Food Safety Certification Guide: SQF, BRC, HACCP & FSMA

Food manufacturers right now are navigating more certification pressure than at any point in the last decade. Retail buyers want GFSI-recognized credentials before they'll take a meeting. FDA enforcement under FSMA has moved from ramp-up to routine. And food safety audit findings are increasingly public — which means a bad result doesn't just cost you a customer, it follows you.

In my experience working with 200+ clients through first-time food safety certifications, the companies that struggle aren't struggling because food safety is hard. They're struggling because they picked the wrong standard for their supply chain, or they built their documentation in the wrong sequence, or they didn't understand how an SQF auditor reads a HACCP plan differently than an FDA inspector does.

This guide covers the full food safety certification landscape — FSMA, HACCP, SQF, and BRCGS — so you can enter your audit program with the right expectations and a realistic timeline.

FSMA: The Regulatory Floor You Cannot Ignore

FSMA compliance isn't optional — it's the baseline for any food facility regulated by FDA. The FDA Food Safety Modernization Act, signed into law January 4, 2011 as Public Law 111-353, represents the most comprehensive reform of U.S. food safety law since 1938, shifting FDA's posture from responding to contamination events to actively preventing them. The core rule most manufacturers need to understand is 21 CFR Part 117, the Preventive Controls for Human Food rule (PCHF).

What 21 CFR Part 117 actually requires:

• A written Food Safety Plan covering hazard analysis, preventive controls, monitoring procedures, corrective action procedures, verification activities, and a recall plan
• A Preventive Controls Qualified Individual (PCQI) who has completed Food Safety Preventive Controls Alliance (FSPCA) training or its equivalent
• Supply-chain program documentation for any supplier-dependent preventive controls
• Environmental monitoring programs for facilities where Listeria or other environmental pathogens are relevant hazards

The PCQI requirement trips up a lot of smaller manufacturers. You can't just appoint someone — the person needs documented training, and FSPCA's two-day course satisfies that requirement. That training should be on the calendar before you start drafting your food safety plan, not after.

One thing worth naming directly: FSMA compliance and GFSI certification are not the same thing, and retail buyers know the difference. Your FDA-compliant food safety plan is a prerequisite for certification audits, not a substitute for them. FDA currently registers approximately 77,000 domestic food manufacturing facilities, and enforcement frequency has increased meaningfully under the FSMA inspection mandate — yet most of those facilities still lack GFSI-recognized certification.

HACCP: The Technical Core That Every Standard Audits

HACCP (Hazard Analysis and Critical Control Points) isn't a certification on its own — it's an internationally recognized methodology codified in the Codex Alimentarius HACCP guidelines, and incorporated directly into FDA regulations for seafood (21 CFR Part 123) and juice (21 CFR Part 120). For most food manufacturers, HACCP is the technical backbone of both FSMA compliance and any GFSI scheme you pursue.

The seven HACCP principles:

1. Conduct a hazard analysis
2. Determine Critical Control Points (CCPs)
3. Establish critical limits
4. Establish monitoring procedures
5. Establish corrective actions
6. Establish verification procedures
7. Establish record-keeping and documentation procedures

Here's what I see go wrong consistently during audit preparation: hazard analyses that stop at physical, chemical, and biological categories without drilling to the process-specific hazard level. An SQF or BRCGS auditor is going to ask you to walk through how you determined that a specific step in your process is or isn't a CCP, and "we ran the decision tree" is not the answer. The reasoning has to be documented, step by step, for every decision point.

A HACCP plan that cannot show the reasoning behind each CCP determination — not just the conclusion — will fail a GFSI-recognized scheme audit regardless of how well the plan itself is written.

SQF vs. BRCGS: Choosing the Right GFSI Scheme

Both SQF (Safe Quality Food) and BRCGS Food Safety are recognized by the Global Food Safety Initiative (GFSI). Both are accepted by major U.S. retailers. The choice between them comes down to your customer mix, your supply chain position, and which auditing body has stronger regional presence where your facility operates.

If your primary customers are U.S.-based and you're in retail grocery, SQF is generally the more direct path. If you're co-manufacturing for brands with UK or EU supply chain exposure, or your buyer has explicitly asked for BRCGS, start there.

In my experience, companies that build their food safety management system to SQF Edition 9 are reasonably well-positioned to add BRCGS Issue 9 later — because both schemes are HACCP-based and FSMA-aligned at the core, and the incremental work from one to the other is considerably smaller than starting fresh. For more detail on BRC requirements specific to food manufacturing, see our BRC food manufacturing certification guide.

What SQF Edition 9 Actually Requires

SQF Edition 9 took effect in January 2023. The structure is modular: every food manufacturer begins with the SQF System Elements (section 2) and the Good Manufacturing Practices module (section 11 or the relevant sector-specific module), and layers the Food Safety Plan — the HACCP study — on top.

Key areas that generate findings in SQF Edition 9 audits:

Section 2.1 — Management Commitment: This isn't just a policy statement. An SQF auditor is looking for evidence that senior management reviews food safety performance data, drives corrective actions, and that food safety objectives appear in documented management reviews. A policy on the wall and a binder of records are not the same thing as a functioning management system.

Section 2.4 — Food Safety Plan: Your HACCP-based food safety plan needs to cover all products, all processes, and all potential hazards — biological, chemical, physical, and radiological under Edition 9. The plan must be validated before you enter your certification audit, and validation means more than a desk review by the person who wrote it.

Section 11 — Good Manufacturing Practices: Pest control, sanitation, allergen management, and environmental monitoring programs need to be operational and generating records before audit day — not drafted and waiting to be implemented.

The unannounced audit option under SQF deserves real consideration. Some retailers require it. Even when they don't, it signals to buyers that your food safety system is designed to run every day, not to pass an annual inspection.

What BRCGS Food Safety Issue 9 Actually Requires

BRCGS Food Safety Issue 9 became mandatory in February 2023. The scheme operates on a three-tier non-conformance structure: Fundamental Requirements, which if breached result in an automatic audit failure; Major Non-Conformances; and Minor Non-Conformances.

This is materially different from SQF's scoring model, and first-time applicants who expect a graded outcome based on accumulated findings are often caught off guard. A single Fundamental finding ends the audit without certification.

Areas that generate Fundamental findings in first-time BRCGS audits:

Clause 2.1 — HACCP: The HACCP study must be conducted in accordance with Codex Alimentarius principles, documented by a trained HACCP team (not a single individual), and kept current. "Kept current" means reviewed and updated whenever products, ingredients, equipment, or processes change — and every review needs to be documented.

Clause 4.2 — Site Security and Food Defense: BRCGS Issue 9 significantly strengthened food defense requirements. A documented food defense plan that includes a TACCP (Threat Assessment Critical Control Points) vulnerability assessment is now expected — not just a site security checklist.

Clause 3.4 — Internal Audit: You need a fully completed internal audit cycle covering all sections of the standard before your certification audit. This is where first-time applicants fall short most frequently — they start the internal audit process too late, discover findings they can't close in time, and enter the certification audit with open gaps.

The Anatomy of a First-Time Audit Failure

The food industry doesn't publish aggregate first-time audit pass rates publicly. What I can tell you from working through certification preparation with hundreds of food manufacturers is that the failure modes are remarkably consistent: incomplete hazard analysis documentation, internal audit programs that weren't run before the certification audit, and allergen control programs that exist on paper but aren't operationalized on the floor.

In food safety certification audits, the gap between a written program and an operational program is the single most common cause of first-time audit failure — a completed SOP in a binder carries no audit value if workers cannot describe how it functions in practice.

At Certify Consulting, we've maintained a 100% first-time audit pass rate across our food safety client work. That result comes from a specific preparation sequence, not from hoping documentation holds up under scrutiny. The sequence matters — and I'll lay it out in the final section below.

