Food and beverage · ISO and GRC consulting
ISO certification for food and beverage that holds up in every customer audit, announced or not.
Your retail and brand-owner customers decide which food safety certificate they accept; we build the system that earns it. Sterling's expert and experienced consultants work from your process flow: prerequisite programmes, the HACCP plan, allergen and traceability controls, and the records an auditor tests, on every line and every shift. We ensure successful certification for our clients.
- One proposal covering consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to the scheme your customer names
- Expert and experienced food safety consultants who have built HACCP-based systems in plants, kitchens and warehouses across many countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- A certificate buyers acceptThe scheme your retailer or brand owner names in its supplier programme, not the nearest substitute.
- Ready on any dayA system that runs the same whether the audit is announced, blended or unannounced.
- Hazards proven under controlValidated limits, records completed on the line and a mock recall that was timed.
- One system, several schemesFood safety, quality, halal and environment run from one set of records in Effivity.
What food and beverage is asked for
Your customer names the scheme. We build a system that satisfies it, and the next one.
Most food and beverage businesses start with HACCP, because every scheme is built on it. Retailers and brand owners then usually ask for a GFSI-recognised certificate: FSSC 22000, BRCGS Food Safety, IFS Food or SQF, depending on the market and the customer. Farms supplying fresh produce are asked for GLOBALG.A.P.; exporters to Muslim-majority markets need halal certification recognised in the destination country. We map what each customer has asked for before we write a single procedure.
Why now
Why food and beverage businesses are asked for certification now.
The request usually arrives in a supplier questionnaire or a new contract. These are the pressures behind it.
- Retail and brand-owner customersMany retailers and brand owners write "GFSI-recognised certification" into their supplier programmes. ISO 22000 on its own is not recognised, which is why FSSC 22000, BRCGS, IFS Food and SQF exist.
- Export and new marketsA buyer abroad may name a different scheme from your home customers, and halal requirements are set by the destination market, from MS 1500:2019 in Malaysia to GSO 2055-1 in the GCC.
- RegulatorsNational food hygiene rules are built on the Codex HACCP principles. Facilities supplying the US answer to FDA rules under FSMA, including written food safety plans and foreign supplier verification.
- Unannounced auditsFSSC 22000 makes at least one surveillance audit per three-year cycle unannounced, and BRCGS requires at least one unannounced audit in three years. The system has to run every day, not the week before.
- Group standardisationGroups with several plants want one food safety standard across sites, with room for local differences, so that customers see the same controls wherever the product is made.
- Scheme revisionsFSSC 22000 Version 7 was published on 1 May 2026, SQF Edition 10 is rolling out, a third edition of ISO 22000 is in preparation and ISO 14001:2026 is now current. Certified sites need a plan for each change.
Scope and evidence
What auditors look at in a food and beverage plant, and the records that answer them.
Every scheme words it differently. On the floor, these six areas carry most of the audit.
| Requirement area | What it looks like in food and beverage | Evidence auditors ask for |
|---|---|---|
| Prerequisite programmes | Cleaning, pest control, maintenance, hygiene zoning, personal hygiene and supplier approval; for manufacturers, ISO 22002-1:2025 sets the baseline | Cleaning schedules with verification, pest control reports, maintenance records, hygiene inspections, approved supplier list |
| Hazard analysis and HACCP plan | A food safety team that knows every step of the flow, with CCPs such as cooking, pasteurisation or metal detection | Flow diagrams confirmed on the floor, critical limits validated by a study, regulatory value or reference, CCP monitoring records completed at the time |
| Allergen control | Segregation, changeover cleaning, label checks and allergen information carried from recipe to pack | Allergen risk assessment, changeover and cleaning verification, label approval records that reconcile with production |
| Traceability, withdrawal and recall | Raw materials, packaging and finished product linked batch by batch, with a recall team that knows its roles | Traceability exercises that reconcile quantities, and a mock recall that was run and timed |
| Food defence and food fraud | Vulnerable ingredients and access points identified, with controls proportionate to the risk; required by FSSC 22000 and IFS Food | Vulnerability assessments, mitigation plans, access controls and their review records |
| Monitoring, calibration and verification | Thermometers, scales and metal detectors checked; environmental monitoring where the scheme requires it; results reviewed, not filed | Calibration records, detector challenge tests, environmental monitoring results, verification analysis in management review |
The exact requirements depend on the scheme and your food chain category. The gap analysis maps every requirement of your customer's scheme against what you already do.
The engagement
What happens between the first call and the certificate.
Six steps, the same whether your customer asks for ISO 22000, FSSC 22000 or a retailer scheme. The primary standard for most plants is ISO 22000, with FSSC 22000 where GFSI recognition is required.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs. Nothing to arrange separately.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Food and beverage
- ISO 22000ISO 22000 certification consulting: PRPs, a validated hazard control plan, traceability and recall readiness, built with your teams for an accredited audit.
