FSSC 22000 Version 7 Consultant: The Certification Path in Morocco

What does FSSC 22000 Version 7 certification actually require?

It requires three building blocks audited at the same time: the ISO 22000:2018 standard, the ISO 22002-x:2025 prerequisite programmes (PRPs) for your category and the FSSC additional requirements. That is what Part 1 of the FSSC 22000 Version 7 scheme sets out; the Foundation FSSC published it in May 2026.

Many managers, in Morocco and elsewhere, still think of it as “HACCP plus a few procedures”. That is not enough. The auditor checks a complete management system, hygiene conditions measured on the shop floor and requirements specific to the scheme.

Which ISO 22002 part applies to your site?

Part 100 applies to everyone except trading without physical handling (subcategory FII). It is combined with a sector part, set by Table 1 in Part 1 of the scheme.

A point to watch: these texts are no longer “ISO/TS” technical specifications. They are international standards published in 2025. A site that still relies on its old ISO/TS documents must replace them.

What do you need in place before starting the project?

The first prerequisite is regulatory: the sanitary authorisation or approval issued by ONSSA (Office National de Sécurité Sanitaire des Produits Alimentaires), Morocco’s national food safety office. No serious certification body will certify a site that does not comply with the law of its own country, and exporting requires that sanitary number in any case.

According to ONSSA, food businesses must hold sanitary approval and/or authorisation under Law 28-07 on the safety of food products and its implementing Decree 2-10-473. The application is filed with the inspection service of the province where the site is located. Outside Morocco, the equivalent national food safety registration plays the same role.

Then come the internal prerequisites:

• A valid ONSSA authorisation or approval, with an activity scope that matches the certification scope you are aiming for.
  
• An existing HACCP plan, even an imperfect one, with an identified HACCP team.
  
• Written commitment from top management: budget, resources, timetable.
  
• A food safety manager available at least half-time for the project.
  
• A list of customers and their requirements: scheme requested, specifications, countries of sale.
  
• FSSC category identified (C, G, I…) and an estimate of the number of HACCP studies.
  
• An up-to-date site plan showing product, staff and waste flows.
  

The customer list is decisive. FSSC 22000 is one of the programmes recognised by the GFSI, like BRCGS and IFS. But some buyers have a preference. Check with your customers, in writing, before you choose. If you are still weighing the options, our GFSI standards comparison sets them side by side. On the GFSI side, the page of recognised programmes still lists Version 6, recognised against the 2020 benchmarking requirements; Version 7 is undergoing benchmarking against version 2024, at the GFSI final decision step (page checked on 6 November 2026).

How does FSSC 22000 consultant support work, step by step?

It runs in seven preparation steps, followed by the certification audit and then maintenance. Each step produces a deliverable you can check. Without a deliverable, the step is not finished.

What role does top management play?

An active one, and it is checked at audit. ISO 22000:2018 requires top management to demonstrate leadership; additional requirement 2.5.8 goes further. Management must set food safety and quality culture objectives, provide resources and follow a plan with targets and deadlines, reported at management review.

In Moroccan SMEs, the classic pitfall is to delegate everything to the quality manager. The auditor notices quickly: they interview the general manager, the production manager and team leaders, not just the quality department. Three decisions belong to management and nobody else: the budget for building works, the availability of teams for training, and the trade-off between production speed and food safety.

How does the certification audit itself work?

The initial audit takes place in two stages. Stage 1 checks that the system is ready; Stage 2 checks how it is implemented on the shop floor. The scheme allows no more than six months between the two. Beyond that, Stage 1 must be repeated.

Findings are graded at three levels. A minor nonconformity requires an action plan accepted by the certification body within 28 calendar days. A major nonconformity must be closed within 28 days; at an initial audit, missing that deadline means repeating the whole of Stage 2. A critical nonconformity at an initial audit means the audit fails: everything has to be done again.

On site, at least half of the audit time is spent on operational control: plant tour, traceability exercise, checks of PRP and control measure records. Flawless paperwork does not make up for a poorly kept workshop. So prepare your shop-floor teams as carefully as your documents: the operator on the packing line should be able to explain, in their own words, what they monitor and what they do when something drifts.

The certificate is valid for a three-year cycle, with two annual surveillance audits. At least one surveillance audit per three-year period is unannounced. The site must therefore be ready every day, not just in the week of the audit.

Maintenance is the eighth step, and the longest. It relies on an internal audit programme, routine PRP inspections, the annual review of the allergen and environmental monitoring plans, and a management review that genuinely uses the data. A site that eases off after certification usually finds out at its first unannounced surveillance audit.

Which FSSC additional requirements make the difference at audit?

The additional requirements are the most scheme-specific part of FSSC 22000. Section 2.5 of Version 7 contains 18 of them. Some apply to all categories, others to specific subcategories. The Foundation FSSC’s official page refers to the scheme for the full text.

