FSSC 22000 V6 Explained: Scope and Audit Pack

Compliance snapshot

FSSC 22000 Version 6 was published on 31 March 2023 and became the version audits are conducted against from 1 April 2024. Foundation FSSC reported over 40,000 certified organizations in more than 150 countries in its 2025 annual report.

The certificate is a management system certificate, not a product certificate. What it covers is defined by the scope line, and a process the supplier outsources sits outside that line.

Version 7 was published on 1 May 2026. Version 6 audits run until 30 April 2027, so a V6 certificate is the document buyers will keep seeing through the 2026 and 2027 sourcing seasons.

The comparison table below sets BRCGS against FSSC 22000 V6 for a listing decision, and the audit pack section lists what to request beyond the certificate itself.

Silk Foods Ceylon in Matale holds BRCGS and FSSC 22000 V6, with USDA Organic and EU Organic on the relevant lines.

A supplier sends a certificate. It is current, it carries the scheme logo, and the buyer files it. Six months later a retailer asks which site sterilized the product, and the answer is a subcontractor that never appeared on the certificate at all.

That gap is not fraud. It is what happens when a buyer reads the certificate and skips the scope statement. The scope statement is where the standard does its actual work, and it is the part most supplier approval files never open.

What FSSC 22000 V6 actually is

FSSC 22000 is not a single standard. It is three documents stacked: ISO 22000 for the food safety management system, a sector-specific prerequisite programme standard from the ISO 22002 series, and a set of additional requirements written by Foundation FSSC. A site can hold ISO 22000 alone and not be FSSC certified. The additional requirements are the difference, and they are where most of the buyer-relevant content sits.

Version 6 replaced Version 5.1 on a fixed timetable. Foundation FSSC published it on 31 March 2023, certification bodies began auditing against it on 1 April 2024, and every certified organization had to complete its upgrade audit by 31 March 2025. Any V6 certificate in circulation today has already been through that upgrade.

Scale matters for what the certificate signals. In its 2025 annual report, published April 2026, Foundation FSSC put the scheme at over 40,000 certified organizations across more than 150 countries. That is broad enough that certification is a filter rather than a distinction. It removes uncertified suppliers from consideration. It does not, by itself, separate two certified ones.

What changed when Version 6 replaced Version 5.1

Five additional requirements were new in Version 6. Food safety and quality culture broadened the existing culture requirement so it covers quality, not food safety alone. Quality control arrived as a requirement in its own right, absorbing what had been a separate FSSC 22000 quality scheme. Food loss and waste requires a documented policy and objectives extending into the supply chain. Equipment management requires hygienic design assessment when new equipment is purchased or installed. Communication requirements set out notification duties for serious events.

Several requirements carried over from V5.1 but were tightened. Management of allergens expanded substantially, requiring a site allergen list, documented validation and verification of the controls, and allergen training. Food fraud vulnerability assessment was widened. Food defense, environmental monitoring, and hazard control carried forward.

For a buyer, the allergen change is usually the one worth reading against. A supplier certified under V5.1 could satisfy an allergen requirement with a procedure. Under V6 the site has to show the controls were validated and that people were trained on them. If a buyer is sourcing a shared-line product, that evidence is now on the certificate’s side of the ledger and can be requested directly.

Version 6 also added a QR code and a certificate identification number to the certificate itself, which makes verification against the public register a matter of seconds rather than an email exchange.

Why the scope line matters more than the certificate

Foundation FSSC publishes a separate document, Annex 1 on certification body scope statements, that governs exactly what a scope line may and may not say. It is ten pages, it is public, and almost no buyer reads it. It rewards the ones who do.

The controlling sentence is that FSSC 22000 is a management system certification, not a product certification. From there the rules get specific. Applied technologies that affect food safety must be named in the scope, and drying, sterilization, pasteurization, and fermentation are given as examples. Brand names are not allowed. Promotional claims are not allowed either, so organic, free-from, origin, and health claims cannot appear in a scope line even when the company legitimately makes them elsewhere.

