Short answer: HACCP is a method for controlling food safety hazards. ISO 22000 is a management system standard that builds HACCP in. BRCGS Food Safety and FSSC 22000 are certification schemes, each owned by an organisation that sets its own audit rules, and both are recognised by the Global Food Safety Initiative (GFSI). A certificate against any of them says that an auditor found a named site's system met stated requirements at the time of the audit. It does not say that any particular lot is safe. What gives a certificate weight is who issued it (an accredited certification body), what it covers (your product, made at the site that will make it) and when (valid through your production dates). Which one to require depends on the product's risk and on where your customer will sell it, so ask your customer before you ask your supplier.
Four layers behind a 'food safety certificate'
Buyers tend to file every food safety document under "certified". It helps to separate four layers.
| Layer | Example | What it is | Who sets it | What a certificate against it evidences |
|---|---|---|---|---|
| Method | HACCP | A set of seven principles for identifying and controlling hazards | Codex Alimentarius (FAO/WHO) | Whatever criteria the certifier chose to audit against; Codex sets up no certification |
| Management system standard | ISO 22000 | Requirements for a food safety management system in any organisation in the food chain | ISO | That the site's management system met the standard at audit; not product safety |
| Certification scheme | FSSC 22000, BRCGS Food Safety, IFS, SQF | A standard plus the scheme owner's audit protocol, rules for certification bodies and a public register | The scheme owner | That the site passed an audit under the scheme's rules, with a status in the owner's register |
| Accreditation | A national accreditation body | An independent assessment of the certification body's competence | Accreditation bodies, linked through an international arrangement | That the issuer of the certificate has itself been assessed |
A separate reading of "HACCP certificate" is a training certificate held by an individual. That shows a person attended a course; it says nothing about the site.
HACCP as a method, and what a HACCP certificate therefore means
The Codex General Principles of Food Hygiene (CXC 1-1969, last revised 2022) set out the seven HACCP principles: hazard analysis and control measures, critical control points, validated critical limits, monitoring, corrective actions, validation and verification, and documentation. Codex defines a HACCP plan as documentation prepared under those principles "to ensure control of significant hazards in the food business", says that prerequisite programmes, including good hygiene practices, should provide the foundation for an effective HACCP system, and places ultimate responsibility for the HACCP system on the food business operator (Codex Alimentarius, CXC 1-1969). The document does not describe a certification scheme.
Law can require HACCP without requiring a certificate. In Great Britain, for example, Regulation (EC) No 852/2004 as it applies there requires food business operators after primary production to "put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles" (legislation.gov.uk, Regulation 852/2004, Article 5). The article says nothing about third-party certification. Other jurisdictions word their requirements differently; check the one you sell into.
So a "HACCP certificate" is a certification body's statement that it audited a site against criteria of its own choosing, or its reading of Codex. Two HACCP certificates can mean quite different things. Ask which document the audit used, how long the audit took and whether the certification body is accredited for that activity.
ISO 22000 as a management system standard, and its scope statement
ISO describes ISO 22000:2018, Food safety management systems — Requirements for any organization in the food chain, as integrating the HACCP principles and application steps developed by Codex with interactive communication, system management and prerequisite programmes. It applies to organisations of any size in the food chain. Amendment 1 (2024) added climate action changes, and on 13 October 2026 ISO still listed the 2018 edition as current but "to be revised", with ISO/DIS 22000 expected to replace it (ISO, ISO 22000:2018).
The companion standard for certification bodies is blunt about what the certificate means. ISO 22003-1:2022 states that "FSMS certification does not attest to the safety or fitness of the products" and that ISO 22000 certification is a management system certification, not a product certification (ISO, ISO 22003-1:2022).
FSSC 22000 versus ISO 22000. FSSC 22000 is a certification scheme built from three parts: ISO 22000, sector prerequisite programmes, mainly from the ISO 22002 series, and the foundation's own scheme requirements (FSSC, FSSC 22000 scheme). ISO 22000 alone does not appear on GFSI's list of recognised programmes; FSSC 22000 does (GFSI, recognised certification programme owners). Version 7 of the FSSC scheme was released on 7 May 2026, and audits against version 6 are permitted until 30 April 2027 (FSSC, Version 7 is official).
BRCGS and comparable retailer-driven schemes, and the grading question
GFSI does not certify anyone. It benchmarks certification programmes against its Benchmarking Requirements, which it says are not a food safety standard in their own right and cannot be audited or certified against; certification is left to the recognised programme owners. Its list includes BRCGS, FSSC 22000, IFS, SQF, GLOBALG.A.P., PrimusGFS and others, some recognised for particular scopes (GFSI, recognised certification programme owners). A "GFSI certificate" is therefore always a certificate under one of those programmes.
GFSI's current recognised-programme page lists BRCGS Global Standard for Food Safety Issue 9 and its announced, blended and unannounced audit programmes (GFSI, recognised certification programme owners). BRCGS certification reports an audit outcome under the scheme's rules, but the certificate still has to be read with its scope, site and validity dates. Confirm the current certificate status and issuing body through the scheme's official directory rather than relying on a PDF supplied by a seller (BRCGS Directory).
