Three acronyms turn up on almost every quotation from a Chinese food or supplement plant, and buyers routinely treat them as interchangeable grades of the same thing. They are not. HACCP is a method. ISO 22000 is a certifiable management system that contains that method. GMP is a legal baseline that a regulator sets and that third parties then audit against. Knowing which is which changes what you ask for, what a certificate actually proves, and whether your retail customer will accept the supplier at all.
What follows is the practical distinction, what each one does not cover, and how to check that a certificate in front of you is real and relevant. It complements the broader survey in ISO certifications for China manufacturers explained by going one level deeper into the food and supplement stack.
HACCP Is a Method, Not a Badge
Hazard Analysis and Critical Control Points is a systematic approach to food safety codified by the Codex Alimentarius Commission and built on seven principles: conduct a hazard analysis, determine the critical control points, establish critical limits for each, establish monitoring, establish corrective actions, establish verification procedures, and establish documentation and record keeping.
The important structural point is that HACCP is a discipline a plant applies, not an accreditation body scheme in its own right. Certificates described as HACCP certification are issued by certification bodies against national or Codex-derived criteria, and their rigour varies with the body and the criteria used. A HACCP certificate is therefore evidence that someone assessed a hazard plan at a point in time. It is not, by itself, evidence that the wider management system, supplier controls, traceability and recall arrangements are in place.
What HACCP genuinely tells you is worth having. Ask which hazards were identified for your dosage form, which control points were designated, what the critical limits are, and what the corrective action is when a limit is breached. A plant that can answer those four questions fluently for the specific line running your product is a materially different proposition from one that produces a certificate and changes the subject.
ISO 22000 Wraps HACCP Inside a Management System
ISO 22000:2018 is a food safety management system standard. It follows the same high-level structure as other ISO management standards, which is why it sits comfortably alongside ISO 9001, and it incorporates the HACCP principles rather than replacing them. Around that core it adds requirements a bare hazard plan does not contain: leadership and policy, interactive communication up and down the supply chain, emergency preparedness, traceability, internal audit, and continual improvement.
It also adds prerequisite programmes, the operational hygiene foundations that make a hazard plan workable in the first place. For food manufacturing these are specified in ISO/TS 22002-1, covering matters such as building layout, utilities, waste, equipment suitability, cleaning, pest control, personnel hygiene and rework. A hazard plan without prerequisite programmes is a plan built on sand, which is precisely the gap ISO 22000 closes.
One commercial limitation catches buyers out. ISO 22000 on its own is not recognised by the Global Food Safety Initiative. Large grocery and pharmacy retailers commonly require a scheme that carries that recognition, and the ISO-based route to it is FSSC 22000, which combines ISO 22000 with the relevant prerequisite specification and a set of additional scheme requirements. If your route to market runs through a major retailer, establish the exact scheme name the retailer accepts before you select a plant, because upgrading a supplier mid-programme is slow.
GMP Is a Regulatory Floor, and the Floor Differs by Market
Good manufacturing practice is not a voluntary standard a company elects to adopt. It is a baseline set by regulators, and the applicable text depends on the destination market and the product category. In the United States, dietary supplements have their own current good manufacturing practice regulation covering areas such as ingredient identity testing, master manufacturing records, batch production records, personnel and holding and distribution. Conventional food falls under a different set of current good manufacturing practice provisions.
Because GMP is a legal requirement rather than a scheme, no certificate is required to comply with it, and there is no single body that issues a universal GMP certificate. What exists is voluntary third-party registration or certification, where a certification body audits a site against a regulatory text or against its own GMP criteria and issues a document saying so. This is why a bare claim of certification to good manufacturing practice carries little information on its own. The only useful version of the claim names the auditing body and the criteria audited against, and the buyer should ask for both.
The practical consequence for supplement buyers is a question with a specific answer: which market's GMP requirements is the plant operating to, and can it show the record types that requirement implies. The regulatory obligations that sit around this answer for United States programmes are set out in importing dietary supplements from China to the USA. Cosmetics have a parallel structure, illustrated in GMP-certified cosmetics OEM in China.
Side by Side
| HACCP | ISO 22000 | GMP | |
|---|---|---|---|
| What it is | Hazard control method (Codex seven principles) | Certifiable food safety management system standard | Regulatory baseline set by the destination market |
| Certifiable | Via certification bodies against varying criteria | Yes, by an accredited certification body | Compliance is mandatory; certification is voluntary and third-party |
| Covers prerequisite programmes | Assumed, not specified | Yes, via ISO/TS 22002-1 | Yes, in the regulatory text |
| Covers management system | No | Yes | Partly, through required records and responsibilities |
| GFSI recognised | No | Not on its own; yes as FSSC 22000 | Not applicable |
| Buyer question it answers | Are the hazards on this line controlled? | Is food safety managed systematically across the site? | Does the plant meet the destination market's legal floor? |
How to Check a Certificate Is Real and Relevant
Most certificate problems are not forgeries. They are genuine documents that do not cover what the buyer assumes, and five checks catch nearly all of it.
