Food Safety Certifications for Candy Factories: BRCGS, FSSC 22000, ISO 22000, HACCP, IFS, Halal & Kosher

Short Answer

There is no single "best certificate" for every candy factory. The correct requirement depends on the buyer's customer, sales channel, destination market, product risk, formulation and procurement policy.

For many retail and international private-label programmes, the first practical question is whether the customer requires a GFSI-recognised certification programme. BRCGS Food Safety Issue 9, FSSC 22000 Version 6 and IFS Food Version 8 are currently represented in GFSI's recognised programme framework for relevant food-manufacturing scopes. ISO 22000 is an international food-safety management-system standard and can be independently certified, but ISO 22000 certification by itself is not the same thing as certification to a GFSI-recognised programme. HACCPSystem controlling food safety hazards. is a foundational hazard-control methodology described by Codex; a document labelled "HACCP certificate" should not be assumed to be equivalent to BRCGS, FSSC 22000 or IFS.

Halal and Kosher are a different compliance axis. They address religious dietary status and related ingredient, equipment, process and supervision requirements. They do not replace a food-safety management certification, and a food-safety certificate does not prove that a candy SKUOne distinct sellable product unit. is halal or kosher.

The most important verification is not the logo. The buyer must match: certificate → legal entity → manufacturing address → scope → product/process → version → validity → certification body → official register. For halal and kosher, the buyer must also verify whether the specific product or product family, ingredients, production site and certifying body are covered and accepted by the intended customer or destination.

Buyer takeaway: A certificate is a controlled piece of supplier evidence, not a substitute for supplier qualification. A factory can hold a legitimate certificate and still be unsuitable for your exact gummy, sour belt, freeze-dried candy, chocolate-coated SKU, packaging format or customer specification.

Buyer Decision Summary

Primary decision rule: Start with the buyer's required evidence, then evaluate factories. Do not choose a factory first and later ask whether its certificates happen to fit the programme.

1. First Separate Four Different Evidence Layers

A professional supplier file should not collapse all "certificates" into one folder and treat them as interchangeable.

AXTIMES operational insight — Amanda XUN, Head of Sourcing: In supplier qualification, the most common document error is not "no certificate." It is misapplied evidence: a real certificate from the wrong site, a halal raw-material certificate presented as proof for the finished product, an ISO certificate used to answer a retailer's GFSI requirement, or a general factory certificate used to avoid product-specific verification.

2. Certification Comparison: What Each Scheme Actually Means

3. HACCP: Foundational Methodology, Not a Certification Scheme

HACCP (Hazard Analysis and Critical Control Points) is a food-safety methodology described in Codex Alimentarius. It is a legal requirement in many jurisdictions and is embedded as a foundational element in BRCGS, FSSC 22000, IFS Food and ISO 22000. A factory that holds BRCGS, FSSC 22000 or IFS Food has been assessed against standards that include HACCP requirements.

A standalone document described as a "HACCP certificate" is a completely different thing:

• There is no single global "HACCP certification scheme" equivalent to BRCGS or FSSC 22000.
• A HACCP document may have been issued by a consultancy, a local body, a trade association or a government agency under varying criteria.
• The scope, audit rigour and independence of a HACCP document vary enormously.
• Many markets require documented HACCP as a food-law baseline; this is not the same as satisfying a retailer's GFSI programme requirement.

Buyer should ask about a HACCP document:

• What exact standard or criteria was the audit based on?
• Who issued the certificate?
• Is the certification body accredited, and to what standard?
• Which legal entity and site are in scope?
• What products and processes are covered?
• What are the issue and expiry dates?

4. ISO 22000: Food-Safety Management System Standard

ISO 22000 specifies requirements for a Food Safety Management System for organisations in the food chain, combining management-system principles, hazard control, communication and continual improvement. A candy factory with ISO 22000 certification has had its FSMS assessed by an independent party for the specified scope.

Critical boundaries to understand:

• ISO does not itself certify factories; certification is performed by third-party certification bodies.
• This is a management-system certification, not a product certificate for each candy SKU.
• The certificate is valid only for the named site and scope.
• If the customer explicitly requires a GFSI-recognised programme, ISO 22000 certification does not automatically satisfy that requirement.
• Product specification, allergen controls, laboratory evidence, packaging capability, approved samples and pre-shipment inspection still need independent control.

