RISK ASSESSMENT · PEST CONTROL

Pest Control Risk Assessment: Designing the Programme Instead of Signing the Contractor’s

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 16 min read

A pest control risk assessment is the document that tells your contractor what to do, not the other way round. FSSC 22000 Version 7, published in May 2026, and BRCGS Global Standard Food Safety Issue 9, published on 1 August 2022, both hold the site responsible for the prerequisite programme. The Pest Control Risk Assessment Template (RA05) is R690 and puts the specification back in your hands.

Why do the certification schemes want a pest risk assessment and not just a contract?

Because a contract is a commercial arrangement and a risk assessment is a control decision. FSSC 22000 Version 7 is ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements, and pest management sits inside that prerequisite layer. The scheme asks the site to justify its programme, and a supplier’s quotation is not a justification.

The practical test happens in the audit room. An auditor points at the site plan and asks why there are twenty four external bait stations rather than forty, why the internal monitors stop at the packing hall door, and why the service interval is monthly in the dry store but fortnightly in the intake bay. Almost every site I visit gives the same answer the first time: that is what the contractor recommended. That answer transfers the reasoning to a supplier who has never seen your hazard analysis, does not know which of your lines runs open product, and prices a standard package because standard packages are what a national service business sells.

The prerequisite standards make the ownership explicit. The ISO 22002 series was restructured in July 2025, with most parts moving from Technical Specification to full International Standard, including ISO 22002-1:2025 for food manufacturing and the new common baseline ISO 22002-100:2025 published on 29 July 2025. BRCGS Global Standard Food Safety Issue 9 has nine sections and twelve fundamental requirements, and a major non-conformity against its statement of intent is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified. Codex CXC 1-1969, General Principles of Food Hygiene, revised 2022 in the 2023 edition, treats pest control as a hygiene prerequisite the operator establishes, not one the operator outsources.

It also helps to remember what GFSI is and is not. GFSI is hosted by The Consumer Goods Forum and benchmarks schemes. It does not certify anyone. There is no such thing as GFSI certification, only certification to a GFSI recognised scheme, and every one of those schemes puts the burden of design on the certificate holder. Our guide to the 25 most common FSSC 22000 non-conformances shows how often prerequisite ownership is the underlying cause of a finding that looks like something else.

Your pest control contractor is a supplier. The risk sits with you, and so does the design.

What does a pest control risk assessment have to cover?

It has to cover what ISO 22002-1:2025 places in the prerequisite layer: the pests that are credible at your site, the routes they use to reach product, the controls you have chosen against each route, and the reasoning behind every quantity, position and frequency in the programme. If a number appears anywhere in the pest file, the risk assessment should explain where that number came from and what would change it.

• Scope and boundary: what is included, from the fence line to the finished goods store, and what is excluded and why
• Pest species relevant to your building, your raw materials and your surroundings
• Entry routes: doors, dock levellers, service penetrations, drains, roof voids, cable trays, incoming pallets and raw materials
• Harbourage: internal voids, false ceilings, equipment plinths, pallet stacks, external vegetation, disused equipment
• Attractants: waste, spillage, standing water, condensate, external lighting, canteen and locker areas
• Device type, quantity, position and rationale for each zone, with the site plan as an annexure
• Inspection frequency by zone, with the risk basis for each interval
• Action and escalation levels: what catch count or sighting triggers what response, and who decides
• Trend review: who reviews, how often, on what data and what the output looks like
• Verification: how you check that the contractor did what the specification says
• Interfaces with other programmes: proofing, cleaning, waste, storage, maintenance
• Review triggers: catch spikes, structural work, new raw materials, new neighbours, seasonal change

The Pest Control Risk Assessment Template (RA05) at R690 is built around exactly that structure. Every pack in the range contains a register, a procedure, a completion guide and a read me, in editable Word and Excel, mapped to BRCGS, IFS and SQF clauses, so the completed assessment slots into an existing document index without renumbering anything.

