Allergen Management under FSSC 22000: What Your Food Safety Plan Must Include

Allergen management is one of the most audited areas of FSSC 22000 certification. A missing or incomplete allergen management plan is among the top nonconformances raised by certification bodies during FSSC 22000 audits, and in Malaysia, where food manufacturers produce for export markets with strict allergen labelling legislation, the stakes are high. For manufacturers preparing for food export certification Malaysia, understanding and implementing effective allergen management is essential.

What Is Allergen Management and Why Is It a Mandatory Requirement under FSSC 22000?

Allergen management is the set of documented procedures a food manufacturer uses to identify, assess, and control the risk that allergenic ingredients will be present in a product that is not intended to contain them. Under FSSC 22000, allergen management is a mandatory additional requirement under clause 2.5.6, which sits above and beyond what ISO 22000:2018 already requires.

ISO 22000:2018 addresses allergens as a biological, chemical, or physical hazard within the hazard analysis process (clause 8.5.2) and as part of prerequisite programmes. FSSC 22000 adds specific additional requirements that go further: a documented allergen management plan, risk assessment, validated control measures, targeted verification testing, mandatory training, and an annual review.

For Malaysian food manufacturers exporting to the European Union, United Kingdom, United States, Japan, or Australia, compliance with the importing country’s allergen declaration requirements is not optional. FSSC 22000 clause 2.5.6 explicitly requires finished products to be labelled in accordance with all applicable statutory and regulatory requirements in the country of intended sale, including allergen and customer-specific requirements.

What Must a Documented Allergen Management Plan Include under FSSC 22000?

A documented allergen management plan under FSSC 22000 clause 2.5.6 must include a list of all allergens handled on-site in raw materials and finished products, a risk assessment covering all potential sources of allergen cross-contact, and documented control measures derived from that risk assessment.

The plan must address the following elements:

• A complete inventory of all allergenic raw materials used on-site, including sub-ingredients and processing aids
• A complete list of allergens declared or potentially present in all finished products manufactured at the facility
• A risk assessment identifying all sources of cross-contact including shared equipment, air handling, drainage flow, staff movement, and rework streams
• Documented control measures for each identified cross-contact risk, including segregation, scheduling, dedicated equipment, cleaning procedures, and positive release systems
• Precautionary allergen labelling (PAL) policy, with evidence that PAL does not substitute for control measures or testing
• Allergen training records for all production, quality, and maintenance personnel
• An annual review mechanism, with records showing the review was completed and any changes captured

In our work with Malaysian food manufacturers preparing for FSSC 22000 certification, the most common gap is a risk assessment that covers allergens in raw materials but does not trace all potential cross-contact routes through the production process, particularly from rework addition and shared drainage points between allergen-containing and allergen-free lines.

How Should a Malaysian Food Manufacturer Control Allergen Cross-Contact?

Allergen cross-contact occurs when an allergen is unintentionally transferred from one food or surface to another. It is distinct from cross-contamination: cross-contamination refers broadly to transfer of any unintended substance (including microbiological hazards), while cross-contact specifically describes the transfer of allergenic proteins. Understanding this distinction is one of the foundations of a HACCP-based food safety system and is directly relevant to how control measures are documented and verified.

FSSC 22000 requires control measures to reduce or eliminate the risk of cross-contact. The acceptable hierarchy of controls is:

• Elimination: removing the allergen from the site entirely where technically feasible
• Physical segregation: dedicated equipment, utensils, production lines, and storage areas for allergen-containing products
• Production scheduling: running allergen-free products first, before allergen-containing products, without line changeover
• Allergen cleaning: validated cleaning procedures that reduce allergenic residue below a quantified threshold, with written cleaning records and sign-off
• Positive release: holding finished product or production equipment pending allergen test results before release to packing or dispatch

Malaysian Food Regulations 1985 (First Schedule) require declaration of cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk, nuts, and sulphites above 10mg/kg. Manufacturers producing for export must also meet the allergen lists of the destination country, which may differ. FSSC 22000 requires the allergen management plan to account for all applicable requirements across all intended markets.

What Are the Validation and Verification Requirements for Allergen Control under FSSC 22000?

FSSC 22000 clause 2.5.6 requires both validation and verification of allergen control measures. These are distinct activities with different purposes and timing.