ISO 22000 verification checklist: Check the certificate number, legal entity, site address, scope, standard version, issue/surveillance/expiry dates, certification body and its accreditation, and accreditation body. Cross-check via IAF CertSearch or national accreditation body records where relevant.

Red flag: A supplier says "ISO gave us an ISO 22000 certificate." The correct statement is that a third-party certification body assessed and certified the factory against the ISO standard. ISO itself does not certify factories.

5. FSSC 22000: ISO-Based, But Not Equivalent to ISO 22000

FSSC 22000 is built on ISO 22000, sector-specific prerequisite programme standards and FSSC's own additional requirements. It is a separate scheme and cannot be described as ISO 22000 with a different logo.

2026–2028 version transition — understand it correctly:

At the time of review, FSSC 22000 Version 7 had been published in May 2026, but this does not mean all Version 6 certificates immediately became invalid.

The Foundation FSSC's published transition plan:

• Version 7 officially published: May 2026;
• Version 6 audits continue until 30 April 2027;
• Version 7 upgrade audits: 1 May 2027 – 30 April 2028.

At the review date, GFSI's recognised programme information still listed FSSC 22000 Version 6. Buyers must re-verify the exact version, GFSI status and customer acceptance at the actual time of supplier approval, not rely on a table compiled earlier.

FSSC certificate verification: legal entity/site; food-chain category/subcategory; product/process scope; certificate validity/status; certification body; FSSC official register; audit version; 2027–2028 transition timing; customer-specific requirements.

Failure scenario: A procurement team in late 2026 sees that V7 is published and automatically rejects suppliers with still-valid V6 certificates in transition. The error is treating "new version published" as "old version expired today." Control: check the scheme owner's official transition schedule and current GFSI/customer status.

6. BRCGS Food Safety: Site-Focused, Strong Controls

BRCGS Global Standard Food Safety is used for food manufacturing. Third-party audits assess the production site against food-safety, quality and operational criteria. The current published version at review is Issue 9.

BRCGS is particularly relevant for candy sourcing when retailers, brand owners or distributors explicitly name it as an accepted programme.

Buyer should verify:

• The certificate is specifically BRCGS Food Safety, not another BRCGS standard;
• Issue 9;
• The exact manufacturing site address;
• Scope wording and product categories;
• Grade or status;
• Issue and expiry dates;
• Certification body name and its accreditation;
• Match to the BRCGS Directory at brcgsdirectory.org.

Red flag: The factory presents a BRCGS certificate but the site address listed does not match the facility where your candy will be produced.

7. IFS Food: Version 8 in 2026

IFS Food is used for food-manufacturing site audits, with a version structure and scope management similar in concept to BRCGS and FSSC 22000, though with different detailed requirements. Version 8 is the current version at review. It is represented in GFSI's recognised programme framework for relevant scopes.

Buyer should verify: site, scope, version, grade/score, validity, certification body, IFS database record.

8. Halal Certification: Product and Site Level, Not Factory Level

Halal certification addresses whether defined products produced at a defined site under defined conditions are acceptable under the certifier's interpretation of halal rules. Core controls typically include:

• all ingredients and processing aids are permissible;
• equipment and shared lines are controlled;
• cleaning and segregation protocols are specified;
• traceability and documentation cover the finished product;
• on-site supervision or remote audit protocols are in place.

Buyer checklist for halal certification:

• Does the certificate cover the exact product or product family being sourced?
• Does the certificate cover the specific manufacturing site?
• Are all ingredients and processing aids in scope?
• Is the certifying body accepted by the intended customer and destination market?
• Does the scope include packaging, glazing and any outsourced operations?
• What is the audit/review schedule and when does the certificate expire?

Common misapplication: A halal certificate for gelatin, pectin or another ingredient is not proof that the finished gummy or candy product is halal. Glazing agents, flavours, colours and processing aids also matter. A finished-product halal certificate and schedule from an accepted certifier is required.

Halal Nuances for Candy

For gummies specifically: the gelatin or gelling agent is a primary focus, but glazing (carnauba, shellac, beeswax), flavours, colourings, processing aids and shared production-line history must also be addressed. Shellac is derived from insects and is not universally accepted by all certifiers. Some consumer markets differentiate between pork-gelatin-free (labelled accordingly) and full halal certification.

