What GFSI Certification Requires

The Global Food Safety Initiative (GFSI) is an Industry Solution of the Consumer Goods Forum that works on food safety across the supply chain. Its best known work is benchmarking. GFSI publishes Benchmarking Requirements for Certification Program Owners (CPOs), the organizations that own and run food safety schemes. A CPO that meets those requirements can be recognized by GFSI (GFSI, Recognition).

The aim, in GFSI's own words, is a "once certified, accepted everywhere" approach. A buyer that accepts GFSI-recognized certificates does not need to send its own auditor to every supplier, and a supplier does not need a different audit for every customer.

What GFSI is not:

• Not a certification body. In GFSI's words, "GFSI does not provide food safety certification, rather we recognize a number of certification programs that meet the GFSI Benchmarking Requirements" (GFSI, Certification). Sites are audited by certification bodies against a recognized program.
• Not a standard you audit against. GFSI says its Benchmarking Requirements are not a food safety standard in their own right, and food businesses cannot be audited or certified against them (GFSI, recognized CPOs). Your auditor checks you against the scheme's standard.
• Not a law. Certification is usually a customer requirement. It does not replace your legal duties, such as the UK requirement for HACCP based procedures or the US FSMA rules.

So "GFSI certification" is shorthand for certification to a GFSI-recognized scheme.

GFSI recognizes a number of certification programs across different parts of the supply chain. When we checked GFSI's list of recognized Certification Program Owners on 30 October 2026, it included BRCGS, CanadaGAP, Freshcare, FSSC 22000, Global Red Meat Standard, Global Seafood Alliance, GLOBALG.A.P., GRMA, IFS, the Japan Food Safety Management Association (JFS-C), PrimusGFS and SQF (GFSI, recognized CPOs). Four that food manufacturers often meet are:

FSSC 22000 combines ISO 22000, a sector prerequisite programme specification (such as ISO/TS 22002-1) and the FSSC Additional Requirements (FSSC). The other three are each built around their own published standard or code.

Recognition can change, and schemes publish new issues or versions. Always check GFSI's current list of recognized programs and each scheme owner's site before you commit.

If you are not sure which scheme fits your customers, products and markets, use our Which Standard tool. It is designed for that decision, so this guide does not repeat it.

Each scheme has its own clauses and wording, so check the current issue of the one you choose. Because they are all benchmarked against the same GFSI requirements, they share a common core. Expect to show the following.

Senior Management Commitment

A documented food safety policy, clear responsibilities, resources and regular management review. Food safety culture is a growing focus, so check what the current issue of your scheme asks for. Expect auditors to talk to people on the floor, not only the technical team.

A Food Safety Management System

Document control, records, internal audits, corrective action, complaint handling, management of non-conforming product, and a process for incidents, withdrawals and recalls.

HACCP Based Hazard Control

A HACCP plan built on the Codex principles, with a trained, multidisciplinary team, a hazard analysis for each product and process, controls at critical control points and verification that the plan works. See our PRP vs OPRP vs CCP guide for how controls are categorized.

Prerequisite Programs

Site standards for premises, equipment, cleaning, pest control, hygiene, maintenance, waste and utilities, documented and monitored.

Supplier and Raw Material Control

Risk based approval and monitoring of suppliers, specifications for raw materials and packaging, and control of outsourced processes. Our Supplier Approval Risk Signs guide covers this in detail.

Product Safety Topics

Allergen management, foreign body control, labeling, traceability, and product testing. Check how your scheme covers food fraud vulnerability and Food Defense, as schemes use different names and wording for them.

People

Training records, competence for key roles, and hygiene rules for staff, contractors and visitors.

Most sites follow a similar path, whichever scheme they choose.

1. Confirm what your customers require. Ask which schemes they accept, and whether they expect a particular grade or audit type.
2. Choose a scheme. Base this on customer requirements, your products and your markets. Use the Which Standard tool.
3. Get the standard. Download the current issue and any guidance from the scheme owner.
4. Run a gap analysis. Compare what you do today with every clause. Be honest about what is documented versus what actually happens.
5. Close the gaps. Write or update procedures, build the HACCP plan, train people and start keeping records.
6. Build a record history. Auditors look for evidence that the system has been running, not just written. Check your scheme's guidance on how much history is expected.
7. Run internal audits and a management review. Treat these as a rehearsal for the real audit.
8. Choose an accredited certification body. It must be approved by the scheme owner and accredited for your scope.
9. Book and pass the audit. Agree the scope, then host the audit. Any non-conformities must be closed with evidence within the scheme's timeframe before a certificate is issued.
10. Maintain it. Certificates are time limited. Plan for recertification audits, possible unannounced audits (IFS Food, for example, requires at least one in every three audits to be unannounced, per IFS) and continuous improvement.

The right scheme is the one your customers accept and your site can sustain. For most first-time sites, customer requirements decide it. If several schemes are acceptable, think about your markets, any existing ISO management systems, and the auditing options each scheme offers. Our Which Standard tool walks you through these questions and suggests a starting point.

• Writing the manual, not running the system. Procedures that do not match what happens on the floor are quickly found at audit.
• Too little record history. Booking the audit before the system has run long enough to show evidence.
• Getting the scope wrong. Leaving out a product, process or site area that the customer expects to be covered.
• A weak HACCP study. A copied plan, a hazard analysis that misses allergens or foreign bodies, or a team without the right training.
• Ignoring supplier approval. Approved supplier lists with expired certificates or missing specifications are a frequent finding.
• Leaving culture to the technical team. Auditors expect senior managers to own food safety.
• Missing closure deadlines. Non-conformities left open past the scheme's deadline can delay or prevent certification.
• Old versions. Working to an issue of the standard that has been replaced.

Primority's template library is aligned with BRCGS, IFS, FSSC 22000 and SQF, which helps sites start their documentation from a structured base. It has been trusted since 2010 by teams in 30+ countries.