HACCP, FSSC 22000 and SQF in Canada: What Food Manufacturers Actually Need to Do
A Canadian food plant can pass a CFIA inspection and still lose a retail contract over a certification audit, because the two systems ask different questions. One is law. The others are conditions written into purchase orders by the retailers and distributors who buy your product. Mixing them up sends money to the wrong place: certificates nobody asked for, or missing records that hold a shipment at the dock.
This guide separates the three for Canadian food manufacturers — the preventive control plan required under the Safe Food for Canadians Regulations, the GFSI-benchmarked schemes such as FSSC 22000 and SQF that buyers demand, and the monitoring and verification supplies that keep both sets of records defensible.
The legal baseline: CFIA preventive control plans
Every food business that manufactures, processes, treats, preserves, packages or labels food for interprovincial or international trade operates under a preventive control plan (PCP). The CFIA preventive control plan framework describes what the plan must cover: the hazards you identified, the controls that prevent them, how you monitor those controls, what you do when a control fails, and how you verify that the whole system still works.
HACCP is the method underneath that structure. You run a hazard analysis, decide which steps are critical control points, set limits, monitor them, record the results and verify the plan. The controls applied to food page breaks those controls into the categories an inspector walks through: biological, chemical, physical, allergens, sanitation and hygiene, and the monitoring that supports each one.
Two obligations sit alongside the PCP. First, a licence under the Safe Food for Canadians Regulations for most manufacturing, importing and exporting activities. Second, traceability: the ability to trace one step back and one step forward through your supply chain, which is why traceability requirements appear in the same conversation as your HACCP documentation.
Where FSSC 22000 and SQF fit
Certification schemes exist because retailers do not want to audit thousands of plants themselves. They accept a certificate from a scheme they recognise, and the Global Food Safety Initiative (GFSI) benchmark is what makes a certificate recognisable across buyers.
- FSSC 22000 is built on ISO 22000 (food safety management) plus sector-specific prerequisite programmes. The FSSC 22000 scheme is widely accepted by European and North American retailers and by food service groups.
- SQF is owned by the Safe Quality Food Institute and delivered through licensed certification bodies. It splits food safety and food quality into separate modules, which matters when a customer wants a quality specification audited as well as safety.
- BRCGS Food Safety is common with buyers whose specification lists it by name, particularly where the customer's own brand is on the pack. BRCGS publishes the standard and the audit protocol behind it.
None of these replaces the legal requirement. A certified plant still holds a PCP, still keeps the records, and still gets inspected. What certification adds is a third-party audit against a scheme standard, on a defined cycle, plus the corrective action process that follows a non-conformance.
What actually differs in day-to-day work
| Question | CFIA preventive control plan | FSSC 22000 / SQF |
|---|---|---|
| Who requires it | Government — Safe Food for Canadians Regulations | Your customer's purchasing specification |
| Who checks it | CFIA inspectors | Certification body auditors |
| Scope | Hazards, controls, sanitation, traceability, recalls | Same ground, plus management system, supplier approval, food defence, sometimes quality |
| Records | Monitoring, verification, corrective actions, traceability | Same records, structured around the scheme's clauses |
| Failure | Compliance action, licence consequences | Non-conformance, suspension of the certificate, lost listings |
The practical consequence is that one set of well-kept records serves both. Plants that keep two parallel systems spend twice the labour and still fail audits, because the numbers do not agree between them.
Where monitoring and sterilization verification enter the plan
Most food manufacturers run at least one piece of steam equipment: an autoclave for media and glassware in the in-house lab, a sterilizer for sampling tools, or a retort for shelf-stable product. Whatever the vessel, the plan has to show that the process achieved what it claims.
That is a monitoring question, and the answer is a stack of supplies rather than a single product. Chemical indicators show a package or load saw the conditions of a cycle. Class 5 steam chemical integrators respond to the combination of time, temperature and steam that the standard for internal indicators defines. Biological indicators answer the harder question: did the cycle actually kill resistant spores? A 24-hour readout biological indicator pairs with an incubator and a written log, and the log is the document an auditor asks to see during the record review. If you want to run the protocol on your own equipment before committing to a format, the 5-pack biological indicator trial exists for exactly that.
