SQF and FSSC 22000 Certification for Grain Milling & Flour

Choose a program your customers accept, because each customer decides which programs it takes. Both are GFSI-recognized, and both cover pathogens, mycotoxins, foreign matter, pests, allergens and labeling. They differ in how the audit works, how findings are scored and who issues the certificate. SQF is a food safety code with a 100-point audit score and a recertification audit every 12 months. FSSC 22000 is a management system scheme built on ISO 22000, with a three-year certificate, annual surveillance audits and no audit score. Through Kiwa, SQF certificates come from Kiwa ASI, and FSSC 22000 certificates from Kiwa VERIN B.V., a Kiwa group certification body licensed by Foundation FSSC.

SQF FSC 22 and FSSC 22000 category CIV. Under SQF Edition 9, milling grain into flour, meal and grits, and making pasta and breakfast cereals, fall under FSC 22: Processing of Cereal Grains, under the SQF Food Safety Code: Food Manufacturing. FSSC 22000 category CIV, processing of ambient stable products, names flour and pasta. Your certification body confirms the category for each product when it sets your scope.

The category name, the scoring and the corrective action deadline. Edition 10 renames FSC 22 Processing of Grains and Flours and adds non-traditional plant-based grains and flours, such as watermelon seed and nut flours. Approved suppliers (2.3.4), the food safety plan (2.4.3), allergen management (2.8.1), environmental monitoring (2.4.8), cleaning and sanitation (11.2.5) and foreign matter control (11.7.3) are among the clauses that become Core Clauses, where a minor non-conformance deducts 2 points and a major 7; ratings become Certified (80–100) or Certified with Surveillance (70–79); and corrective actions get 40 days. Edition 10 audits start no earlier than January 2, 2027, depending on GFSI benchmarking, so audits today still use Edition 9 and FSC 22 as Processing of Cereal Grains. Kiwa ASI's ANAB accreditation currently covers specific SQF Edition 9 codes, and no Edition 10 code.

It's the older name for certification to an SQF Food Safety Code, which for these sites is the SQF Food Safety Code: Food Manufacturing. SQF's three programs, the SQF Fundamentals Program, the SQF Food Safety Codes and the SQF Quality Code, were historically known as Levels 1, 2 and 3, and GFSI's list of recognized programs still labels the Edition 9 food safety codes "level 2." The SQF Quality Code, once Level 3, is optional.

No. ISO 22000 is the international standard for food safety management systems. FSSC 22000 is a certification scheme built on it: it adds the prerequisite program standard for your category, ISO/TS 22002-1 for food manufacturing under Version 6, and the FSSC 22000 additional requirements. ISO 22000 certification on its own isn't GFSI-recognized; FSSC 22000 is.

No law requires either one. Flour and grain mills must meet FDA's rules, including facility registration, good manufacturing practices, preventive controls unless exempt, and labeling, whether or not they're certified. Certification is voluntary, though bakeries, food manufacturers and other buyers may ask their suppliers for GFSI-recognized certification.

First-year cost can range from about $6,000 for a small, well-prepared site to $25,000 or more for a larger plant that needs outside help and upgrades. These are estimates only; your audit fee depends on the audit duration your certification body calculates. The first-year total includes the audit fee (roughly $4,500–$9,000+), SQFI registration ($650 for the Food Manufacturing code, capped at $800 for two or more codes), training, any outside help and any facility upgrades.

Plan on at least four to five months from the day your system starts producing records, and longer if you're building it from scratch. SQFI recommends at least 90 days of records before the certification audit, the audit takes at least two days, non-conformances must be closed within 30 days, and SQF gives the certification body up to 45 days after the audit to make its certification decision. The biggest variables are whether a HACCP plan and environmental monitoring program already exist.

70 out of 100 under Edition 9, with no critical non-conformance and every minor and major non-conformance closed within 30 days. Every audit starts at 100 points; each minor non-conformance deducts 1 point, each major 5 and each critical 50. A score of 70–85 (C – Complies) adds a six-month surveillance audit, and a score below 70 or any critical non-conformance fails an initial audit.

Every 12 months. Recertification audits fall within 30 days either side of the anniversary of the last day of your initial certification audit. Sites rated C – Complies (70–85) under Edition 9 also get a surveillance audit at six months, and at least one recertification audit every three years is unannounced and fully on-site.