9. Kosher Certification

Kosher certification covers ingredient, equipment and process requirements under rabbinical authority and typically involves ongoing rabbinical supervision or periodic inspections. Requirements vary by certifying agency and by consumer market.

Buyer checklist:

• Is the specific product/product family covered?
• Which rabbinical agency issued the certificate?
• Is that agency accepted by the buyer's target retailer or consumer community?
• Are all ingredients, processing aids, glazing agents and shared-line considerations addressed?
• Is the certificate current and does the schedule include the specific factory and product?

10. GFSI Recognition: A Framework, Not a Single Certificate

GFSI (Global Food Safety Initiative, a programme managed by The Consumer Goods Forum) operates a benchmarking process through which food-safety certification schemes can demonstrate equivalence against GFSI guidance. Being "GFSI-recognised" means the scheme was assessed and recognised within that framework; it does not mean every individual factory certificate is endorsed by GFSI.

Key buyer points:

• GFSI recognition applies to schemes, not to individual factories.
• Recognition is version-specific; a new scheme version must go through the process again.
• Customer requirements typically reference specific scheme(s) at specific versions.
• The GFSI website and customer vendor manuals are the authoritative sources.

11. Certificate Verification: The Chain That Must Match

A certificate must be matched across all the following:

1. Legal entity name — matches the business that contracted with the buyer;
2. Manufacturing site address — the physical location where the buyer's candy is produced;
3. Scope — covers confectionery / the product category being sourced;
4. Version — the right version for the customer requirement;
5. Validity / status — not expired, suspended or withdrawn;
6. Certification body — accredited by an IAF MLA signatory accreditation body;
7. Official register or directory — matches the scheme owner's published record.

A discrepancy in any of these invalidates the certificate as evidence for that specific buyer requirement.

12. Version Control: Why It Matters

Certification schemes publish new versions to address emerging food-safety science, audit experience and stakeholder feedback. When a new version is published:

• The scheme owner publishes a transition timeline, usually 12–24 months.
• Certificates to the old version remain valid until the transition deadline.
• Customer requirements may specify a minimum version.
• A buyer should not mechanically accept the old version at the end of a transition period, nor automatically reject it before the transition deadline.

Always confirm: current version at review → transition schedule → customer-specific version requirement → validity at time of qualification.

13. Outsourced Operations and Multi-Site Scope

Many candy products involve outsourced packing, coating, printing or secondary processing at a site different from the primary manufacturer. A certificate issued to the primary manufacturer does not automatically cover the outsourced site.

Buyer checklist for outsourced operations:

• Is the outsourced site named in the primary certificate scope?
• If not, is the outsourced site independently qualified?
• Is the halal or kosher scope extended to the outsourced operation?
• Are traceability, batch coding and quality controls applied consistently across both sites?

14. What a Certificate Does Not Prove

Even a strong third-party certification programme does not remove the need to verify:

• exact formula and allergens;
• approved flavour, colour, acidity and texture;
• piece weight and dimensions;
• moisture/water activity where relevant;
• coating uniformity;
• filling integrity;
• net weight and checkweigher performance;
• seal integrity and packaging barrier;
• artwork and legal label text;
• shelf-life basis;
• date coding;
• carton configuration;
• foreign-body control on the actual production line;
• batch testing to the buyer's specification;
• pre-shipment condition;
• customer-specific requirements;
• destination-market legal requirements.

Conclusion: certification reduces one class of supplier risk. It does not convert an unverified SKU into an approved product.

15. Candy-Specific Residual Controls After Certification

16. Pre-Shipment Reminder: Certificate Status Can Change

A certificate that was valid at supplier qualification may have been suspended, downgraded or allowed to lapse by the time the order ships. Buyers should re-verify certificate status:

• at the point of purchase order issuance;
• before batch release or shipment authorisation;
• after any significant period (three months or more) since last verification;
• when the factory notifies any certification-status change.

Verification means checking the scheme's official directory or register, not relying only on a PDF copy sent by the factory.

17. Worked Example — Three Factories, Same Product

A buyer needs a private-label pectin gummy for a retail customer. The customer requires a currently accepted GFSI-recognised food-manufacturing programme and a halal claim from an accepted certifier.