The exclusions rule is the one with teeth. Nothing that influences end-product food safety can be excluded. Where a permitted exclusion does apply, the certificate must carry the words “Exclusions apply” followed by the excluded products, processes, or services. A buyer who never scans for that phrase can miss the single most important line on the document.

Scope line element	Status under Annex 1	What a buyer should do
Drying, sterilization, pasteurization, fermentation	Must be named where it affects food safety	Confirm the process you depend on is written there
Brand names	Not allowed	Do not expect your own brand to appear
Organic, free-from, origin, health claims	Not allowed in the scope	Verify these through separate per-SKU certificates
”Sales”, “marketing”, “exporting”, “importing”	Not allowed	Treat their presence as a red flag on a forged or misread document
Outsourced processes outside the supplier’s legal control	Shall not appear	Ask who holds certification for that step
Permitted exclusions	Must be stated as “Exclusions apply: …”	Search the certificate for this exact phrase
Storage and distribution added to a manufacturing scope	Only if dedicated to own production and the same legal entity	Third-party logistics needs its own certification

Three traps catch Ceylon sourcing specifically. Sterilization is the first: if a spice supplier sends product out for steam or ethylene oxide treatment, that step is legally outside their scope and belongs to whoever performs it. The second is the trader problem. Because the words exporting and importing may never appear in a scope, a trading company’s certificate covers trading and brokering, not manufacturing, and the two are different food chain categories. The third is herbal capsules, which sit close to the boundary where the scheme stops covering food and self-medication products begin. A capsule scope needs to be written carefully, and a buyer is entitled to read it closely.

Certification snapshot Silk Foods Ceylon, Matale, Sri Lanka

BRCGS, covering drying, grinding and sieving of teas, powders, spices and coconut derivatives, cutting and cooking of vegan patties and nuggets, milk-alternative processing, and jam and syrup processing

FSSC 22000 V6, covering the processing scope including spices, herbals, capsules, plant-based milks, spray-dried and fruit powders, coconut spreads, jackfruit in brine, plant-based meat alternatives, and beverages

USDA Organic and EU Organic on the relevant products, issued per SKU

Halal and kosher issued per SKU on request

Does the certificate get a supplier onto a retail listing?

Partly, and the distinction is worth getting right before a buyer promises anything internally.

FSSC 22000 Version 6 was recognised by the Global Food Safety Initiative on 23 August 2024, benchmarked against the GFSI Benchmarking Requirements version 2020. One detail from that announcement changes how a certificate should be read: only certificates issued on or after 23 August 2024 carry the Version 6 recognition. An older certificate is not equivalent, and a buyer checking GFSI status has to look at the issue date, not just the version number.

What recognition buys is reach across customers rather than an automatic listing. Walmart’s published food safety requirements make the shape of this clear. Suppliers in its supply chain must hold certification to a GFSI-recognised standard, renewed annually, at every manufacturing site rather than at head office, and co-manufacturers must each hold their own. Government inspections are explicitly not accepted as a substitute. The requirement is a precondition of doing business, not a scoring advantage.

The important limit runs the other way. The US Food and Drug Administration states that a third-party audit used for supply-chain verification must be conducted by a qualified auditor and consider applicable food safety regulations, and that the receiving facility keeps responsibility either way. A GFSI certificate does not automatically discharge a US importer’s obligations. Buyers who assume it does are the ones who discover the gap during an inspection.

BRCGS and FSSC 22000 V6, side by side for a listing decision

Both are GFSI-recognised. They are not interchangeable, and which one gates a listing depends on the retailer more than on the product.

