Regulatory and Scheme Requirements
This domain tests whether you know which requirement applies and at what level: regulation, certification scheme, or customer specification. Findings must cite the correct source, and scheme rules on nonconformity grading drive the certification outcome.
The hierarchy
Regulation sets the legal floor (for example, in the US, FSMA preventive controls for human food, produce safety, Foreign Supplier Verification Programs, sanitary transport, intentional adulteration, and the Food Traceability Rule with key data elements and critical tracking events; in the EU, general food law and hygiene regulations). Certification schemes sit above regulation where they add requirements. Customer specifications can be stricter still. Where requirements conflict, the most stringent applies and the report should say which one was breached.
Schemes and benchmarking
GFSI is a benchmarking body, not a scheme: it recognises schemes such as BRCGS Food Safety, SQF, FSSC 22000, IFS Food, and GlobalG.A.P. ISO 22000 sets management-system requirements, ISO 22002-1 covers PRPs, ISO 19011 governs audit technique, and ISO/IEC 17021-1 governs certification bodies.
Schemes differ in structure, scoring, nonconformity grading (critical, major, minor, observation), follow-up timelines, unannounced audit options, and logo use. Grade outcomes depend on the count and grade of findings; a critical nonconformity generally means failure and certification action regardless of everything else conforming.
Worked example
A site meets its scheme's allergen changeover requirement but a retail customer specification demands allergen-specific verification after cleaning, which the site does not do. Reasoning: audit criteria include the customer specification, so a nonconformity is raised against that specification even though the scheme requirement is satisfied. The report names the customer code as the criterion, notes the scheme requirement was met, and the corrective action addresses the validation gap - not the scheme clause.
Traps that cost marks
- Citing only an internal procedure when the requirement is regulatory or scheme-based.
- Calling GFSI a certification scheme.
- Assuming certification proves legal compliance.
- Applying one scheme's grading or timeline rules to another.
- Missing that the stricter customer requirement governs when both apply.