FSSC 22000 Implementation and Certification Readiness
ASC Food Safety Consultants builds an FSSC 22000 food safety management system across all three layers, ISO 22000:2018, the applicable ISO 22002 prerequisite standard and the scheme’s additional requirements, then prepares the site for its certification audit. ASC is a consultancy and not a certification body.
Consulting is charged hourly. A full implementation is quoted on scope once ASC has seen the site and the size of the gap, and ASC will tell you before the quote if the work is smaller than you think.
FSSC 22000 is a GFSI recognised certification scheme built on three layers a certified site has to satisfy at once: ISO 22000:2018 for the management system, a sector specific prerequisite programme standard from the ISO 22002 series, and a set of additional requirements published by the scheme owner. ASC builds that system with you, runs it in with your team, and prepares the site for the audit that decides certification.
Each layer is audited differently. ISO 22000:2018 is tested on whether the management system genuinely controls food safety, from leadership and planning through competence, operational control and performance evaluation. The prerequisite standard is tested on the floor: the building, the utilities, the cleaning, the pest control. The additional requirements are tested on evidence, and that is where first time sites most often lose ground, because none of it sat in the old HACCP file.
Sites that treat FSSC 22000 as a document exercise fail. An auditor does not grade the manual. They pull a monitoring record from a night shift, follow it back to the operator who wrote it, then forward into the verification that should have caught the deviation. Hygiene is also a legal matter. R638 of 22 June 2018, made under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, sets the general hygiene requirements for food premises and the transport of food, and requires a valid certificate of acceptability from the local authority. FSSC 22000 sits above that floor rather than replacing it.
Key facts at a glance
When a business calls ASC in
- A retailer or export buyer has set a certification deadline, and the site has a HACCP file but no management system.
- The HACCP plan is years old and has never been mapped against ISO 22000:2018, the applicable ISO 22002 standard or the additional requirements.
- A certification body has raised findings the site cannot close in the time allowed.
- A certificate is held but internal audits are behind, management review has lapsed and corrective actions sit open.
How ASC works with you
Scoping and a gap analysis against all three layers
Scope decides which standard the site is audited against, because your food chain category fixes the prerequisite programme standard that applies: ISO 22002-1 for food manufacturing, with separate parts covering food packaging manufacturing, transport and storage, catering and farming. Getting it wrong is expensive, because the whole prerequisite set is then rewritten. ASC confirms the category, agrees the scope, then audits against all three layers in one pass. The output is a gap register naming the requirement, the evidence, the gap, the owner and a date, sequenced so the slowest work starts first.
Hazard analysis, prerequisite programmes and validation
The HACCP study is rebuilt with your team, because the auditor interviews the team and not the consultant. That means flow diagrams verified on the floor while the line runs, hazards identified at each step as biological, chemical, physical or allergen, and control measures sorted into critical control points and operational prerequisite programmes on evidence rather than habit. Critical limits then have to be validated, the step most often missing: a thermal process needs its kill step justified against the target organism, and a metal detector needs its sensitivity established on the actual product and pack, work ASC carries out under food science and technology support. Verification then asks whether monitoring is done correctly and the results show the plan working. ASC also builds or repairs the prerequisite programmes ISO 22002-1 requires of a manufacturing site, from construction and utilities through cleaning, pest control, personnel hygiene and warehousing, aligned with R638 so that one set of rules serves both the scheme and the law.
Additional requirements, governance and audit preparation
The additional requirements produce predictable findings, each with an evidence trail an auditor asks for by name.
- Food fraud vulnerability assessment: the data behind each score across raw materials, packaging and services, the mitigation plan flowing from the high scores, and evidence of review.
- Food defence threat assessment: the site, its access points, deliveries and utilities assessed, the resulting plan, and evidence it has been tested rather than only written.
- Allergen management: allergens handled, the cross contact risk assessment, validated cleaning between products, rework rules, and label checks against R146 of 1 March 2010, with precautionary wording only where a risk assessment supports it.
- Environmental monitoring: a sampling plan with a rationale for the sites and frequencies, results trended over time, and documented action when a trend moves the wrong way. It cannot start a month before the audit.
- Food safety culture: objectives set by senior management, a plan covering communication, training, feedback and measurement, and evidence progress has been reviewed.
Three systems decide whether this survives after ASC leaves: internal audit, corrective action and management review. ASC trains your internal auditors, then runs a full internal audit against all three layers, two and a half to three days on site depending on the size of the operation. Findings go to management on the last day, with the written report within two weeks of the closing meeting. Corrective action is taught as root cause work with verified effectiveness, and management review is built on real inputs so the meeting produces decisions rather than minutes. ASC then readies the site for stage 1 and stage 2, and closes whatever stage 1 raises.
What you receive
| Deliverable | What it contains |
|---|---|
| Scope and gap analysis report | Confirmed food chain category and scope, with findings against all three layers, each with an owner, a priority and a date. |
| Hazard analysis and HACCP pack | Verified flow diagrams, hazard assessment, control measure selection, validated critical limits, monitoring and verification. |
| Prerequisite programme set | Procedures, work instructions and records covering the ISO 22002-1 areas, written to match the plant and aligned with R638. |
| Additional requirements pack | Food fraud and food defence assessments, allergen controls, an environmental monitoring plan, and a food safety culture plan. |
| Internal audit and readiness programme | Audit schedule, auditor competence, checklists across all three layers, a full internal audit of two and a half to three days on site with the report within two weeks, a management review record and a stage 1 readiness check. |
Everything you need for FSSC 22000, in one place
Consulting is one route. If you would rather build it yourself, train your own team first, or read before you commit, ASC publishes all three.
Do it yourself
Editable ASC document toolkits and templates, built by the same auditors who run the audits.
Train your team
Accredited online courses on ascfoodsafetytraining.com, studied at your own pace with certificates on completion.
Read first
Free guidance from the ASC library, written for South African food businesses.
Who this work suits
This suits manufacturers and processors of every size, from dairy, meat and poultry to bakery, beverages, snacks, spice blending and fresh produce packhouses. Contract packers, food packaging manufacturers, cold stores and distribution operators fit equally, where the hazards and the prerequisite standard differ but the management system requirements do not.
ASC is led by Mthokozisi Nkosi, a SAATCA registered lead auditor, is a FoodBev SETA Accredited Provider No. 587/00337/1900 and is B-BBEE Level 1. Consulting is charged by the hour, while a full implementation is a project running over days or weeks, quoted once the scope and the starting point are agreed.
Where ASC stops
ASC is a consultancy and not a certification body. ASC does not certify anyone, does not award a certificate against FSSC 22000 and cannot guarantee a certification result. That decision belongs to your chosen accredited certification body, on its own third party audit and independent review. The scheme documents are revised from time to time, so confirm the applicable version and its transition dates with your certification body before fixing an audit date.
Frequently asked questions
How long does an FSSC 22000 implementation take?
It depends on the starting point, the number of sites and how much usable evidence exists. The floor is set by how long evidence takes to mature rather than by how fast documents are written: monitoring results with a trend behind them, a completed internal audit cycle, and at least one management review with real inputs.
Which ISO 22002 standard applies to our operation?
That follows from your food chain category, and food manufacturing sites work to ISO 22002-1. Your certification body confirms the category when it defines the audit, so settle it before the prerequisite programmes are written.
Is FSSC 22000 required by South African law?
No. The legal requirement comes from the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and the general hygiene requirements in R638 of 22 June 2018, enforced by environmental health practitioners from your local authority. FSSC 22000 is voluntary and customer driven, and a certificate does not reduce what R638 requires of you.
What happens between the stage 1 and stage 2 audits?
Stage 1 is your certification body checking readiness across scope, documentation, hazard analysis, prerequisite programmes and evidence that internal audit and management review have run. Whatever it raises must be closed before stage 2, the full on site assessment of how the system works in practice. Ask your certification body how it schedules the cycle after certification, including any unannounced audit.
What happens if the certification audit still raises findings?
Some will. An audit that raises nothing at all is unusual, and the certification body is entitled to see things ASC did not. What ASC works to prevent is a finding against a requirement it built, and a finding the site cannot close inside the certification body’s deadline. ASC stays available while findings are closed, works each one back to a root cause rather than patching it, and gathers the closure evidence in the form the auditor asked for. ASC cannot guarantee the outcome, because the decision belongs to the certification body, and any consultant who guarantees it is telling you something they cannot deliver.
Get an honest read on your FSSC 22000 gap
Tell ASC the site, the food chain category and the date your customer has set. A senior consultant will come back with a scope and a quotation, and will say plainly if the date is not achievable.
Not ready for a quote? Use Where Do I Start to see which standard your market actually needs, or book a virtual consultation.