ISO 22000 to FSSC 22000: Case Study of a Moroccan Dairy

What is this dairy’s starting point?

An SME in good standing with ONSSA, Morocco’s national food safety office, demanding local customers, and a management team that wanted a certificate that would still be useful later. This case study is composite: it brings together situations met in the field, without describing a real company. Names, volumes and dates are deliberately left out.

The company collects milk from collection centres and farmers in its region, pasteurises it and makes packaged milk, yoghurts, lben (a traditional Moroccan fermented milk) and butter. It complies with the rules of ONSSA, the Office national de sécurité sanitaire des produits alimentaires: it holds a sanitary approval or authorisation, depending on the regime that applies to each of its activities, and it has a HACCP plan, written for the sanitary file and rarely reviewed since.

Its customers at the time are Moroccan supermarkets, cafés and pastry shops, plus an industrial pastry maker that buys cream and butter. It is the latter that triggers the project: its new supplier specification asks for “a food safety management system certified to ISO 22000 or equivalent”.

Why start with ISO 22000 rather than FSSC 22000?

Because that is what the customers of the time accepted, in writing, and management wanted a complete system before taking on a heavier scheme. Before choosing, it wrote to its main customers to ask which standards they accepted. None of them required a GFSI-recognised scheme at that point.

The decision was nonetheless taken with the next step in mind. The GFSI page lists FSSC 22000, not ISO 22000 on its own: a future international buyer could ask for more. Three choices were therefore made from the outset.

The ISO 22000 project followed the classic path described in our guide to ISO 22000 certification in Morocco. Most of the work went into the hazard analysis. The original plan classified almost every step as a CCP. After the analysis, the team kept pasteurisation as a CCP, with a validated time and temperature schedule, and classified several measures as OPRPs, including checks on milk at reception, cold chain control and cleaning-in-place before production changeovers, each one justified in writing. The method is detailed in our how-to guide on the ISO 22000 HACCP plan, PRPs, OPRPs and CCPs.

What happened when the GFSI buyer arrived?

An international food group established in Morocco wanted to list the dairy as a supplier of dairy products. Its purchasing policy requires a GFSI-recognised certification, with a written deadline to obtain it. The ISO 22000 certificate, although valid, did not meet that condition.

Management first asked the same question as at the start: which standards, which version? The answer: BRCGS, IFS or FSSC 22000. The dairy chose FSSC 22000, which takes over ISO 22000:2018 as it stands.

The version was obvious. According to the Foundation FSSC upgrade document, audits against Version 6 are only possible until 30 April 2027: the whole project targeted Version 7. The dairy falls under category C, food manufacturing, with ISO 22002-100:2025 and ISO 22002-1:2025 as mandatory PRPs.

That left the type of audit. The transfer of certification provided for by the scheme (Part 3, §5.6) only covers existing FSSC 22000 certificates; for a site certified to ISO 22000, the scheme provides for a transition audit (Part 3, §5.8). It starts a new certification cycle, meets the objectives of a stage 2 audit and lasts at least two-thirds of the basic audit duration calculated under ISO 22003-1:2022, plus the additional FSSC time; a stage 1 audit is at the certification body’s discretion. Management therefore asked its certification body, in writing, whether it planned a stage 1 and for the detail of the duration, calculated under ISO 22003-1:2022 with the FSSC time on top.

Which gaps did the analysis reveal?

Few on HACCP and PRPs, many on the additional requirements in Part 2 of the scheme. That is the most common profile of a well-run ISO 22000 site.

Environmental monitoring set the timetable. To analyse trends, you need results over several months: the programme therefore started first, even before the other procedures were written. The culture plan, for its part, took more discussion than documents: management had to choose objectives it was prepared to follow up in management review.

The system also had to prepare for the unexpected. FSSC 22000 requires at least one unannounced surveillance audit per three-year cycle. The dairy reworked its records so that they were up to date every day, not on the eve of an announced audit.

What lessons for a Moroccan food SME?

ISO 22000 is not a wasted step if it is built to last. In this case study, the move to FSSC 22000 concerned the additional requirements, not the core of the system. The extra costs avoided came from decisions taken in the first project; the cost items are detailed in our article on ISO 22000 certification cost and the move to FSSC 22000.

If you are starting ISO 22000 today knowing that a GFSI buyer may come along, check these points.

• Each customer’s requirements are in writing: standard, version, accepted accreditation.
  
• The PRPs are linked to ISO 22002-100:2025 and to the sector part for your category.
  
• The certification body is accredited for ISO 22000 and for your category, and it appears on the list of FSSC-licensed certification bodies.
  
• The HACCP plan separates CCPs and OPRPs, with written validations.
  
• Environmental monitoring starts early, so that trends are available on the day of the FSSC audit.
  
• Allergens, food fraud and food defence are assessed in writing, even though ISO 22000 alone does not require it in this form.
  
• A quality policy and quality objectives exist alongside the food safety policy.
  
• Records are kept every day, as if the audit could be unannounced.
  

For the rest of the FSSC path, see our guide to the FSSC 22000 Version 7 consultant in Morocco.