EMP consulting

Hiring an Environmental Monitoring Programme Consultant in South Africa: What the Work Should Deliver

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 22 min read

An environmental monitoring programme consultant should leave your site with a programme that finds contamination before your product does: a zone map, target organisms justified from your product and process, a scored risk assessment, a costed sampling plan, a checked laboratory, written action levels with hold and release rules, and trained samplers. ASC Food Safety designs, investigates and verifies these programmes for South African manufacturers, quotes per site after a scoping call, and backs the work with the RA19 template, the Automated EMP tool and a 9 hour EMP course.

When does a food site need an outside environmental monitoring consultant?

Bring in outside help when the programme has to change faster, or more defensibly, than your own team can manage alone. The usual moments are a first certification audit, a first or repeat pathogen positive, an auditor or customer finding, a new high risk line, a programme that has never found anything, and the weeks after an outbreak or recall.

Most technical teams can run an environmental monitoring programme (EMP) once it exists. Designing one from a blank page, or rebuilding one under pressure, needs someone who has walked many plants, reads laboratory reports critically and has sat on the auditor’s side of the table. The trigger decides what kind of help you need.

The seventh trigger is the hardest: the period after an outbreak, a recall or a withdrawal. South Africa knows what that looks like. The 2017 to 2018 listeriosis outbreak recorded 1 060 cases and 216 deaths where the outcome was reported, and was linked to ready to eat meat products and Listeria monocytogenes sequence type 6, according to the WHO Regional Office for Africa. WHO also records that the response included assessments of all ready to eat meat processing plants. In our experience, South African customers, retailers and auditors now ask much harder questions about how a site looks for Listeria, and they expect evidence rather than reassurance.

What do the certification schemes and regulators actually ask of the programme?

No certification scheme hands you a list of swab sites. FSSC 22000, BRCGS, SQF and IFS all require a risk based programme you can defend, with defined organisms, locations, frequencies, limits, corrective action and review. A consultant’s first job is to turn those short clauses into a programme an auditor can follow from risk to result.

Certification schemes

FSSC 22000 Version 7 clause 2.5.7 asks for (a) a risk based programme for the relevant pathogens, spoilage and indicator organisms, (b) a documented procedure, (c) trend analysis and (d) a review at least annually and on triggers: significant change, an extended period without positives, out of specification trends, repeat pathogen detection, and product alerts, recalls or withdrawals. Clause 2.5.1 (a) requires laboratories to show they produce precise and repeatable results with validated methods, through proficiency testing, regulatory programmes or accreditation such as ISO/IEC 17025. FSSC permits Version 6 audits until 30 April 2027 and runs Version 7 upgrade audits from 1 May 2027 (FSSC). Our clause 2.5.7 guide gives the auditor’s view.

BRCGS Food Safety Issue 9 clause 4.11.8 requires risk based programmes for pathogens or spoilage organisms, covering at least all production areas with open and ready to eat products, with defined control or action limits and documented corrective action when results fail a limit or show an upward trend of positives. For analyses critical to product safety, authenticity or legality, BRCGS expects the laboratory to hold recognised accreditation or operate to the principles of ISO/IEC 17025 (BRCGS). SQF Food Manufacturing Edition 9 clause 2.4.8 requires a risk based programme for all food manufacturing processes and the immediate surrounding areas that affect them (SQFI guidance), and SQFI expects Edition 10 audits to start on 2 January 2027 (SQFI). IFS Food Version 8 covers the topic in section 5.6, and ISO 22000:2018 through clauses 8.8 and 9.1. If you already have a finding, see our guide to environmental monitoring audit nonconformities.

South African law and international references

South African food hygiene law is Regulation R638 of 22 June 2018 under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, administered by the Department of Health and enforced by municipal environmental health practitioners. Regulation 6(4)(b) of R638 limits food contact surfaces, before food touches them, to 100 viable micro-organisms per cm² using the SANS 5763 swab technique. That is a cleaning verification limit; a good consultant keeps it in the programme without confusing it with pathogen monitoring.

