What is the exporter’s starting point?
A biscuit factory in good standing with the sanitary authority, with a HACCP plan, but no GFSI certificate. This is a typical case: it brings together situations our teams meet at Moroccan exporters, without describing any one client.
The site, on the outskirts of Casablanca, makes dry biscuits, wafers and filled biscuits. It buys flour, sugar, fats, cocoa, hazelnuts, milk powder and printed packaging, bakes on several lines and packs in bags and boxes. It produces all year round and exports a growing share of its volumes under its customers’ brands.
The initial gap analysis found:
- a sanitary authorisation from ONSSA (Office National de Sécurité Sanitaire des Produits Alimentaires, Morocco’s national food safety authority) and a HACCP plan built for official inspection, not for a GFSI audit;
- an allergen matrix that ignored hazelnut traces on a shared line;
- long-standing suppliers, approved without a risk assessment;
- one label per market, checked only at the start of a run;
- no food safety culture plan and no food fraud vulnerability assessment;
- a management team considering FSSC 22000, because it is also preparing for ISO 9001:2026.
The sanitary authorisation remains the prerequisite (biscuit making falls under authorisation in Order 2768-12), issued by ONSSA under the procedure described on its page on food establishments. GFSI certification comes on top of it as a commercial requirement.
What exactly do the three buyers require?
Three different requirements, collected in writing with the questions from our method for choosing which food safety certification to export with. Before this step, management only had memories of sales meetings.
Buyer | What it wrote | What the written question revealed |
|---|---|---|
British importer, supplying a retailer | “BRCGS Food Safety” | No other standard accepted; minimum grade to be set at listing; unannounced programme not required at first |
German retailer, private label | “IFS Food” | Version 8; Higher level preferred, not required; no other standard accepted |
Gulf distributor | “A GFSI-recognised certificate” | BRCGS or IFS accepted; halal certificate required in addition, under its own supplier requirements |
The second column alone would have misled management. The German customer had written “IFS preferred” in a first email; it was the written question on accepted standards that turned this preference into a firm requirement.
Why two standards, and why not FSSC 22000?
Because the requirements matrix left no other option. No single standard covered all three customers.
Buyer | BRCGS Food Safety | IFS Food | FSSC 22000 |
|---|---|---|---|
British importer | Required | Refused | Refused |
German retailer | Refused | Required | Refused |
Gulf distributor | Accepted | Accepted | Accepted |
Result | Needed | Needed | Not needed for these customers |
FSSC 22000 had a real advantage for this site: its ISO structure, reusable for ISO 9001:2026. But neither of the two main customers accepted it. Management put the ISO 9001:2026 project off until later, relying on the management review and internal audits already required by BRCGS and IFS.
The scope, for its part, was simple: a single address and ambient-stable products (GFSI scope CIV), for which the GFSI page lists BRCGS Food Safety Issue 9 and IFS Food version 8. A small trading activity in imported confectionery, resold without repacking, was excluded from the BRCGS scope, which requires all traded products or none to be included.
How do you build a common foundation for BRCGS and IFS?
By writing a single system, then linking it clause by clause to both standards. The gap analysis was carried out against both texts at once: the BRCGS self-assessment checklist and the IFS Food version 8 checklist.
Topic | Common foundation built once | What remains specific to each standard |
|---|---|---|
Suppliers | Risk assessment by material (cocoa, hazelnuts, fats, packaging), approval, specifications | Raw material specifications as KO No. 5 at IFS (4.2.1.3); risk-based approval, fundamental requirement 3.5.1 at BRCGS |
Allergens | Matrix by line and product, validated cleaning plan, scheduling | Fundamental requirement 5.3 at BRCGS; chapter 4.19 at IFS |
Traceability | Link between the batch of flour or hazelnuts, the finished batch, the printed packaging and the customer | Test achievable within 4 hours at BRCGS (3.9); KO No. 7 at IFS (4.18.1) |
Foreign material | Metal detection, control of glass and hard plastics | KO No. 6 at IFS (4.12.1) |
Labelling | Check at every start-up, batch change and reel change | Fundamental requirement 6.2 at BRCGS; customer agreements as KO No. 4 at IFS (4.1.3) |
Food safety culture | One plan led by the managing director, reviewed by the management committee | Plan reviewed at least once a year at BRCGS (1.1); culture objectives in the policy at IFS (1.1.1) |
Internal audits | A single programme, spread over the year | At least four dates at BRCGS (3.4); KO No. 8 at IFS (5.1.1), completed within 15 months at most |
Allergens took the most work. Three markets mean three labels to validate under the regulations of the country of sale, with the same matrix upstream. Fraud came next: cocoa, hazelnuts and fats received a vulnerability assessment, and every positive claim on the label must be backed by the specifications and the material balances.
The halal certification for the third customer was handled separately, with its own requirements: see our page Halal and Kosher. It reuses the supplier approval and traceability of the foundation, but it is not among the GFSI-recognised programmes.
How do you plan two audits and two unannounced calendars?
Starting from the nearest deadline. The British importer wanted the certificate before its next listing; the German customer allowed more time.
Step | Choice made | Official rule behind it |
|---|---|---|
First BRCGS audit | Announced, fully on site, all lines running | First audit announced; no blended audit for an initial audit; the auditor assesses practices observed |
BRCGS close-out | Evidence file prepared before the audit | 28 days to submit corrections; certificate no later than 42 days after the first audit day |
First IFS audit | A few weeks later, once the BRCGS findings were closed | Full on-site audit; action plan completed within four weeks |
BRCGS unannounced audit | In one of the following two years | The certification body notifies the year within three months after the audit, never the date; ten excluded days at most, justified |
IFS unannounced audit | At least one audit in three | Window from 16 weeks before to 2 weeks after the anniversary date; ten operational days of unavailability at most, in three periods |
The two calendars are separate: an IFS unannounced audit does not replace the BRCGS one. The site therefore appointed a trained deputy for every process owner and keeps its records up to date every day. Maintenance shutdowns are notified in advance to the certification body for each standard. The budget effects of this double rhythm are compared in our article on BRCGS, IFS and FSSC 22000 certification cost.
What lessons for other exporters?
Three lessons apply to any company serving several markets.
- The written question changes the decision. A verbal preference is not a requirement, and the reverse is true.
- The best standard on paper is not always the right one. FSSC 22000 suited the site’s organisation, not its customers.
- Two standards do not mean two systems. The foundation is built once; only the audit protocol and the specific requirements need dedicated work.
Checklist to repeat the approach:
The full comparison of the standards is in our BRCGS vs IFS vs FSSC 22000 comparison, and the status of GFSI recognition in our update on GFSI recognised standards in 2026.