Which Food Safety Certification Does Your Business Need? FSSC 22000, BRCGS, ISO 22000, GLOBALG.A.P. and HACCP Compared

Home / Guides / Which food safety certification do you need

Choosing a scheme · GFSI certification

By Mthokozisi Nkosi, food scientist, registered Lead Auditor with Exemplar Global and IRCA, and one of four SAATCA registered R638:2018 Lead Implementers. Founder of ASC Food Safety Consultants. Last updated 9 September 2026.

How do you know which food safety certification you need?

Your customer decides. Certification is a purchasing requirement, not a legal one. No South African law names FSSC 22000, BRCGS, ISO 22000 or GLOBALG.A.P. The law you must meet is Regulation R638 of 2018 under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972. Everything above that line was written into a contract by a buyer.

So the conversation starts with a purchase order, not with a standard. Ask the customer for four things in writing: the scheme name, the issue or version number, the edition where the scheme has editions, and the scope wording they expect on your certificate. Those four things are not interchangeable. BRCGS Global Standard Food Safety Issue 9 is a different ask from BRCGS Global Standard Packaging Materials Issue 7. GLOBALG.A.P. IFA v6 Smart is a different ask from IFA v6 GFS, and only one of the two is the GFSI route.

What your site physically does narrows the field before anyone’s preference does, because schemes are scoped to activities: growing, packing, manufacturing, making packaging materials, storing and distributing, catering and retail are all separate worlds. Where your customer’s customer sits narrows it again, because a certificate that satisfies a South African wholesaler may not satisfy the retailer buying from them in the United Kingdom. What settles it is whether the certificate has to survive a retailer’s supplier approval process, which is where GFSI recognition stops being a technicality and starts being the whole question.

The scheme you personally prefer carries no weight in a supplier approval meeting. On a site I audited, the quality manager walked me through a year of work before the opening meeting had properly started: procedures written, the hazard analysis rebuilt, internal audits running on a schedule, all of it aimed at a scheme nobody had actually asked for. When we opened the buyer’s specification together, it named FSSC 22000 in the second paragraph. None of that work was wasted, but the certificate they were three months away from earning would not have closed the requirement. If the specification says FSSC 22000, an ISO 22000 certificate on the wall starts a negotiation, not an approval.

What is GFSI, and why “GFSI certified” is not a thing

GFSI is the Global Food Safety Initiative, hosted by The Consumer Goods Forum. It benchmarks certification programmes against its own requirements and recognises the ones that meet them. GFSI does not audit sites and issues no certificates, so no business anywhere is GFSI certified. You are certified to a GFSI recognised scheme, by an accredited certification body, against a named issue of that scheme.

The recognised programmes include BRCGS, FSSC 22000, GLOBALG.A.P., SQF, IFS, Freshcare, Global Red Meat Standard, Global Seafood Alliance, GRMA, PrimusGFS, CanadaGAP and JFSM. ISO 22000 on its own is not among them.

Recognition attaches to a scheme rather than to an organisation. BRCGS publishes several standards, including Storage and Distribution, Agents and Brokers, Consumer Products, Plant-Based, Gluten-Free, Ethical Trade and Responsible Sourcing, Retail and START, and not all of them are GFSI recognised. Recognition can also attach to one edition of a scheme and not another, which is exactly the case with GLOBALG.A.P. IFA v6, where the GFS edition is the recognised route and the Smart edition is not.

When a buyer writes “you must be GFSI certified”, they are using shorthand for “hold a current certificate against a GFSI recognised scheme with a scope that covers what you sell us”. Write back and ask which scheme they will accept. Many will accept any recognised scheme, and that answer alone can save you the cost of certifying twice.

FSSC 22000 vs BRCGS vs ISO 22000 vs GLOBALG.A.P. vs HACCP

The table below compares the five routes South African food businesses are actually asked for. Read the “who typically demands it” column first, then the “best fit” column, then decide. The last column is the ASC course that teaches the scheme in enough depth to run a gap assessment against your own site.

A short decision tree

If your customer is a UK or European retailer, or a South African supplier of retailer own brand product, start at BRCGS Global Standard Food Safety Issue 9. If your customer is a multinational manufacturer or brand owner buying ingredients, bulk product or contract manufacture, start at FSSC 22000 Version 7. If you manufacture packaging that will touch food, start at BRCGS Global Standard Packaging Materials Issue 7, or at FSSC 22000 with ISO 22002-4:2025 if the buyer prefers FSSC.

If you are a farm growing fruit or vegetables for EU retail, start at GLOBALG.A.P. IFA v6 and confirm the buyer wants the GFS edition. If you pack, store, trade, process or sell certified produce that you did not grow yourself, start at GLOBALG.A.P. Chain of Custody v6.1 instead. If a buyer wants proof of a management system and has not named a GFSI recognised scheme, start at ISO 22000:2018. If nobody has asked you for a scheme and you sell into the South African market, start at R638 of 2018 and a documented HACCP system, and stop there until a customer asks for more.

When is FSSC 22000 the right answer?

FSSC 22000 fits a manufacturer that runs, or wants to run, an ISO style management system and needs a GFSI recognised certificate. It is ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements. Version 7 was published in May 2026 and replaces Version 6, on a transition timetable that is already running.

The three part structure is the practical reason to choose it. Your prerequisite programmes come from the ISO 22002 part that matches your sector, running from ISO 22002-1:2025 for food manufacturing through ISO 22002-2:2025 for catering, ISO 22002-4:2025 for food packaging, ISO 22002-5:2025 for transport and storage and ISO 22002-6:2025 for feed to ISO 22002-7:2025 for retail and wholesale, over the common baseline in ISO 22002-100:2025, and our guide to ISO 22000 explained sets out which part applies to which sector. The additional requirements sit on top and carry the themes buyers ask about most: food fraud and food defence, food safety culture and quality management, supplier and outsourcing management, traceability, sustainability including food loss and waste, and AI governance.

The Version 7 timetable is the reason certified sites should be booking training now rather than in 2027. The dates below come from the FSSC upgrade process document.

If you are already certified, the shortest route through this is the FSSC 22000 transition course at R1,450, and the detail of what changed is set out in our guide to what is changing in FSSC 22000 Version 7. If you are starting from nothing, take the whole system in order.

When is BRCGS the right answer?

BRCGS is the right answer when a retailer is in the chain. Global Standard Food Safety Issue 9, published on 1 August 2022, is still the current issue, with Issue 10 in development after consultation and not yet published. Global Standard Packaging Materials Issue 7, published on 28 October 2024, is current for packaging manufacturers. Both are audited clause by clause against written requirements.

The practical difference between BRCGS and FSSC 22000 is how much design freedom you have. BRCGS tells you what it expects to see and an auditor checks it. FSSC leaves more of the design to you and then audits whether your design works. Neither approach is superior, but they suit different sites. A factory with a strong technical team and an established system often finds FSSC 22000 the better fit. A site building its first formal system, particularly one supplying retail own brand, often finds BRCGS easier to follow, because the standard reads much closer to an instruction than to a framework.

Packaging is the case where the answer is usually clear cut. If you print, convert or mould material that will contact food and your customer sells to retail, ask directly whether they want BRCGS Packaging Materials Issue 7 or FSSC 22000 with ISO 22002-4:2025. Those are two different implementation projects and you should only pay for one. The full comparison of the food and packaging audits sits in our guide to BRCGS certification explained.

When is ISO 22000 on its own enough, and when is it not?

ISO 22000:2018 is enough when a buyer wants evidence of a working food safety management system and has not named a GFSI recognised scheme. It stops being enough the moment a retailer specification requires GFSI recognition, because ISO 22000 on its own is not recognised. ISO 22000:2018 is the current edition, confirmed in 2023, with Amendment 1:2024 adding climate action text.

ISO 22000 alone is the right answer in a few clear situations. A manufacturer selling only into the South African market whose customers want a management system certificate. A group standardising across sites that are not all in scope for a retail scheme. A service provider, storage operator or equipment supplier that no GFSI scheme fits cleanly. A site building towards FSSC 22000 that wants the management system running and audited first. Nothing is wasted in that last case, because the clause structure is identical and the step to FSSC is the prerequisite programme standard and the additional requirements, not a rebuild.

Because the standard leaves the prerequisite programmes to you, an ISO 22000 certificate can mean very different things at two different sites, which is the usual reason a buyer asks for a recognised scheme the second time round. The clause by clause detail, the PRP, OPRP and CCP question and what a certification audit involves are worked through in our guide to ISO 22000 explained, with the prerequisite programme side in our guide to prerequisite programmes and GMP for South African food manufacturing. The training route is the Introduction to ISO 22000 Bundle at R4,543, which saves R1,136 against the three courses bought separately.

When is GLOBALG.A.P. the answer instead?

GLOBALG.A.P. is the answer when the certified activity is farming. Integrated Farm Assurance v6 is current, having fully replaced v5.2 after it was phased out on 31 December 2023, and it covers the plants and aquaculture scopes, IFA for livestock having been discontinued as a legacy solution with audits possible only until 31 December 2023. It is issued in two editions, IFA v6 Smart and IFA v6 GFS, and only the GFS edition is the GFSI recognised route. If your buyer is an EU retailer, confirm which edition they require before your first audit.

The second GLOBALG.A.P. decision is Chain of Custody. Chain of Custody version 6.1, published in November 2022 and replacing version 6 on 1 July 2023, is the standard for businesses that handle, process, pack, store, trade or sell certified product without farming it. A packhouse that buys in certified fruit needs it. A producer who already holds IFA does not need a separate Chain of Custody certificate for their own product. Getting this wrong in either direction costs money: one business pays for a certificate it does not need, the next loses a claim on certified status it cannot support.

The version of this I see most often is a packhouse printing a grower’s GLOBALG.A.P. number on cartons of fruit it bought in, on the honest assumption that the certificate travels with the pallet. It does not. The packhouse manager showed me a supplier file with every grower certificate in it, current and correctly filed, and no Chain of Custody certificate of his own, and the claim on the carton was therefore unsupported. Chain of Custody for Plants is a four hour course and R649. The alternative was a customer complaint about a certified status claim, which is a slower and far more expensive conversation.

