Food safety standards, and which is which
Three things in this category are confused constantly and each one costs somebody a purchase order. GFSI does not certify anybody. ISO 22000 on its own is not GFSI-recognised. HACCP is a method rather than a certification, and no organisation issues a HACCP certificate as its author.
The certifications a customer asks for
These are certification schemes: a site is audited against one by a certification body and holds a certificate with a scope and an expiry. All four are recognised by the Global Food Safety Initiative, which is why a customer requiring GFSI recognition will usually accept any of them.
- BRCGS3BRCGS, part of LGC
- FSSC 220003Foundation FSSC
- IFS Food3IFS Management GmbH
- SQF3SQFI, a division of FMI
- ISO 220003International Organization for Standardization
The things that are not certifications
Each of these is asked for as though it were a certificate and none of them is one. FSMA is law. GFSI is a benchmark. HACCP and Codex are methods and standards that schemes and regulations are built on.
- HACCP4Codex Alimentarius Commission (FAO and WHO)
- FSMA4U.S. Food and Drug Administration
- GFSI3The Consumer Goods Forum
- Codex Alimentarius3FAO and WHO
What can and cannot be published about them
The Foundation FSSC and IFS both publish their full schemes free of charge, which is unusual and is why Krolda maps those two in full. BRCGS sells its standards and polices redistribution of their text; ISO sells ISO 22000; SQF sells its codes. For those three Krolda maps clause identifiers and its own summaries and hosts not one line of their text.
21 CFR is the exception in the other direction. It is a work of the United States government and is in the public domain, so every food-safety section of it is reproduced in full on this site.
Questions
- Which food safety certification should a site get?
- Usually the one the customer asking for it will accept, which in United Kingdom retail is typically BRCGS, in continental European private label typically IFS Food, in North American retail typically SQF, and internationally often FSSC 22000. All four are recognised by the Global Food Safety Initiative, so a customer requiring GFSI recognition will accept any of them unless they name one specifically.
- Is GFSI a certification?
- No. The Global Food Safety Initiative benchmarks other organisations' certification programmes against its own requirements and publishes the list that meet them. No site is certified to GFSI. A site is certified to a recognised programme such as BRCGS, FSSC 22000, IFS or SQF, and that certificate is what a customer asking for GFSI certification means.
- Is ISO 22000 enough for a GFSI requirement?
- No. Certification to ISO 22000 on its own is not recognised by the Global Food Safety Initiative. FSSC 22000 is the recognised scheme built on ISO 22000, adding a sector prerequisite programme specification and a set of additional requirements. A customer requiring GFSI recognition will not accept an ISO 22000 certificate.
- Does certification make a site FSMA compliant?
- No. FSMA is United States law, implemented through 21 CFR, and a certification is a private scheme certificate. The two overlap heavily and much of the same evidence satisfies both, but certification does not exempt a facility from FDA inspection, and an investigator audits against the rule rather than against the scheme.
Whichever scheme a site holds, the audit asks the same question of every clause: what is the evidence, and is it current. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.
Early access