FSSC 22000 Version 6: What the Nonconformity Data Tells Us

Have you ever wondered which nonconformities are most frequently identified during FSSC 22000 audits? If so, then look no further.

This article provides insight into some of the most common audit nonconformities and highlights key areas where organizations may benefit from strengthening their controls to enhance the effectiveness of their food safety management system and provide greater confidence in the safety of the food produced or supplied.

The article also highlights the requirements most frequently associated with nonconformities during FSSC 22000 Version 6 audits, regardless of their grading.

Note: The information is based on nonconformities recorded between April 2024 and May 2026 using data available in our Assurance Platform at the time of analysis.

Within this article we will explore why these requirements are important and provide guidance to help organizations strengthen implementation and reduce recurring findings.

What is a Nonconformity?

A nonconformity indicates that a specified requirement was not fully met. Audit findings may relate to documented information, operational planning and controls, infrastructure, competence, verification activities, or the effectiveness of implementation of the FSMS in practice.

The trended data reviewed for this article shows that many frequently identified findings concern routine operational controls. This reinforces an important principle: an effective food safety management system depends not only on documented procedures, but also on consistent implementation, monitoring, verification, and continual improvement.

Top 15 Nonconformities for FSSC 22000 V6

The sections that follow explore each of the top 15 nonconformities, explain why they matter, and provide practical points for organizations to consider. A summary of commonly identified findings is also included for each area to illustrate the types of issues observed during audits.

The points to consider are intended as practical prompts and do not represent additional Scheme requirements. Organizations should always refer to the applicable FSSC 22000 Scheme requirements, ISO standards, sector-specific PRP requirements, and applicable legal and customer requirements.

1. Physical contamination

Why it matters:

Controls intended to prevent foreign material contamination are essential to minimize the risk of unintended foreign objects entering food products. Potential contaminants may include glass, brittle plastic, metal, wood, stones, and other materials that could cause injury or present a choking hazard. Robust foreign material controls are therefore fundamental to protecting consumers and maintaining confidence that products manufactured by certified organizations are safe and suitable for their intended use.

Common findings:

Common findings included damaged or torn plastic strip curtains, loose bolts, nuts and washers, broken plastic conveyor belts, peeling or flaking paint, and deteriorating silicone on equipment, all of which may introduce foreign material into the product. Other potential physical contamination hazards, such as overhead lights, Perspex covers, wall clocks, control panels and display screens, were not always included in routine inspection checklists.

Points to consider:

• Are equipment, structures and components intact and free from damage, deterioration or loose/missing parts that could contaminate the product?
• Have all potential foreign material sources been identified, controlled and included in routine inspections?
• Where damage or missing pieces are identified, has the organization assessed where the material went and whether product may have been contaminated?
• Are identified defects recorded, investigated and corrected promptly, with appropriate actions taken to protect affected product?

Requirement: ISO/TS 22002-1:2009, clause 10.4 and ISO/TS 22002-4:2013, clause 4.7.3

2. Preventive and corrective maintenance

Why it matters:

Effective maintenance helps ensure that buildings, utilities, and equipment remain in a condition that supports safe food production and does not introduce food safety hazards. Weaknesses in maintenance controls may result in equipment deterioration, foreign material contamination, chemical contamination, or loss of control over processes important to food safety.

Nonconformities may arise when preventive maintenance is overdue or not completed as planned, temporary repairs introduce or increase food safety risks, equipment defects are not addressed, or adequate controls are not applied before equipment is released back into production following maintenance activities.

Common findings:

Common findings included missing or outdated preventive maintenance records, unresolved equipment defects, insufficient evidence of the food safety suitability of lubricants, and missing training records for maintenance personnel. In some cases, changes to equipment associated with Critical Control Points (CCPs) had also not been adequately validated.

Points to consider:

• Are maintenance activities completed as planned, with equipment and infrastructure defects promptly identified, recorded, and corrected?
• Are maintenance materials suitable for their intended use, and are personnel and contractors competent in the relevant food safety requirements?
• Following maintenance or equipment changes, are appropriate cleaning, inspection, verification and, where required, validation activities completed before equipment is returned to production?

Requirement: ISO/TS 22002-1:2009, clause 8.6

3. Quality control

Why it matters:

Effective quality control helps ensure that materials, operational processes, packaging, labelling, and finished products meet defined requirements before product release. Weak or inconsistently applied controls may reduce confidence that out-of-specification or otherwise unsuitable products will be identified and appropriately controlled.