FSMA and GFSI: How They Overlap and Where They Don't

One of the most practical questions food manufacturers ask is whether FSMA compliance and GFSI certification can be built as a single integrated system rather than two parallel documentation efforts. In my view, yes — and building them separately is one of the more expensive mistakes you can make.

The core overlap:

• Both require hazard analysis using equivalent methodology (HARPC under FSMA; HACCP under GFSI schemes)
• Both require supply chain management programs
• Both require verification and validation of preventive controls
• Both require documented corrective actions and recall programs

The meaningful gaps:

• FSMA Part 117 requires a PCQI; SQF and BRCGS require a trained HACCP team but don't specifically require FSPCA credentials
• BRCGS Issue 9 requires TACCP food defense vulnerability assessment more explicitly than FSMA's food defense provisions for most smaller manufacturers
• SQF Edition 9 Level 3 includes quality management system elements (management review, corrective action tracking at a systems level) that have no direct FSMA analog

The practical guidance: build the system to the GFSI scheme you're targeting. FSMA compliance follows naturally from that work in most cases, because SQF Edition 9 and BRCGS Issue 9 both exceed FSMA Preventive Controls requirements in their documentation and verification standards.

How Long Does Food Safety Certification Take?

The honest answer and the wishful answer diverge here. A well-organized facility with reasonable GMP baseline, a PCQI on staff, and prior experience with management system standards can reach SQF or BRCGS audit readiness in roughly six months. For most first-time applicants — particularly those who are FSMA-compliant on paper but haven't operationalized their programs — nine to twelve months is more realistic.

What most affects the timeline:

• PCQI status: If no one at the facility has completed FSPCA training, that's the first step and it creates a hard scheduling dependency before the food safety plan can be finalized.
• Existing documentation: A facility with current GMPs, an existing HACCP plan, and a functioning internal audit program is in a materially different position from one starting from scratch.
• Auditor availability: In some regions, SQF and BRCGS certified auditor scheduling adds two to three months to the process. Build that buffer in.
• Scope decisions: Certifying one product line versus your full manufacturing operation is a different project in terms of HACCP complexity and documentation volume.

The global food safety testing and certification market is projected to reach $24.6 billion by 2027, which reflects how seriously the industry is treating third-party verification. The demand for certified facilities is only moving in one direction.

The Right Preparation Sequence

If you're beginning a food safety certification program today, this is the sequence that consistently produces first-time audit success — across SQF, BRCGS, and combined programs:

1. Confirm your scheme: Which standard does your target customer require? If multiple customers want different schemes, which is most stringent, and where do they overlap?
2. PCQI training: If no one is PCQI-qualified, schedule FSPCA training immediately. Everything downstream depends on it.
3. Baseline gap assessment: Measure your current state against every element of the chosen scheme's requirements. Don't guess at the gaps.
4. Build and validate your Food Safety Plan: HACCP study conducted by a documented team, validated through real testing or process review — not a desk sign-off.
5. Operationalize your programs: GMP compliance, allergen control, environmental monitoring, pest control — all running and generating records before the audit.
6. Complete a full internal audit cycle: Every element of the standard audited, findings documented, corrective actions closed and verified.
7. Pre-assessment: An outside review of your system before the certification auditor arrives. This is where avoidable surprises get found.
8. Certification audit: With everything in place and no open corrective actions.

None of those steps are optional, and the order matters. The manufacturers who compress or skip the internal audit step and the pre-assessment are the ones who fail first-time audits — consistently. For a full breakdown of what Certify Consulting's food safety audit preparation program includes, visit certify.consulting/food-safety-certification.

Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, RAC is Principal Consultant at Certify Consulting. With 8+ years of experience and 200+ clients served, Certify Consulting provides full-service food safety certification support for SQF, BRCGS, HACCP, and FSMA compliance programs.

Last updated: 2026-06-26