ISO 22002-100:2025 and FSSC 22000 V7: A PRP Transition Plan You Can Actually Use

ISO 22002-100:2025 is the new common-baseline standard for prerequisite programmes (PRPs) in food safety management systems. ISO published it in 2025. It sets a single set of general PRP requirements that the rest of the ISO 22002 series now builds on, including the updated ISO 22002-1:2025 for food manufacturing. If you're certified to ISO 22000 or FSSC 22000, that shifts both the documentation you keep and the conversation you'll have at your next audit.

The FSSC 22000 V7 scheme, published by the Foundation FSSC in 2025, references the new ISO 22002 series as the PRP basis for certified sites. So the transition isn't only an ISO 22000 question. If you hold an FSSC certificate, your FSSC 22000 V7 transition and your ISO 22002-100:2025 PRP update are one project, not two. Certification bodies are already framing them that way during stage 1 reviews.

Why the urgency? Because the auditor's first question at recertification isn't "what changed in your system" anymore. It's "show us your transition plan." Companies that walk in with a documented plan, even an early rough one, materially reduce their nonconformity exposure. Companies that don't end up explaining why a known, published standard change has no documented response. That gap goes straight into the audit report under change management.

If you supply retail, export to the EU, or run a contract manufacturing operation, the buyer side adds pressure too. Procurement teams are already asking for FSSC 22000 V7 readiness statements. Honestly, "we'll start when the deadline is closer" is already costing contracts.

The easiest way to picture the change is as a layered structure. ISO 22002-100:2025 holds the common PRP requirements that apply across the food chain. The sector-specific parts of the series handle the details for each segment: ISO 22002-1 for manufacturing, 22002-2 for catering, 22002-3 for farming, 22002-4 for packaging, 22002-5 for transport and storage, 22002-6 for feed. For a multi-site operator, that means one unified PRP baseline instead of slightly different copies of the same requirements scattered across each unit.

What that demands in practice is precision. Your team has to know exactly where general PRP controls apply, where sector requirements layer on top, and how each requirement is evidenced in records. We've found that food businesses with mature documentation often assume their existing procedures already cover the new structure. A walk-through almost always shows otherwise. Monitoring frequencies, allergen-control records, and traceability touchpoints are the areas where general and sector requirements overlap most, and that's where the gaps surface.

Honest warning: for the first two weeks, skip the templates entirely. Walk the process from incoming raw materials through dispatch. List every control point against ISO 22002-100:2025 and the relevant sector part. Only then look at what the documentation says. The picture from the floor will tell you where the real PRP gaps are, and your team won't burn weeks reshuffling documents that turn out to be the wrong starting point.

This is the angle most companies underestimate. ISO 22000:2018 clause 6.3 ("Planning of changes") doesn't suggest that you plan changes to your food safety management system. It requires it. The clause says that when changes to the FSMS are needed, they must be carried out in a planned manner, with consideration given to the purpose of the change and its potential consequences, system integrity, available resources, and the allocation or reallocation of responsibilities and authorities.

A transition to ISO 22002-100:2025, ISO 22002-1:2025, and the related FSSC 22000 V7 scheme requirements is exactly the kind of change clause 6.3 was written for. That gives auditors a direct hook. They don't have to argue that you're behind on a transition. They just ask whether the transition was planned in line with clause 6.3 and whether the planning is documented. No plan, no document trail, clause 6.3 finding, regardless of how much else you've done.

In practical terms, your PRP transition plan needs to demonstrate four clause 6.3 elements:

• Purpose and consequences, why the change is needed (publication of ISO 22002-100:2025 and the FSSC 22000 V7 scheme) and what happens if you don't implement it (loss of certification, supplier delistings, retail audit findings).
• System integrity, how you maintain food safety performance during the transition, including HACCP review, validation of revised PRPs, and management of any temporary controls.
• Resources, budget, internal time, external support, and any equipment or infrastructure changes the new requirements trigger.
• Responsibilities and authorities, a named transition owner with a written mandate and a clear allocation of work across quality, production, warehouse, procurement, HR, and management.

Framing the plan against these four clause 6.3 anchors does two things at once. It satisfies the auditor's evidence expectations for change management. And it forces the management team to make the transition real, with a budget, schedule, and owner, instead of letting it sit in the quality department's inbox.

A useful transition plan does one thing well: it answers a fixed set of questions in plain language. What are we changing. Why. What breaks if we skip it. Who owns each piece. When it's due. And how we'll check that the change actually works in operations. A document that doesn't answer these is decorative, and auditors notice the difference inside ten minutes.

We build the change list by process, not by standard clause. So the items read like "sanitation PRP update against ISO 22002-1:2025 §11", "pest control monitoring revision", "temperature monitoring frequency review", "traceability records in dispatch", "supplier evaluation criteria refresh". Each item gets a one-line reason tied to the specific new requirement it addresses, plus a risk rating. For most food businesses, this single list is the first time the management team sees every open PRP point on one page. That tends to change how the project gets resourced.