- The certification body and its accreditation. A certificate means as much as the body behind it. Look for the accreditation body and check that it is a signatory to the International Accreditation Forum multilateral arrangement, then confirm the certificate in the certification body's or accreditation body's public directory rather than trusting the PDF.
- The scope statement. This is where the surprises live. Scope names the processes, the product categories and often the specific building or floor. A certificate covering solid beverage production does not cover a gummy line, and a certificate naming one workshop does not cover a second site down the road.
- The site address. Compare the address on the certificate with the address on the business licence and with the address you would actually visit. A registered office and a production site are frequently different, and only one of them is certified.
- Validity dates and the certificate number. Check the certificate is in date and note the number for verification. Management system certificates run on multi-year cycles with surveillance audits in between, so an in-date certificate still implies a maintenance history you can ask about.
- The legal entity. The name on the certificate should match the entity that will issue your invoice. A mismatch usually means a trading company is presenting a manufacturer's paperwork, a pattern examined in factory or trading company: how to tell the difference.
A concrete example makes the scope point clear. Guangci Nutraceuticals, a Dongguan contract manufacturer on ChinaMakersHub founded in 2014 in Fenggang, holds ISO 9001:2015 certificate 0070023Q53783R2M and ISO 22000:2018 certificate 007FSMS1700177, both issued by Zhongjian Certification Co., Ltd. under CNAS accreditation C007-M and valid to 7 October 2026. The ISO 22000 scope names the dosage forms covered, solid beverage, hard candy, tablet candy and gel candy, and the production workshop on the third and fourth floors. Separately it holds China export food producer filing 4400/11384 issued by Fenggang Customs across the same four categories. Those two documents can be read against each other, and against a buyer's own product specification, in about five minutes. That is the exercise worth doing on every candidate plant.
Where Certificates Stop and Audits Begin
A certificate says a system was found conforming at an audit point. It does not say the line running your order was staffed and controlled last Tuesday. That gap is what a factory audit is for, and the audit types are not interchangeable either: a quality system audit, a social compliance audit and a pre-shipment inspection answer different questions, as China factory audits: which type you need and what it proves sets out. Social and labour conditions specifically run through the schemes described in China social compliance audits: SMETA, BSCI and Sedex.
Sequence them so each one is doing work the previous one could not. Verify the certificates and the entity first, using the document set listed in documents to request from a Chinese supplier before ordering and the entity checks in China supplier verification. Score candidates against comparable criteria, as in the buyer's supplier scorecard. Commission an audit against the standard that matters to your market, reading the output as described in how to read a China factory audit report and, where the visit is your own, working through what to inspect in one day. Then book pre-shipment inspection against agreed acceptance criteria, because none of the earlier steps inspects your actual goods.
Standards are revised and scheme recognition changes. Confirm the current version of any standard and the exact scheme your customer accepts before it becomes a contractual commitment.
Common questions
What is the difference between HACCP and ISO 22000?
HACCP is a hazard control method built on seven Codex principles, while ISO 22000 is a certifiable management system standard that incorporates those principles and adds leadership, communication, traceability, emergency preparedness, internal audit and prerequisite programmes around them. In short, HACCP addresses the hazards on a process; ISO 22000 addresses whether the whole site manages food safety systematically.
Is ISO 22000 accepted by major retailers?
Not always on its own, because ISO 22000 by itself is not recognised by the Global Food Safety Initiative. The ISO-based route to recognition is FSSC 22000, which combines ISO 22000 with a sector prerequisite specification and additional scheme requirements. Confirm the exact scheme name your retail customer accepts before selecting a supplier, since changing plants later is slow and expensive.
Is there such a thing as a GMP certificate?
Good manufacturing practice is a regulatory requirement rather than a voluntary scheme, so there is no single universal GMP certificate. Third-party bodies do offer voluntary GMP registration or certification, auditing a site against a regulatory text or their own criteria. Treat the phrase as incomplete until the supplier names the auditing body and the specific criteria audited against.
Which certificate matters most when buying private-label supplements from China?
None of them matters more than the scope statement attached to it. A relevant certificate is one whose scope names your dosage form and the site that will actually run your order, issued by a body with traceable accreditation and still in date. A broad certificate that excludes your product line is worth less than a narrow one that includes it.
How can a Chinese certificate be verified independently?
Identify the certification body and its accreditation body on the certificate, confirm that the accreditation body is an International Accreditation Forum multilateral arrangement signatory, then look the certificate number up in the certification body's or accreditation body's public register rather than relying on the supplied document. Finally, check that the certified legal entity and site address match the company that will invoice you.
Assessing a nutraceutical or functional food plant in the Greater Bay Area? Review the Guangci Nutraceuticals factory profile on ChinaMakersHub, or request a quote and state your dosage form and destination market so the relevant scope lines can be checked before sampling begins.