Codex guideline CXG 61-2007 on Listeria monocytogenes was revised at the 49th Codex Alimentarius Commission in July 2026 (Codex). Its Annex I, which predates the revision, recommends an environmental monitoring programme for processing areas, including Listeria spp. testing as an indicator and a planned response to positives (CXG 61-2007). Codex is guidance, not South African law, though customers and schemes lean on it; our 2026 Codex article explains the revision. Export customers bring their own references. EU Regulation (EC) No 2073/2005 Article 5(2) requires ready to eat producers in the EU to sample processing areas and equipment for Listeria monocytogenes and names ISO 18593 as the reference sampling method. For FDA registered facilities, 21 CFR 117.165 (a)(3) requires environmental monitoring where contamination of a ready to eat food with an environmental pathogen is a hazard requiring a preventive control, and the written procedures must identify the organisms, sites, timing, frequency, tests, laboratory and corrective actions.

What does a competent EMP consultant do, phase by phase?

A competent consultant works in a fixed sequence: walk the site and map the zones, justify the organisms, score the risk, build a costed sampling plan, check the laboratory and method, write action and release rules, and train the samplers. Positives, trending and review follow once the programme is live. A skipped phase leaves a gap an auditor will find.

For design principles such as which organisms suit which products and how many sites to sample, see our microbiological risk assessment and EMP design guide.

1. Site walk and zone mappingThe consultant walks the site during production and again during sanitation, following people, water, air, pallets, waste and condensate. Zones 1 to 4 are marked on a current drawing. Monitoring zones are not the same as hygienic zones; if your high care and low care boundaries need work, the layout and hygienic zoning risk assessment comes first.
2. Organism justificationEach target organism is justified from the product and process: water activity, pH, the kill step, exposure after that step, storage and the consumer. The reasoning is written down, so an auditor can see why Listeria spp. is tested in one room and Enterobacteriaceae in another.
3. Risk assessment in the RA19 structureRegister lines are built per zone, site and organism. Each line gets an inherent score and a residual score on a 5 x 5 matrix, and controls are credited only where they are verified. The residual rating then drives frequency, so the schedule follows the risk rather than habit.
4. Sampling plan and swab budgetSites become a four week schedule with shift and day rotation, pre operational and in production timing, fixed sentinel sites and rotating sites. The consultant prices the weekly sample load against your laboratory’s price list, so management approves a budget it can sustain. Our sibling article on what an EMP costs in South Africa covers the money side.
5. Laboratory selection and method checkAccreditation scope, method, turnaround, reporting and the neutralising broth are checked against each area’s sanitiser. This phase is covered in detail in the next section because it is where many programmes quietly fail.
6. Action levels and hold and release rulesAlert, action and escalation levels are written per zone and organism, along with what product is held, for how long, what testing releases it and who signs. These rules are agreed before the first positive, not negotiated during it.
7. Training the samplersSwabbers are trained and observed on aseptic technique, area sampled, broth handling, labelling, chain of custody and chilled transport. Each sampler is signed off only after an observed round.
8. First cycle verificationThe consultant watches the first rounds, checks turnaround against the hold rules and reviews the first month’s results before signing off.

How should a consultant check your laboratory and methods?

A programme is only as good as the result behind it. The consultant should confirm that the laboratory is accredited for the exact test and sample type you send, that the method is a reference or validated alternative method, that turnaround fits your hold rules, and that your swab broth neutralises the sanitiser used on each surface.

Accreditation and scope

In South Africa the Accreditation for Conformity Assessment, Calibration and Good Laboratory Practice Act 19 of 2006 recognises SANAS as the only accreditation body in the Republic for conformity assessment. “SANAS accredited” is not enough on its own. Ask for the certificate and the scope that lists each accredited test, and check that the pathogen detection you rely on, on environmental samples, is on it.

Methods

ISO 11290-1:2017 covers detection of L. monocytogenes and Listeria spp. and applies to environmental samples from food production and handling areas. ISO 6579-1:2017 covers detection of Salmonella spp., including environmental samples. Rapid proprietary methods are acceptable when validated for the sample type, and ISO 16140-2 is the protocol for validating alternative methods against a reference method. The consultant should also ask how the laboratory handles pooled samples and whether isolates can be kept for later typing if a pattern emerges.

