Verifying a supplier's food safety certification takes four checks — the certificate itself, a word-for-word match between its stated scope and the products you buy, its validity and surveillance status, and a cross-check in the certifying body's own public database. A logo on a website satisfies none of them.
Say you're evaluating tapioca pearl suppliers for a new market, and three of the five candidates show a HACCP logo somewhere on their site. That logo doesn't tell you which certification body issued it, whether it's still active, or whether it even covers the products you're about to order. Buyers who stop at the logo usually find out the difference the hard way — a shipment flagged at customs, or a retail partner's audit turning up a certificate that doesn't cover the product line in question. The rest of this guide explains what HACCP, ISO 22000, and FSSC 22000 each actually certify, then walks through the four-step process for checking a supplier's paperwork before you rely on it.
A few things are worth having straight before you request a single document:
The three terms get used interchangeably, but they sit at different levels of the same system.
HACCP — Hazard Analysis and Critical Control Points — is a methodology for identifying, assessing, and controlling food safety hazards, rooted in the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969). It underlies almost every modern food safety system: find where a process can fail — biological, chemical, or physical hazards — then set, monitor, and correct controls at the critical points. A factory can be audited and certified against the Codex principles to demonstrate the methodology is genuinely in operation, not just on paper.
ISO 22000 is the International Organization for Standardization's food safety management system (FSMS) standard, currently ISO 22000:2018. It wraps HACCP methodology inside a full management system — leadership commitment, prerequisite programs (PRPs), risk-based thinking, internal communication, continual improvement. Put simply: HACCP manages hazards in the process; ISO 22000 manages how the whole organization runs food safety as an institution rather than a checklist.
FSSC 22000 builds on ISO 22000 with sector-specific prerequisite program specifications — ISO/TS 22002-1 for food manufacturing, for example — plus additional requirements under the current Version 6, covering food defense, food fraud mitigation, and allergen management. The difference that actually matters to a buyer: FSSC 22000 is GFSI-recognized; HACCP and ISO 22000 on their own are not. GFSI recognition means the scheme has passed the Global Food Safety Initiative's benchmarking review, placing it alongside BRCGS, IFS, and SQF — the practical entry bar most major Western retailers and international chains set for suppliers. FSSC 22000 also requires at least one unannounced audit within every three-year certification cycle (FSSC 22000 Scheme Version 6 requirement) — the factory gets no advance notice, which gives buyers a more honest read on day-to-day compliance than a scheduled audit alone.
| Aspect | HACCP | ISO 22000 | FSSC 22000 |
|---|---|---|---|
| Nature | Hazard control methodology (Codex CXC 1-1969) | International FSMS standard | Full certification scheme (ISO 22000 + ISO/TS 22002-1 + additional requirements) |
| Coverage | Process hazard analysis and critical control points | HACCP + management system + PRPs | ISO 22000 + sector PRPs + food fraud, food defense, and other additional requirements |
| GFSI recognition | No | No | Yes (alongside BRCGS, IFS, SQF) |
| Audit regime | Scheduled audits | Scheduled audits | Scheduled audits + at least one unannounced audit per 3-year cycle |
| Public verification channel | Verify with the issuing CB directly | IAF CertSearch (accredited certificates only) | Public database at fssc.com, searchable by COID (Certified Organization ID) |
| What it signals to a buyer | Baseline: hazards are managed | A step up: food safety runs as a system, not a person's habit | Global supply chain passport: the bar most major retailers set |
The table settles what each certification is. It doesn't settle whether the specific certificate in front of you is real, current, or relevant to the product you're buying — that takes the four-step process below.
Verifying a certification means confirming it's genuine, current, and relevant: issued by a credible certification body, still within its validity period, and covering — by name — the exact products and processes you buy. Miss any one of the three, and the certificate offers no real protection.
Ask the supplier for the certificate itself, not a description of it. A genuine certificate carries, at minimum: a certificate number, company name and address, the standard and its version, the certification scope, validity dates, and the issuing CB with an authorized signature. A supplier who offers only a logo, only names the certification body without a number, or declines "for confidentiality reasons" — treat that as a red flag, not a formality to work around.
This is the step buyers skip most often, and the one that matters most. The certification scope has to explicitly cover the products and processes you actually purchase — "we're FSSC 22000 certified" is not the same claim as "the product you're buying sits inside our certified scope." This matters more in bubble tea ingredient sourcing than in most categories, because a single supplier often ships pearls, syrups, powders, and jellies off the same production site — and certification scope gaps hide exactly there, between product lines that look interchangeable on an invoice but sit on different sides of the audit boundary. If the item you're buying isn't named in the scope, ask why: a different production site? An outsourced line? A product genuinely outside the certified scope? Any of those answers is fine — silence is not.
Certificates typically run on a three-year cycle, staying valid only through satisfactory annual surveillance audits. Two dates matter here: the expiry date, and "certified since" — the second tells you how many consecutive years the factory has held certification without a gap. FSSC 22000 certificates also list the date of the most recent unannounced audit, which is worth checking against the three-year window.
Once the scope, dates, and database record all line up, one question remains: does the CB that signed the certificate carry any weight?
A certificate's credibility comes from whoever issued it, judged on three levels.
Level 1 — internationally recognized CBs. The names most widely accepted in food manufacturing include SGS, Bureau Veritas, Intertek, TÜV SÜD, TÜV Rheinland, NSF, DNV, LRQA (Lloyd's Register), and Eurofins. These operate globally with mature auditor networks, and certificates they issue carry the highest acceptance among international buyers.