- HACCPHACCP certification consulting: hazards analysed, CCPs determined and limits validated and monitored, on good hygiene practices, ready for independent audit.
- FSSC 22000FSSC 22000 certification consulting for GFSI-recognised food safety: ISO 22000, sector PRPs and FSSC requirements, ready for a licensed body's audit.
- SQFSQF certification consulting for food, feed and packaging sites: a HACCP-based food safety plan and system elements ready for a licensed body's scored audit.
- GLOBALG.A.P.GLOBALG.A.P.
- Halal certificationHalal certification consulting for food, cosmetics and pharmaceutical makers: ingredients, segregation and traceability ready for your halal authority.
- IFS FoodIFS Food certification consulting for food manufacturers: HACCP, food fraud, food defence and operations ready for the annual scored IFS audit.
- BRCGS Food SafetyBRCGS Food Safety certification consulting for food manufacturers: HACCP plan, site standards and controls ready for a graded audit, announced or unannounced.
Food and beverage client experience
On the record: what food and beverage clients say about working with Sterling.
The plant's quality control manager describes the hazard analysis and CCP review as detailed and grounded in the actual processing flow, and credits the team with strengthening monitoring records and corrective-action decisions.
The group quality manager writes that the consultants standardised food safety practice across several sites while allowing for operational differences, and that the training material was clear and useful for managers and frontline staff alike.
The food safety team leader reports that implementation was built around the company's own processes and existing HACCP plan, and that roles, operational controls, verification activities and corrective actions became much easier for employees to understand.
The quality manager, who led the ISO 9001 and ISO 22000 project, writes that the consultants showed solid knowledge of the standards, kept a professional and cooperative approach throughout, and that the work was organised and steady with useful guidance at each stage.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions food and beverage clients ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which certification does a food and beverage manufacturer need?
The one your customers name. Start with the supplier programmes and questionnaires you have received: many retailers and brand owners ask for a GFSI-recognised certificate, which means FSSC 22000, BRCGS Food Safety, IFS Food or SQF. Where no customer has set a scheme, HACCP or ISO 22000 is often the sensible first step, because both lead naturally to a GFSI scheme later. We confirm the choice in the discovery call.
Is ISO 22000 enough, or do we need FSSC 22000?
ISO 22000 alone is not recognised by the Global Food Safety Initiative, so it is enough only where your customers accept it. FSSC 22000 combines ISO 22000, the ISO 22002 prerequisite programmes for your food chain category and the FSSC additional requirements, such as food defence, food fraud and allergens. A well-built ISO 22000 system is most of the work; moving to FSSC 22000 adds the missing parts rather than starting again.
BRCGS, IFS Food, SQF or FSSC 22000: how do we choose?
Choose by customer and market, not by preference. All four are GFSI-recognised, but they audit differently: BRCGS Food Safety grades sites from AA to D, IFS Food certifies at Foundation or Higher level after a scored audit, SQF scores out of 100, and FSSC 22000 is built on ISO 22000. If customers ask for different schemes, we build one system and map it to each, so a second certificate costs far less effort than the first.
Do we still need HACCP if we get ISO 22000 or FSSC 22000?
Yes, because HACCP is inside both. The Codex HACCP principles are audited within every ISO 22000 and FSSC 22000 certification, so your hazard analysis and HACCP plan remain the core of the system. A separate HACCP certificate is useful for smaller businesses or customers who ask for it specifically. If you already hold one, the HACCP plan carries across and the work concentrates on the management system around it.
We supply the US market. Is there an FSMA certificate?
No certificate of FSMA compliance exists: the FDA regulates and inspects. Facilities that must register with the FDA need a written food safety plan with a hazard analysis, preventive controls, monitoring, corrective actions, verification and a written recall plan, and the FDA sets training expectations for the people who build it. US importers must verify their foreign suppliers. We help you build and evidence that programme, often inside the food safety system you are certifying.
How long does food safety certification take?
Typically three to six months for HACCP, four to nine months for ISO 22000 and six to twelve months for FSSC 22000. The range depends on how mature your prerequisite programmes are, whether critical limits still need validating, how many products, lines and sites are in scope, and how much production is needed for records to show a pattern. The gap analysis gives you a dated plan against your customer's deadline.
Can we combine food safety with halal, ISO 9001 or ISO 14001?
Yes, and most plants benefit from doing so. Document control, training, internal audit, corrective action and management review can run once for every standard, with the halal assurance system, quality objectives or environmental aspects added on top. ISO 14001:2026, published on 15 April 2026, is the edition new environmental systems are built to. In Effivity, each certification body sees the same live records.
Talk to a consultant
Plan certification for your food and beverage operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice