Frequently asked questions

No. It applies to any organisation that needs controlled processes and evidence-based improvement.

Timing depends on readiness, scope and closure of findings. QSI will not promise a certificate before audit evidence exists.

No. You need documents and records that reflect how work is actually controlled.

QSI can explain findings and certification rules, but cannot provide consultancy for its own certification clients.

No. It certifies the management system. The audit checks how legal obligations are identified, evaluated and controlled.

Yes. Operational controls, emergency preparedness and monitoring records are reviewed against actual site conditions.

Yes, if the environmental management system is appropriate to the site and scope.

Aspect evaluation, compliance controls, objectives, monitoring, training and management review are usually central.

No. The audit must test whether hazard controls operate in the workplace.

Worker participation and awareness are part of the standard, so interviews are expected.

Yes, if scope, sampling and audit planning rules support it.

Weak hazard assessment, poor incident learning, incomplete controls and unclear responsibilities are common.

HACCP focuses on hazards and controls. ISO 22000 embeds those controls inside a managed system with objectives, review and improvement.

Yes. Records, prerequisite programmes, CCP monitoring and corrective action evidence are central to the audit.

Yes, when storage or distribution activities affect food safety and customers require certified controls.

QSI is SFDA-approved (CB-2024-FO-0011), and food-sector audits in Saudi Arabia are planned with that regulatory context in view. The certificate itself attests the named standard and scope.

It is a direct way to show hazards are identified, controlled, monitored and corrected with records.

Yes. A HACCP file that does not match the floor is a certification risk.

Often, yes. HACCP can become the food-safety core of a wider ISO 22000 management system.

The certificate scope must be specific. It should not imply product certification unless that is explicitly covered.

No such claim is made here. FSSC 22000 is delivered through partner certification bodies, and the issuing body is named before any engagement begins.

FSSC builds on ISO 22000, adds the sector prerequisite programmes and FSSC additional requirements, and is benchmarked under GFSI, which is what global buyers are checking for.

The certificate is issued by the licensed partner body, so recognition follows that body’s license and accreditation. That is stated openly, which is exactly what a serious buyer verifies.

Where scopes and sites overlap, planning can align FSSC activity with ISO 22000 or HACCP work to reduce disruption. The scheme rules stay controlling.

Do not assume that. Scope and accreditation status must be verified before claims are published.

Integrated audits may be possible when scopes, sites and system controls overlap. Planning confirms this.

It is route-to-market support around defined product evidence and documentation, not a blanket approval.

They are important long-tail services, but each needs careful scope confirmation before stronger claims are made.

HACCP (Hazard Analysis and Critical Control Points) is a preventive food safety methodology built on the Codex Alimentarius General Principles of Food Hygiene. Instead of relying on end-product testing, you identify the biological, chemical and physical hazards in your process, decide where they must be controlled, and monitor those points continuously. The Codex framework rests on 12 steps, which include the 7 HACCP principles: Conduct a hazard analysis. Determine the critical control points (CCPs). Establish critical limits. Establish monitoring procedures. Establish corrective actions.

There is no single law that says "every food business must hold a HACCP certificate", but in practice several drivers make it close to unavoidable: SFDA-licensed food factories. The Saudi Food and Drug Authority (sfda.gov.sa) requires locally manufactured food products to be produced in a licensed establishment, and the registration file for products such as food supplements must include a HACCP, GMP or ISO 22000 certificate for the manufacturing facility. If you want your products registered and cleared, certified food safety controls are part of the file. Municipality and inspection regimes.

For a factory with reasonable hygiene infrastructure already in place, a realistic end-to-end timeline is 3 to 6 months: implementation and record-building are the long poles, not the audit itself. Sites starting from scratch on PRPs (facility modifications, new monitoring equipment, staff training) should plan for longer.

Management system structure. ISO 22000 follows the same high-level structure as ISO 9001 and ISO 14001: context of the organisation, leadership, planning, support, operation, performance evaluation, improvement. That makes it straightforward to integrate with existing ISO certifications. PRPs formalised. ISO 22000 requires you to select and document prerequisite programmes systematically; most manufacturers use ISO/TS 22002-1 as the reference for food manufacturing PRPs. OPRPs.

Costs follow effort: ISO 22000 audits take more auditor days and the system takes longer to build, so expect a higher total investment. (Actual fees depend on site size, processes and headcount; get quotes rather than relying on generic figures.)

Certification follows the accredited two-stage model under ISO/IEC 17021 rules (with food-scheme-specific requirements applied by the certification body): stage 1 readiness review, stage 2 on-site audit during production, then annual surveillance and recertification in year three. Auditors will want to see the plant running, records at the line, a live traceability test, and evidence the two PDCA loops are both turning: management review that actually discusses verification data, and a hazard control plan that reflects this year's process, not the consultant's template.

1. Prequalification. There is no Saudi law that says every contractor must hold ISO 45001. In practice, it barely matters: large clients impose it contractually. Saudi Aramco and other major industrial clients embed OHS management system expectations in contractor prequalification and safety requirements, and the Vision 2030 giga-projects and major government tenders routinely list ISO 9001, ISO 14001 and ISO 45001 in prequalification criteria. Without them, contractors are filtered out before the technical bid is even read, or scored down against certified competitors. 2.

ISO 45001:2018 follows the same high-level structure as ISO 9001 and ISO 14001, which makes integration straightforward. The requirements that bite hardest on contractors: Hazard identification and risk assessment (6.1.2). Not one generic register, but a living process covering routine and non-routine activities: work at height, excavation, lifting operations, confined spaces, hot works, temporary electrics, plant-pedestrian interfaces, and Saudi-specific realities such as heat stress in summer months.

The value of ISO 45001 certification depends on who issued it. Clients' prequalification teams increasingly verify that the certificate comes from a certification body accredited under ISO/IEC 17021-1 by a recognised accreditation body. In the Kingdom, the Saudi Accreditation Center (saac.gov.sa) is the national accreditation body and an IAF MLA signatory. An unaccredited certificate can cost you the very prequalification you bought it for. --- QSI Cert is a SAAC-accredited, SFDA-approved certification body based in Riyadh, with an Al Khobar office opening in 2026.

Nothing physically stops a company from printing "ISO 9001 certificate" on nice paper. Unaccredited "certification" is cheaper and faster precisely because nobody audits the issuer: no witnessed audits, no competence requirements, no impartiality rules, no oversight of audit duration. The consequences surface later: Tender rejection. Prequalification teams increasingly verify accreditation marks and check registries. Regulator rejection. A certificate from a non-approved, non-accredited issuer will not carry an SFDA file. Customer audits anyway.

Read the certificate. Identify the CB and the accreditation mark(s). Check the scope wording and the sites listed: a certificate covering a head office does not cover a factory that is not named. Check the accreditor is real. Is it SAAC, IAS or another IAF MLA signatory? (iaf.nu lists signatories.). Check the CB's accreditation scope. On the AB's registry (e.g. SAAC's accredited-bodies directory), confirm the CB is accredited for that standard. Accredited for ISO 9001 does not mean accredited for ISO 22000. Verify the certificate itself.