ISO 9001 vs FSSC 22000: Do We Need Both?

The question usually arrives the same way. A retailer supplier questionnaire or an export customer’s approval pack has a line that says “ISO 9001 certificate”, and your site holds FSSC 22000. Somebody forwards it to QA with the subject line “do we need this too”. The short version is that a GFSI scheme certificate does not answer the ISO 9001 question, so in most cases yes, you will need both certificates. But you will not need two management systems, and a site that already holds FSSC 22000 has already built most of what ISO 9001:2026 asks for.

ISO 9001:2026 is the sixth edition, published on 16 September 2026. It cancels and replaces ISO 9001:2015 and incorporates Amendment 1:2024, the climate change amendment. Certified organisations have until 30 September 2029 to complete the transition, under the three-year transition set by Global Accreditation Cooperation, known as Global ACI, which took over the work of the IAF when the IAF ceased operations on 1 January 2026. From 31 March 2028 new and initial accredited certifications may only be issued to the 2026 edition. Confirm the dates with your own certification body. Confirm the clause lettering against your own controlled copy of ISO 9001:2026. If you are adding ISO 9001 in 2026 or 2027, add the 2026 edition. There is no sense certifying to an edition that expires inside your first certification cycle.

A note on versions. FSSC 22000 Version 7 is the version to build to, but V6 remains the version being audited until 30 April 2027, with V7 upgrade audits from 1 May 2027 to 30 April 2028. The additional requirement numbering used here is the 2.5.x numbering both versions share. Confirm your own upgrade audit date with your certification body.

Why does a customer ask for ISO 9001 when we already hold FSSC 22000?

Because they are asking a different question, and usually a different department is asking it. Your FSSC 22000 certificate goes to technical and food safety. The ISO 9001 line on the questionnaire is normally there because procurement, the quality function or a corporate supplier approval policy wants assurance about consistency, complaint handling, on-time-in-full performance and how you manage change, none of which a food safety certificate speaks to.

It is worth saying plainly what FSSC 22000 does and does not cover. FSSC 22000 V7 is built on ISO 22000:2018, the ISO 22002-x:2025 prerequisite programme series and the FSSC Additional Requirements. None of those three require you to manage customer satisfaction as a performance measure, to hold a register of improvement opportunities, or to run the full ISO 9001 planning and improvement cycle. FSSC does reach into quality at two points, and you should know which: Additional Requirement 2.5.9 Quality Control requires a quality policy, quality objectives and quality control parameters for every product in scope, and Additional Requirement 2.5.13 Product Design and Development applies to packaging manufacturers in category I. What FSSC does not do is require customer satisfaction measurement, an opportunity register under 6.1.3, analysis and evaluation to the eight items at 9.1.3, or a management review to the eight inputs at 9.3. An auditor on an FSSC audit will not raise a nonconformity because your on-time delivery has fallen to 74 percent or because a print colour complaint took 21 days to close. An ISO 9001 auditor will ask about both.

The reverse is also true, and it is why nobody sensible drops the GFSI certificate. ISO 9001 has no HACCP, no prerequisite programmes, no food defence, no food fraud vulnerability assessment. An ISO 9001 certificate will not on its own get you onto a retailer’s approved supplier list for a food contact product. Neither replaces the other.

What does each standard actually ask?

Read that table as two overlapping circles, not two separate ones. The management system requirements around the outside are almost the same. The technical core in the middle is completely different. That is the whole basis of integration.

How do you run one system and hold two certificates?

ISO 9001:2026 and ISO 22000:2018 are both written on the ISO harmonized structure, which is what ISO now calls what used to be known as the high-level structure. Clause 4 is context in both. Clause 5 is leadership in both. Clause 6 is planning, 7 is support, 8 is operation, 9 is performance evaluation, 10 is improvement, in both. The clause numbers line up because ISO designed them to.

That means the correct unit of decision is not the standard and not the document. It is the individual requirement. For each one, decide SHARE, EXTEND or SEPARATE.

• SHARE. Both standards ask for the same thing. Build it once, name both standards in the document, audit it twice. One document, one record set, one owner.
• EXTEND. The requirement exists in both, but one of them asks for more. Build the broader version once and add the extra field, the extra column or the extra section. Still one document.
• SEPARATE. The requirement exists in only one standard, or the two versions conflict in a way that would create risk if merged. Keep two documents. This is the smallest group, but getting it wrong is the most expensive.

What can be shared or extended: the ones that pay

What must stay separate

The list below is short, and every item on it is short for a reason. These are the requirements that exist in only one of the two standards, and merging them buys you nothing while creating the risk that a shared document becomes harder to audit.

• HACCP and the hazard control plan. ISO 22000 clauses 8.5.2 to 8.5.4 have no ISO 9001 equivalent at all. Your hazard analysis, your CCP determination, your critical limits and your validation stay in the food safety system, owned by the food safety team.
• The prerequisite programmes. The ISO 22002-x:2025 series, and ISO 22002-100:2025 as the unified baseline under FSSC 22000 V7, has no ISO 9001 counterpart. Cleaning, pest control, personal hygiene, environmental monitoring, waste: none of it appears in ISO 9001.
• Food defence and food fraud. These are FSSC 22000 Additional Requirements. ISO 9001 says nothing about intentional adulteration or economically motivated substitution. Keep the threat assessment and the vulnerability assessment where they are.
• Withdrawal and recall. ISO 22000 8.9.5. ISO 9001 handles nonconforming output at 8.7 and has no recall requirement. Do not fold your recall procedure into a nonconforming product procedure.
• The opportunity register under ISO 9001:2026 clause 6.1.3. This one runs the other way, and it surprises people. ISO 22000:2018 has no equivalent. 6.1.3 is a new dedicated sub-clause requiring you to determine, analyse, evaluate, plan, integrate, implement and then evaluate the effectiveness of opportunities. For a site that already holds a GFSI certificate, this is the single biggest genuinely new build in adding ISO 9001:2026. Your existing combined risk register will not cover it, because 6.1.2 in the 2026 edition is now focused on undesired effects and separated from opportunities entirely.
• Management of change under ISO 9001:2026 clause 6.3. The four considerations became seven. The new ones are e) communication of the changes, f) monitoring and evaluating the effectiveness of the changes, and g) reviewing the results. Your food safety change control probably covers the first four. Add the three columns.

Where combining the two goes wrong

We build both systems, and these are the two mistakes we see most often on sites that integrated without thinking it through.

One form carrying a CCP record and a quality check

Putting the metal detector check and the print colour check on the same line record is efficient. The operator fills one sheet, the supervisor signs one sheet, the record goes to one file. There is nothing wrong with it in principle and we often recommend it.

What goes wrong is when the form does not make clear which entries are food safety critical. Three things differ between the two kinds of entry on that one page:

• The disposition authority differs. A failed colour check can be dispositioned by the shift supervisor or released on a concession agreed with the customer. A failed CCP cannot. Product affected by a CCP failure goes to the defined food safety authority under ISO 22000 8.9.4, and nobody else has the authority to release it.
• The retention period differs. Food safety records are typically retained to shelf life plus a defined margin, and the scheme or your customer specifies it. Quality records are retained to your own defined period. On a shared form the longer period wins, or you lose records you were required to keep.
• The escalation trigger differs. A CCP deviation triggers evaluation of all product produced since the last acceptable check, and potentially withdrawal. A quality deviation triggers rework or a concession. If the form does not distinguish them, the operator has to remember which is which at two in the morning.

The fix is simple and costs nothing: shade or box the food safety critical fields on the form, state the disposition authority for each type in the form’s footer, and state the retention period on the form itself. Then the shared form is a genuine saving rather than an audit finding waiting to happen.

Treating a food safety nonconformity as something a concession can release

This is the one that must never happen. ISO 9001 clause 8.7 allows nonconforming output to be handled by correction, segregation, return, suspension, informing the customer, or obtaining authorisation for acceptance under concession. That last route is normal in quality. A customer agrees to accept a carton with a colour variation outside tolerance, it is recorded, the product ships.

There is no equivalent route for a food safety nonconformity. A product that is potentially unsafe cannot be released by agreement, by concession, by a customer’s signature, or by a commercial decision. The only routes are the ones ISO 22000 8.9.4 allows: it is shown to be acceptable against the food safety criteria, it is reprocessed or further processed so that it becomes acceptable, or it is destroyed or disposed of as waste.

When you integrate your nonconformity register, put the food safety yes/no field first, before the disposition field, and make the concession option unavailable when the answer is yes. Build the rule into the form rather than relying on training to catch it.

What does the integration actually save?

On a site that already holds FSSC 22000, adding ISO 9001:2026 with proper integration removes duplicate documentation you can count row by row. In the toolkit’s integration matrix, 20 of its 38 clause rows are marked SHARE and 13 EXTEND, which means one context register, one interested parties register, one competence matrix, one calibration register, one document control system, one internal audit programme and one management review across both certificates. That is not a saving in certification fees, which are set by audit days. It is a saving in three places: the documents you do not have to write, the documents you do not have to maintain and revise every year, and the internal audit programme you run once instead of twice.

The maintenance saving is the one people underestimate. Two context registers means two annual reviews, two sets of approvals, and two chances to disagree with yourself in front of an auditor. One register means one review. Multiply that across context, interested parties, competence, calibration, document control, supplier approval, internal audit and management review, and the annual hours saved run into the dozens.

The integration matrix in our ISO 9001:2026 toolkit is, for a site in your position, the most valuable single item in the whole package. It carries thirty-eight clause-level rows from 4.1 to 10.2 mapping ISO 9001:2026 against ISO 22000:2018 and FSSC 22000 V7, each marked SHARE, EXTEND or SEPARATE, with the decision recorded and signed, so the decision that takes a consultant three or four days to work through is already made. Be aware that one column of that matrix references document numbers in our companion FSSC 22000 toolkit, TK02, so on that column you are reading our numbering rather than yours. It sits alongside a 123-row internal audit checklist covering every sub-clause from 4.1 to 10.2 with the 2026-specific rows flagged, twelve Excel risk assessment workbooks with live formulas and inherent and residual scoring, and a master product and process specification that holds every parameter once, so no two documents can state a different limit, which is exactly the failure mode integration is supposed to prevent.

The toolkit is 202 documents, 190 Word and 12 Excel, plus the proof-read and remediation report, roughly 553 000 words, written by people who build both kinds of system for South African manufacturers, and independently proof-read before release by an ISO 9001 lead auditor, a packaging technical manager and a document control specialist. A proof-read and remediation report ships with it. It is R6 850, at a launch price of R5 480 until 30 November 2026. All ASC prices in this article, for the toolkit and for the courses, are excluding VAT, and no VAT is added at checkout. Advisera sells a 61-document generic ISO 9001 toolkit from US$897, roughly R16 000, with no integration matrix and no packaging content.

What it does not do is implement itself. Every shared document still has to be made true for your site, and the SEPARATE items still have to be built. What the matrix removes is the three or four days of deciding.

Which course does your team need?

Three routes, depending on where your site actually is. All three are at ascfoodsafetytraining.com/iso-9001, self-paced, with lifetime access, a 70 percent pass mark and three attempts.

The pattern that works on a dual-scheme site is one or two people on Implementation, and everyone an auditor will interview on the Introduction. At five or more, ask about a group arrangement.

What to do this week

1. Go back to the questionnaire and check what it actually asked for. Some ask for “ISO 9001 or equivalent” and accept a GFSI certificate for the scope in question. Most do not. Read the wording before you commit to a project.
2. Ask your certification body whether they can audit both standards at the same visit as a combined audit, and what that does to the day count. Many can, and it is the largest single cost saving available to you.
3. Pull your existing context register, interested parties register, competence matrix, calibration register, internal audit programme and management review minutes. Those six documents are most of clauses 4, 5, 7 and 9 already done.
4. Accept that clause 6.1.3, the opportunity register, is a genuinely new build. Start it early. It is the item that most often holds up stage 2.
5. Decide on the documentation route before you book consultant days, and read our breakdown of what ISO 9001 certification actually costs a South African manufacturer so you know which lines are avoidable.

If you want the clause-level detail on what moved between the two editions, our article on ISO 9001:2026 versus ISO 9001:2015 goes through it. If ISO 9001 is new to your site entirely, start with what ISO 9001 means for a South African manufacturer. And if you would rather have someone who builds both systems sit with your existing FSSC 22000 documentation and mark it up, that is what our ISO 9001 implementation consulting is for.

Questions people ask

Does FSSC 22000 include ISO 9001?

No. FSSC 22000 is built on ISO 22000:2018, the ISO 22002-x prerequisite programme series and the FSSC Additional Requirements. Those Additional Requirements do reach into quality: 2.5.9 Quality Control requires a quality policy, quality objectives and quality control parameters, and 2.5.13 covers product design and development for packaging manufacturers in category I. What they do not give you is customer satisfaction measurement, the opportunity register under 6.1.3, the 9.1.3 analysis lines or the eight-input management review at 9.3. That is why a customer who already holds your FSSC 22000 certificate still asks for ISO 9001.

Do we need both ISO 9001 and FSSC 22000?

In most cases yes, if a customer has asked for both. They are separate certificates from separate audits against separate standards, and neither substitutes for the other. But you need one management system, not two. ISO 9001:2026 and ISO 22000:2018 share the same harmonized structure, so most of clauses 4, 5, 6, 7, 9 and 10 can be run once and audited twice.

How much duplicate documentation can we remove by integrating?

Count it from the integration matrix rather than from a rule of thumb. 20 of its 38 clause rows are marked SHARE and 13 EXTEND, which means one context register, one interested parties register, one competence matrix, one calibration register, one document control system, one internal audit programme and one management review across both certificates.

Can one internal audit cover both ISO 9001 and FSSC 22000?

Yes. Run a combined audit under the guidance in ISO 19011:2026, the fourth edition of the auditing guidelines, which also brings new guidance on remote auditing and virtual locations. One auditor walks a process once and audits it against both sets of criteria. ISO 9001:2026 clause 9.2.2 a) now requires you to define the audit objectives, criteria and scope for each audit, so name both standards in the objective sentence on every audit plan.

What is the biggest new build for an FSSC 22000 site adding ISO 9001:2026?

The opportunity register under clause 6.1.3. It is a new dedicated sub-clause in the 2026 edition requiring you to determine, analyse, evaluate, plan, integrate, implement and evaluate the effectiveness of opportunities. ISO 22000:2018 has no equivalent, and your existing combined risk register will not cover it because 6.1.2 in the 2026 edition is separated from opportunities and focused on undesired effects. The rebuilt change record under 6.3 is second.

Can a customer concession release a food safety nonconformity?

No. ISO 9001 clause 8.7 allows nonconforming output to be accepted under concession where the customer agrees, and that is normal practice in quality. There is no equivalent route for food safety. Product that is potentially unsafe can only be shown acceptable against the food safety criteria, reprocessed so that it becomes acceptable, or destroyed. Build that rule into your shared nonconformity form rather than relying on training.

When do we have to be on ISO 9001:2026?

ISO 9001:2026 was published on 16 September 2026 and the transition period set by Global Accreditation Cooperation, known as Global ACI, which took over the work of the IAF when the IAF ceased operations on 1 January 2026, is three years, so certified organisations have until 30 September 2029 to complete the transition. From 31 March 2028 new and initial accredited certifications may only be issued to the 2026 edition. If you are adding ISO 9001 for the first time now, certify to the 2026 edition. Confirm the exact dates with your own certification body.

ISO 9001:2026, ISO 22000:2018 and ISO 19011:2026 are published by the International Organization for Standardization. FSSC 22000 is operated by Foundation FSSC. ASC Food Safety Consultants is an independent consultancy, training provider and auditing firm. Our toolkit and courses are independent products and are not approved, endorsed or accredited by ISO, by Foundation FSSC, or by any certification body.