Purchased materials, services and the labs you rely on
Plain-language summary
Extra controls on what you buy and who tests it: competent laboratories, emergency purchasing, specification reviews and, for some categories, prohibited-substance and recycled-packaging rules.
What the clause is really asking
ISO 22000 already asks you to control externally provided processes, products and services. FSSC adds teeth. Any laboratory whose results verify or validate a parameter critical to food safety must be demonstrably competent and work to the requirements of ISO/IEC 17025 — internal or external. Manufacturing-type categories (BIII, C, D, I, FII, G, K) need a documented emergency-procurement procedure so a rushed purchase still goes to an evaluated supplier, and a review process that keeps raw-material and finished-product specifications current — with microbiological, chemical, physical and allergen limits based on science where the law is silent. Animal-product categories (C0, CI, CIII, CIV) need a policy on buying animals, fish and seafood subject to prohibited-substance control, and packaging manufacturers (I) need criteria for recycled packaging inputs.
What auditors look for
Auditors ask which results matter for food safety and then ask how you know the lab is competent: accreditation scope, proficiency-test results, method validation. They pull a recent emergency purchase and check the supplier was evaluated. They pick a specification and ask when it was last reviewed and where a limit came from.
Typical evidence
Laboratory competence evidence (accreditation scope, proficiency testing, method validation); emergency-procurement procedure and records; specification review procedure with review dates; scientific basis for limits where no legislation exists; prohibited-substance policy (animal categories); recycled-packaging criteria (Category I)
How to comply — recommendations
List every food-safety-critical test and the lab that runs it, and file the competence evidence next to it — do not assume the big-name lab is accredited for your matrix. Write the emergency purchase route as a short decision tree that still ends at an approved supplier. Give specifications an owner and a review date, and record the source of each limit.
Common nonconformities
Critical results from a lab with no competence evidence; emergency purchases from unevaluated suppliers; specifications never reviewed or with limits nobody can justify; category-specific policies (prohibited substances, recycled packaging) missing
Related clauses
ISO 22000 7.1.6 (externally provided processes, products and services), 8.2 (PRPs); ISO 22002-1:2025 clause 10 (purchasing); FSSC 22000 2.5.2, 2.5.15
Get the free ISO 9001:2026 Readiness Scorecard
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
Qlause provides interpretive guidance only and is not a substitute for the standard. Refer to your licensed copy of the relevant standard for the authoritative text.