Level 2 — proper licensing and accreditation. For FSSC 22000, only CBs licensed by the FSSC Foundation may issue certificates; the licensed list is public at fssc.com. For ISO 22000, the CB itself should be accredited by an IAF-member accreditation body — UKAS (UK), RvA (Netherlands), ANAB (US), TAF (Taiwan), or JAS-ANZ (Australia/New Zealand) are common examples. The accreditation body's mark usually appears on the certificate.
Level 3 — it checks out. Whatever the CB's reputation, the final test is simple: the certificate number turns up through the CB's own channel or the databases above, and the company name, scope, and dates all match. A certificate from an obscure CB with no verifiable accreditation and no database record shouldn't be relied on, however polished the document looks.
Certification proves a management system operates effectively — it doesn't guarantee every shipment. Buyers who treat it well use certification as the entry bar, then layer on top: per-batch COAs, third-party testing where warranted, on-site or virtual factory audits, and sample-to-production consistency checks. Certification narrows the risk; those other tools manage what's left at the batch level.
From working with international buyers on the factory side, these situations consistently deserve a harder look:
From the manufacturing side, our position is simple: verification is good for everyone. The more seriously buyers check, the fairer the market gets for factories that do certification properly rather than just display it.
T Foods Co., Ltd., BubblePhil's manufacturing entity, holds all three certificates covered in this guide — HACCP, ISO 22000:2018, and FSSC 22000 (Version 6) — all issued by SGS, with a certified scope covering tapioca pearl production in both ambient and frozen formats, premix powders, and flavored syrup lines (BubblePhil certification records). Certification has run continuously since 2022, with unannounced audits conducted on schedule as FSSC requires. Our FSSC 22000 certificate can be checked directly against the fssc.com database — buyers are welcome to run us through the exact process in this article.
A supplier who hands over the certificate number and shows you where to check it is a different kind of partner than one who hands over a logo. That difference predicts more about long-term supply risk than the certificate itself.
HACCP, ISO 22000, and FSSC 22000 answer questions at three different levels: whether hazards are controlled, whether food safety runs as an institution, and whether that institution has cleared the toughest international benchmark. Knowing the difference is only the starting point for a buyer. Matching scope word for word, checking validity and surveillance status, and running the official databases is what turns a certificate from something a supplier shows you into something you've actually confirmed.
A few questions come up almost every time a buyer starts checking certificates for the first time:
Q : What is the difference between HACCP, ISO 22000, and FSSC 22000? HACCP is the hazard analysis and critical control point methodology; ISO 22000 is the international standard that builds HACCP into a complete management system; FSSC 22000 combines ISO 22000 with sector prerequisite programs and additional requirements — and is the only one of the three recognized by GFSI.
Q : What is GFSI recognition, and why does it matter? GFSI benchmarks certification schemes against a common global standard. Recognized schemes — FSSC 22000, BRCGS, IFS, SQF — are mutually accepted by major retailers and food groups worldwide, and many international buyers list a GFSI-recognized certification as a supplier entry requirement.
Q : How do you verify an FSSC 22000 certificate for free? Search the public database at fssc.com using the company name or the COID printed on the certificate. It returns the organization's certification status, scope, and validity — no record found is itself a red flag.
Q : Where can you check an ISO 22000 certificate? Accredited ISO certificates can be checked through IAF CertSearch, or verified directly through the issuing CB's official channels — SGS, Bureau Veritas, TÜV, and similar bodies all offer certificate lookups.
Q : If a supplier is certified, does that mean every shipment is safe? No. Certification proves the management system operates effectively; it doesn't guarantee individual batches. Mature procurement treats certification as the entry bar and adds per-batch COAs and, where warranted, third-party testing and factory audits to manage batch-level risk.
Q : How do you check a certification scope? Compare the products and processes listed on the certificate, word for word, against what you actually purchase. Anything not listed may come from a different site, an outsourced line, or an uncertified line — the supplier needs to explain which.
Q : Is it normal for a supplier to show only a certification logo and not the certificate? No. A certificate exists specifically so trading partners can verify it, and a normal supplier shares the electronic copy with its certificate number on request. Deflection should count as a serious red flag in evaluation.
Q : Why do FSSC 22000's unannounced audits matter to buyers? An unannounced audit means the certification body arrives without notice, so the factory can't stage the site beforehand. A factory that consistently passes unannounced audits has a smaller gap between its everyday state and its audit-day state — a more honest basis for buyer confidence.
Q : A trading company showed me its factory's certificate. Is that acceptable? The company name on the certificate should match the actual manufacturer. When buying through a trader, ask for the manufacturing factory to be disclosed, get that factory's certificate directly, and confirm its scope covers your product. A deal structure that can't disclose the manufacturing source leaves the risk with you.
Q : Can HACCP be self-declared? No. Valid HACCP certification must be audited and issued by a certification body against the Codex General Principles of Food Hygiene, with a certificate number and named issuing body. "We follow HACCP principles" and "we are HACCP certified" are two different claims.
Q : Which certification bodies issue the most credible certificates? Certificates from international bodies — SGS, Bureau Veritas, Intertek, TÜV SÜD, TÜV Rheinland, NSF, DNV, LRQA, Eurofins — carry the widest acceptance. Also confirm that an FSSC 22000 certificate comes from an FSSC-licensed CB (list at fssc.com) and that an ISO certificate's CB is accredited by an IAF-member body such as UKAS, TAF, or ANAB.
Evaluating suppliers for tapioca pearls or other bubble tea ingredients? Contact the BubblePhil team for our full certification documents, product specifications, and samples — certificate numbers included, along with exactly where to verify them.