Common findings:

Common findings included missing or inadequately defined quality objectives, quantity controls, line start-up and changeover procedures, and quality control parameters. Other findings were related to outdated procedures, failure to review quality control results during management review, and insufficient evidence that products, packaging, and labelling met applicable legal and customer requirements. 

Points to consider:

• Are quality objectives, parameters and quantity controls clearly defined, documented, monitored, and achieved?
• Are appropriate controls implemented during production, start-up, changeover, product release, packaging, and labelling to verify that defined legal, customer, and product requirements are met?
• Are quality control results and trends reviewed, including through management review, and are procedures kept up to date when requirements or processes change?

Requirement: FSSC 22000 Additional Requirement, clause 2.5.9

4. Traceability system

Why it matters:

An effective traceability system enables an organization to identify and track raw materials, intermediate products, rework, packaging, and finished products throughout the production process. Reliable traceability is essential for rapidly identifying and locating potentially unsafe or nonconforming products and supports effective incident management, product withdrawal, and recall.

Common findings:

Common findings included planned traceability exercises not being completed in accordance with established procedures, inadequate testing of system effectiveness, and exercises that did not consider all relevant inputs and products. Other findings included decanted materials that could not be traced while in use and traceability records that could not be readily retrieved during the audit.

Points to consider:

• Can materials and products be effectively traced through all relevant stages, including raw materials, packaging, intermediate products, rework, decanted materials, and finished products?
• Is the traceability system tested at a planned frequency and across its full scope, including relevant inputs and outputs?
• Can required traceability information be accurately and promptly retrieved when needed, and are weaknesses identified during exercises investigated and corrected?

Requirement: ISO 22000:2018, clause 8.3

5. Internal audit

Why it matters:

Internal audits provide a systematic and independent means of evaluating whether the food safety management system is effectively implemented and maintained. An ineffective internal audit programme may allow gaps, recurring issues, or systemic weaknesses to remain undetected until they are identified during an external audit or result in a food safety incident.

Common findings:

Common findings included internal audits not being completed as planned, incomplete coverage of production and technical areas, and off-site storage facilities being omitted from the audit programme. In other cases, there was insufficient evidence that the FSSC 22000 Additional Requirements had been audited or that the internal audit programme had been updated to reflect the requirements of FSSC 22000 Version 6.

Points to consider:

• Does the internal audit programme cover the full scope of the FSMS, including relevant processes, departments, off-site activities and the requirements of the related normative documents including ISO 22000:2018, the relevant sector specific PRP standards, and applicable FSSC 22000 Additional Requirements?
• Are internal audits completed as planned, with sufficient records to demonstrate what was assessed and the results?
• Is the audit programme reviewed and updated when requirements, processes, activities, or the FSMS change?

Requirement: ISO 22000:2018, clause 9.2

6. Food safety and quality culture

Why it matters:

Food safety and quality culture is reflected in the shared values, behaviours, attitudes, and everyday decisions that influence how food safety and quality are managed across an organization. A programme that exists only as a policy statement or periodic activity may not demonstrate that the intended culture is effectively embedded. A strong culture shall be evident in how people communicate, make decisions, follow established controls, and respond to food safety and quality concerns, from senior management through to employees.

Common findings:

Common findings included missing or inadequately defined food safety and quality culture objectives and plans, activities without measurable targets or timelines, and insufficient employee training or awareness. Other findings related to inadequate evaluation of culture through surveys or other assessment methods, failure to consider the culture plan during management review, and observed weaknesses in PRPs, hygiene, PPE, housekeeping, or employee behaviours that did not support the intended food safety and quality culture.

Points to consider:

• Is there a documented food safety and quality culture plan with clear objectives, measurable targets, timelines, and defined activities?
• Are employees aware, engaged, and demonstrating the expected behaviours through their day-to-day activities, including hygiene, PRPs, PPE, and housekeeping practices?
• Is the effectiveness of the culture programme evaluated and reviewed, including through appropriate assessment methods and management review, with action taken where improvement is needed?

Requirement: FSSC 22000 Additional Requirement, clause 2.5.8

7. Internal structures and fittings

Why it matters:

The design, condition, and maintenance of floors, walls, ceilings, doors, drains, and other internal structures and fittings are important for maintaining a hygienic production environment. Poorly maintained or inadequately designed structures can hinder effective cleaning, allow pest entry, contribute to water accumulation or condensation, and increase the risk of physical, chemical, or microbiological contamination.