This matters more, not less, once you move toward FSSC 22000 or SQF, because those schemes expect documented verification of the equipment your own testing depends on. Our guide to industrial sterilization verification under ISO 11138 covers the standard behind those spore tests, and the sterilization compliance hub collects the products and protocols in one place.
Records: what both an inspector and an auditor will ask for
Records are where programs are won and lost, and the list is shorter than most plants expect. Expect to produce: the hazard analysis and the reasoning behind each control decision; monitoring records with date, value, equipment and initials; corrective actions with the product disposition that followed; verification activities, including calibration certificates and spore test results; sanitation records with chemical concentration and contact time; training records for the people who perform the monitoring; and traceability exercises that show you can follow a lot forward and a raw material back.
Two habits keep that stack defensible. Record at the time of the activity, not at the end of the shift, because auditors look for a pen that moved in real time. And keep the standard you are auditing against in the same binder as the record, so anyone can check the limit without hunting for a specification sheet.
A 90-day sequence for plants adding certification
- Weeks 1–2. Map what you already have against the scheme clauses. Most of the PCP content transfers; the gaps are usually supplier approval, food defence, and management review.
- Weeks 3–4. Close documentation gaps on monitoring equipment, including the calibration and spore test records attached to each sterilizer or autoclave in the lab.
- Weeks 5–8. Run the new records in parallel with existing ones and check that the values agree. This is the stage that catches the two-systems problem before an auditor does.
- Weeks 9–12. Internal audit, corrective actions, management review, then the certification body's stage 1 and stage 2 audit. Keep the PCP records current throughout — inspection readiness does not pause for a certification project.
Related Reading
Guides that pick up where this one stops:
- Industrial Sterilization Verification in Canada: ISO 11138, Biological Indicators and Food-Processing Compliance — the standard behind in-house spore testing.
- Food Plant Hygiene Programs: PPE and Cleaning Under CFIA Rules — personnel hygiene and sanitation controls in practice.
- Food Testing Labs in Canada: Specimen Bag and Sampling Guide — moving samples from the line to the lab without invalidating them.
- Next in this series: HACCP environmental monitoring — what the standard requires you to test, and how to build the sampling plan.
Related Reading
- Guide to industrial sterilization verification under ISO 11138
- Food Plant Hygiene Programs: PPE and Cleaning Under CFIA Rules
- Food Testing Labs in Canada: Specimen Bag and Sampling Guide
- Next in this series: HACCP environmental monitoring
Frequently Asked Questions
Is HACCP required by law in Canada?
Canadian food businesses covered by the Safe Food for Canadians Regulations must have a preventive control plan, and that plan is built on HACCP principles: hazard analysis, critical control points, monitoring, corrective action and verification. The regulation sets the requirement; HACCP is the method used to meet it.
Do I need FSSC 22000 or SQF to sell in Canada?
Not by law. Certification is a commercial condition set by the retailers, distributors or food service groups you sell to. If your customer's specification names a GFSI-benchmarked scheme, you need that scheme's certificate. If it does not, the PCP is the requirement you must meet.
Which certification scheme should a Canadian manufacturer choose?
Take the scheme your customers already accept. FSSC 22000 suits manufacturers selling into European and North American retail and food service chains, while SQF is frequently requested where buyers also want quality specifications audited. Ask the buyer's technical contact which certificate their specification lists before building a program.
Does a food plant need biological indicators if it has a lab autoclave?
If the autoclave sterilizes media, glassware or sampling tools that your food safety testing depends on, the plan has to show the sterilization is verified. A biological indicator is direct evidence that the cycle killed resistant spores; chemical indicators show cycle conditions but cannot replace spore testing in a verification program.
How long do food safety records need to be kept?
Retention depends on the type of record and the regulation that applies to your product, so confirm the periods for your commodity with your CFIA inspector or certification body. The practical rule is to keep records at least as long as the shelf life of the product they cover, plus the review period.
Last updated: September 11, 2026. CliniEco Medical is a licensed medical device establishment (MDEL #35334).
0 comments