It usually arrives as a polite email from the retailer’s quality assurance team. “As part of our supplier requirements, please provide evidence of GFSI-recognised food safety certification by…” Then a date that feels far too close.
That email tends to bring chaos, frantic calls and an unscheduled meeting. It lands like an uninvited guest who turns up at your holiday house, unannounced, and announces that they are staying.
I spent more than two decades in the food industry. I know that email, and I know the sinking feeling that follows it. If you have just received one, this article is for you.
Here is the uncomfortable truth behind it. Between January 2017 and July 2018, South Africa recorded 1,060 laboratory-confirmed cases of listeriosis, including 216 deaths. The World Health Organisation described it as the largest outbreak of listeriosis ever detected. The source was a ready-to-eat polony from a single processing facility in Polokwane, and the outbreak strain was found in the factory environment as well as in the product.
That facility was not a backyard operation. It belonged to one of the country’s largest food producers. The lesson for the retail sector was simple: a supplier’s word is not evidence. Retailers now want independent proof that your food safety system works every day, not only on audit day.
What your retailer is actually asking for
The phrase that matters in that email is “GFSI-recognised”. Retailers differ in what they accept. Woolworths’ supplier programme, for example, starts from a GFSI-benchmarked certificate or its own base standard, and Shoprite asks suppliers for an audit report or certificate. A GFSI-recognised scheme is the one that travels furthest, because most retailers and export customers accept it.
GFSI itself certifies nobody. It benchmarks certification schemes, and a scheme that passes is “recognised”. This is where most suppliers get confused, because three names get used as if they mean the same thing. They do not.
| HACCP (SANS 10330 / Codex) | ISO 22000:2018 | FSSC 22000 | |
|---|---|---|---|
| What it is | A hazard-control method | A food safety management system standard | A certification scheme: ISO 22000 + sector prerequisite programmes + FSSC additional requirements |
| GFSI-recognised on its own? | No | No | Yes |
| What it proves | You have identified and control your critical hazards | You manage food safety as a system, with leadership, risk and improvement | Both, benchmarked to the level global retailers accept |
In plain terms: HACCP sits inside ISO 22000, and ISO 22000 sits inside FSSC 22000. A HACCP certificate on its own will rarely satisfy a retailer that has asked for GFSI.
The timing matters right now. FSSC 22000 Version 7 was published in May 2026. Version 6 audits may still be conducted until 30 April 2027. From 1 May 2027, audits must be against Version 7, and every certified organisation must complete its upgrade audit by 30 April 2028. Version 7 rebuilds the prerequisite programme requirements around the new ISO 22002 series, which was published in 2025.
If you are starting from scratch today, there is no point in building to Version 6. Build to Version 7 from day one.
Before the certificate: the legal floor
FSSC 22000 is a commercial requirement. The law comes first, and an FSSC auditor will check that you meet it. ISO 22000 requires you to identify and comply with the statutory and regulatory requirements that apply to your products.
- Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972. The parent Act for food control in South Africa, administered by the National Department of Health.
- Regulation R638 of 22 June 2018. A food business may not operate without a valid Certificate of Acceptability issued by the local authority. The certificate is issued to the person in charge, is not transferable, and must be displayed on the premises. The person in charge must also make sure that staff are trained in food safety and hygiene.
- Labelling. Regulation R146 of 2010 still applies. Draft regulation R3337, with its front-of-pack warning labels, was published for comment in 2023 and is not yet law. Do not reprint your packaging to a draft, but do plan for it.
- Consumer Protection Act 68 of 2008, section 61. Producers, importers, distributors and retailers can be held liable for harm caused by unsafe goods, irrespective of negligence. Your retailer carries that risk with you, which is exactly why it audits you.
- Occupational Health and Safety Act 85 of 1993. Your food handlers are also employees. The same cleaning chemicals, cold rooms and machinery that sit in your food safety plan also sit in your OHS risk assessment.
A supplier who arrives at an FSSC 22000 audit without a valid Certificate of Acceptability has already failed. It is the most basic gap there is, and it is surprisingly common.
Why good food businesses fail their first audit
Most suppliers who fail are not careless. They make good food. They fail because they treat certification as a documentation exercise: they buy a manual, fill in the templates and hope. An FSSC 22000 auditor is trained to look past the paperwork to what actually happens on the floor.
Many companies use generic paperwork pulled off the internet. Auditors can spot it from a mile away, and they will point it out and penalise you for it. The auditor is no fool. They have been around the block a few hundred times, and they know the paperwork better than you ever will.
These are the areas where I see the system break down most often:
- Prerequisite programmes that live on paper. Cleaning schedules signed off for shifts nobody worked. Pest control reports filed but never read. Under Version 7, the prerequisite programmes are rebuilt on the ISO 22002 series, so outdated documents will not survive the upgrade.
- A hazard analysis copied from somewhere else. ISO 22000 clause 8.5 requires a hazard analysis of your products, your process and your premises. A generic HACCP plan tells the auditor immediately that nobody on site understands the risks.
- No visible food safety culture. FSSC 22000 requires a food safety culture plan, and auditors test it by talking to your people. If the forklift driver cannot tell the auditor why the red-zone door stays closed, the plan does not work.
- Top management who are “too busy”. ISO 22000 clause 5.1 places accountability on top management. When the owner hands the whole project to a junior QA controller, the auditor will find it.
- Corrective actions that fix the symptom. Cleaning the dirty surface is a correction. Finding out why it was dirty, and stopping it from recurring, is a corrective action. Auditors know the difference.
None of this is solved by a better template. It is solved by a system your people understand and actually run.
Already ISO 9001 or ISO 45001 certified? You are further ahead than you think
ISO 22000 follows the same high-level clause structure as ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (occupational health and safety). Context of the organisation, leadership, planning, support, operation, performance evaluation and improvement all sit in the same place in each standard.
That means your management review, internal audit programme, document control, competence records and corrective action process can serve all of them. You do not need four parallel systems that compete for the same people’s time. An integrated system is cheaper to run and easier to audit, and it gives you one version of the truth.
The food-specific parts, such as hazard analysis, prerequisite programmes, the HACCP plan, traceability, allergen control, food defence and food fraud, are what you add on top. In my experience, this is where most of the real work and most of the real value lie. Read more about ISO 22000 food safety management.
Received that email? Let’s talk for 15 minutes
Every supplier starts from a different point. Some need a Certificate of Acceptability before anything else. Some have a solid HACCP plan and only need to build the management system around it. Others are ISO 9001 certified and closer to FSSC 22000 than they realise.
In a 15-minute call, I will ask you five questions about your operation and tell you honestly where you stand, what your retailer will look for first, and whether your deadline is realistic. There is no sales pitch and no obligation. We implement the system, and an independent, accredited certification body audits and certifies it.
About the author. Dr Andreas B Burger spent more than 20 years in the food industry before founding SHEQ4SME (Pty) Ltd and Andreas Burger Consulting (Pty) Ltd. He holds an MBA, MPhil and a DBA, the NEBOSH International Diploma and SAMTRAC, and is an ISO 9001 and ISO 45001 Lead Auditor. He builds integrated management systems for South African businesses.
Sources
- ISO 22000:2018 Food safety management systems: Requirements for any organization in the food chain
- Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972; Consumer Protection Act 68 of 2008; Occupational Health and Safety Act 85 of 1993
- WHO Disease Outbreak News: Listeriosis, South Africa (2 May 2018)
- Minister of Health: update on the listeriosis outbreak (4 March 2018)
- UKAS technical bulletin: FSSC 22000 v7 transition
- Bureau Veritas: FSSC 22000 Version 7, what certified organizations need to know
- TUV SUD: FSSC 22000 v7 and the ISO 22002:2025 series
- Shoprite Holdings: become a supplier
- GoLegal: draft food labelling regulations (R3337), current status