Consideration	BRCGS	FSSC 22000 V6
Underlying structure	A standalone standard with its own clauses	ISO 22000 plus sector prerequisite programmes plus FSSC additional requirements
Typical gating use	UK and EU multiple grocery own-label listings	Multinational manufacturer and ingredient buyer qualification
Audit announcement	Announced and unannounced options	At least one unannounced surveillance audit within each three-year cycle
Grading	Graded outcome	Certified or not, no grade on the face of the certificate
Scope discipline	Category-based	Governed by the published Annex 1 scope statement rules
Best read alongside	The full audit report	The scope line and the public register entry

The unannounced audit requirement is the item most buyers under-use. Because FSSC requires at least one unannounced surveillance audit in every three-year cycle, asking a supplier where they sit in that cycle is a fair and answerable question. A site that has already taken its unannounced audit has been observed working normally, not working for an audit date.

What to ask for in the audit pack

There is no published standard defining a supplier approval pack, and any list that claims otherwise is describing commercial practice rather than a requirement. The defensible way to build one is to work backwards from what a regulator or retailer actually imposes.

Two of those are hard requirements. Walmart names the GFSI certificate, the complete final audit report rather than the certificate alone, the food safety plan, and the preventive control hazard analysis. The FDA’s Foreign Supplier Verification Programs rule puts an annual on-site audit as the default verification activity where the foreign supplier controls a hazard requiring a control, unless the importer documents a written determination that other activities give adequate assurance. That rule is the reason a US buyer asks a Sri Lankan supplier for so much paper. It is their obligation, not an act of suspicion.

Buyer’s checklist: the FSSC 22000 V6 audit pack

The certificate, with the issue date checked against 23 August 2024 for GFSI Version 6 recognition

The scope statement, read in full, searched for the phrase “Exclusions apply”

The complete final audit report, not the certificate alone

Position in the three-year cycle, and whether the unannounced surveillance audit has happened

Non-conformity and corrective action close-out status from the most recent audit

The site allergen list and evidence that allergen controls were validated

Certification held by any subcontractor performing sterilization, drying, or storage

Per-batch certificate of analysis, with the testing parameters named rather than assumed

The last four are practice rather than scheme requirements, and framing them that way with a supplier tends to get faster answers than presenting them as mandatory.

How the certificate connects to US and EU import rules

Certification and import law are separate systems that buyers routinely conflate.

In the European Union, Regulation (EC) No 178/2002 puts a traceability duty on every food business operator, importers included: identify the immediate supplier and the immediate customer, and produce that on demand. One step back, one step forward. Regulation (EU) 2017/625 provides the legal basis for import controls at border control posts. Neither references a private certification scheme, which is why an EU importer pushes a records demand down to a Sri Lankan supplier regardless of what certificates that supplier holds.

In the United States, the traceability picture is genuinely unsettled and worth stating carefully. The FSMA food traceability rule reaches foreign firms producing food for US consumption and requires traceability lot codes and key data elements across seven critical tracking events for foods on the Food Traceability List, produced to the FDA within 24 hours of a request. The original compliance date was 20 January 2026. The FDA has proposed a 30-month extension to 20 July 2028, and Congress has directed the agency not to enforce the rule before that date. As of the FDA’s own page update in July 2026, the extension is still described as proposed. Buyers should treat 20 July 2028 as the working date while noting that the final rule codifying it has not been confirmed published, and should check whether a specific product actually appears on the Food Traceability List, since most plain dried spices and coconut products do not.

Sri Lankan origin carries its own context here. A World Trade Organization-hosted Standards and Trade Development Facility project on Sri Lankan spices records annual exports of roughly 30,000 tonnes, a top-ten world position in cloves and nutmeg, and more than 70 percent of holdings under one hectare. That fragmentation at the farm end is exactly why traceability depth, rather than certification alone, is the thing worth interrogating in this origin. The per-lot testing discipline behind a certificate of analysis is where that shows up in practice, and the 2026 Ceylon export compliance checklist covers the document set a shipment has to clear.