Our guide to GLOBALG.A.P. certification in South Africa works through the IFA and Chain of Custody decision in full.

When is plain HACCP and R638 compliance the correct and sufficient answer?

For a business selling into the South African market with no customer demanding a scheme, the correct answer is a valid certificate of acceptability under regulation 3(1) of R638 of 2018, prerequisite programmes that actually run, and a documented HACCP system built on Codex CXC 1-1969. That is a complete, defensible position. It is also a foundation rather than a GFSI certificate, and no recognised scheme accepts it as a substitute.

a person may not handle food or permit food to be handled … on food premises in respect of which a valid certificate of acceptability, has not been issued or is not in force.Regulation 3(1), R638 of 2018, Government Gazette 41730, 22 June 2018

R638 also sets the training duty, and it is worth reading the exact wording, because it explains why no certification scheme is named anywhere in South African food premises law.

he or she is suitably qualified or otherwise adequately trained in the principles and practices of food safety and hygiene, as appropriate, and that the training is accredited or conducted by an inspector, where applicable.Regulation 10(1)(a), R638 of 2018

R638 names no course, no provider, no unit standard and no scheme. It states a competence outcome and, at regulation 10(1)(d), a duty to keep training programmes and records and make them available to an inspector on request. An environmental health practitioner is looking for evidence of competence, not for a GFSI logo. The full picture is in our guide to the certificate of acceptability and R638 compliance.

A certification body can issue a HACCP certificate, and many South African businesses hold one. It is useful, it satisfies a great many local buyers, and it is not GFSI recognised. Understand it for what it is. The good news is that HACCP work is never wasted: the seven principles and twelve steps sit inside FSSC 22000, BRCGS, IFA v6 and ISO 22000 alike, so a site with a properly validated hazard analysis has already done the hardest part of any scheme it later chooses. Our HACCP guide for South Africa and the guide to which HACCP course you need cover the training decision in detail.

What does certification cost a South African business in time and effort?

Certification costs three separate things: the certification body’s audit fee, which is quoted per site and which ASC does not publish because it is not ours to quote; your own people’s time building and running the system; and training. ASC’s implementation courses run from R4,200 for GLOBALG.A.P. IFA for Plants to R5,500 for FSSC 22000. Municipal certificate of acceptability fees are separate tariff items entirely: Garden Route District Municipality charged R280 in 2025/26.

Ask three accredited certification bodies for written quotations before you commit to a scheme. The audit fee turns on scope, site size, number of processes, number of audit days and travel, and the difference between quotations for the same site can be significant. Ask what the three year cycle costs, not only the first audit.

The time cost is where projects actually fail, and it is rarely the audit week. The first file I ask for is validation, and the answer I hear most often is that the critical limit came from the equipment supplier and nobody has ever tested it on this line with this product. On a site I audited the cold room floor fell away from the gully instead of towards it, so water stood under the racking every night. That is a building contractor, a quotation and about six weeks, not a procedure someone can write on a Friday. Records are the third one. You cannot audit a system that started last month, because a certification body wants to see it operating over time, including at least one internal audit and one management review before it will recommend certification.

Budget training as a line item, not an afterthought, and train the people who will do the work rather than only the quality manager. Course by course prices and how ASC compares to other South African providers are set out in our food safety training cost guide.

How do you choose if two customers ask for two different schemes?

Read the wording before you spend anything. Most buyer specifications ask for a GFSI recognised scheme rather than a named one, and where both of your customers have written it that way, one certificate satisfies both. Where one has genuinely named a scheme, you have three options: certify to the named one, ask in writing whether an alternative recognised scheme is acceptable, or hold two certificates.

Dual certification is legitimate and more common than people think. One site can hold BRCGS and FSSC 22000, often audited by the same certification body in the same week. It costs more, because each scheme carries its own audit days and its own document set, so treat it as a commercial decision: if the second customer is worth more than the second certificate costs over three years, hold both. If not, negotiate. Keep every buyer’s written answer on file, because supplier approval teams change and the question comes back.

What should you do in your first ninety days?

Spend the first ninety days deciding correctly and building the foundation that every scheme shares, rather than rushing to book an audit. The decision itself takes a week if you ask the right people. The gap assessment takes a month. What follows is the sequence I use with new implementation clients, and it works whichever scheme you land on.

Which ASC course should you start with for each route?

Start with the scheme your customer named, at the level the person actually works at. Every route below opens with an entry course that teaches the scheme and closes with an implementation course for the person who will build the system. Bundles are cheaper than the same courses bought separately and the saving is stated in each case.

Frequently asked questions

ASC Food Safety Training · Leading with Science. Ensuring Food Safety. · Fully online, serving all of South Africa and beyond · info@ascfoodsafety.com · WhatsApp +27 61 483 0381 · SAATCA registered training centre (TC No. 065) · FoodBev SETA accredited provider No. 587/00337/1900 · B-BBEE Level 1 · Registered Lead Auditor (Exemplar Global and IRCA) · Consulting and document toolkits at ascfoodsafety.com