacturer, and a manufacturing toolkit will describe processes you do not run.
• Category K, biochemicals. Additives, vitamins, cultures, enzymes and processing aids. The clause set is the same family, the prerequisite content and the traceability expectations are not.

Scope wording on your certificate, or on the application you are about to submit, settles the argument faster than any internal debate. If you have not chosen a scheme yet, the training site guide on which food safety certification your business needs works through the decision, and the site article comparing BRCGS, FSSC 22000 and IFS covers the customer driven side of it.

Which toolkit matches your standard and your food chain category

Every toolkit below is a complete management system: policies, procedures, work instructions, forms and risk assessments, indexed and cross referenced, supplied in editable Word and Excel, and every one includes one hour of premium consultation with one of our consultants. Prices run from R699 for the R638 aligned basic set to R8,720 for GLOBALG.A.P. IFA with all add-ons.

Three more sets sit outside the table. Dutch HACCP, R5,500 runs to more than 200 documents, the SIZA Ethical Trade Management System, R2,650 holds 150 documents and is covered in the SIZA ethical trade toolkit guide, and ISO 22000:2018 for the other sector categories, R5,900 is supplied on the same basis. The seven FSSC 22000 sector toolkits share one price of R6,350 and one landing page at the FSSC 22000 Version 7 toolkit range, so the only decision you have to get right is the category. If you want to see the anatomy of a toolkit before you spend, we published a plain explainer on what a food safety toolkit is, and the purchase terms sit at the toolkit terms and conditions.

What you still have to do yourself after you buy a toolkit

A toolkit hands you the writing. What ISO 22000:2018 and FSSC 22000 Version 7 still require from you is your own process flow, your own hazard analysis, your own supplier file and your own records. Plan on eight pieces of work that remain yours: personalisation, the HACCP study, the prerequisite programme risk assessments, the supplier approval file, training, records, internal audit and management review. That list is the honest scope of what you are taking on.

• Delete what you do not do. The fastest and most valuable hour of the whole project. A procedure describing a process you do not run is a finding waiting to be written.
• Fill every field. Site name, scope, product streams, named roles, frequencies, limits, department names. Nothing may remain as supplied placeholder text.
• Run your own HACCP study. Your process flow, verified on the floor, your hazard analysis, your critical control points and your validated critical limits. Nobody can supply these.
• Do the prerequisite risk assessments with your own data. Zoning, cleaning frequency, water, air, pest, glass and hard plastic, allergens. The registers are supplied, the judgements are yours.
• Build the supplier approval file. Specifications, certificates of analysis, approval records and the vulnerability assessment behind them.
• Train the people named in the documents. A procedure the operator has never seen is documentation, not control.
• Generate records long enough to be auditable. Most certification bodies want the system running before the audit, so the calendar matters more than the documents.
• Run one internal audit and one management review. Both are clause requirements and both are commonly missing at first certification.

Two of those items are training problems rather than documentation problems. If your prerequisite programmes are weak on the floor, the Implementation of Good Manufacturing Practices course at R1,950 covers the practical implementation your procedures will assume. If you have no trained internal auditors, the Internal and Supplier Auditing Practices course at R3,500 builds the capability the clause requires, and we cover the reasoning in our guide to building internal and supplier auditors. ASC does not charge VAT on training, so the price shown is the price paid.

How long personalisation actually takes

The planning figure I give clients is four to eight weeks of part time work for a single site, whichever set in the R699 to R8,720 range was bought, with one competent owner and a HACCP team that meets weekly. Deletion and field completion move fast. The HACCP study, the prerequisite programme risk assessments and the supplier approval file are the slow parts, because they need your data and your team, not editing.

1. Week one: index and deleteRead the index against your certificate scope. Mark every document as keep, adapt or delete. Use the included hour of premium consultation here, not at the end, because this is where the whole plan is set.
2. Weeks one and two: identity passSite name, scope statement, product streams, organogram, named roles, document control convention and review dates across the whole set. Mechanical work, best done in one block by one person.
3. Weeks two to four: HACCP studyProcess flow verified on the floor, hazard analysis, control measure selection, critical limits and validation. This is a team exercise and it sets the content of a dozen other documents.
4. Weeks three to six: risk assessmentsZoning, cleaning and disinfection, allergens, pest, glass and hard plastic, water and air, environmental monitoring where relevant. Registers supplied, judgements yours.
5. Weeks five to eight: train, run, recordBrief every named role, start the records, then run one internal audit and one management review before you book the certification audit.

Two things stretch that timeline. Multi site groups need a decision about what is corporate and what is local before anyone edits a document, and that decision usually takes longer than the editing. Sites with several product streams under one certificate need a HACCP study per stream, which multiplies the slowest part of the project. If your audit date is already booked and the calendar does not work, say so early and ask for a scoped quote rather than compressing the study.

What a clause mapped index is, and why it matters at an audit

A clause mapped index is a single register that lists every document, its number, its owner and the clause it answers, so you can move from a clause to a document and from a document back to the clause. Every ASC FSSC 22000 toolkit at R6,350 carries one. At an audit it converts a search into a lookup, and searching in front of an auditor is expensive.

Audits are timed. An auditor working through a stacked scheme has to satisfy themselves on the ISO 22000:2018 clauses, the sector prerequisite programme content and the FSSC additional requirements inside a fixed number of days. Every minute your team spends looking for the document that answers a question is a minute not spent showing the control working. Worse, hunting invites the auditor to widen the sample, and a widened sample on a weak subject is how one minor becomes six, and six minors move your grade band.

If you cannot get from a clause number to the document that answers it inside thirty seconds, the auditor will find your gaps before you do.

The index also protects you after certification. It is the thing that tells you which documents have to change when a standard is revised, which is exactly the problem sitting in front of every FSSC site right now. Without it, a version change becomes a document by document search through a shared drive nobody has owned since the last audit.

Numbering is the other half of it. Pick a convention before you edit anything, keep it across policies, procedures, work instructions and forms, and resist renumbering a document to fill the gap left by a deletion. A supplied toolkit arrives with one convention already applied across the whole set, which is worth more than it sounds on the day a version change lands and you have to find every document that cites a superseded standard.

The ISO 22002 restructure of July 2025 and why it dates your current system

The ISO 22002 prerequisite programme series was restructured in July 2025. Most parts moved from Technical Specification to full International Standard, and ISO 22002-100:2025 was published on 29 July 2025 as a new common baseline. ISO/TS 22002-3:2011 for farming is the exception, reviewed and confirmed in 2025 and still a Technical Specification. Systems that still cite the old technical specifications are citing superseded references.

Here is why this is a reason to act rather than a piece of standards trivia. Open your prerequisite programme procedures and look at the reference line in the header. If it still reads ISO/TS 22002-1 rather than ISO 22002-1:2025, every one of those documents needs its reference corrected, and any clause text quoted from the old part needs checking against the restructured content. On a system of 260 documents that is not a five minute job, and it is exactly the kind of housekeeping that gets deferred until an auditor raises it.

Sites that buy a current toolkit skip that work entirely, because the documents are written to the restructured series rather than retrofitted to it. Teams who would rather understand the series before they edit anything can take the ISO 22002 Prerequisite Programme Requirements course at R2,100 on the training site, and the guide on prerequisite programmes and GMP in South African food manufacturing covers the floor level side.

FSSC 22000 Version 7: the transition dates that set your deadline

FSSC 22000 Version 7 was published in May 2026, replacing Version 6. From FSSC’s own upgrade document, Version 6 audits are permitted until 30 April 2027, the Version 7 upgrade audit window runs from 1 May 2027 to 30 April 2028, and the certification body must complete the upgrade documentation in the FSSC platform by 30 June 2028, after which remaining Version 6 certificates are withdrawn automatically.

Work backwards from your own surveillance and recertification dates rather than from the scheme deadlines, because your audit date is the one that binds you. The full timeline, the clause by clause differences and the upgrade sequence are set out in the complete 2026 guide to FSSC 22000 Version 7 in South Africa and in the full Version 6 to Version 7 change guide.

The mistakes that make a bought system fail an audit

No standard prohibits purchased documentation, not BRCGS Issue 9 and not FSSC 22000 Version 7, and no auditor is entitled to reject a system because you did not type it yourself. Systems fail for the same handful of reasons every time: unedited placeholders, procedures describing processes the site does not run, no records behind the procedures, no evidence of training, and a HACCP study that was never actually done. Each of those is avoidable.

• Placeholder text left in. A supplied example frequency or a generic site name in a live procedure tells the auditor exactly how much attention the system has had.
• Procedures for processes you do not run. The most common failure. If you do not operate a metal detector, delete the metal detector work instruction rather than leaving it as a promise you cannot evidence.
• No records behind the procedure. A monthly verification written into a procedure creates twelve expected records a year. The procedure is the promise, the record is the proof.
• A HACCP study that was copied rather than done. Auditors test this by walking the line against your flow diagram. A flow diagram that does not match the floor undoes the documents built on it.
• Nobody trained on the new procedure. Ask an operator to describe the control in their own words. If they cannot, the document is not implemented.
• Old scheme or standard references. A superseded ISO 22002 citation, or a Version 6 reference on a system heading into a Version 7 audit.
• No internal audit and no management review. Both are clause requirements, both need to have happened before the certification audit, and both are commonly missing.
• The index not reconciled after deletion. Deleting fifty documents without updating the index leaves an auditor with fifty dead references to ask about.

When you genuinely do need a consultant instead

Buy a toolkit when the constraint is writing time. Hire a person when the constraint is judgement. Multi site groups, new build commissioning, a suspended certificate, a major non conformance with a short closeout window and sites with no trained HACCP team all need someone in the room. ASC consultation starts at R480 an hour, with full projects scoped and quoted as one figure.

Ready to eat processes that need an environmental monitoring programme belong on that list too, as does any site whose certificate was withdrawn and has to be rebuilt under a customer deadline. There is also a middle route that most buyers overlook. Buy the toolkit, use the included hour of premium consultation on the index and the deletion plan, then commission a short scoped review of your HACCP study and your prerequisite risk assessments once your own team has drafted them. That puts the expensive expertise where it earns most, which is on the judgement calls rather than on the typing.

What I would not do is hand the whole thing to an outsider and walk away. A system written entirely by a consultant, with no internal owner, passes its first audit and then decays, because the people running it never had to reason about why a control was chosen. The version change in front of every FSSC site is the moment that decay shows. Whichever route you take, somebody inside your business has to be able to explain the system to a stranger. For the wider picture on how audits are run and what auditors sample, see our complete guide to food hygiene audits.

A scoped quote is worth asking for even when you intend to buy the toolkit and do the work yourself, because the scoping conversation surfaces the parts of your operation that will be difficult. Ready to eat handling, a shared line running allergen containing products, water reuse and rework all change what the documented system has to prove. Knowing that before you start editing is cheaper than discovering it in week six.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.