Sampling technique and the neutraliser

ISO 18593:2018 sets out horizontal methods for surface sampling with contact plates, stick swabs, sponges and cloths; ISO lists it as confirmed after its 2023 review. The standard calls for a neutraliser where residual disinfectant is expected, so the sanitiser does not inhibit the organisms you are trying to recover, and advises against adding one where no residue is expected. Broth choice matters. In a study published in BMC Microbiology (Li and colleagues, 2020), Dey Engley, Letheen and HiCap broths performed similarly for low levels of L. monocytogenes on stainless steel exposed to 400 ppm quaternary ammonium, but Letheen did not effectively neutralise 8 000 ppm. When a site changes sanitiser, the broth must be checked again. Our surface swabbing guide goes deeper on sponges, swabs and broth selection.

What should a consultant do when results come back positive?

When a positive arrives, the consultant’s value is speed and discipline: contain and decide on product under the rules already signed, intensify sampling around the site, find a root cause that names a harbourage or a practice, remove it, and prove it has gone with verification sampling. Cleaning and swabbing again is not a root cause.

Containment and the product decision

The first hour is about product. The consultant works through the hold and release rules with you: which batches were exposed, which Zone 1 surfaces link the positive to product, what testing supports release and who signs. Codex CXG 61-2007 Annex I says an action plan should be designed and established to respond to positive findings, with responses ranging from no action to holding and testing product. If no rules exist, the consultant helps you make a documented, conservative decision, then writes the rules.

Investigative and vector sampling

Investigative sampling expands outward from the positive in a star burst (vector) pattern: surrounding surfaces, equipment above and below, drains, and the people and trolleys that pass. Some of it is done before cleaning, because the aim is to find the organism. Where harbourage inside equipment is suspected, a seek and destroy exercise follows, as explained in our EMP design guide.

Root cause and CAPA

A defensible root cause names something physical or behavioural: a cracked floor joint, a hollow roller, a split gasket, a condensate drip, a hose used on the floor and then on the line. Corrective action removes it, and the CAPA closes only after the planned verification sampling comes back clean. Drains and cracks also shelter flies, cockroaches and rodents, so investigations often overlap with pest control. The FSSC guidance on environmental monitoring notes that investigative sampling may be used as part of root cause analysis.

How should trend review work, and what if the programme never finds anything?

Trending turns single results into evidence. A consultant should set up a monthly review of positive rate by zone, repeat sites and counts against limits, plus an annual review and trigger reviews. Long runs of negatives are a question to answer, because FSSC 22000 lists an extended period without positives as a reason to review the programme.

A useful trend review is short and regular: the month’s positive rate per zone, repeat sites, positives by area and counts above the alert or action limits. The team then decides what changes, such as a site added, a frequency raised or equipment sent for redesign. Codex Annex I makes the same point about long term review of the data.

The annual review, and the trigger reviews listed in FSSC 22000 clause 2.5.7 (d), should leave a written record: what triggered the review, what was looked at, what changed and who approved it. A review log with those four columns is often the first thing an auditor asks for.

Which deliverables should you insist on?

Insist on documents your team can run without the consultant: a zone map, a scored risk register, a schedule and budget, a laboratory and method sheet, written action and release rules, a positive response plan, trend and review templates, and training records. If a deliverable only makes sense while the consultant is in the room, it is not finished.

• A current site drawing with Zones 1 to 4 marked and every sampling site numbered.
• A written organism justification per area, linked to the product and process.
• A risk register with inherent and residual scores per zone, site and organism, and the controls credited.
• A four week sampling schedule with shift and day rotation, and a weekly swab budget in rand.
• A laboratory and method sheet: accreditation scope, method per organism, turnaround, transport rules.
• A neutraliser table matching broth to the sanitiser in each area.
• Alert, action and escalation levels per zone, with hold and release rules and named signatories.
• A positive response plan with the vector sampling pattern and a root cause and CAPA form.
• A results log, a monthly trend template and a review log for the annual and trigger reviews.
• Sampler training material, observed competence records and sign offs.

