In short: FSSC 22000 and HACCP answer two different questions. HACCP is the hazard-control logic: which steps in the process can prevent, eliminate or reduce a hazard, and what records prove those steps ran. FSSC 22000 is the audited management system that houses that logic, built on ISO 22000 and recognised by the GFSI. When you evaluate a supplier, three checks matter more than the logo: does the certificate’s scope cover your product and process step, is it current and verifiable by number on the certifying body’s database, and can they show their CCP list with monitoring records.
Two systems, two different assurances
HACCP is a preventive food-safety method applied at specific process steps. FSSC 22000 is a full food-safety management system certification that requires HACCP principles plus prerequisite programmes, food fraud prevention and food defence. In practice the buyer-visible difference is this: HACCP describes how hazards are controlled; FSSC 22000 adds third-party audit, documentation discipline and scope definition — the parts your own QA team and your retail customers can actually verify.
Where the critical control points usually sit in a plant extract plant
| Process step | Hazard being controlled | Control approach | Record that proves it ran |
|---|---|---|---|
| Spray drying | Microbiological survival and product stability | Controlled inlet/outlet air temperature within validated limits | Continuous temperature logs per batch, with deviation records |
| Metal detection | Physical contamination (ferrous and non-ferrous metal) | 100% of inner-packaged product passes a metal detector before outer packing | Detector check logs (start-up, hourly, end-of-run) with reject verification |
| Sieving / de-ironing | Physical contamination above the specified mesh size | Specified mesh screen plus magnetic separation | Sieve integrity checks and magnet inspection records |
Important boundary: the exact CCP list is plant- and product-specific. Ask for the supplier’s own CCP list and monitoring records rather than assuming the three above apply unchanged. A supplier who cannot produce a dated, signed CCP list does not have a functioning HACCP plan to show you.
What to verify, beyond the logo
| Item | What to ask | How to verify | Red flag |
|---|---|---|---|
| Certification body | Who issued it — SGS, Intertek, BSI, TÜV or a national accredited body? | Look the certificate number up on the issuing body’s own public database | Number not findable anywhere; only a PDF is supplied |
| Validity | Issue and expiry dates | Confirm it is current at shipment, not merely at quotation | Certificate expiring before your delivery window |
| Scope | Which products and process steps are covered? | Read the scope statement, not the cover page | Scope names a different product line or a different site |
| Legal entity | Which company holds the certificate? | Match the holder to the manufacturer named on your contract | Holder is a different group entity than the manufacturer or exporter |
| CCP documentation | The CCP list plus monitoring records | Ask for a recent batch record, not a summary | Only a schematic HACCP flow chart, no monitoring data |
| Audit recency | Date of the most recent third-party audit | Audit cycles are typically annual, sometimes semi-annual | Last audit not recent, or summary withheld |
How to verify a certificate number in practice
Every certification document carries two things you can act on: the certificate number and the issuing body. Take the number, go to that body’s public verification page, and search. For example, a certificate number in the form CN26/00xxxxxx issued by SGS is checked on SGS’s own verification service. If the number resolves and the scope matches, you have a verified document; if it does not resolve, treat the certificate as unconfirmed and ask the supplier to reconcile it — including the possibility that a newer version supersedes the document you were sent.
How this protects your brand
When you import botanical extracts, your finished product inherits your supplier’s food-safety performance. A documented system changes what happens in three practical situations:
- Before release: chemical, biological and physical hazards are controlled at defined steps rather than discovered by your incoming QC.
- During an incident: batch records and CCP monitoring data make a targeted investigation or recall possible instead of a blanket withdrawal.
- During audit: retail and regulatory audits of your finished product are easier when the supply chain can produce verifiable system evidence.
Supplier question template
| Category | Ask exactly this |
|---|---|
| Certificate evidence | “Please share your current FSSC 22000 or ISO 22000 certificate including the certification body, certificate number, scope statement and expiry date.” |
| Hazard control | “Please share your CCP list and a recent batch’s monitoring records for the product we are buying.” |
| Audit history | “When was your most recent third-party audit, and can you share the audit summary or certificate update?” |
A manufacturer with a functioning system answers these within one business day — the documents exist and are simply retrieved. Lengthy deflection is itself information.
FAQ
Is FSSC 22000 better than ISO 22000?
FSSC 22000 builds on ISO 22000 and adds requirements for prerequisite programmes, food fraud prevention and food defence, and it is recognised by the GFSI. That makes it the more widely accepted scheme for retail and branded manufacturers, though ISO 22000 alone still evidences a managed food-safety system.
What is a CCP in plant extract production?
A critical control point is a step where a hazard can be prevented, eliminated or reduced to an acceptable level, and which must therefore be monitored. In extract plants these commonly include spray-drying temperature control, metal detection after inner packaging, and sieving or magnetic separation for physical contaminants.
Is HACCP the same as FSSC 22000?
No. HACCP is the hazard-control methodology; FSSC 22000 is the certified management system that includes HACCP principles together with additional audited requirements. A supplier can describe HACCP without holding any certification.
Do I need HALAL or KOSHER certificates as well?
If your target markets include Muslim or kosher-observant consumer segments, yes. HALAL and KOSHER certify religious-compliant production and are complementary to food-safety schemes rather than substitutes for them.
How do I check that a certificate is genuine?
Look up the certificate number on the issuing body’s own public verification service and confirm the scope matches your product. A certificate number that cannot be resolved anywhere should be treated as unconfirmed.
Does the certificate cover the exporting company too?
Not automatically. Certificates are held by a specific legal entity and cover a specific site. Manufacturing and trading entities are often separate companies, so confirm in writing which entity holds the certificate and which entity manufactures your material.
How often should the certificate be renewed?
Management-system certifications such as FSSC 22000 operate on an annual surveillance cycle within a multi-year validity period. Ask for the current version at the time of each order rather than reusing the document you received earlier.
What if the supplier cannot provide CCP monitoring records?
Treat it as an unanswered question rather than a formality. Monitoring records are the evidence that a hazard-control system operates; without them you have a plan on paper and no proof it runs. Consider an on-site or third-party audit before committing to volume.
LongBio operates under FSSC 22000 with a documented HACCP system — see the certificate register, or request scope documents and CCP records for your product line.