FSSC 22000 guide
ISO 22000 vs FSSC 22000 vs BRCGS: which food safety certification do your buyers expect?
ISO 22000 is the management system, FSSC 22000 the GFSI-recognised scheme built on it, and BRCGS Food Safety the graded retail site standard. This guide compares scope, auditors, certificates and audit cycles, and shows when each one, or two together, fits your buyers.
Key points
- ISO 22000 is a management system standard, FSSC 22000 is a certification scheme built on it, and BRCGS Food Safety is a prescriptive site standard written for the retail supply chain.
- FSSC 22000 and BRCGS Food Safety are both recognised by GFSI; ISO 22000 on its own is not, so a buyer who asks for GFSI-recognised certification will not accept it alone.
- BRCGS grades each site from AA to D and re-audits every twelve or six months; FSSC 22000 and ISO 22000 run a three-year certificate with annual surveillance.
- The buyer's written specification decides more often than the site's preference; where two buyers name different schemes, one food safety system can carry both certificates.
ISO 22000 vs FSSC 22000 vs BRCGS: the short answer
Start with the document your customer sent you. If a retailer or brand owner requires "GFSI-recognised certification", ISO 22000 alone will not satisfy it, and the real choice is between FSSC 22000 and BRCGS Food Safety. If nobody asks for GFSI recognition, ISO 22000 is usually enough.
Between the two GFSI routes, three questions decide: which scheme your largest buyers name, whether you manufacture food or cater, store, transport, retail or make packaging, and whether you prefer designing your own controls or meeting a detailed, graded checklist.
Three different kinds of document
ISO 22000: the management system
ISO 22000:2018, with its 2024 climate amendment, sets what a food safety management system must achieve anywhere in the food chain, from context and leadership to prerequisite programmes and a hazard control plan built on the Codex HACCP principles. It leaves the method to you.
FSSC 22000: ISO 22000 plus two layers
Foundation FSSC owns a scheme, not a standard. Its Version 7, published on 1 May 2026, audits three parts together: ISO 22000, the ISO 22002 prerequisite programme standard for your food chain category used with the common baseline ISO 22002-100, and eighteen additional requirements covering subjects such as food defence, food fraud mitigation, allergens, environmental monitoring and culture. Those layers have their own guide: FSSC 22000 additional requirements explained, one by one.
BRCGS Food Safety: the prescriptive site standard
First published in 1998 for the retail supply chain, the BRCGS Global Standard Food Safety is now at Issue 9, audited since 1 February 2023, with nine sections from senior management commitment and the HACCP-based food safety plan to site standards, production risk zones and traded products. Where ISO asks what outcome you intend, BRCGS often states what the auditor expects to see. Issue 10 is in development, with no dates announced.
Side by side: scope, auditor, output and cycle
| What is compared | ISO 22000 | FSSC 22000 | BRCGS Food Safety |
|---|---|---|---|
| Owner and current edition | ISO; 2018 edition with Amendment 1:2024 | Foundation FSSC; Version 7, May 2026 | BRCGS; Issue 9, audited since February 2023 |
| GFSI recognition | No | Yes, for the manufacturing, feed, packaging, storage and (bio)chemical categories on GFSI's list | Yes, for its manufacturing and processing scopes |
| Who can be certified | Any organisation in the food chain | Food chain categories from processing and feed to catering, retail, transport, packaging and trading | Sites that manufacture, process or pack food, across 18 product categories; traded products optional |
| Who audits | A certification body accredited under ISO/IEC 17021-1 and ISO 22003-1 | A body licensed by Foundation FSSC and accredited for the scheme under the same two standards | A BRCGS-approved certification body accredited to ISO/IEC 17065 |
| What you receive | A certificate for the stated scope | A certificate listed on the FSSC public register | A graded certificate, AA to D, with a "+" after an unannounced audit; the report sits in the BRCGS Directory |
| Audit cycle | Stage 1 and Stage 2, annual surveillance, recertification in the third year | The same three-year cycle; every surveillance is a full audit and at least one in each cycle is unannounced | A full re-audit every twelve or six months depending on grade; at least one unannounced audit in three years |
| Findings | Major and minor nonconformities | Minor, major and critical; a critical finding leads to suspension | Critical, major and minor; a critical finding means no certificate or withdrawal |
| What drives audit cost | Audit time set under ISO 22003-1 by category, HACCP studies, employees and sites | The ISO 22003-1 time plus the scheme's own half day to day and a half, with no reductions allowed | BRCGS's duration calculator: employees per main shift, site area, HACCP plans, plus risk zones, traded products and modules |
| Typical preparation (Sterling's range) | Four to nine months | Six to twelve months | Five to ten months |
The cost factors are set out in FSSC 22000 certification cost: what moves the price.
When each one is the right choice
ISO 22000 on its own
Choose it when your customers want evidence of a structured, independently certified food safety system but none of them requires GFSI recognition. Check that position against each buyer's current specification rather than assuming it, because supplier programmes change.
FSSC 22000
Choose it when a buyer requires GFSI-recognised certification and your organisation already thinks in management-system terms, perhaps with ISO 9001 or ISO 14001 in place. Its categories reach feed, packaging, transport and storage as well as processing; catering, retail and trading sites can be certified too, but check GFSI's current list before relying on recognition for those.
BRCGS Food Safety
Choose it when your buyers name BRCGS, whose standard was written by and for the retail supply chain, or when your team prefers detailed, prescriptive requirements to designing its own controls. It is a manufacturing and packing standard; storage, transport, brokers and packaging makers have their own BRCGS standards.
Both FSSC 22000 and BRCGS
When two buyers name different schemes, first ask each whether the other GFSI-recognised certificate is acceptable. Where both are genuinely required, build one system mapped to both and plan the two audit calendars together.
Decision table: match the route to your situation
| Your situation | Recommended route | Why |
|---|---|---|
| No buyer asks for GFSI; you want a recognised food safety system | ISO 22000 | Credible and accredited, with less audit time than FSSC 22000 and a clean path to FSSC 22000 later |
| A buyer requires GFSI recognition and you already run ISO management systems | FSSC 22000 | Builds on the ISO structure you know and integrates with it |
| A retailer names BRCGS in its supplier manual | BRCGS Food Safety | The specification decides; an alternative certificate may not be read |
| You make packaging, or run storage and transport | FSSC 22000, or the matching BRCGS standard | BRCGS Food Safety is written for food sites; both owners have dedicated routes |
| Two major buyers name different GFSI schemes | Both, on one system | One set of controls and records, two audit programmes planned together |
Before committing, confirm in writing which schemes each buyer accepts, and whether your building and equipment would pass a prescriptive site inspection today.
What changes on the factory floor
Day to day, a well-run site looks similar under all three; the differences show at audit. An FSSC 22000 auditor tests whether your management system produced sound decisions. A BRCGS auditor spends more time checking the site against specified requirements, from walls, doors and equipment hygiene to cleaning and storage, and the number and severity of findings sets a grade your customers will look up.
Both GFSI schemes expect to arrive unannounced at least once in three years, so the system has to run on any day, not only on audit week. See The unannounced audit: how to be ready on any day.
How Sterling helps you choose and build the right route
One food safety system, mapped to the certificate your buyers actually read.
Sterling's expert and experienced consultants, working in 60+ countries since 2003, begin with your buyers' specifications and a gap analysis of your site against the route they point to, whether ISO 22000, FSSC 22000, BRCGS Food Safety or more than one. Under Sterling OS™ you choose Design™, where your team implements with Sterling's structure and coaching, or Drive™, where Sterling consultants carry the agreed consulting and documentation work with your people. The system runs in Effivity, included with the engagement at no additional cost. We ensure successful certification for our clients. Sterling does not certify: a licensed, BRCGS-approved or accredited certification body audits and decides.
Book a free discovery callISO 22000, FSSC 22000 and BRCGS: questions buyers ask
Is FSSC 22000 or BRCGS better?
Neither is better in general; the better one is the scheme your buyers accept and your site can sustain.
Is ISO 22000 recognised by GFSI?
No, ISO 22000 on its own is not GFSI-recognised. FSSC 22000 carries that recognition by adding the ISO 22002 prerequisite programmes and the scheme's additional requirements to ISO 22000.
Can a caterer, warehouse or packaging maker get BRCGS Food Safety?
Usually not; BRCGS Food Safety is written for sites that manufacture, process or pack food. BRCGS publishes separate standards for packaging materials, storage and distribution, and agents and brokers, while FSSC 22000 covers catering, storage, transport, retail and packaging as categories within one scheme.
Can we hold FSSC 22000 and BRCGS certificates at the same time?
Yes, a site can hold both, each audited separately under its own rules and certification body approvals. One system and one set of records can serve both.
Which is harder to pass, FSSC 22000 or BRCGS?
They are demanding in different ways rather than one being harder. BRCGS tests a long list of specified site and process requirements and grades the result, while FSSC 22000 tests whether your own system reaches sound decisions and covers eighteen additional requirements.
Does switching from BRCGS to FSSC 22000 mean starting again?
No, most of the work carries over: the HACCP plan, prerequisite programmes, traceability, culture and supplier controls. A gap analysis finds what is missing, usually the management-system clauses, the ISO 22002 mapping and some additional requirements.
More FSSC 22000 guides
Every guide in the FSSC 22000 series is written for one question and links back to the hub for the whole picture.
- FSSC 22000 case study
- FSSC 22000 certification cost: what moves the price
- FSSC 22000 certification process, step by step
- Effivity for FSSC 22000: the guide
- Food defence and food fraud assessments
- FSSC 22000 additional requirements explained, one by one
- FSSC 22000 training: who needs what
- The unannounced audit: how to be ready on any day
- FSSC 22000 Version 7: what changed
- ISO 22000 vs FSSC 22000 vs BRCGS
Keep exploring
Explore more about FSSC 22000
Watch a video on how to implement FSSC 22000 here.
Watch a video on FSSC 22000 requirements here.
FSSC 22000 resources
Services for FSSC 22000
Industries
Talk to a consultant
Not sure whether your buyers expect ISO 22000, FSSC 22000 or BRCGS? Talk it through with a Sterling consultant.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice