ISO 9001, ISO 22000, BRC, IFS: which certificate matters for your product

Certificates are the part of a supplier's homepage everybody scrolls past and then argues about later. Four logos in a row and no explanation of what any of them promises. The problem is not that suppliers hide things. It is that the logos say less than buyers assume and more than sceptics allow, and unless you know which one your product actually needs, you either over-ask and lose good small factories, or under-ask and find out at your customer's audit.

Here is the short version, in the words the auditors use. It fits on a page, and the rule at the centre of it is simple: a certificate covers a system, at a site, for a scope. Everything else follows from reading those three words on the document itself.

A management-system certificate says that an independent certification body audited the factory's way of working against a published standard and found it conformant. It does not certify your product. It certifies that the factory has a system for making products consistently, spotting the ones that go wrong, and fixing the cause. That is valuable, and it is narrower than the logo implies.

Three things on the document decide whether it means anything for you. The site: a certificate is issued to a location, and a company with three plants can hold it at one. The scope: a sentence naming the activities audited, which may or may not include the process you are buying. The expiry, with surveillance audits in between. And behind all three, the certification body, which should itself be accredited by a national accreditation body: the RvA in the Netherlands, DAkkS in Germany, COFRAC in France, UKAS in the UK. An unaccredited certificate is a piece of paper from a company that sells pieces of paper.

ISO 9001 is the quality management standard, and it is deliberately sector-neutral: the same standard certifies a machine shop, a printer and a software house. It tells you the factory has documented processes, records nonconformities, measures what it does and has a loop for improving it. It does not tell you the parts are good. It tells you the factory will notice when they are not, and has a procedure for what happens next.

For most industrial products, that is the reasonable minimum to ask for and the wrong thing to be impressed by. Treat it as the floor. Sectors with real consequences add their own standard on top, and a factory that only has ISO 9001 in a sector that expects more is telling you something.

Food is where the logos multiply, and where the differences actually matter. ISO 22000 is the food safety management standard, built on HACCP, and it applies to any link in the chain: ingredients, processing, packaging, storage. FSSC 22000 is ISO 22000 plus sector-specific prerequisite programmes and a set of additional requirements, and that addition is the reason it exists: FSSC 22000 is recognised by the Global Food Safety Initiative, the retailer-led benchmark, and ISO 22000 on its own is not.

BRCGS (the standard many still call BRC, after the British Retail Consortium that started it) and IFS (International Featured Standards, from German and French retail) are the two other GFSI-recognised schemes you will meet in Europe. Both audit food safety and quality; both publish a result you can read. BRCGS grades the audit from AA down to D, with a marker for unannounced audits. IFS scores it, and reports Foundation level or Higher level. That result is worth asking for alongside the certificate, because "BRCGS certified" at grade C and at grade AA are not the same news.

Which one you need is decided by your customer, not by your product. Many large retailers expect a GFSI-recognised certificate from the site making their private label, and which of the three they prefer tends to follow their home market: BRCGS is historically strongest in the UK, IFS in Germany and France, and a good many EU retailers accept any of the three. If you are the brand owner, ask your retail buyer which schemes they accept before you ask a factory for anything.

The big four, and the one that answers the retailer ZM / CERT-01 REV. A

Standard	What it covers	Who tends to ask for it	GFSI-recognised
ISO 9001	Quality management system. Sector-neutral.	Most industrial buyers, as the baseline for anything made to a drawing.	Not a food scheme
ISO 22000	Food safety management system, built on HACCP, for any link in the food chain.	Food and drink buyers, ingredient and packaging suppliers.	No, on its own
FSSC 22000	ISO 22000 plus sector prerequisite programmes and extra requirements.	Food manufacturers and packaging converters supplying retail brands.	Yes
BRCGS Food	Food safety standard with a graded audit (AA to D, plus a marker for unannounced).	Retailers and brand owners, historically strongest in the UK.	Yes
IFS Food	Food safety standard with a scored audit (Foundation or Higher level).	Retailers and brand owners, historically strongest in Germany and France.	Yes

Outside food, each sector has its own layer on top of ISO 9001, and you generally know if you are in one. Automotive supply chains ask for IATF 16949. Medical devices run on ISO 13485. Aerospace uses EN 9100. ISO 14001 covers environmental management and ISO 45001 occupational health and safety; both are increasingly asked for in tenders rather than by product. Cosmetics manufacturing has its own good-practice standard, ISO 22716. Paper, board and timber carry chain-of-custody certificates such as FSC or PEFC. Halal and kosher come from religious certification bodies, organic from control bodies approved under EU organic rules. If a term in that list is unfamiliar, you probably do not need it; if it is familiar, you probably do.

Then there are the things that look like certificates and are not. CE marking is a manufacturer's own declaration that a product meets the EU legislation that applies to it, with an independent body involved only for certain product categories; it is not a certificate a factory "has". REACH and RoHS are regulations you comply with, evidenced by declarations and test reports, not by a logo. A declaration of compliance for food-contact materials is a document about a specific material and use, not a badge on the factory. Ask for all of these by their real names, and expect a document rather than a logo in return.

Ask for the certificate, not the logo, and read five fields. The certificate number. The issuing body, and whether that body is accredited. The site address, and whether it is the plant that will make your product. The scope sentence, and whether your process is inside it. The expiry date, and the date of the last audit. Then check the number where it can be checked: most certification bodies run a public register, many ISO certificates appear in the IAF CertSearch database, and BRCGS and IFS both publish directories of certified sites. Five minutes, and you are past the point where most sourcing mistakes with certificates are made.

The five-minute check ZM / CERT-02 REV. A

Number On the document, and findable in the body's register or a public directory Must match

Body Named, and accredited by a national accreditation body Must match

Site The address of the plant that will make your product, not head office Must match

Scope The sentence names your process or product family Must match

Expiry & last audit In date, with the audit result (grade or level) if the scheme publishes one Ask for the summary

Verifies Number · body · site · scope · date Does not verify Your product, your batch, your drawing

Illustrative example. The two buyers below are invented to show how the check plays out. Neither is a customer, and the factories are not real.

A brand owner wants a private-label oat drink co-packed for a supermarket chain. The retailer expects a GFSI-recognised scheme, so the shortlist filter is FSSC 22000, BRCGS or IFS at the site; ISO 9001 alone is out, and ISO 22000 alone probably is too, pending a check with the retailer. One candidate shows FSSC 22000 on its homepage. The five-minute check finds the certificate is real, in date, and issued for the main plant, while the aseptic line the buyer would use sits at a second site forty kilometres away that holds ISO 9001 only. The logo was honest and the scope was not the one that mattered. That is the whole reason to read the site line.

A machine builder wants an aluminium bracket, 2,000 a year, to a drawing. Here the food family is noise. ISO 9001 at the site is the reasonable ask, together with a material certificate for each batch, the mill's 3.1 certificate under EN 10204 that most metal buyers already know, and first-article inspection against the drawing. Two buyers, two different right answers, and the same five fields in both cases.

On ZoraMatch, the certifications you name in your brief are hard filters, not preferences. Matching removes every factory that does not carry them before anything gets ranked, so a shortlist for that oat drink never contains a plant without a GFSI-recognised scheme, and a shortlist for the bracket is never cluttered with the food family. Factories name their standards at intake, and the Verified badge a factory can earn comes from identity and quality checks, never from a rate card. The five-minute read of the actual document is still yours to do, and it is worth every one of the five minutes.

For where certificates sit inside a brief, read How to brief a manufacturer. For the report that should already carry the number and scope before you call, read What a screening report tells you.