The question most plans skip: what's the risk of doing nothing, or doing it halfway? That risk drives prioritisation. A delayed sanitation update that affects allergen carryover goes to the top. A document template reformat with no operational impact waits.

The last block is verification. Not "did we update the document" but "is the change working on the floor." Shift records, internal audit findings, incident trends, supplier KPIs. That's what closes the loop and gives the external auditor something to test.

In short, a working transition plan needs:

• a list of changes with priorities and deadlines, mapped to ISO 22002-100:2025 and the relevant sector part;
• assigned roles and resources for each stage, in line with ISO 22000:2018 clause 6.3;
• verification criteria that confirm changes are working in operations, not just on paper.

The structure below works for both internal management reviews and audit demonstration. Each row maps to clause 6.3 expectations and to the FSSC 22000 V7 PRP scheme requirements.

The next table is the artifact most ISO 22002-100:2025 transition plans are missing: a per-PRP-area minimum that maps the artifact, owner, frequency, and audit-ready evidence. It works as a one-page check before the certification body arrives, and as a working document during the transition itself.

If anyone on your management team can't name the transition owner inside five seconds, the project is already drifting. The single most common reason these transitions stall is diffused responsibility. Management asks "the team" to handle it. The team assumes someone else is leading. Three months later, nothing has moved.

Appoint one person, not a committee. One named owner for the ISO 22002-100:2025 and FSSC 22000 V7 transition project, with a written mandate from top management. Then spell out every function's piece in writing. Quality handles methodology, document control, and clause-by-clause mapping. Production translates new requirements into shift-level actions. Warehouse and logistics own their process areas. Procurement and legal review supplier contracts. HR runs role-specific training. Senior management reviews progress monthly and signs off on stage gates.

When each person can describe their part of the transition without checking a document, the auditor picks up on it inside the first hour. The transition stops being one specialist's side project and becomes visible across the management team. That's a very different conversation from the one that starts with "so who's running this?" and a long pause.

A PRP gap analysis has one job: separate the urgent from the eventual. We use three tiers. Tier one covers anything that directly touches product safety or traceability, because a failure here means a food safety incident or a recall scenario. Tier two covers systemic weaknesses that produce the same nonconformities cycle after cycle. Tier three covers document formatting, template alignment, and process labels with no operational impact.

The failure mode we see repeatedly is the company that tries to close every gap in a single push. It almost never works. Quality teams burn out, line managers stop attending review meetings, and most of the "fixes" turn into copy-paste procedure updates nobody on the floor actually reads. Several months later, the external audit finds the same problems the gap analysis flagged at the start.

Short waves work better. Pick the hottest tier-one gaps. Close them. Verify they hold in operations. Move on to the next batch. Production keeps running, people don't burn out, and management can see real movement against the FSSC 22000 V7 timeline rather than activity reports.

One rule we apply on every Ekontrol project: each change must end with a checkable result. Updated procedure plus signed training record. Completed traceability test. Closed internal audit finding. If you can't point to a concrete outcome, the change isn't done. The auditor will treat it the same way.

Documents don't make food safe. People do. If a line operator doesn't know what changed in the sanitation PRP, the new procedure might as well not exist. Same goes for warehouse staff, logistics shifts, and cleaning crews. Training has to be short, role-specific, and concrete: a quick walkthrough of what changed on this line, what gets done differently from Monday, and why it matters for the product. A two-hour lecture on "what ISO 22002-100 means" tends to lose the room inside ten minutes.

The training that lands is the one that connects a new requirement to a problem the team already recognises. A supervisor seeing that a revised temperature monitoring frequency would have caught a recurring complaint pattern is the moment buy-in happens. Without that connection, the new procedures get followed for a week and then quietly drift back to old habits.

Suppliers are the second half of the work. A partner running a critical operation outside your ISO 22002-100:2025 transition plan is an audit finding waiting to be written. Review selection criteria, contract language, evaluation schedules, and how deviations get handled. One weak supplier can cost you a nonconformity and, honestly, the customer who triggered the audit in the first place.

The commercial side is worth flagging. Stable supplier relationships reduce complaint rates, lower returns, and give you negotiating weight with retail buyers. When you can show chain control across all your partners under the new PRP framework, buyers see predictability, and that often matters more than a price discount.

Auditors usually work through four layers when they look at a transition. Did management make a decision to transition? Are the changes documented? Did the changes actually happen on the floor? Has someone verified the results? An auditor who finds all four moves on quickly. An auditor who finds a hole in any one of them starts digging, and that's where time-consuming findings come from.