These are the ones that take the most work in a Moroccan plant:

• 2.5.1 Services and purchased materials. Analyses that verify or validate a critical parameter must be carried out by a competent laboratory, internal or external, in line with the applicable ISO/IEC 17025 requirements. For an exporter, that usually means pesticide residue or microbiological testing.
• 2.5.2 Labelling. Labels must comply with the regulations of the country of sale. A product made in Agadir for a European customer follows the rules of the destination market, allergens included. Any claim (origin, production method) must be substantiated, with a mass balance to back it up.
• 2.5.3 and 2.5.4 Food defence and food fraud. Threat and vulnerability assessments, with mitigation plans kept up to date by competent people.
• 2.5.6 Allergens. A list of the allergens on site, a cross-contact risk assessment, cleaning validation and at least an annual review.
• 2.5.7 Environmental monitoring. For categories BIII, C, I and K: a risk-based programme, trend analysis and at least an annual review.
• 2.5.8 Food safety and quality culture. Objectives set by management, a plan with targets and deadlines, performance measurement.
• 2.5.9 Quality control. Quality policy and objectives, quantity control (weight, volume), start-up and changeover procedures.
• 2.5.11 Foreign matter. A risk assessment to justify metal detectors, X-ray, magnets or sieves, and breakage management.
• 2.5.12 PRP verification. Regular site inspections, monthly for example, at a risk-based frequency.
• 2.5.13 Design and development. A procedure for any new product or process change; for sites that design primary packaging, design principles aimed at reducing food loss.
• 2.5.15 Equipment. Purchase specifications that include hygienic design, and change management.
• 2.5.16 Food loss and waste. A policy, measurable objectives, and control of donations and of by-products sent for animal feed.
• 2.5.17 Communication. The certification body must be informed within 3 working days of a serious event: public recall, regulatory action, legal proceedings.

The remaining headings cover use of the logo, transport and storage (FEFO and FIFO, tankers), traceability in slaughtering and multi-site organisations.

When should you target Version 7 if you start today?

Right away. The Foundation FSSC has set a clear timetable in its upgrade process document: audits against the previous version are only possible until 30 April 2027, and v7 upgrade audits run from 1 May 2027 to 30 April 2028.

For an initial audit, the rule is as follows: if the audit takes place from 1 May 2027, Stages 1 and 2 are both carried out against v7. A Stage 1 held before that date may still follow the previous version, but a Stage 2 held from 1 May 2027 is a v7 audit.

In practice, a Moroccan site launching its project in late 2026 will, in most cases, be audited after 1 May 2027. Building the system on v7 from the gap analysis onwards avoids writing the documentation twice. If your initial audit really has to take place before that date, ask the certification body to confirm in writing which version will be applied and when your later upgrade will take place. The full timetable is in our article FSSC 22000 Version 7: what changes and the transition timeline.

How do you choose an FSSC 22000 consultant?

Choose on evidence, not on a brochure. A good consultant knows your category, has already taken sites all the way to certification and can train your teams to run the system without them.

• Proven experience in your FSSC category (manufacturing, packaging, storage).
  
• Verifiable qualifications: IRCA lead auditor, auditor for GFSI-recognised schemes.
  
• Complete independence from the certification body you choose: the consultant will never be your auditor.
  
• A written method with deliverables for each step, not a “turnkey documentation” package.
  
• The ability to train in the site’s working languages (in Morocco, French and Arabic), on site, with assessment of what has been learned.
  
• A presence on the shop floor: an FSSC system cannot be built remotely.
  
• Follow-up after certification: internal audits, surveillance preparation, monitoring of scheme updates.
  

Be wary of promises of certification in record time. The certification body decides alone, on evidence. The consultant’s job is to make that evidence obvious.

What should a consultancy proposal contain?

A serious proposal reads like a project plan, not a price list. Ask for at least:

• the exact scope: site, activities, FSSC category, number of HACCP studies covered;
• the method, step by step, with the deliverables for each step;
• the number of days on site and remotely, and the names of the consultants involved;
• the training included, its audience, its language and how learning is assessed;
• what remains at your expense: building works, laboratory analyses, purchase of the ISO standards, certification body fees;
• the planning assumptions, in particular the target date for Stage 2 in light of the Version 7 timetable;
• the follow-up arrangements after certification.

Compare two proposals on these seven points, not on the total price. A cheaper offer that leaves out the mock audit or internal auditor training often costs more in the end: repeating Stage 2 weighs more heavily than a few extra days of consultancy.

To estimate the effort and the budget, read our article on FSSC 22000 certification cost in Morocco. If you are already certified, go straight to the v6 to v7 upgrade plan. And for a concrete example, see the typical case of a fruit juice producer in Agadir.