How do you judge an environmental monitoring consultant?

Judge a consultant on evidence: registrations and audit experience you can check, sample work you can read, a clear position on independence from laboratories and suppliers, and honest limits on what they will do. Ask how they handled a real positive, without names, and listen for a method rather than a story.

Competence evidence

Ask for qualifications in food science or microbiology, lead auditor registrations you can verify with the issuing body, and a redacted risk register and investigation report. Ask who will actually do the site work, and check that person’s background, not only the company’s.

Independence

A consultant paid per sample by a laboratory, or selling chemicals or kits on commission, has a reason to recommend more samples or a particular product. That does not make the advice wrong, but you should know, in writing. The designer of your programme should also be comfortable with someone else auditing it.

Laboratory relationships

A good consultant knows several laboratories and their scopes, and will tell you which suits your tests and location. Those relationships help when a positive needs fast confirmation, but never replace the checks described above.

What a good consultant will not do

• Will not copy a swab list from another site without a risk assessment behind it.
• Will not move sampling sites away from a positive to improve the numbers.
• Will not advise sanitising before investigative sampling.
• Will not close a CAPA on “cleaned and swabbed again”.
• Will not promise a certificate or guarantee an audit outcome.
• Will not act as your certification auditor for the same programme.
• Will not make a product release decision for you; they help you make and document it.

What are the red flags in an EMP consulting proposal?

Red flags are proposals that sell sample volume instead of design, skip the site walk, ignore the laboratory and neutraliser, leave positives and review undefined, or hand over documents your team cannot run. Compare every proposal against a short list of what good looks like before you sign.

Which engagement model suits your site?

Most EMP work fits one of four models: a once off design, an investigation call out after a positive, retained verification through the year, or training plus a tool so your own team runs the programme. Many sites combine two, for example a design followed by quarterly verification visits.

Cost depends on the number of lines and rooms, the scheme, travel and urgency, and two sites of the same size can need very different work. ASC therefore quotes per site after a scoping call.

How does ASC run an environmental monitoring engagement?

ASC runs EMP work as a scoped project: a scoping call, a site walk, a design built in the RA19 structure, a laboratory and method check, sampler training and a first cycle review, with investigation and verification available afterwards. The consultants are food scientists and auditors working from offices in Gqeberha, Johannesburg and Cape Town.

1. Scoping callWhat you make, your scheme, your results and the trigger. You receive a written scope and quote per site.
2. Site visitWe walk production and sanitation, map zones, and review layout, drains, pests and people flow.
3. DesignWe build the risk register, schedule, swab budget, action levels, hold and release rules and positive response plan in the RA19 structure, in editable files or in the Automated EMP tool.
4. Laboratory and method checkWe review your laboratory’s scope, methods, turnaround and transport, and match broths to sanitisers.
5. TrainingWe train and observe your samplers on site, and can enrol your technical team on the EMP course.
6. First cycle reviewWe review the first month’s results and trend, then hand over, or move into retained verification if you want it.

ASC has more than one lead auditor on the team, and our principal consultant is an FSSC 22000 and BRCGS lead auditor, which is why our designs are written so an auditor can trace them. He was named the Nelson Mandela Bay Business Chamber’s Entrepreneur of the Year in 2022. Where you need an independent check of good hygiene practice alongside the EMP, our food hygiene audits benchmark the site against R638, GMP and good hygiene practice, with a 5 star rating and Platinum, Gold, Silver or Bronze certificates.

Franchise groups including KFC and Spur train their teams with ASC. For tools without a full engagement, the RA14 and Cleaning and Disinfection risk assessments (R690, about USD 42 · EUR 37 · GBP 31 · AED 155, each) and the TK11 Basic Food Safety Document Templates Toolkit (R699, about USD 43 · EUR 37 · GBP 32 · AED 157) are in the ASC shop.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for site specific advice.