What is the starting point of this case study?
An exporter in good standing with the food safety authority, a demanding customer, and a certificate that was worthless to that customer. This case study is composite: it brings together situations met in the field, without describing a real company. Names, volumes and dates are deliberately left out.
The company is a vegetable freezing plant in the Gharb region of north-western Morocco. It buys its vegetables from growers, then prepares, blanches, freezes and packs them for export. It holds its sanitary approval or authorisation, depending on its activity code, from ONSSA (Office National de Sécurité Sanitaire des Produits Alimentaires, Morocco’s national food safety office) and keeps its HACCP plan up to date.
A few years earlier, management had wanted “a certificate” to reassure its customers. An entity had offered it a single package: drafting the documentation, a visit, then an “ISO 22000 certificate” on its own letterhead. Nobody asked about accreditation.
The problem arose with a new customer, a British importer certified to BRCGS Food Safety Issue 9. During supplier approval, its quality department asked for the certificate, examined it, then rejected it in writing, asking for a recognised certification within a set deadline.
Why did the buyer reject the certificate?
Because the document failed every check the buyer itself had to justify to its own auditor. The rejection was not arbitrary: it followed from the rules of the buyer’s standard and from accreditation rules.
Buyer’s finding | Applicable rule | Consequence |
|---|---|---|
A standard, ISO 22000, that the GFSI does not recognise on its own | BRCGS Food Safety Issue 9, clause 3.5.1.2: certification to a BRCGS Standard or a GFSI-benchmarked standard | The “certificate” route of supplier approval is closed |
No accreditation body named on the document | GFSI 2024 requirements: certificates issued by bodies accredited by signatories of the multilateral recognition arrangement | No external check of the issuer’s competence and impartiality |
The issuing entity had also drafted the documentation | ISO/IEC 17021-1, clauses 5.2.5 and 5.2.9: no consultancy, no certification marketed with consultancy | Conflict of interest: the issuer was certifying its own work |
A scope worded “food products” | Clause 3.5.1.2: the scope must include the raw materials purchased | Impossible to tell whether frozen vegetables were covered |
No verifiable trace | ISO/IEC 17021-1, clause 8.1.2: a body provides the status of a certification on request | Nothing to check beyond the PDF sent |
The first finding would have been enough. Clause 3.5.1.2 of BRCGS Food Safety Issue 9 requires, to approve a supplier on the basis of a certificate, a valid certification to the applicable BRCGS Standard or a GFSI-benchmarked standard, whose scope includes the raw materials purchased. The GFSI page lists twelve recognised programme owners; ISO 22000 is not among them on its own: it is FSSC 22000, which incorporates it, that appears there.
The buyer did not walk away for all that. The same clause allows another approval route: a supplier audit covering product safety, traceability, HACCP review, food defence, authenticity and good manufacturing practices. The buyer therefore commissioned a second-party audit and kept limited orders going while the exporter obtained a recognised certification. What such an audit checks is explained in our supplier audit guide for EU and UK buyers sourcing in Morocco.
How did the company rebuild its route to certification?
By putting each party back in its place, in the right order. Management first asked the question it had never asked, then separated consultancy from certification.
1. A written question to the buyer. Which standards does it accept, in which version, with which audit programme? The answer: BRCGS Food Safety or any other GFSI-recognised standard. As its other European customers also accepted FSSC 22000, the company chose that standard, which made the best use of its ISO 22000 work.
2. An independent consultant. The company chose a consultancy on written criteria, with a declaration of independence from any certification body, following the method in our guide to choosing an ISO consultant. The consultancy recommended no body; it provided criteria.
3. A gap analysis against the right version. Audits against FSSC 22000 Version 6 are only allowed up to 30 April 2027, according to the Foundation’s upgrade document: the project went straight for Version 7. The ISO 22000:2018 system was carried over, then completed with the ISO 22002-100:2025 prerequisite programmes and the applicable sector part, and with the scheme’s additional requirements.
4. A body chosen by the company, and checked. Management approached several bodies on the list of FSSC licensed certification bodies, and checked for each one the ISO/IEC 17021-1 and ISO 22003-1 accreditation, the food chain category covered and the accreditation body. As the list of accreditation bodies under agreement with the Foundation does not include Morocco, the body selected is accredited by a foreign accreditation body.
5. Implementation, then the mock audit. Process owners drafted and applied their documents with the consultancy’s support; trained internal auditors carried out a full cycle; management held its review. The consultancy then ran a mock audit under the conditions of the certification audit.
6. The certification audit, with no mixing of roles. The company asked the body for the auditors’ names and checked that none of them had worked for it. The senior representative of the site and the auditors signed the integrity declaration that FSSC 22000 requires at every audit. The decision was made by the body, by people who had not carried out the audit.
Stage | Who acts | What the buyer receives |
|---|---|---|
Requirements | Management, in writing | Confirmation of the standard chosen |
Preparation | The company, with the consultancy | Project schedule |
Second-party audit | The auditor commissioned by the buyer | Full report, action plan |
Choice of body | Management alone | Name of the body and of its accreditation body |
Certification audit | The certification body | Audit date |
Certificate | The body, after its decision | Reference in the FSSC public register |
In the end, the exporter did not send a PDF: it sent the reference of its certificate, which the buyer found for itself in the FSSC public register. The supplier approval was updated on that basis.
What changed in the way the company chooses?
The order of the questions. Before, management looked for “a certificate” at the best price and as fast as possible. Afterwards, it looked for what its customer accepts, then for who is entitled to issue it, and only then for who could help it prepare.
Three changes lasted:
- Consultancy and certification are no longer bought together. Two contracts, two providers, no link between them. The SADCAS assessment checklist for certification bodies, which restates ISO/IEC 17021-1, forbids a certification body to sell consultancy.
- Accreditation is checked before signing, following the method in our guide to checking a certification body and a certificate.
- The system belongs to the company. Process owners answer on their own at the audit; the consultant prepares, it does not carry the system.
The hidden cost of the old route lies less in the invoice than in lost time: a first certificate that could not be used, reduced orders during the rebuild, and a second-party audit that could have been avoided. Our article on the real cost of certification details these items.
What lessons does this hold for an exporter in Morocco?
A certificate is chosen starting from the buyer, not from the offer. The role of each party is summarised in our guide consultant vs certification body: who does what. Before starting a project, check these points: