to Version 4.1 All changes from version 3.2 to version 4 are highlighted in yellow. i 3.2 Prerequisite programmes 2.1.3 Prerequisite Programs (PRP) When establishing, implementing and maintaining the Prerequisite programmes (PRPs) in accordance with clause 7.2 of ISO 22000, the organization shall in addition to ISO 22000 requirements consider and utilise the requirements of technical specification for sector PRPs. Apart from these requirements, other appropriate information shall be considered and utilised especially: regulatory requirements, recognized sector or product group codes of practices and guidelines, customer requirements. The conditions of the PRPs shall be specified and documented, fully operational and verified in order to facilitate the successful application and implementation of an effective food safety management system. Exceptions where the requirements are not applicable shall be motivated in writing. ISO 22000 requires in clause 7.2 that organizations shall select and implement specific PRPs for basic hygiene conditions. Organizations establishing, implementing and maintaining these PRPs shall consider other appropriate information and utilize it accordingly. Such information shall include: a) regulatory requirements; b) recognized sector or product group codes of practices and guidelines; c) customer requirements. To facilitate the successful implementation of the food safety management system, the conditions of the PRPs shall be; a) specified, b) documented, c) approved and d) verified. 2.1.4 Additional requirements To meet the needs of the key stakeholders and to ensure an adequate control of food safety, specific additional FSSC requirements for the food safety management system are included in the Scheme. The changes require sites to establish which PRPs they need, based on a range of information sources. The PRPs must be applicable to their process and product. When the PRPs have been established, the clause now states that they must be clearly documented, approved and verified. This section now also defines which additional PRPs are required to meet the FSSC 22,00 standard. Each of these PRPs (such as food defence, food fraud) are detailed in the FSSC 22,000 standard. 1
to Version 4.1 1. Specifications for services The organization in the food chain shall ensure that all services (including utilities, transport and maintenance) which are provided and may have an impact on food safety: a) shall have specified requirements, b) shall be described in documents to the extent needed to conduct hazard analysis, c) shall be managed in conformance with the requirements of technical specification for sector PRPs. i These may be elaborations of the clauses in ISO 22000 and technical specifications for sector PRPs or additional requirements as outlined below. The additional Scheme requirements are: 1) Management of services 2) Product labelling 3) Food defense 4) Food fraud prevention 5) Logo use 6) Management of allergens 7) Environmental monitoring 8) Formulation of products (only for pet food for dogs and cats) 9) Management of natural resources (for animal production only) 2.1.4.1 Management of services 1) The organization in the food chain shall ensure that all services that are provided and may have an impact on food safety: a) have specified requirements, which are regularly reviewed, b) are described in documents to the extent needed to conduct hazard analysis, c) are managed in conformance with the requirements of technical specification for sector PRPs, d) are assessed and approved demonstrating compliance with specified requirements Change in title to the section. The specific requirements for service suppliers now need to reviewed regulatory to ensure that they are still applicable. There must be a approval process in place to ensure that service suppliers meet the specified requirements, and then, a monitoring programme to ensure that they continue to meet th specified requirements. Basically, this means that a supplier approval and monitoring programme is required now for service suppliers. 2
to Version 4.1 7. Food defence, bio vigilance and bioterrorism (extension to animal production) i e) are monitored, to assure continued service provider approval status. 2) The services referred to in 1) above shall include at least: a) utilities, b) transport and storage, c) maintenance, d) cleaning and e) outsourced activities. 3) The organization shall implement a system to assure that when analysis critical to the verification of food safety is undertaken, this is conducted by a competent laboratory that has the capability to produce precise and repeatable test results using validated test methods and best practices (e.g. successful participation in proficiency testing programs, regulatory approved programs or accreditation to international standards such as ISO 17025). 2.1.4.2 Product labelling The organization shall ensure that the finished product is labelled according to the applicable food regulations in the country of intended sale 2.1.4.3 Food defense 2.1.4.5.1 Threat assessment The FSSC then go on to clarify that company management system must apply these requirements to services suppliers, which are as a minimum are suppliers of utilities, transport and storage, maintenance, cleaning and any outsourced activities (such as production or packing). The standard also now requires the company to ensure that labs used are either approved to a certification standard or work to procedures that comply with the ISO 17025 standard. New section. Companies now need to ensure that the labelling on the product complies with the legislation, in which the product is going to be sold. Food defense is not a new section, but it have substantially expanded to include all food production. 3
