ISO 22000:2018 is the international standard for food safety management systems, but on its own it is not recognised by the Global Food Safety Initiative (GFSI). FSSC 22000 builds on ISO 22000 by adding sector-specific prerequisite programmes and extra scheme requirements, and it is GFSI-recognised. BRCGS Global Standard for Food Safety is a separate, more prescriptive GFSI-recognised standard that grew out of UK retail.
In practice, your customers usually decide. A UK supermarket supplier, a contract manufacturer for a global brand and a dairy selling only locally can each reach a different, correct answer.
Choosing badly is expensive: a full ISO 22000 system will not satisfy an export buyer who insists on GFSI recognition.
What GFSI recognition means
GFSI is an industry-led initiative that benchmarks certification programmes against its own requirements. Recognition for a scope means many retailers and brand owners accept that certificate without running their own full supplier audit.
FSSC 22000 and BRCGS Food Safety are both GFSI-recognised, as are other schemes such as IFS Food, widely used by German and French retailers, and SQF, common in North America. ISO 22000 is not, mainly because its prerequisite programme requirements are general rather than sector-specific. GFSI's list of recognised programmes changes over time, so check the current list on the GFSI website.
The three standards in brief
ISO 22000:2018
ISO 22000 shares the high-level structure of ISO 9001 and ISO 14001 and applies Plan-Do-Check-Act at two levels: the management system and operational hazard control. It combines risk-based thinking with HACCP principles and separates controls into prerequisite programmes (PRPs), operational PRPs (OPRPs) and critical control points (CCPs). See CCP vs OPRP.
FSSC 22000
FSSC 22000 is owned by Foundation FSSC. It combines three parts: ISO 22000, the relevant sector PRP specification from the ISO/TS 22002 series (for example, Part 1 for food manufacturing or Part 4 for food packaging manufacturing; check the current editions), and FSSC additional requirements. Additions include food fraud mitigation, food defence, allergen management, environmental monitoring and food safety and quality culture. Version 6 is the current version at the time of writing; check the current version with Foundation FSSC.
BRCGS Global Standard for Food Safety
BRCGS, which began as the British Retail Consortium's standard, publishes a detailed clause-by-clause standard, currently Issue 9 (check the current issue). It covers senior management commitment, the HACCP plan, the quality management system, site standards, product and process control, and personnel. Some clauses are fundamental; failing one can prevent certification. Audits are graded, with options for announced or unannounced audits.
FSSC 22000 vs ISO 22000 vs BRCGS side by side
| Aspect | ISO 22000:2018 | FSSC 22000 | BRCGS Food Safety |
|---|---|---|---|
| Owner | ISO | Foundation FSSC | BRCGS |
| Structure | High-level management system structure with PDCA | ISO 22000 + ISO/TS 22002 sector PRPs + FSSC additional requirements | Prescriptive clauses grouped by topic, with fundamental requirements |
| GFSI-recognised | No, not on its own | Yes, for recognised scopes | Yes, for recognised scopes |
| Style | Framework | Framework plus specified rules | Prescriptive |
| PRPs | General requirement; organisation selects and justifies | Sector-specific PRPs defined | Built into detailed site, product and process clauses |
| Audit outcome | Certified or not; no grade | Certified or not; no grade; includes unannounced audits | Graded result; announced or unannounced options |
| Typical customers | Domestic buyers, first-time FSMS sites | Global brands, exporters | UK retailers and their suppliers, exporters |
| Integration with ISO 9001/14001 | Strong, same structure | Strong; quality option available | Possible, but a different structure |
Which should you choose? A decision guide
Start with your customers, then consider maturity and existing systems.
| Situation | Usually suits | Why |
|---|---|---|
| Supplying UK retailers or own-label products | BRCGS | Long established with UK retail |
| Supplying EU retailers | A GFSI scheme such as FSSC 22000, IFS or BRCGS | Acceptance varies by retailer and country |
| Supplying multinational brand owners | FSSC 22000 or another GFSI scheme | Supplier manuals specify accepted schemes |
| Exporting to several markets | FSSC 22000 or BRCGS | One GFSI certificate can satisfy several buyers |
| Local GCC or Indian market, no GFSI demand | ISO 22000 | Credible, with an upgrade path to FSSC 22000 |
| Already certified to ISO 9001 or ISO 14001 | ISO 22000 or FSSC 22000 | Shared structure eases integration |
Maturity matters too. A site with weak basics may find BRCGS's detailed clauses a useful checklist. A site wanting food safety, quality and environment in one integrated system often prefers ISO 22000 or FSSC 22000. Either way, confirm in writing which schemes and scopes your key customers accept.
