Under FSSC 22000 version 6 (V6), you needed a food fraud vulnerability assessment and a food defense plan. Under version 7 (V7), having the documents is no longer enough. The people who prepare and maintain them need to be demonstrably competent.
This shift follows the GFSI Benchmarking Requirements 2024, which raised expectations across food fraud and food defense. Requirements are now partly moved into ISO 22002-100:2025, making them clearer and more specific. Your suppliers face stronger expectations too, alongside clearer documentation of what you require from them.
What changed in v7 food fraud and defense requirements
- Stronger competency expectations for the people carrying out food defense threat assessments and food fraud vulnerability assessments
- Requirements partly moved into the new ISO 22002-100:2025
- Stronger expectations around suppliers
- Clear responsibility for reviewing food fraud and food defense plans
The assessments, plans and mitigation plans themselves remain central. What is new is the question behind them: who did this work, and how do you know they were qualified to do it?
Questions to expect from auditors on competency and ownership
Auditors will want to see evidence, not intent. Expect questions such as:
Who owns each assessment and what training do they hold?
- Auditors won't accept a name on a document. They want training records, certifications, experience and any qualifications relevant to food fraud or food defense work. If your assessor isn't documented, that's a gap.
When were plans reviewed and what triggered the review?
- You need to show the date of each review and the documented reason for it. A review triggered by a new supplier, a sourcing change or a known fraud incident looks intentional. An undated, unreasoned review looks like a box-ticking exercise.
Do assessments match your actual materials and suppliers?
- Your assessment can't reflect suppliers or sourcing regions you're not using anymore. Outdated assessments signal a system that isn't maintained. Auditors will catch this and flag it as non-conformance.
What do you require of suppliers and how do you verify it?
- You need documented supplier requirements and evidence of verification. Not requests. Evidence.
Why competency evidence matters most in complex supply chains
Fraud vulnerability sits largely in the supply chain. The more tiers, countries and ingredients you source, the more places an assessment has to cover, and the faster it can go out of date when sourcing changes. For multinational organizations, one well-written plan at head office is not enough if sites are assessing risk differently or keeping records in different places.
Five competency tasks to close before your audit
Identify owners at every site
Start by listing who currently owns each food fraud and food defense assessment and plan at every site. This is your baseline.
Document training and qualifications
Check the training and qualification records for each person. Fill gaps now. Make sure evidence is documented and accessible to auditors.
Align plans to ISO 22002-100:2025
Don't just relabel your existing plans. Rebuild them against the updated ISO 22002-100:2025 requirements so they meet the new standard.
Link assessments to supplier data
Connect your assessments to your supplier records so changes in sourcing automatically flag a need for review. This stops assessments going stale.
Create an audit trail
Keep a complete audit trail showing who reviewed what, when and why. This is the evidence auditors will specifically look for.
This is an evidence problem as much as a food safety one. Connecting your safe food processes and your supply chain data in one place makes the audit trail far easier to produce.
Why auditors now scrutinize who owns your assessments
The competency requirement is straightforward in principle but demanding in practice. You need to identify who owns each assessment at every site, confirm they have the right training and qualifications and maintain an audit trail showing who reviewed what and when. The gap between having a plan and proving your team was qualified to create it is where most organizations discover their work actually lies.
Auditors scrutinize ownership and qualifications because competent assessment directly impacts food safety outcomes. A fraud or defense assessment written by someone without training doesn't provide the protection it should.
Getting your competency evidence ready
The five competency tasks above are where most organizations need to focus. Start with ownership, then document qualifications and training. Rebuild your plans against ISO 22002-100:2025, connect assessments to supplier data and create your audit trail. Doing this now means your audit won't stall on evidence that auditors can't find.
Our version 7 guide sets out the full list of changes and who they affect, including these new expectations.
Download the FSSC 22000 version 7 guide.
Explore food & beverage solutions
One contamination event. One missed audit. One gap in your supply chain. That's all it takes to undo years of hard-won consumer trust. One connected platform. Every food and beverage challenge covered.