FSSC 22000 Gap Review NZ: Map Sector PRPs and Additional Requirements

An FSSC 22000 gap review should show where your food safety management system meets the applicable requirements, where evidence is missing and what needs to change. For a New Zealand manufacturer already working to ISO 22000, the useful question is how its actual activities and records match the additional certification basis.

Start with the intended products, processes and sites. Then agree the review criteria and connect them to evidence. This article gives a practical preparation method; it is not a complete scheme checklist or a certification decision. For the broader certification pathway, use the ISO 22000 certification guide.

Define the FSSC 22000 gap review question

Write a short purpose before requesting a quotation. For example: “Assess the readiness of our existing system for the agreed FSSC certification scope, identify evidence gaps and recommend an implementation sequence.” That is an illustrative brief, not a claim about an AFVA client.

Describe the products, process steps, shifts, site boundaries and relevant outsourced activities. Include supporting functions and interfaces where they affect the proposed system. A review limited to a document folder gives a different level of assurance from one that also observes operations and speaks with staff.

• Identify whether the project is an initial certification preparation, an expansion of scope or a scheme-version transition.
• State the customer requirement and target audit timing without treating a requested date as an achievable promise.
• Agree which locations, activities and records will be examined, and identify limitations.
• Separate the consultant’s preparation work from the independent certification body’s assessment.

Ask for a report that explains both the evidence examined and the areas not examined. “Ready” is too broad if the review excluded a relevant process, shift or location. A bounded conclusion is more useful than an unexplained percentage score.

Confirm the scheme version and sector PRPs

As checked on 5 November 2026, Foundation FSSC has published Version 7. Its Version 7 upgrade process permits Version 6 audits only through 30 April 2027 and sets the Version 7 upgrade-audit window at 1 May 2027 to 30 April 2028. Initial certification arrangements also change from 1 May 2027, including a provision for a Version 6 Stage 1 before that date followed by a Version 7 Stage 2 afterwards.

Agree the actual audit basis with the certification body before building the gap-review checklist. Keep today’s applicable criteria and future transition work separately labelled. Publication of a new version does not mean that every audit immediately uses it.

The FSSC 22000 Version 7 scheme combines ISO 22000, specified sector prerequisite programmes and additional FSSC requirements. Its scope mapping, decisions and interpretations also need attention. PRPs are the foundational operating conditions and activities supporting food safety; selecting their documents depends on the actual scope.

For the 2025 PRP structure, ISO 22002-100’s public description identifies the common foundation, used with relevant sector parts. ISO 22002-1:2025’s public scope concerns food manufacturing and is used with that common part. Do not apply the manufacturing part automatically to catering, storage, packaging or trading. Use the applicable scheme mapping, including any stated exceptions.

Obtain authorised copies of the applicable standards. Public descriptions and this article do not reproduce their complete requirements. Record document titles, editions and the basis for the chosen sector before assessing conformity.

Build an evidence map people can actually use

AFVA recommends a working map that connects a selected requirement with the process, evidence and decision. You can use a spreadsheet, controlled document or suitable system; the format below is a suggested organising method, not a prescribed FSSC form.

Start by indexing evidence already available. Use stable record references and accessible versions, rather than copying the same file into several folders. Where one record supports several criteria, show the relationship. Where a criterion needs several pieces of evidence, do not reduce the conclusion to a tick beside one procedure.

Keep three states distinct: evidence reviewed; evidence not yet supplied; and a supported conclusion that a gap exists. Missing access during a short visit is a limitation to resolve. It should not quietly become either proof of compliance or an unsupported allegation of failure.

Turn a concern into a reviewable gap

Consider this hypothetical preparation example. The reviewer is examining an applicable requirement selected from the agreed criteria. A manager provides a procedure, but the business has not yet located records demonstrating how the procedure operates across the selected activity. The following steps are recommended review practice, not a copied scheme finding.