Version 7 is published, and what that means for a V6 certificate

Foundation FSSC published Version 7 on 1 May 2026. This does not make a V6 certificate stale, and the transition timetable is the reason.

Date	Status
31 March 2023	Version 6 published
1 April 2024	Audits conducted against Version 6
31 March 2025	Version 6 upgrade audits complete
1 May 2026	Version 7 published
30 April 2027	Last date for Version 6 audits
1 May 2027 to 30 April 2028	Version 7 upgrade audit window
1 May 2028	All audits against Version 7

Version 6 remains the version audits are conducted against until 30 April 2027, so it is the version on essentially every supplier certificate a buyer will review during the 2026 and 2027 seasons. Version 7 moves the scheme onto the 2025 revision of the ISO 22002 prerequisite series, adds packaging design considerations for food loss and waste, updates auditor competence, and introduces governance requirements covering artificial intelligence.

The practical instruction for a buyer is narrow. Do not treat a V6 certificate as expired, because it is not. Do ask a supplier when they are scheduled into the V7 upgrade window, because a site with no answer in 2027 is a site that has not planned its audit calendar.

Where Silk Route Ventures is not the right fit

A buyer whose approval process needs Demeter, Naturland, or Bio Suisse certification specifically will not find it here. Silk Route Ventures (SRV) holds USDA Organic and EU Organic, and for those heavier European organic stacks a sourcing-agent partnership is the honest answer rather than a certificate that does not exist. The same applies to buyers competing purely on shelf price below the Ceylon premium, where a competent Vietnamese or Indonesian processor is the better match.

Frequently asked questions

Is an FSSC 22000 V6 certificate still valid now that Version 7 has been published?

Yes. Foundation FSSC published Version 7 on 1 May 2026, but audits continue to be conducted against Version 6 until 30 April 2027, with the Version 7 upgrade window running from 1 May 2027 to 30 April 2028. A current V6 certificate is the expected document throughout 2026 and 2027.

What is the difference between FSSC 22000 and BRCGS?

Both are recognised by the Global Food Safety Initiative but they are built differently. FSSC 22000 combines ISO 22000 with sector prerequisite programmes and additional requirements. BRCGS is a standalone graded standard, and it is more often the gating certificate for UK and European multiple grocery own-label listings.

Why does the scope statement matter if the certificate is valid?

Because FSSC 22000 certifies a management system, not a product. Foundation FSSC’s Annex 1 rules bar brand names and promotional claims from a scope, require food-safety-relevant technologies such as drying and sterilization to be named, and require the words “Exclusions apply” where an exclusion has been permitted.

Is the Silk Foods Ceylon facility audited under BRCGS and FSSC 22000 V6 for spice and herb processing?

Yes. The Silk Foods Ceylon (SFC) site in Matale holds BRCGS and FSSC 22000 V6 across its processing scope, covering spices, herbs, powders, capsules, plant-based formats, and beverages, with USDA Organic and EU Organic on the relevant products. Buyers can request the certificate and scope statement alongside a first sample.

How Silk Route Ventures can help

Silk Route Ventures (SRV) supplies bulk and private-label ingredients, and contract-manufactures finished SKUs, from the Silk Foods Ceylon (SFC) facility at Nalanda in Matale, one kilometre from the Nalanda Gedige and inside the country’s historical spice growing belt. The site holds BRCGS and FSSC 22000 V6 across its processing scope, with USDA Organic and EU Organic on the relevant lines, and its cellular manufacturing layout carries more than 400 SKU variants without a separate audit cycle for each new introduction. First-order minimums start at 50 kilograms per SKU on dried botanicals, with samples dispatched in three to five business days and production orders shipping two to three weeks from purchase order. Every batch carries a certificate of analysis, and traceability runs to farm level. To request the certificate and scope statement, or a co-manufacturing capability briefing for a specific SKU, contact us.

