WhatsApp contact icon for Nathan ISO Consulting
WhatsApp contact icon for Nathan ISO Consulting

Australia and New Zealand export food at scale. Dairy, red meat, grain, wine, seafood, horticulture, infant formula. In most of those supply chains the question is not whether you need food safety certification. It is which scheme your buyer will actually accept.

That question has a more specific answer than most consultancies give, and getting it wrong is expensive in a particular way. You complete an eight-month project, receive a certificate, send it to your largest customer, and discover it does not satisfy their supplier approval requirements.

Start here: three questions that decide your scheme

One. Has a buyer specified a scheme by name?

If a customer contract or supplier approval standard names BRCGS, SQF or FSSC 22000, that is your answer and the rest of this page is background reading. Buyer specification overrides every other consideration, including your own preference and your consultant's.

Two. Has a buyer asked for a GFSI recognised scheme without naming one?

Then ISO 22000 on its own will not satisfy them, and this is the point that catches Australian manufacturers out most often. The Global Food Safety Initiative benchmarks certification schemes so that major retailers and manufacturers can accept one audit instead of running their own. ISO 22000 is not GFSI recognised. FSSC 22000 is, because it adds the sector prerequisite programs and additional requirements that GFSI benchmarking demands.

Three. Has nobody asked for anything specific?

Then you have a genuine choice, and it should be made on where your business is heading rather than where it is. If export or major retail supply is on the roadmap within two years, build to FSSC 22000 now. If you are supplying food service or regional customers with no GFSI expectation, ISO 22000 is a legitimate and cheaper destination.

The schemes, compared

SchemeWhat it isGFSI recognisedChoose it when
HACCPA hazard analysis methodology, not a management systemNoYou need a regulatory baseline and no buyer has asked for more
ISO 22000International food safety management system standardNo, on its ownYou want a recognised management system and no buyer has specified GFSI
FSSC 22000ISO 22000 plus sector prerequisite programs plus additional requirementsYesYou supply major retailers, manufacturers or export markets
BRCGSBritish Retail Consortium Global StandardYesYour buyers are UK or European retailers specifying it
SQFSafe Quality Food, widely used in Australia and North AmericaYesYour buyers are Australian retailers or North American markets specifying SQF

For most Australian food manufacturers, FSSC 22000 is the destination and ISO 22000 is a component of it rather than an alternative to it.

What sits inside FSSC 22000

The scheme is built in three layers, and understanding that structure explains why the project scopes the way it does.

  • Layer one, ISO 22000:2018. The food safety management system requirements, incorporating HACCP principles and the plan-do-check-act structure.
  • Layer two, sector prerequisite programs. Drawn from the ISO 22002 series and matched to your food chain category. Facility and equipment, cleaning and sanitation, pest control, personnel hygiene, utilities and waste.
  • Layer three, FSSC additional requirements. Food fraud prevention, food defence, allergen management, environmental monitoring, food safety culture, and food loss and waste, among others.

The legal floor underneath certification

None of these schemes replaces your regulatory obligations, and those apply whether or not you certify.

Domestic food law

The FSANZ Food Standards Code governs food safety practices, food safety programs for certain sectors, labelling, composition and contaminant limits across Australia and New Zealand. It is enforced through state and territory food acts, administered by state health departments and local councils, which handle registration, inspection and enforcement. Primary production and processing standards add sector-specific requirements for dairy, meat, poultry, seafood, eggs and other categories.

Export control

If you export prescribed goods, the Export Control Act 2020 and its rules apply. That means export registration for your establishment and an approved arrangement documenting how you meet export and importing country requirements. This is a legal regime administered by the department, entirely separate from commercial certification, and it catches exporters who assumed a GFSI certificate covered them.

Importing country requirements

Market-specific conditions that vary by country and product, and which change without a great deal of notice. Certification helps you demonstrate control; it does not tell you what China or the European Union requires of your particular product this quarter.

What export markets expect

MarketTypical expectation
ChinaGACC registration requirements, plus buyer-specified GFSI certification for many categories including dairy and infant formula
Japan and South KoreaStrong preference for GFSI recognised certification alongside export registration
European UnionEstablishment listing, with GFSI schemes commonly specified by retailers and manufacturers
United StatesFSMA requirements, with SQF and FSSC 22000 both widely accepted by buyers
Middle East and South East AsiaHalal certification alongside food safety certification for relevant categories
Australian domestic retailMajor supermarket suppliers are generally required to hold a GFSI recognised scheme

How a food safety project runs with us

Twenty to thirty-six weeks from a standing start is realistic. The variable that moves the timeline most is not documentation. It is whether your prerequisite programs require physical work.

Step one — Confirm the scheme and the category

Which scheme your buyers require, and which food chain category applies to you. Category determines which prerequisite program standard you implement, and getting it wrong is discovered at Stage 1 when it is expensive to fix.

Step two — Gap analysis against all three layers

Current practice assessed against ISO 22000, the applicable prerequisite program standard and the FSSC additional requirements together, not sequentially.

Step three — Prerequisite programs

The unglamorous foundation and usually the longest phase. Where facility, drainage or segregation work is needed, this becomes a capital project with its own timeline and we will tell you that early rather than late.

Step four — Hazard analysis and HACCP

Hazard identification, control measure selection, CCP and OPRP determination, and validated critical limits with the supporting science documented.

Step five — Additional requirements

Food fraud vulnerability assessment, food defence, allergen management with cleaning validation, environmental monitoring with trend analysis, and food safety culture built as something an auditor can test.

Step six — Verification, traceability and recall

Monitoring and verification activities, traceability system, and a mock recall designed to stress the system rather than to pass.

Step seven — Audit and certification

Full internal audit, documented management review, then Stage 1 and Stage 2 with a JAS-ANZ accredited body. We attend both.

Where we add value that others do not

  • We ask who buys from you before recommending anything. There is no incentive for us in selling you the larger project when the smaller one satisfies your market.
  • We build prerequisite programs properly. Most audit findings land here rather than in the HACCP plan, and PRPs treated as paperwork are the most common cause of a difficult Stage 2.
  • We assess your real supply chain for food fraud. Not a template. The ingredients with documented global substitution history are the ones that need attention.
  • We validate allergen cleaning. Allergen labelling and cross-contact drive a large share of Australian recalls, and a cleaning procedure that has never been validated is an assumption.
  • We design mock recalls that fail usefully. An exercise that produces no findings has taught you nothing about your traceability.
  • We align the export arrangement with the FSMS. One set of records serving both your approved arrangement and your certification, rather than two systems documenting the same controls.
  • We track scheme version changes for you. Version transitions arrive on the scheme owner's timeline, not yours, and finding out from your certification body is finding out late.

Food production regions we work in

Dairy work takes us to Gippsland, south-west Victoria, Tasmania, northern New South Wales and south-east South Australia. Red meat and smallgoods clients sit in and around Melbourne, Brisbane, Toowoomba, Rockhampton, Wagga Wagga, Dubbo, Perth and Adelaide.

Wine and beverage work spans the Barossa, McLaren Vale, the Hunter Valley, the Yarra Valley, Margaret River, the Riverina and Tasmania. Seafood and aquaculture takes us to Hobart, Devonport, Port Lincoln, Coffin Bay, Darwin, Cairns and southern Western Australia.

Horticulture and fresh produce work covers Shepparton, Griffith, Bundaberg, Sunraysia, the Lockyer Valley, Carnarvon and Bowen. Grain, milling and bakery clients sit in Melbourne, Adelaide, Perth, Toowoomba, Wagga Wagga and Northam. Infant formula, nutritionals, packaging and ingredient manufacturers concentrate in Melbourne, Sydney, Brisbane and Tasmania.

FAQ'S

ISO 22000 is the food safety management system standard. FSSC 22000 is a certification scheme built on ISO 22000 plus sector prerequisite programs and additional requirements. FSSC 22000 is GFSI recognised; ISO 22000 on its own is not.

It depends entirely on who they are. If a buyer specifies a GFSI recognised scheme, ISO 22000 alone will not satisfy them. If nobody has specified GFSI and you want a recognised management system, ISO 22000 may be sufficient and cheaper.

HACCP principles are built into ISO 22000 and therefore into FSSC 22000, so a separate HACCP certificate becomes redundant. Your obligations under the Food Standards Code, including any required food safety program, remain in force regardless of certification.

It classifies what your operation does, from primary production through processing to packaging and storage, and determines which prerequisite program standard applies. Getting it wrong means implementing the wrong requirements, usually discovered at Stage 1.

Version 6 has been the current edition, with a later version published and running through a transition window. Your certification body will confirm which version your next audit is conducted against and the deadline for transitioning.

Yes, and it is common when buyer requirements change. Much of your existing system carries across, particularly prerequisite programs and hazard analysis. The work concentrates on restructuring to the ISO 22000 management system format and the FSSC additional requirements.

Typically 20 to 36 weeks from a standing start. Prerequisite program upgrades drive the timeline, particularly where facility, drainage or segregation work is required, because those become capital projects rather than documentation exercises.

A structured assessment of where your supply chain is vulnerable to economically motivated adulteration or substitution, and what controls mitigate it. Auditors expect it to reflect real ingredient risk, including categories with documented global fraud history.

Through evidence rather than intent. Auditors look for measurable objectives, communication, training, performance measurement, and evidence that leadership acts on food safety issues raised by staff. Posters and a slogan will not close this requirement.

They are separate. Export registration and approved arrangements are legal requirements administered by the department. Certification is a market requirement driven by buyers. A well-built system serves both from one set of records rather than two.

Prerequisite program gaps, unvalidated critical limits, allergen controls never verified by cleaning validation, environmental monitoring with no trend analysis, and traceability that has never been tested under exercise conditions.

Yes, and many Australian manufacturers do exactly that. ISO 22000 follows the harmonised structure, so governance, internal audit, management review and document control integrate cleanly with an existing quality management system.

Send us your customer's food safety clause

The food safety requirement from your largest customer's supply agreement usually answers the scheme question in under ten minutes. Start there rather than with a discovery call.

CONTACT
Reach out to us for any inquiries, collaborations,
or just to say hello!

Contact information for Nathan ISO Consulting

CLIENTELE
Our Valuable Client

WHEN NUMBERS MATTER
Empowering Insights into our Business Performance