Common findings:

Common findings included damaged or poorly fitted doors, missing ceiling tiles, cracked or deteriorating floors, lifting epoxy coatings, and peeling or flaking paint. Other findings included stagnant water, damaged, blocked or uncovered drains, mould and mildew resulting from inadequate cleaning, and roof damage such as holes or deteriorating insulation.

Points to consider:

• Are floors, walls, ceilings, doors, drains, roofs, and other structures intact, cleanable, adequately maintained, and designed to prevent contamination and pest entry?
• Are signs of deterioration, such as cracks, gaps, flaking surfaces, water accumulation, mould, damaged drains, or roof defects, routinely identified and promptly addressed?
• Do routine inspections and maintenance activities effectively identify and correct structural conditions that could affect hygiene or food safety?

Requirement: ISO/TS 22002-1:2009, clause 5.3

8. Environmental monitoring

Why it matters:

A risk-based environmental monitoring program (EMP) provides valuable insight into the hygienic condition of the production environment and helps verify whether measures designed to prevent microbiological contamination are effective.

An effective EMP considers appropriate sampling zones, target organisms and sampling frequencies, supports evaluation of the effectiveness of hygienic controls, and enables adverse trends to be identified and acted upon.  When environmental monitoring is not adequately risk-based, organizations may fail to identify emerging contamination risks or adverse trends before they affect product safety.

Common findings:

Common findings included failure to review the environmental monitoring programme for continued effectiveness and suitability at least annually, missing or inadequate trend analysis of monitoring results, and insufficient documented evidence that the programme and its results had been reviewed.

Points to consider:

• Is the EMP risk-based and appropriate to the production environment, including relevant sampling locations, target organisms and sampling frequencies?
• Are environmental monitoring results effectively trended and evaluated to identify recurring, unusual, or adverse patterns and trigger appropriate action?
• Is the programme reviewed at least annually, and when significant changes occur, with documented evidence that it remains suitable and effective?

Requirement: FSSC 22000 Additional Requirement, clause 2.5.7

9. Control of monitoring and measuring

Why it matters:  

Monitoring and measuring methods and equipment must be suitable, accurate and reliable where results are used to demonstrate process or product conformity. Inaccurate or poorly controlled monitoring and measuring devices can compromise critical food safety decisions.

Common findings:

Common findings included monitoring and measuring equipment not being calibrated or verified at specified intervals or prior to use, missing calibration records or certificates, and equipment with an unclear or outdated calibration status. Other findings included missing calibration labels and magnets not being tested for gauss strength.

Points to consider:

• Are monitoring and measuring devices identified, suitable for their intended use, and calibrated or verified at defined intervals?
• Is the calibration or verification status readily identifiable, with supporting records and certificates available?
• Where equipment is found to be inaccurate, overdue, or outside acceptable limits, is the potential impact on previous monitoring results and product safety assessed and appropriate action taken?

Requirement: ISO 22000:2018, clause 8.7

10. Management of allergens

Why it matters:  

Allergen management is essential to prevent unintended presence of allergens in food products and ensure that consumers receive accurate product and allergen information. Weaknesses in supplier controls, segregation, scheduling, cleaning, rework, label control, changeover, or validation and verification activities may result in undeclared allergens and place susceptible consumers at risk of an adverse reaction.

Common findings:

Common findings included missing allergen training records, absent or incomplete allergen risk assessments, and failure to consider all potential sources of allergen cross-contact. Other findings related to inadequate verification of cleaning effectiveness, insufficient validation and verification of allergen control measures, incomplete FSMS documentation, and failure to review the allergen management programme.

Points to consider:

• Does the allergen risk assessment identify all relevant allergens and potential sources of cross-contact, with appropriate controls established?
• Are allergen controls, including segregation, cleaning, changeover, rework, and labelling, effectively implemented, validated where required, and routinely verified?
• Are personnel appropriately trained, and is the allergen management programme documented, regularly reviewed, and updated when changes occur?

Requirement: FSSC 22000 Additional Requirement, clause 2.5.6

11. Documented information

Why it matters:

Documented information provides evidence that planned controls have been established, implemented, and completed in accordance with applicable requirements. Effective document and record control helps ensure that personnel have access to current and accurate information, and that reliable evidence of activities and decisions is maintained. Weak controls may result in outdated information being used, incomplete or unreliable records, or an inability to demonstrate effective implementation of the FSMS.

Common findings:

Common findings included outdated, obsolete, or uncontrolled documents remaining in use; incomplete records; missing document identification, review, or approval information; and inadequate control of revisions and changes. Other findings related to outdated external documents or registers, records that were not readily retrievable, inconsistencies between documented information and actual practices, improper record corrections, inadequate retention arrangements, and insufficient control or protection of electronic records.

