Introduction to Global Food Safety Standards

Buy coffee, spices, cocoa, or frozen vegetables across borders and you quickly meet a wall of logos: BRCGS, SQF, FSSC 22000, IFS, GLOBALG.A.P. Each promises food safety, yet each has its own audit, scoring, and certificate. Understanding what sits behind those logos stops you paying for duplication or trusting a certificate outside its scope.

Global standards exist because trade needs a shared language. A buyer in Toronto, a retailer in Berlin, and a manufacturer in Bangkok cannot each invent a private definition of safe production and expect trade to flow. Standards codify expected controls so an audit result travels.

Codex and the public foundation

Codex Alimentarius, developed jointly under the Food and Agriculture Organization and the World Health Organization, provides international food standards, guidelines, and codes of practice. Its General Principles of Food Hygiene, CXC 1-1969, includes HACCP principles and is widely referenced by governments and private schemes.

Codex texts are not certificates and Codex does not audit your supplier. Governments use Codex when building national law, and trade disputes may refer to it. Private schemes build more detailed management requirements on top of that public foundation, adding audit and certification machinery.

ISO standards form another public-facing layer. ISO 22000 sets requirements for a food safety management system for any organisation in the food chain. FSSC 22000 uses ISO 22000 plus sector prerequisite programme specifications and additional scheme requirements as its basis.

GFSI and benchmarking explained

GFSI, the Global Food Safety Initiative, is an industry-led initiative now housed under The Consumer Goods Forum. Its core work is benchmarking: comparing certification programmes against GFSI Benchmarking Requirements covering food safety management, HACCP, prerequisite programmes, and audit governance.

Recognition matters because many large buyers accept any GFSI-benchmarked certificate instead of running their own full audit of every site. That acceptance reduces duplicate audits, though it does not remove a buyer’s right, or in some cases duty, to do more verification for high-risk materials.

  • GFSI does not write a single audit checklist used on every site.
  • GFSI does not issue certificates to food businesses.
  • Certification bodies, accredited for a specific programme, carry out audits and issue certificates.
  • Recognition applies to a programme and version, so status can change over time.

Major GFSI-benchmarked programmes

BRCGS Global Standard Food Safety began in the United Kingdom and is widely used by manufacturers supplying retailers. Audits use grading, and unannounced audit options exist within the programme. SQF, administered by the SQF Institute, offers codes for primary production, manufacturing, storage and distribution, and other scopes, with a strong presence in North America and Asia-Pacific.

FSSC 22000, owned by Foundation FSSC, combines ISO 22000, sector prerequisite programmes based on ISO Technical Specifications, and additional requirements. IFS Food, developed by European retailer associations, is common among suppliers to European retailers and uses a scoring approach. GLOBALG.A.P. focuses mainly on primary agricultural production, while schemes such as PrimusGFS also serve produce operations. Other recognised programmes cover packaging, storage and distribution, and agents and brokers.

Names and recognition status change as programmes revise versions. Before you rely on any list, check current GFSI recognition for the programme, version, and scope relevant to your supplier. A packaging certificate does not prove competence in ready-to-eat manufacturing.

How certification audits work

First, second, and third party

Party language describes who audits whom. A first-party audit is internal: an organisation audits itself. A second-party audit is carried out by a customer, or someone acting for a customer, on a supplier. A third-party audit is performed by an independent body with no direct commercial interest in the outcome, such as a certification body auditing for a certificate.

Certification usually follows a cycle. An initial audit assesses the full system, nonconformities must be corrected within scheme timelines, and surveillance or recertification audits follow at intervals set by the programme. Some programmes use announced audits, others offer or require unannounced elements. Scoring, grades, and rules for suspending or withdrawing certificates belong to the programme owner and certification body, not to you as buyer.

Using global standards wisely as a buyer

Ask for the full certificate and, where the supplier agrees, the audit report or a summary of nonconformities and corrective actions. Verify the legal entity, site address, product scope, expiry date, and certification body. A mismatch on any of those points deserves a question before approval.

Standards give you a strong baseline, yet your specific hazard may need more. A scheme audit samples a system; it may not test your exact allergen, your packaging format, or a fraud risk specific to a high-value ingredient. Add targeted verification where your risk assessment demands it, and record why.

Regional preferences still shape buying. A supplier selling mainly into European retail may hold IFS, a North American manufacturer may hold SQF, and an exporter using ISO-based systems may hold FSSC 22000. None of those choices alone signals a better plant. Judge the underlying findings, the scope certified, and how the site handles problems between certification visits, because daily practice protects product far more than a logo on a gate.

Key points

  • Codex and ISO provide foundations; private programmes add certification and audit governance.
  • GFSI benchmarks programmes for recognition; it neither certifies sites nor issues checklists for site audits.
  • BRCGS, SQF, FSSC 22000, and IFS Food are major GFSI-benchmarked manufacturing programmes, with others for farming, packaging, and logistics.
  • First-party means internal, second-party means customer-led, and third-party means independent certification.
  • Always verify certificate scope, site, entity, and expiry against the material you buy.
  • Use certification as baseline evidence and add targeted checks for your specific risks.
PreviousNext