Which pests matter in a South African food facility, and what does each one tell you about the building?

Every pest that turns up is a message about a condition you control. FSSC 22000 Version 7 audits the reasoning in your file rather than the contractor’s catch sheet. Rodents report on your boundary and your proofing. Stored product insects report on your suppliers and your stock rotation. Flies report on your waste and your drains. Birds report on your loading bay discipline. Reading the message correctly is what separates a programme that improves from one that just keeps catching.

The South African context matters here. Many food sites sit next to open ground, informal trading, a municipal drain line or a neighbour with a different attitude to waste, and that produces a standing external rodent pressure the site cannot remove. An ever larger bait programme does not answer that pressure. A hardened boundary, a proofed building and a monitoring line that tells you when the boundary is failing does. Proofing beats baiting every time, because proofing removes the route while baiting only reduces the population that is already using it.

How do you survey a site for pest pressure?

You walk it in a fixed order, with a plan in your hand, at a time when the site is operating, because a BRCGS Issue 9 auditor traces every device position back to it. A survey done on a quiet Saturday with the doors closed misses the two conditions that matter most: how the building behaves when running, and where people prop doors open. Record what you see against the plan, then convert each observation into a decision.

1. Perimeter and boundaryWalk the full fence line. Note neighbouring land use, open ground, refuse, informal structures, water, and any point where the boundary is broken. Photograph each elevation.
2. ProofingEvery door, dock leveller, roller shutter, personnel door, window, vent, duct penetration, cable entry and roof junction. Look for light gaps, worn brush strips, gnaw marks and daylight under doors.
3. DrainageInternal and external gullies, interceptors, uncapped rodding points, damaged covers, standing water and any drain that connects the building to the municipal line.
4. Vegetation and groundGrass and shrubs against the wall, trees touching the roof, mulch and rubble beds, pallets and disused equipment stored outside, and any surface that hides a burrow.
5. WasteContainer type and condition, lids, hardstanding, wash down provision, holding time, collection frequency and the distance from the waste point to the nearest intake door.
6. Deliveries and intakeHow vehicles present, whether the bay seals, how long doors stand open, whether pallets are inspected on arrival, and where rejected or damaged stock goes.
7. Internal harbourageVoids, false ceilings, plinths, wall cavities, redundant pipework, cardboard storage, pallet stacks against walls, and equipment that has not been moved in a year.
8. Convert to decisionsEvery observation becomes either a proofing action with an owner and a date, a device decision, a frequency decision, or a documented acceptance of residual risk.

Mapping pest pressure indicators to the control decision

Notice how many of those rows leave the pest file. That is the point. Pest control is a downstream indicator of building fabric, waste and storage. The Site and Building Fabric Risk Assessment Template (RA07) at R690 and the Waste and Food Loss Management Risk Assessment Template (RA06) at R690 usually get bought at the same time as RA05.

How are device type and density decided?

Device type follows the pest and the zone, and the ASC register at R690 is where the reasoning for both is written down. Device density follows pressure, boundary length, entry points and history. There is no correct number that applies to every factory, and any proposal that arrives with a standard count before anyone has walked your fence line is a price list rather than a control decision. The risk assessment records the reasoning so the count can be defended and, more usefully, changed.

Work outward in three lines. The external line is the boundary, and its job is to intercept pressure arriving from outside. The perimeter building line sits tight against the wall and around entry points, and its job is to tell you the moment the boundary line is being overrun. The internal line is monitoring, and inside a food factory it should be non-toxic monitoring with clear positional logic, because a toxic bait inside a production area is a contamination hazard in its own right and a finding waiting to happen.

Density decisions worth writing down include the spacing you have chosen on each elevation and why, the tighter spacing at corners, doors and service penetrations, the treatment of areas where a device cannot be placed and what compensates for that, and the flying insect unit positions with the reasoning about height, proximity to open product and line of sight from doors. Flying insect units placed where they draw insects across an open product line are a classic own goal, and an auditor who sees one will look harder at everything else.