Points to consider:

• Are documents and records current, approved, appropriately identified, complete, and readily available where needed, with obsolete versions effectively controlled?
• Are changes, corrections, retention, distribution, storage, protection, and retrieval of documented information effectively controlled, including electronic records?
• Does documented information accurately reflect current practices and applicable requirements, including relevant legislation, standards, Scheme requirements, processes, and organizational changes?

Requirement: ISO 22000:2018, clause 7.5

12. Competence

Why it matters:

Personnel whose activities can affect food safety need to have the appropriate knowledge, skills, training, education, or experience to perform their responsibilities effectively. Training attendance alone does not necessarily demonstrate that a person is competent. Organizations shall define competence requirements for relevant roles, provide appropriate training or supervision, evaluate whether the actions taken have been effective, address identified gaps, and retain evidence that competence has been achieved and maintained.

Common findings:

Common findings included competence requirements not being clearly defined, missing or incomplete training and competence records, and personnel performing food safety-related activities without adequate evidence of competence. Other findings were related to training needs not being identified, training effectiveness not being evaluated, and competence gaps not being adequately addressed.

Points to consider:

• Are competence requirements clearly defined for roles that can affect food safety, and do personnel meet those requirements?
• Where training or other development activities are provided, is their effectiveness evaluated to confirm competence, rather than relying only on attendance?
• Are competence gaps identified and addressed, with appropriate records maintained to demonstrate education, training, skills, or experience?

Requirement: ISO 22000:2018, clause 7.2

13. Storage of food, packaging materials, ingredients and non-food chemicals

Why it matters:

Effective storage practices help protect food, ingredients, packaging materials, and other materials from contamination, deterioration, damage, cross-contamination, and unauthorized use. Appropriate controls shall consider segregation, identification, stock rotation, environmental conditions, pest prevention, allergen management, chemical storage, and the control of nonconforming or returned materials.

Common findings included food, ingredients, containers, or utensils stored directly on the floor; open or inadequately protected packaging and ingredients; and insufficient segregation between raw materials, work in progress, finished products, and allergen-containing materials. Other findings related to damp or pest-affected storage conditions, failure to follow established storage arrangements, and inadequate segregation of chemicals or other non-food materials from food and food-contact materials.

Points to consider:

• Are food, ingredients, packaging, and other materials identified, adequately protected, and stored under suitable environmental and hygienic conditions?
• Are appropriate segregation and storage controls maintained for allergens, chemicals, raw materials, work in progress, finished products, and nonconforming or returned materials?
• Are established storage, stock rotation, pest prevention, and housekeeping controls consistently followed and routinely checked?

Requirement: ISO/TS 22002-1:2009, 5.7

14 Cleaning and sanitizing programmes

Why it matters:

Cleaning and sanitizing programmes are fundamental to hygienic production conditions and preventing contamination that could affect food safety. Effectiveness requires more than a documented cleaning schedule; appropriate methods, chemicals, frequencies, responsibilities, validation where applicable, and ongoing verification are needed to demonstrate that cleaning and sanitizing controls achieve their intended purpose.

Common findings:

Common findings included inadequately cleaned equipment and production areas, accumulation of dust and product residues, poor housekeeping, mould or mildew, dirty or blocked drains, and contamination of walls, ceilings, overhead structures, and storage areas. Other findings related to incomplete cleaning procedures or records, poorly maintained cleaning utensils, and inadequate control or verification of cleaning chemicals, sanitizer concentrations, and cleaning-in-place (CIP) parameters.

Points to consider:

• Do cleaning and sanitizing programmes clearly define what is cleaned, how, when, by whom, and using which methods and chemicals, including difficult-to-access and high-level areas?
• Are cleaning and sanitizing activities consistently implemented and effective, with appropriate validation and/or verification to demonstrate that residues, contaminants, and microorganisms are adequately controlled?
• Are cleaning records, chemical concentrations, CIP parameters, cleaning equipment, and overall hygiene conditions routinely checked, with deficiencies promptly corrected?

Requirement: ISO/TS 22002-1:2009, clause 11

15. Verification related to PRPs and the hazard control plan

Why it matters:

Verification provides confidence that PRPs and the hazard control plan are implemented as intended and remain effective in controlling food safety hazards. Effective verification goes beyond confirming that an activity was completed; it shall provide evidence that established controls continue to achieve their intended outcomes. Inadequate verification may allow weaknesses or loss of control to remain undetected.