Read a grade as the outcome of one audit, not a rating of product quality. A lower grade with a shorter cycle may still suit your requirement; a high grade for another product line does not help you.
Accreditation: the question that decides whether a certificate means anything
A certification body certifies the supplier. An accreditation body assesses the certification body. Without accreditation, a certificate can be genuine, the audit may have happened, and still no independent body has checked the auditor's competence or impartiality.
Each route has its accreditation standard. ISO 22003-1 serves as criteria for accrediting bodies that certify food safety management systems (ISO, ISO 22003-1:2022). ISO 22003-2 covers bodies certifying products, processes and services under food safety schemes and supplements ISO/IEC 17065 (ISO, ISO 22003-2:2022). BRCGS says accreditation bodies assess its certification bodies against ISO/IEC 17065 and must be signatories to the IAF Multilateral Recognition Arrangement (BRCGS, accreditation bodies). FSSC says its scheme works with licensed and accredited certification bodies (FSSC, FSSC 22000 scheme).
The international layer changed in 2026. On 1 January 2026, Global Accreditation Cooperation Incorporated replaced the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC). Accreditations issued under the IAF MLA or ILAC MRA continue to be recognised while the arrangements move to the new body's MRA, and the old marks remain valid until the new mark is fully adopted (IAF, Global Accreditation Cooperation launch). Certificates and scheme documents that still mention the IAF MLA are not wrong for that reason.
Scope: certified for what product, at what site, over what period
The scope statement is the part of a certificate that decides whether it applies to your purchase. Before you accept one, read:
- Holder and site. The legal name and the address of the site certified, not the head office.
- Product scope. The product categories and processes covered, in the scheme's own wording. "Biscuits" and "pasta" are different scopes.
- Standard, scheme and version. ISO 22000:2018, FSSC 22000 version 6 or 7, BRCGS Issue 9.
- Exclusions. Products or processes named as excluded.
- Dates. Issue date, audit date and expiry. Will it still be valid when your goods are produced?
- Issuer and accreditation. The certification body and the accreditation body for that scheme.
- Grade and audit type, where the scheme has them.
If goods will come from a subcontractor or a second factory, that factory needs its own certificate.
Matching the requirement to product risk and destination channel
No scheme is required everywhere or accepted by every buyer. Start from your customer and your regulator, then set the minimum.
| Situation | A reasonable minimum to ask for | What to check with others |
|---|---|---|
| Customer is a retailer or brand owner with a supplier standard | The scheme or schemes that customer names, often a GFSI-recognised programme, with the product and site in scope | Ask the customer for its approved list in writing |
| Higher-risk product for a food manufacturer (for example milk powder, ready-to-eat items) | A GFSI-recognised certificate or accredited ISO 22000, plus your own specification and testing | Whether the manufacturer's customers impose a scheme |
| Lower-risk bulk ingredient for further processing | Evidence of HACCP-based controls, ideally under accredited certification; test results against your specification | Contaminants the destination tests for |
| Any destination with official import controls | The official certificates and registrations the importing authority requires, separately from private certification | The importing authority and your customs broker |
Private certification is not an import permit. Nigeria's standards regulator, for example, lists food products among the exemptions from its SONCAP Offshore scheme, and adds that exemption from the scheme does not mean a product is unregulated (SON, SONCAP FAQ); other agencies and rules still apply. Official health and phytosanitary certificates are a separate layer; see the document set behind one shipment, and for a product where certification is agreed country pair by country pair, chilled lamb by air. Documentation requirements depend on the product, facility and destination.
Verifying a certificate with the issuing body, not by reading it
A certificate on paper or in a PDF is a claim. Confirm it through the scheme owner's register or the certification body, reached through contact details you found yourself, and check the issuer's accreditation. The detailed method, including what to do when a certificate is missing from a register, is covered in our guide to verifying certificates through registers. The point for this article is narrower: verification tells you the certificate exists; the scope tells you whether it is relevant.
Worked example: a valid certificate for the wrong site
Hypothetical teaching example. Suppliers, figures and prices are invented. Amounts are in currency units (CU).
A buyer needs 40 tonnes of sweet biscuits for a retail customer that requires a GFSI-recognised certificate covering the producing site. Three suppliers quote.
| Check | Supplier A | Supplier B | Supplier C |
|---|---|---|---|
| Certificate offered | FSSC 22000, version 6 | BRCGS Food Safety Issue 9, grade AA | ISO 22000:2018 |
| Accredited certification body | Yes | Yes | Yes |
| Product scope | Biscuits and wafers | Dried pasta | Biscuits |
| Site in scope | The biscuit factory | The group's pasta plant | The biscuit factory |
| GFSI-recognised programme | Yes | Yes | No |
| Meets the customer's requirement | Yes | No | Only if the customer accepts it |
| Price per tonne | 1,450 CU | 1,380 CU | 1,410 CU |
| Order value (40 t) | 58,000 CU | 55,200 CU | 56,400 CU |
Supplier B's certificate is genuine, current and well graded, and nothing on it is forged. The scope line settles the matter: it covers pasta at another plant. The biscuits would come from a site that holds only a HACCP certificate from a body with no stated accreditation. B's apparent saving of 2,800 CU (4.83% of A's order value) buys goods the retail customer will not accept.