to Version 4.1 The organization (Animal farm) shall assess the susceptibility of on-farm produced raw materials to potential acts of sabotage, vandalism or terrorism, identify the hazards and shall put in place appropriate protective measures to protect animal health and public health i 1) The organization shall have a documented, and implemented threat assessment procedure place that: a) identifies potential threats, b) develops control measures, and c) prioritises them against the identified threats. 2) To identify the threats, the organization shall assess the susceptibility of its products to potential food defence acts. 2.1.4.3.2 Control measures The organization shall put in place appropriate control measures to reduce or eliminate the identified threats. 2.1.4.3.3 Plan 1) All policies, procedures and records are included in a food defense plan supported by the organization s food safety management system for all its products. 2) The plan shall comply with applicable legislation. 2.1.4.4 Food Fraud prevention 2.1.4.4.1 Vulnerability assessment 1) The organization shall have a documented, and implemented vulnerability assessment procedure in place that: a) identifies potential vulnerabilities, b) develops control measures, and 4 The site must have a documented food defence assessment in place, which covers threats on site and within the sites responsibility. Where threats are identified controls measures must be put in place. FSSC has changed the term used here from preventive measures to control measures, within the changes mad from version 4 to version 4.1. Personally, I think control is a bit of a strong word to use for threats as we can t control them as such, we can only protector ourselves from them. The requirement to review the plan has also been removed within the changers from version 4 to version 4.1. Instead, this was replaced with the requirement that it must meet applicable legislation. This is applicable in the US where the FSMA rules require a review, but I m not sure how this will work in the other parts of the world where the legislation does not require a food defence plan and therefore, a review is also not required. Will this mean that a review is not required to meet FSSC in this situation? This is a new section. This section is very aligned with the food defence plan requirements. The site must have a documented food fraud assessment in place, which covers threats due to financial gain.
to Version 4.1 i c) prioritises them against the identified vulnerabilities. 2) In order to identify the vulnerabilities, the organization shall assess the susceptibility of its products to potential acts of food fraud. 2.1.4. 4.2 Control measures The organization shall put in place appropriate control measures to reduce or eliminate the identified vulnerabilities. 2.1.4.4.3 Plan 1) All policies, procedures and records are included in a food defense plan supported by the organization s food safety management system for all its products. 2) The plan shall comply with applicable legislation. 2.1.4.6 Management of allergens (for categories C, I and K only) 1) A documented allergen management plan shall be in place that includes: a) risk assessment addressing potential allergen cross contamination; b) control measures to reduce or eliminate the risk of cross contamination; c) validation and verification of effective implementation. Again, control measures need to be applied where threats are highlighted and the assessment must meet the legislation. New section. A documented risk assessment is now required. Where the risk assessment highlights a crosscontamination risk, control measures must be applied. Control measures must be validated, where they can be, such as hygiene procedures. 5
to Version 4.1 i 2) All finished products intentionally or potentially containing allergenic materials are labeled according to the allergen labelling regulations in the country of manufacture and country of destination. 2.1.4.7 Environmental monitoring (for categories C, I and K only) The organization shall ensure that an environmental monitoring program is in place to verify the effectiveness of cleaning and sanitation programs which shall meet the verification requirements as described in ISO 22000. Verification must also be implemented to show that the validation continues to be effective, such as routine swabbing. The standard also states that the label must have accurate allergen declarations on it, which are suitable for the county in which the product is going to be sold. New section. A monitoring program is now required for environmental standards, applicable to the type of process and product being produced. This would require verification activities, such as listeria swabbing for chilled ready to eat production areas or mould air plates for bakery environments. 6