Common findings:

Common findings included planned verification activities not being completed or performed at the required frequency, incomplete or missing verification records, and verification plans that did not adequately cover relevant PRPs, OPRPs, CCPs, or significant hazards. Other findings related to incomplete testing programmes, inadequate review of monitoring records, poorly defined verification methods or acceptance criteria, and abnormal or out-of-specification results not being appropriately investigated or addressed. Verification results were also not always analysed, trended, considered during management review, or updated following changes.

Points to consider:

• Does the verification programme cover relevant PRPs, OPRPs, CCPs, the hazard control plan, testing activities, and associated control measures, with appropriate methods, responsibilities, frequencies, and acceptance criteria defined?
• Are verification activities completed as planned and used to evaluate effectiveness, with results reviewed, analysed, and appropriately acted upon when deviations, adverse trends, or other weaknesses are identified?
• Is the verification programme risk-based, appropriately independent where required, and reviewed following changes, with complete records available to demonstrate that controls continue to operate effectively?

Requirement: ISO 22000:2018, clause 8.8

Understanding the trends

The trends highlighted in this article provide an opportunity for organizations to look beyond individual findings and consider what they may reveal about the overall effectiveness of the FSMS. Key lessons include:

• Use trend data proactively – Consider recurring nonconformities alongside verification results, complaints, incidents, monitoring data, internal audit findings, and other relevant information to identify patterns, emerging risks, and wider system weaknesses.
• Turn documented controls into everyday practice – Procedures alone do not ensure effective food safety management. Use observations, interviews, records, and routine verification to confirm that controls are understood and consistently applied in day-to-day operations.
• Strengthen management oversight – Ensure appropriate resources are available, responsibilities and accountabilities are clear, performance is regularly reviewed, and unresolved or recurring food safety issues are promptly escalated and addressed.
• Look beyond the individual finding – Consider whether a nonconformity is an isolated issue or an indication of a broader weakness in the FSMS. Effective root cause analysis can help identify systemic issues and prevent recurrence.
• Treat minor nonconformities as early warning signals – Repeated minor findings may indicate ineffective implementation or weaknesses that extend beyond the individual issue identified. Timely action can help prevent recurrence and reduce the likelihood of more significant failures.

The top 15 nonconformities provide insight into the requirements most frequently associated with nonconformities overall. To provide further perspective on the trends, the following sections highlight the requirements most frequently associated with critical, major, and minor nonconformities.

Critical nonconformities

The information highlights the five requirements most frequently associated with critical nonconformities during the period analysed. These findings relate to leadership and commitment, traceability, monitoring of CCPs and OPRPs, product labelling and pest control, and the food safety management system.

Although critical nonconformities occur less frequently, understanding where they arise can help organizations identify areas requiring strong management oversight, effective operational control, and timely verification.

Major nonconformities

The information highlights the 15 requirements most frequently associated with major nonconformities. Major nonconformities indicate findings that affect the capability of the management system to achieve its intended results and therefore warrant particular attention.

The trends span both system-level and operational controls, including internal audits, traceability, corrective action, monitoring of CCPs and OPRPs, allergen management, environmental monitoring, quality control, and verification activities. Reviewing these trends can help organizations identify areas where stronger implementation, verification, and oversight may be needed to prevent significant gaps in their food safety management.

Minor nonconformities

The information highlights the 15 requirements most frequently associated with minor nonconformities. Although minor nonconformities do not affect the capability of the management system to achieve its intended results, they still indicate requirements that have not been fully met.

Addressing these findings can help prevent recurrence and reduce the risk of more significant nonconformities in the future.

Conclusion

The trends highlighted in this article demonstrate that an effective FSMS relies not only on documented controls, but on their consistent implementation, monitoring, and verification.

While individual findings may differ in their nature and grading, each provides an opportunity to identify weaknesses and strengthen the FSMS. Organizations are encouraged to use nonconformity data alongside internal audit results, complaints, incidents, monitoring and verification results, and other performance information to identify recurring issues and emerging trends.

Particular attention should be given to repeated or recurring findings, as these may indicate that corrections have addressed the immediate issue, whilst corrective actions may not have effectively addressed the underlying cause.

Ultimately, organizations that take a proactive approach to analysing trends, addressing root causes, strengthening operational controls, and engaging personnel at all levels are better positioned to prevent recurrence, drive continual improvement, and maintain confidence in the safety of the food they produce or supply.