Moving from HACCP to GFSI: the real gap list
What a site with a working HACCP plan usually has to add to pass SQF, BRCGS or FSSC 22000, and how to close each gap without starting again.
4 min read
Your HACCP plan is the core of any GFSI system, so you keep it. What you add is the management system around it: senior management commitment and food safety culture, document control, internal audits, management review, risk-based supplier approval, food defence and food fraud assessments, tested traceability, and proof that your controls are validated. Then you need a run of records showing it all works. SQFI, for example, recommends at least 90 days of records before a site audit.
What HACCP-only sites usually have to add
Not every site has every gap. The effort column is our rough guide for a small manufacturer, not a scheme rule.
| Area | What GFSI schemes expect | Typical gap at a HACCP-only site | Effort |
|---|---|---|---|
| Management commitment | A food safety policy, objectives, resources and visible leadership | Policy exists but no objectives or evidence of review | Low |
| Food safety culture | A plan to build and measure culture | Nothing written down | Medium |
| Document control | Controlled versions, approvals, and only current documents in use | Old versions on the floor; no register | Medium |
| Internal audits | A schedule covering the whole system, with findings closed | Ad hoc checks, or none | Medium |
| Management review | Regular review with minutes and actions | Never held formally | Low |
| Supplier approval | Risk-based approval, specifications, monitoring and review | A list of suppliers, some certificates | Medium |
| Food defence and food fraud | Threat and vulnerability assessments with controls | Not done | Medium |
| Validation and verification | Evidence critical limits work; checks that the system runs | Limits copied from a template; no validation | High |
| Traceability | Tested traceability with mass balance, at least yearly | Never tested end to end | Medium |
| Allergen management | Risk assessment, validated changeovers, label controls | Allergen list, no validation | Medium |
| Environmental monitoring | For ready-to-eat products, a monitoring program with actions | None | High |
| Training and competency | A training matrix showing competence for each role | Induction only | Low |
| Complaints and corrective actions | Logged, trended, root-caused and closed with evidence | Handled informally | Medium |
Exact requirements differ by scheme. SQF practitioner rules, the BRCGS fundamental requirements and the FSSC additional requirements each add specifics. See SQF, BRCGS and FSSC 22000. 90-day records guidance: SQF Food Safety Code, Edition 9.
Closing the gaps, in order
Choose the scheme and buy the standard
Confirm with customers which scheme they accept, then compare the three. You’ll gap-check against the exact wording, so get the current version.
Gap-check clause by clause
For each requirement, note whether you can show a record today. Group the gaps using the table above.
Fix validation and prerequisite programs first
These take longest and produce the records everything else depends on. Start your traceability test and supplier approval early.
Add the management system
Document control, culture plan, food defence and fraud assessments, internal audit schedule, management review.
Run it, then audit yourself
Build up a run of records, complete an internal audit and a management review, close what you find, then book the certification audit.
What you can keep
- Your HACCP plan. It stays the core, though you’ll review it against the scheme and validate your critical limits.
- Your prerequisite programs. Most carry straight over; you’ll formalise records and frequencies. Here are all 18 explained.
- Your existing records. Every log you already keep counts toward the run of records an auditor wants to see.
See the gap clause by clause
EthicalHub’s scheme workflows track your progress against SQF, BRCGS or FSSC 22000 clauses, with evidence notes, on top of the HACCP plan, 18 prerequisite programs and corrective actions you already run. You see what’s done and what’s left, and the records build up as you go.
Start with a quick gap check
The free assessment and 59-point checklist show where your records stand today.
HACCP to GFSI: common questions
What is the difference between HACCP and GFSI certification?
How long does it take to go from HACCP to GFSI certification?
Do I need to rewrite my HACCP plan?
What is the biggest gap for most HACCP-only sites?
Close the gap, one clause at a time.
See where your records stand, then how EthicalHub tracks the rest.