Validation demonstrates that a control measure, when correctly implemented, is capable of achieving the intended allergen reduction. For a cleaning procedure, validation involves demonstrating through allergen testing that the procedure reduces allergenic protein below the acceptable threshold. Validation is performed before the procedure is used in routine production, or when a cleaning chemical, equipment, or process is changed.

Verification demonstrates that the control measure has been correctly implemented in routine production. Verification includes scheduled allergen swabbing or rinse testing on equipment after cleaning, ELISA or lateral flow strip testing of finished product before release, and review of production records to confirm scheduling controls were followed. FSSC 22000 requires that when products with different allergen profiles are manufactured in the same facility, verification testing frequency is set based on risk assessment.

A critical requirement added in FSSC 22000 Version 6 and carried through to Version 7 is that warnings on product labels do not substitute for control measures and verification testing. A “may contain” statement does not relieve the manufacturer of the obligation to have implemented and validated control measures. This is a frequent finding during FSSC 22000 audits, manufacturers with strong PAL labelling but no documented cleaning validation or allergen testing programme will receive a nonconformance.

How Does FSSC 22000 Version 7 Change Allergen Management Requirements?

FSSC 22000 Version 7, released on 1 May 2026, does not fundamentally restructure the allergen management requirements in clause 2.5.6. The core requirements from Version 6 remain in place. The most significant update in Version 7 specific to allergen management is a clarification under clause 2.5.6(h): the allergen management requirements may not apply to pet food manufacturers certified under ISO 22000, unless the country where the product is to be sold has applicable allergen legislation or an allergen-related claim has been made on the product.

For Malaysian food manufacturers producing human food, this clarification has no practical impact. All FSSC 22000-certified human food manufacturers must continue to meet the full allergen management requirements of clause 2.5.6.

The transition timeline for FSSC 22000 Version 7 requires all organisations to complete their transition audits before 30 April 2028. Allergen management documentation should be reviewed as part of the transition to confirm it reflects the Version 7 requirements, particularly the validation evidence and annual review records. Organisations whose allergen management plans were last reviewed against Version 5 or an earlier version should update them against the current clause 2.5.6 requirements during their next internal audit cycle.

Allergen Management Is a System, Not a Label

A compliant allergen management programme under FSSC 22000 is built on four foundations: a documented plan covering all allergens and all cross-contact routes, validated control measures with quantified acceptance criteria, systematic verification testing before product release, and annual review to capture changes in raw materials, processes, or applicable legislation.

Malaysian food manufacturers that treat allergen management as a labelling exercise rather than a production control system will face nonconformances at certification audit. Manufacturers that prepare for a food safety audit by building allergen management into their food safety management system from the start are the ones that pass first-time and maintain certification through multiple audit cycles.

Ready to implement FSSC 22000 in your facility? Contact Connext for a free consultation.

Frequently Asked Questions

What is allergen management in food manufacturing?

Allergen management is the set of documented procedures a food manufacturer uses to identify all allergens on-site, assess cross-contact risks, and implement controls to prevent unintended allergen presence in finished products. Under FSSC 22000, allergen management is a mandatory additional requirement under clause 2.5.6.

What allergens must be declared in Malaysia?

Malaysia Food Regulations 1985 (First Schedule) require declaration of cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk and nuts Manufacturers exporting to other countries must also comply with the allergen declaration requirements of each destination market.

What is the difference between allergen cross-contact and cross-contamination?

Cross-contact refers specifically to the unintended transfer of allergenic proteins from one food or surface to another. Cross-contamination refers more broadly to the transfer of any unintended substance, including microbiological hazards. FSSC 22000 requires specific control measures and verification testing for allergen cross-contact, separate from general contamination controls.

Does FSSC 22000 require allergen testing?

Yes. FSSC 22000 clause 2.5.6 requires both validation testing to confirm that cleaning procedures reduce allergen residue to acceptable levels, and ongoing verification testing when products with different allergen profiles are produced in the same facility. A precautionary label warning does not substitute for testing requirements.

How often should an allergen management plan be reviewed?

FSSC 22000 requires an annual review of the allergen management plan as a minimum. Reviews must also be triggered by changes in raw materials or suppliers, new products or product reformulations, equipment changes, changes in applicable legislation in any market where the product is sold, or nonconformances identified during verification testing.