Factory A

• ISO 22000 certificate for the correct site.
• Generic "HACCP certified" document.
• Halal certificate only for the pectin supplier.
• No finished-product halal schedule.

Conclusion: Food-safety evidence may be useful, but the stated customer requirements are not yet met. The buyer must not treat ISO 22000 as the required GFSI programme, or the pectin certificate as finished-product halal approval.

Factory B

• Valid FSSC 22000 V6 certificate for the correct site and confectionery scope.
• Official register record matches.
• Finished-product halal certificate covers the relevant product family and site.
• Certifier is accepted by the intended customer/market.

Conclusion: Strong qualification candidate. Continue with technical sample, specification, packaging and batch controls. The certificate stack is necessary but not sufficient.

Factory C

• Valid BRCGS Food Safety Issue 9 certificate for the correct manufacturing site and scope.
• Strong technical capability.
• No halal certification for the proposed SKU.

Conclusion: Food-safety gate may pass; halal gate fails. Factory C can still be suitable for a non-halal programme, but not for this project unless the halal certification path is completed before artwork and mass production.

Commercial conclusion: The "best certified factory" is not the one with the most logos. It is the factory whose evidence stack matches the actual buyer requirement and the actual production chain.

18. Failure Scenarios: What Goes Wrong

Failure 1 — Certificate belongs to another site

Assumption: Same group name means same certification.
Overlooked: Manufacturing address differs.
Consequence: Customer rejects supplier approval after project development.
Control: Match legal entity + site + scope before sample approval.

Failure 2 — FSSC transition misunderstood

Assumption: New version published = old certificate immediately invalid.
Overlooked: Official transition window.
Consequence: Good supplier is rejected unnecessarily.
Control: Check scheme-owner transition dates and current GFSI/customer acceptance.

Failure 3 — Raw-material halal certificate misused

Assumption: Halal gelatin or pectin means halal finished gummy.
Overlooked: Flavours, glazing, processing aids, shared lines and finished-product certification.
Consequence: Packaging claim cannot be supported.
Control: Verify finished-product/site scope and certifier acceptance.

Failure 4 — ISO logo treated as product approval

Assumption: ISO 22000 certificate proves every batch complies with the buyer specification.
Overlooked: ISO certification covers a management system within a defined scope.
Consequence: Batch-level defects discovered after shipment.
Control: Use the certificate only as evidence of system level; apply batch controls separately.

Failure 5 — GFSI requirement resolved with a non-GFSI scheme

Assumption: Customer asked for "GFSI or equivalent," so ISO 22000 is sufficient.
Overlooked: Customer's vendor manual specifically names BRCGS, FSSC or IFS.
Consequence: Factory disqualified after the certificate was reviewed at a later stage.
Control: Get the customer requirement in writing and verify against it before factory approval.

19. AXTIMES Qualification Process

AXTIMES reviews the full factory certificate pack — food-safety scheme certificate with official register confirmation, government manufacturing licence, halal/kosher certificates where required, and allergen statement — before approving a factory for a specific SKU and project. Certificate review is not a standalone gate; it is one input to a qualification that also includes technical sample evaluation, specification review, packaging capability assessment and batch-evidence planning.

Amanda XUN, Head of Sourcing, AXTIMES: In China confectionery sourcing, the most frequent document issue we encounter is not forgery — it is legitimate certificates applied to the wrong scope. A factory holds a valid BRC certificate for its biscuit or bakery line, but the gummy or sour candy line operates under a different scope, or different site, that is not covered. The certificate is real. The coverage is not. That distinction requires reading the scope language carefully, confirming the address, and checking the scheme directory — not just receiving a PDF and filing it.

Bottom Line

The certificate is the starting point, not the finish line.

• Identify what your customer or retailer actually requires in writing.
• Match every element: legal entity, site address, scope, version, validity, certification body, official register.
• For halal and kosher, verify the finished-product certificate with the specific product/site in scope, from a certifier your customer accepts.
• Do not treat ISO 22000 or a standalone HACCP document as a GFSI-recognised programme unless the customer explicitly accepts it as such.
• Re-verify certificate status at purchase order, not only at qualification.
• Use batch controls — specification, inspection, COA, retained samples — in every order regardless of certification status.