Food safety: which scheme, and why the buyer decides

Food businesses are offered four things that sound like the same thing: HACCP, ISO 22000, FSSC 22000 and BRC. They share most of their content. They are not interchangeable, and choosing on price is how an organisation ends up certifying twice.

What each one is

HACCP is the method — hazard analysis and critical control points — not a management system. It is the core of everything else here, and in many jurisdictions it is a legal requirement rather than a commercial choice.

ISO 22000 wraps HACCP in a management system: context, leadership, competence, internal audit, management review, plus prerequisite programmes and operational prerequisites.

FSSC 22000 is ISO 22000 plus sector-specific prerequisite requirements and a set of additional requirements. It is recognised by the Global Food Safety Initiative, which is what many international retailers require.

BRCGS is a separate standard with its own grading system, widely named by UK and European retailers, and audited unannounced at higher grades.

The decision rule

Ask the buyer. GFSI recognition is the dividing line in practice: if your customer requires a GFSI-benchmarked scheme, ISO 22000 alone will not satisfy them, and the gap between it and FSSC 22000 is smaller than the cost of discovering that later.

Where food businesses actually fail audits

Rarely on the HACCP plan, which is usually the best-written document in the building. The findings come from the prerequisite programmes: cleaning records signed in advance, pest control reports with open actions from three visits ago, personal hygiene rules not followed in the one area the auditor walks through unannounced, water testing that lapsed.

And from traceability. The exercise is simple — take a finished batch, trace back to the raw material and forward to the customer, within the time the standard allows — and it exposes everything. A business that has never run one under time pressure should do so before an auditor asks.