Supplier C has the right product and site, but ISO 22000 alone is not a GFSI-recognised programme. If the customer agreed to accept it subject to a buyer-commissioned audit costing 2,000 CU, C's cost would be 58,400 CU, or 1,460 CU per tonne, 400 CU more than A.
On these figures Supplier A is the only offer that meets the requirement without conditions. Before ordering, the buyer confirms A's certificate in the FSSC register and checks that its expiry falls after the production dates.
Common mistakes
- Asking for "a HACCP certificate" without saying against what, issued by whom.
- Treating ISO 22000 and FSSC 22000 as interchangeable when a customer names GFSI-recognised programmes.
- Reading the logo and the grade, not the site address and product scope.
- Accepting a group certificate for a sister plant.
- Ignoring the expiry date, or a scheme version that is about to change.
- Treating a management system certificate as proof that a shipment is safe; that needs your specification and testing.
Limits and what to recheck
ISO 22000 is under revision, FSSC 22000 version 7 is in transition, and BRCGS Issue 10 is in development; recheck the current editions when you write a requirement. GFSI's recognised list changes as programmes are benchmarked against its 2024 requirements. The move from IAF and ILAC to Global Accreditation Cooperation Incorporated is still in transition, so names and marks on certificates may be mixed. Retailer and regulator requirements differ by market and change; confirm them with your customer, importing authority and customs broker. This is general information, not advice from a food safety certification specialist.
FAQ
What is HACCP certification? A certification body's statement that a site's HACCP-based controls met the criteria it audited against. Codex sets out the HACCP principles but no certification scheme, so ask which criteria were used.
Is ISO 22000 GFSI-recognised? ISO 22000 on its own is not on GFSI's recognised list. FSSC 22000, which is built on ISO 22000 with added prerequisite programmes and scheme requirements, is.
What is the difference between FSSC 22000 and ISO 22000? ISO 22000 is a management system standard. FSSC 22000 is a certification scheme that combines ISO 22000, sector prerequisite programmes, mainly from the ISO 22002 series, and its own scheme requirements.
Is BRCGS better than FSSC 22000? Neither is better in general. Both are GFSI-recognised; the right one is the one your customer accepts, covering your product at the producing site.
Next step
Before you request quotations, write down the certificate you need: the scheme or standard, the product scope, the producing site, the accreditation and the validity dates your customer and destination require. Send that checklist with the specification so every supplier answers the same requirement.
Resources
- FAO/WHO Codex Alimentarius — General Principles of Food Hygiene (CXC 1-1969) — https://www.fao.org/fao-who-codexalimentarius/sh-proxy/en/?lnk=1&url=https%3A%2F%2Fworkspace.fao.org%2Fsites%2Fcodex%2FStandards%2FCXC+1-1969%2FCXC_001e.pdf (accessed 23 September 2026)
- legislation.gov.uk — Regulation (EC) No 852/2004, Article 5 — https://www.legislation.gov.uk/eur/2004/852/article/5 (accessed 23 September 2026)
- ISO — ISO 22000:2018 Food safety management systems — https://www.iso.org/standard/65464.html (rechecked 13 October 2026)
- ISO — ISO 22003-1:2022 Requirements for bodies providing audit and certification of food safety management systems — https://www.iso.org/standard/74410.html (accessed 23 September 2026)
- ISO — ISO 22003-2:2022 Requirements for bodies providing evaluation and certification of products, processes and services — https://www.iso.org/standard/78516.html (accessed 23 September 2026)
- GFSI — GFSI-recognised certification programme owners — https://mygfsi.com/how-to-implement/recognition/certification-programme-owners/ (rechecked 13 October 2026)
- FSSC — FSSC 22000 scheme — https://www.fssc.com/schemes/fssc-22000/ (accessed 23 September 2026)
- FSSC — Version 7 is official — https://www.fssc.com/insights/version-7-is-official/ (accessed 23 September 2026)
- BRCGS — Directory — https://directory.brcgs.com/ (rechecked 13 October 2026)
- BRCGS — Accreditation bodies — https://www.brcgs.com/partners/certification-bodies/accreditation-bodies (rechecked 13 October 2026)
- International Accreditation Forum — Global Accreditation Cooperation Incorporated launch — https://iaf.nu/en/news/global-accreditation-cooperation-incorporated-launch-unifies-international-accreditation-organisations-and-strengthens-worldwide-trust/ (rechecked 13 October 2026)
- Standards Organisation of Nigeria — SONCAP FAQ — https://son.gov.ng/soncap-faq/ (accessed 23 September 2026)