Sources

Foundation FSSC, “FSSC 22000 Version 6 Becomes Mandatory as of 1 April 2024,” 2024. https://www.fssc.com/insights/fssc-22000-version-6-becomes-mandatory-as-of-1-april-2024/ (retrieved 5 September 2026)
Foundation FSSC, “FSSC 22000 Scheme,” 2026. https://www.fssc.com/fssc-22000/ (retrieved 5 September 2026)
Foundation FSSC, “FSSC Annual Report 2025,” 2026. https://www.fssc.com/insights/fssc-annual-report-2025/ (retrieved 5 September 2026)
Foundation FSSC, “FSSC 22000 Version 6 FAQ,” 2024. https://www.fssc.com/fssc-22000/fssc-22000-version-6-faq/ (retrieved 5 September 2026)
Foundation FSSC, “Annex 1: CB Certificate Scope Statements, Version 6,” 2023. https://www.fssc.com/wp-content/uploads/2023/03/Annex-1_CB-scope-statements_Version-6.pdf (retrieved 5 September 2026)
Foundation FSSC, “FSSC 22000 Version 7: Key Changes Explained,” 2026. https://www.fssc.com/insights/fssc-22000-version-7-key-changes/ (retrieved 5 September 2026)
Global Food Safety Initiative, “FSSC 22000 v6 Gains GFSI Recognition,” 2024. https://mygfsi.com/press_releases/fssc-22000-v6-gains-gfsi-recognition/ (retrieved 5 September 2026)
US Food and Drug Administration, “FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods,” 2026. https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-final-rule-requirements-additional-traceability-records-certain-foods (retrieved 5 September 2026)
Office of the Federal Register, “Requirements for Additional Traceability Records for Certain Foods: Compliance Date Extension,” proposed rule, 2025. https://www.federalregister.gov/documents/2025/08/07/2025-14967/requirements-for-additional-traceability-records-for-certain-foods-compliance-date-extension (retrieved 5 September 2026)
US Food and Drug Administration, “Final Rule on Foreign Supplier Verification Programs: Key Requirements,” 2026. https://www.fda.gov/food/food-safety-modernization-act-fsma/final-rule-foreign-supplier-verification-programs-fsvp-key-requirements (retrieved 5 September 2026)
US Food and Drug Administration, “Industry Resources on Third-Party Audit Standards and FSMA Supplier Verification Requirements,” 2024. https://www.fda.gov/food/importing-food-products-united-states/industry-resources-third-party-audit-standards-and-fsma-supplier-verification-requirements (retrieved 5 September 2026)
Walmart, “Food Safety Requirements: National Branded Products, All Other Commodities,” 2026. https://enablement.walmart.com/content/food-safety/en_us/food-safety-requirements/national-branded-products/all-other-commodities.html (retrieved 5 September 2026)
European Commission, “Import Controls of Food and Feed: Questions and Answers,” 2026. https://food.ec.europa.eu/horizontal-topics/official-controls-and-enforcement/import-controls-food-and-feed-qas_en (retrieved 5 September 2026)
European Union, “Regulation (EC) No 178/2002 laying down the general principles and requirements of food law,” 2002. https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex:32002R0178 (retrieved 5 September 2026)
Standards and Trade Development Facility, “Strengthening Food Safety and Quality Compliance in Select Sri Lankan Spices,” STDF/PPG/721, 2020. https://standardsfacility.org/PPG-721 (retrieved 5 September 2026)

Written by the Silk Route Ventures Trade Team. Silk Route Ventures (E-Silk Route Ventures Ltd) is a Sri Lankan B2B supply-chain operator for the Food, Beverage, Wellness, and Nutraceuticals sectors. The Silk Foods Ceylon manufacturing arm holds BRCGS and FSSC 22000 V6 certifications, with USDA Organic and EU Organic on the relevant lines. Questions or to request a sample: Contact us or email info@esilkroute.com.lk.

FSSC 22000 V6 Explained: Scope, Audit Pack, and V7 Transition