Implementation roadmap
- Confirm customer requirements, including the exact scheme and scope.
- Run a gap analysis against the chosen standard, PRPs included.
- Secure senior management commitment and a competent food safety team.
- Fix site PRPs first: layout, hygiene, pests, maintenance and supplier control.
- Update the hazard analysis and HACCP or hazard control plan.
- Add scheme elements such as food fraud, food defence and culture plans.
- Train staff and build records over a meaningful period.
- Complete internal audits and a management review.
- Choose a certification body accredited and approved for that scheme.
- Prepare for surveillance, recertification and unannounced audits.
Food fraud and food defence are common weak points in first audits; VACCP vs TACCP explains both.
Worked example: a Kerala seafood exporter
A frozen shrimp processor near Kochi exports to the EU with a HACCP-based system and the regulatory export approvals its markets require; private certification is a separate decision. A new UK importer wants its products, and two EU buyers now ask for a GFSI-recognised certificate.
The QA manager lists the real hazards: Vibrio and Listeria in cooked lines, sulphite use and labelling, antibiotic residues in raw material and cold chain integrity. All three standards can cover these, so the decision rests on the buyers.
She requests buyer requirements in writing. The UK importer accepts BRCGS or another GFSI scheme, but its retail customer prefers BRCGS. Both EU buyers accept any GFSI-recognised scheme. The site also plans ISO 9001 certification for a new value-added line.
BRCGS satisfies all three buyers and gives a clear target for the site upgrade. FSSC 22000 would integrate more neatly with ISO 9001 but risks the UK listing. They choose BRCGS and structure documents so a later quality system can sit alongside it.
Common mistakes
- Choosing a standard before asking customers which schemes and scopes they accept.
- Assuming ISO 22000 certification satisfies a buyer who asks for GFSI recognition.
- Running BRCGS as an audit checklist rather than a working system, then struggling with unannounced audits.
- Leaving food fraud, food defence and culture to the last week before the audit.
Key takeaway: ISO 22000 is the management system foundation. FSSC 22000 adds sector PRPs and scheme requirements to make it GFSI-recognised. BRCGS is a prescriptive GFSI-recognised alternative favoured by UK retail. Let your customers' written requirements decide.
Frequently Asked Questions
Is ISO 22000 GFSI recognised?
No. ISO 22000 on its own is not GFSI-recognised, mainly because its prerequisite programme requirements are general rather than sector-specific. FSSC 22000 adds sector PRP specifications and scheme requirements, and that combination is recognised. If a buyer asks for a GFSI-recognised certificate, ISO 22000 alone will usually not meet the request.
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is the international FSMS standard. FSSC 22000 is a certification scheme that uses ISO 22000 as its core, then adds a sector PRP specification from the ISO/TS 22002 series and FSSC's additional requirements, such as food fraud mitigation and food defence. An ISO 22000 system is a strong base for upgrading.
Is BRCGS better than FSSC 22000?
Neither is better overall. Both are GFSI-recognised and respected. BRCGS is more prescriptive, graded and strongly associated with UK retail. FSSC 22000 follows the ISO management system structure, integrates easily with ISO 9001 and ISO 14001 and is popular with multinational brands. The better choice is the one your customers accept and your site can sustain.
Can a site hold both BRCGS and FSSC 22000?
Yes, some sites hold both because different customers require different schemes. It means more audits and overlapping documentation, so first ask whether one GFSI-recognised certificate would satisfy all key customers. If dual certification is unavoidable, build one integrated system mapped to both standards rather than two parallel systems.
Do I still need HACCP with FSSC 22000 or BRCGS?
Yes. HACCP sits at the heart of both. BRCGS requires a HACCP plan based on Codex principles, and FSSC 22000, through ISO 22000, requires hazard analysis and a hazard control plan with CCPs and OPRPs. Certification builds the management system around HACCP; it does not replace it. See ISO 22000 vs HACCP.
Next steps
If you will audit or maintain an ISO 22000 or FSSC 22000 system, the ISO 22000 Internal Auditor: FSMS Auditing & Audit Programme Leadership course builds that skill. For wider management responsibility across schemes and regulations, see Advanced Food Safety Management & Compliance. Not sure which fits your role? Speak to a counsellor.
Related reading: ISO 22000 vs HACCP: which do you need, VACCP vs TACCP and food safety internal audit checklist.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.