How do you set inspection frequency by risk instead of by contract?

Frequency is a control parameter, so it belongs in the risk assessment that ISO 22002-1:2025 leaves the site to own, not in the service agreement. Zone by zone, ask what would happen if activity started the day after a visit and was not found until the next one. Where that answer involves open product, a long interval is not defensible. Where it involves a sealed finished goods store with no history, a longer interval usually is.

Build the frequency table on four inputs. First, product exposure in the zone. Second, the history of activity in that zone over at least twelve months. Third, seasonal pressure, which in most of South Africa means rodent movement indoors as temperatures drop and fly pressure rising through the warm wet months. Fourth, change: building work, a new neighbour, a demolition next door, a new raw material, a line conversion or a shift pattern that leaves doors open longer.

Then write the escalation rule. A defined catch count or a single sighting in a defined zone should shorten the interval automatically for a defined period, without anyone needing to negotiate a variation with the contractor. Sites that have this rule written down recover from a spike in weeks. Sites that do not spend those weeks arranging a quote.

What does trend analysis actually mean, and how do you do it?

Trend analysis means plotting catch and sighting data by device, by zone and by month, then reading the shape of it, and it is the part of the pest file an FSSC 22000 Version 7 auditor turns to first. A single catch is an event. A rising line on one elevation across three months is a boundary that is failing. The analysis is complete only when a named person has reviewed the plot, written a conclusion and either changed something or recorded why nothing changed.

The mechanics are simple and most sites already have the raw data sitting in the contractor’s reports. Pull the catch counts into a spreadsheet with one row per device per visit. Plot four views. Total catches by month for the whole site, which shows seasonality. Catches by elevation, which shows where the pressure is. Catches by individual device, which shows the two or three stations doing all the work and tells you where to proof. Internal monitor activity separately from external, because those two lines mean very different things and averaging them hides the only signal that matters.

Then write the conclusion in words. Something like: external catches on the eastern boundary rose from a monthly average of two to eleven between March and May, concentrated in stations twelve, thirteen and fourteen adjacent to the open ground behind the effluent plant; proofing survey raised on that elevation; two door sweeps replaced on 19 May; monitoring interval on that line shortened to weekly until August. That paragraph, signed and dated, is what an auditor is looking for. A graph with no conclusion is decoration.

Where does your responsibility end and the contractor’s begin?

The contractor services devices, applies products registered under Act 36 of 1947, reports findings and makes recommendations. The site owns the risk assessment, approves the device map, sets frequency, actions recommendations, controls proofing and hygiene, and reviews trends. A site that cannot separate those two roles in conversation will not defend the programme at an audit, because every awkward question ends with the words “the contractor”.

Verification is the line that gets skipped. Somebody from the site should walk with the technician often enough to know that station nineteen still exists, that the internal monitor behind the blender has not been swept under it, and that the report describes the building you actually occupy. If you want your team to audit suppliers like that properly, Internal and Supplier Auditing Practices at R3,500 is the course, and our article on building internal and supplier auditors explains how the capability is developed.

Registered operators, registered products, and what belongs in your file

In South Africa, pest control operators are registered under the Regulations published as Government Notice R.98 in Government Gazette 34020 of 18 February 2011, made under section 23 of the Fertilizers, Farm Feeds, Agricultural Remedies and Stock Remedies Act 36 of 1947. Those regulations set eight registration fields, including structural and fumigation, and registration is valid for three years before renewal.

Regulation 11(6) of the same notice requires the pest control operator to ensure that agricultural remedies are used in accordance with the approved label and with good application practice, and that those remedies are registered in terms of the Act and labelled by the manufacturer as required by the Act. The regulations also require the operator to keep records of each application for at least two years after the day on which the administration was made, and for five years in the case of termite treatments.

Those are the operator’s obligations. Your obligation is to hold your own copies, because at an audit the file that matters is yours.

• Current registration certificate for the contracting business and for each technician who attends site
• Confirmation of the registration field relevant to the work being done on your premises
• A list of every product used on site, with the registration details, the label and the safety data sheet
• The service specification you issued, signed by both parties, with the current device map attached
• Every visit report, with your review signature and the action taken on each recommendation
• Application records for products used, held for your own retention period as well as the operator’s
• Insurance and, where relevant, the fumigation notification and clearance documentation

Separately, food premises in South Africa operate under R638 of 2018, the Regulations Governing General Hygiene Requirements for Food Premises, the Transport of Food and Related Matters, published as Government Notice R.638 in Government Gazette 41730 on 22 June 2018 under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972. Regulation 3(1) prohibits handling food on premises without a valid Certificate of Acceptability issued by the local authority, and an environmental health practitioner arriving for that inspection will look at exactly the conditions this risk assessment covers. Our guide to South African food legislation sets the wider framework out in full.

What does an auditor check in a pest control file?

An auditor working to BRCGS Issue 9 or FSSC 22000 Version 7 checks whether the programme was designed, delivered, verified and reviewed, in that order, and whether the site can explain each step without pointing at a supplier. The file is read backwards from the last finding: show me the trend review, show me what it concluded, show me what changed, show me the evidence it changed, show me who signed it.

Sites preparing for a scheme audit should read the pest file the way an auditor will. Our BRCGS Issue 9 audit preparation countdown and the complete guide to food hygiene audits both cover the sequence, and the FSSC 22000 Version 7 guide for South Africa covers what changed in the current version.

The pest findings that keep recurring

After enough site visits the same short list appears everywhere, across scheme, sector and site size, and it is the list that costs sites marks under BRCGS Issue 9 and FSSC 22000 Version 7. None of these are difficult to fix. All of them are expensive to explain in an audit, and every one of them traces back to a programme that was bought rather than designed.

• Bait stations mapped but not found on site. The map shows thirty two, the auditor can locate twenty seven, and nobody knows when the other five disappeared
• Reports filed unread. A year of service reports in a lever arch file with no review signature anywhere in it
• Contractor recommendations never actioned. The same recommendation about the eastern personnel door repeated on eleven consecutive visit reports
• No trend graph. Catch data exists in the reports but has never been assembled into anything that shows a direction
• No evidence anyone reviewed the programme after a catch spike. The data shows the spike clearly and the file shows nothing happened
• Device numbering that does not match between the map, the report and the label on the station
• Internal toxic bait in a production area with no risk assessment justifying it
• Flying insect units mounted directly above or beside an open product line
• Proofing actions with no owner, no budget and no date, carried on a list for two years
• A risk assessment dated on the day of the audit with a review period that has never actually run

When should a pest finding become a root cause investigation?

Escalate when the evidence says the control system failed rather than that a single pest arrived, which is the distinction a BRCGS Issue 9 auditor is testing when they ask for the root cause record. Any pest inside a production area, any evidence of product contact, any repeat activity in the same location across consecutive visits, and any catch pattern that breaks the established trend should all open a formal investigation rather than a service call.

Use four escalation triggers and write them into the risk assessment so nobody has to make a judgement call under pressure.

1. Product contact or product area sightingImmediate containment of affected stock, immediate investigation, and a decision on product disposition recorded before anything moves.
2. Repeat activity at the same pointTwo consecutive visits with activity at the same device or in the same room. The device is doing its job and the building is not.
3. A trend breakCatch volume outside the range established over the preceding twelve months, or a new species appearing for the first time.
4. A failed corrective actionAn action closed as complete that has not stopped the activity. That is a control system failure, not a pest problem.

The investigation itself should follow the same discipline as any other food safety root cause exercise: describe the problem in measurable terms, establish the sequence, ask why until the answer becomes a system condition rather than a person, and test the proposed fix against the original evidence. Our article on root cause analysis training for food safety teams covers the method. If pest investigations on your site keep closing with “cleaned and re-baited”, the Root Cause Analysis One-Day course at R1,250 is the shortest route to fixing that habit.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.