The evidence base for an FSSC 22000 V7 PRP audit usually contains the approved transition plan itself, a change matrix showing each PRP block with risk, timeline, and current status, the updated procedures, training records with dates and names, internal audit results from after the changes went live, and corrective actions with proof those actions actually worked. The audit-ready evidence template above gives you the per-area breakdown.

One practice worth building into every transition: prepare a two-page management summary of progress and hand it to the auditor in the opening meeting. It takes about ten minutes to read and frames the entire audit. Instead of the auditor piecing the story together from scattered files, they get the narrative upfront. The rest of the audit becomes confirmation rather than discovery. That framing is what separates an audit that feels like a controlled review from one that feels like an investigation.

If your next surveillance or recertification audit is roughly twelve months out, the table below shows a workable sequence with cycle math. Adjust the absolute dates to your own audit schedule. The relative durations have held up across the food manufacturing, packaging, and storage projects we've run.

Across the projects we've supported, the same small handful of failure modes keeps appearing.

The wait-and-see trap is the most expensive. The company knows the standard changed, decides to wait for "official deadlines," and arrives at the ISO 22000 audit with no transition plan, no PRP gap analysis, no evidence. The clause 6.3 finding takes the auditor about twenty minutes to write up.

The rename trap looks like progress and isn't. Someone goes through every document and replaces "ISO/TS 22002-1" with "ISO 22002-1:2025" or "ISO 22002-100". References look current, procedures haven't changed, the shop floor is untouched. The auditor pulls one process record, sees the old monitoring frequency, and the document trail collapses.

The supplier blind spot catches even mature systems. Internal PRPs get updated, but the external warehouse operator or the contract cleaning company hears nothing about it. The auditor asks about supplier alignment and gets silence in return.

Slow drift is the quietest failure. No monthly check-ins, no progress reviews. Small delays compound. By the time anyone notices, there are eight open items and the audit is six weeks away.

The corrective pattern is the same in every case. Start before the calendar forces you to. Name one owner with a written mandate. Prioritise the changes that touch food safety first. Build evidence as you go, not the week before the auditor arrives.

If management can't see the numbers, the project dies quietly. The ISO 22002-100:2025 and FSSC 22000 V7 transition needs to live in operational management, not parked inside the quality department as a side task. Pick three or four KPIs at the start, not twenty, and choose ones that answer a single question: are we actually moving, or just producing activity reports?

In our projects we usually track three numbers. First, the percentage of closed changes in high-risk PRP blocks, which tells you whether the safety-critical changes are landing. Second, the share of staff who completed role-specific training and can demonstrate they understood it, which tells you whether they're sticking. Third, internal audit results after the changes (recurrence rate of nonconformities, time to close corrective actions, shift-level incident trends), which tells you whether the system is improving or just churning paperwork.

The commercial side is worth tracking too. Customer audits passed without findings, contract approval times, frequency of buyer requests for additional PRP evidence. These are the metrics that get a CEO's attention and justify the transition budget at board level.

Timelines have two failure modes. Aggressive schedules miss early milestones, lose momentum, and turn the plan into fiction. Loose schedules drift into next year because there's no urgency or accountability. A staged model with control gates handles both: gap analysis and scope approval, then high-risk PRP changes and training, then stabilisation and internal audit, then evidence assembly and readiness check. Movement between stages goes by criteria, not calendar.

Budget follows the same logic. Don't lump everything into "certification costs." Split it across methodology and document updates, training, internal audits and corrective actions, and the external audit or customer assessment. When overruns appear, you can fix them at source rather than discovering them in a year-end review.

Keep a contingency reserve. Cross-functional dependencies surface during every transition. A logistics procedure change ripples into labelling requirements, which ripple into warehouse records, which means retraining adjacent teams. Around 10–15% of budget and a two-week schedule buffer covers most of these without breaking the plan.

Close each month with a short management meeting, thirty minutes, no longer. KPI status, schedule deviations, root causes, decisions, owners, date of the next check. That rhythm is what keeps the transition visible and gives the team clear priorities instead of a vague sense that "something is happening with ISO."

The transition to ISO 22002-100:2025 and the FSSC 22000 V7 scheme either strengthens how your company operates or it sits in a binder. The difference comes down to whether management treats it as a change management exercise under ISO 22000:2018 clause 6.3 or as a documentation refresh. The first approach produces fewer audit findings, tighter operations, and a stronger position when negotiating with retail buyers. The second produces a binder.

Buyers notice. When two suppliers offer comparable products and one can show a structured, in-progress transition plan with evidence of real execution, that supplier wins the contract more often than not. The ISO 22002-100:2025 update has turned PRP maturity from a back-office topic into a procurement signal.

If you need a transition plan that works without disrupting production, the Ekontrol team can build the roadmap, run the PRP gap analysis, update the procedures, train your people, and assemble the evidence base for the audit. The output isn't a certificate on the wall. It's a food safety system your business can actually grow on.