1. Name the criterion and the relevant activity. Avoid a vague statement such as “FSSC paperwork missing”.
2. List the procedure and actual records examined, including the period and activity represented.
3. Describe the unanswered question: for example, whether the proposed evidence demonstrates the intended control in use.
4. Agree the next step: locate existing evidence, examine implementation or address a substantiated gap. Do not backfill records to make the file appear complete.
5. Identify who will review the response and what would show that the issue has been resolved.

A second example is a criterion marked “not applicable” without an explanation. The action is to establish the applicability decision against the actual scope and requirements, not to invent a document for an irrelevant activity. Retain the reason, supporting information and any certification-body clarification.

This approach also prevents a familiar planning problem: a long action list of new procedures that does not explain what existing arrangements already achieve. Reuse sound work where it meets the selected requirements, and focus effort on the unsupported decision or control.

Prepare a focused review brief and evidence pack

Gather enough information for the reviewer to plan the work. A concise index is usually easier to use than a large unstructured attachment. As an AFVA preparation recommendation, include:

• The proposed scope, current certificate details where relevant, customer request and agreed review purpose.
• The version and sector documents selected, with unresolved questions clearly identified.
• A process flow and description of relevant products, locations, shifts and outsourced activities.
• Current system documents and a representative index of operating records.
• Previous review reports, open actions, significant changes and relevant performance concerns.
• People responsible for the system, operational access arrangements and any confidentiality restrictions.

Ask the reviewer which evidence sample and operational access will be suitable for the agreed work. Do not create a universal “three months of records” rule merely because another business used that period. The useful sample depends on the review’s purpose, activities, changes and available operating history.

If an internal audit programme needs separate attention, the ISO 22000 internal audit programme guide explains coverage and priorities. An FSSC gap review should identify its own criteria and boundaries rather than relabelling an old audit report.

Prioritise actions and verify progress

After the review, distinguish an immediate operational concern from a preparation task. An active food-safety issue needs appropriate controls and competent assessment; its response should not wait for a future certification project. This guide does not decide product disposition or legal notification for an unidentified incident.

For the preparation plan, assign a responsible person, a realistic target and the evidence expected at completion. Separate clarifying applicability, correcting documents, implementing an arrangement and checking effectiveness. A single broad action such as “update the FSSC system” conceals those different jobs.

Retain the original gap and the response. When an action is checked, record the evidence considered, who checked it and any remaining limitation. If more work is needed, keep it open with a revised next step. A consultant’s closed action does not predetermine the certification body’s findings or decision.

Avoid common preparation mistakes

• Starting with an old downloaded checklist. Establish its version, scope and current relevance first.
• Treating ISO 22000 certification as automatic FSSC conformity. Examine the additional certification basis.
• Copying another sector’s PRPs. Confirm the scope mapping instead of choosing the most familiar document.
• Using document presence as the whole conclusion. Connect the written arrangement to implementation evidence.
• Hiding exclusions and access limits. Keep them visible in the report and follow-up plan.
• Calling a gap review certification. Preparation support and independent certification have different functions.

The aim is a manageable list of supported decisions and actions. Avoid an impressive-looking score that conceals uncertainty, or a promise that completing a consultant’s checklist guarantees the external outcome.

How AFVA can help with preparation

Access Food Verification & Auditing Limited provides ISO and FSSC gap-assessment, documentation, internal-audit and readiness support through its verified consulting service. AFVA is based in Auckland and supports New Zealand businesses. Agree the products, activities, evidence access, review criteria and deliverables before the work begins.

AFVA does not issue FSSC or ISO certificates. Certification is a separate assessment and decision by the appropriate certification body. Any regulatory verification, evaluation or other independent engagement also needs its own applicable scope and independence arrangements.

Frequently asked questions

Bring a defined gap-review question to AFVA

Prepare your proposed scope, customer request, current system information and the decision you need to resolve. That gives the discussion a useful starting point and helps define an appropriate review.

General information only. Scheme information checked 5 November 2026. Requirements depend on the actual scope, applicable documents and audit arrangements. Use authorised current requirements and confirm the review basis with your certification body. This article is not the complete standard, a site-specific compliance determination or certification.