Edition 9, for now. SQF audits use Edition 9 until Edition 10 audits begin, which SQFI says will be no earlier than January 2, 2027, depending on GFSI benchmarking. GFSI opened its public consultation on Edition 10 on September 29, 2026. A single audit won't mix requirements from both editions, and a surveillance audit that follows an Edition 9 audit stays on Edition 9, even if it falls after Edition 10 audits begin. Kiwa ASI's ANAB accreditation currently covers specific SQF Edition 9 codes, so ask which edition your first audit will use, and about our Edition 10 status, when you request a quote.

Yes, if we can meet SQF's auditor registration rule for your food sector categories, which we check before we quote. Under Edition 9, you can change to another SQFI-licensed certification body after one certification cycle (the annual period between certification audits), once all non-conformances are closed, as long as the certificate isn't suspended or under threat of suspension or withdrawal. If a surveillance audit is due, change after it. Your certification number, recertification date and unannounced audit schedule carry over, and your current certificate stays valid until it expires. Once Edition 10 applies (no earlier than January 2, 2027), you can switch after your certificate is issued and before your next audit window opens. Kiwa ASI's ANAB accreditation currently covers specific SQF Edition 9 codes, so ask us about Edition 10 status before you plan an Edition 10 transfer. Send your current certificate and your last recertification and surveillance audit reports.

Every calendar year. An FSSC 22000 certificate lasts three years, with a surveillance audit every calendar year and a recertification audit before it expires, and at least one surveillance audit in each three-year cycle is unannounced. Every audit, including surveillance, takes at least 2 days (1.5 days for some small, simple sites), and there's no audit score or grade; findings are graded minor, major or critical. Through Kiwa, certificates are issued by Kiwa VERIN B.V.

Yes. They're separate programs with separate audits and certificates, so a site can hold both if different customers ask for different programs.

Kiwa ASI delivers FSSC 22000 certification in the United States as part of the Kiwa group. Certificates are issued by Kiwa VERIN B.V., a Kiwa group certification body licensed by Foundation FSSC and accredited by the Dutch Accreditation Council (RvA, registration C684) to ISO/IEC 17021-1 and ISO 22003-1. Foundation FSSC's public register lists category CIV, which covers flour and pasta, in Kiwa VERIN B.V.'s licensed scope (full for Version 6, provisional for Version 7) and the United States among its countries (Foundation FSSC). A licensed category doesn't by itself mean an auditor qualified for your products is available, so ask about auditor availability when you request a quote. For the scheme in full, see our FSSC 22000 certification page.

Yes, if your certificate is valid and accredited and an auditor qualified for your category is available; expired or suspended certificates can't be transferred. Kiwa VERIN B.V., which issues FSSC 22000 certificates for Kiwa ASI clients, reviews your certificate, last audit report and open nonconformities before the transfer, sometimes with a site visit, and the transfer must be completed before your certificate expires. Ask about auditor availability for your category when you request a quote.

For SQF, Kiwa ASI is accredited for the codes these sites use. ASI Food Safety, LLC (Kiwa ASI) is licensed by SQFI and accredited by ANAB (accreditation ID 1222) to ISO/IEC 17065 for specific SQF Edition 9 codes, including the SQF Food Safety Code: Food Manufacturing, which SQF uses for FSC 22 grain milling, and Primary Plant Production, which covers grain cleaning and packing (FSC 4). ANAB's listing names codes, not food sector categories, so accreditation alone doesn't confirm we can audit your category. SQF rules require an auditor registered with SQFI for your food sector category, or a registered auditor assisted by an SQFI-approved technical expert. Before we quote, we check whether we can meet that rule and tell you if we can't. For FSSC 22000, certificates are issued by Kiwa VERIN B.V., accredited by the Dutch Accreditation Council (RvA, C684).

No. Kiwa ASI audits and issues SQF certificates; it doesn't provide laboratory testing. SQF requires external laboratories to be accredited to ISO/IEC 17025 or an equivalent international standard, and in-house labs to follow ISO/IEC 17025 for their sampling and testing methods, with annual proficiency testing for staff (2.4.4.2). FSSC 22000 requires competent laboratories, internal or external (2.5.1). The auditor reviews your results, such as mycotoxin, pathogen or environmental monitoring results, as part of the audit.

Yes, for food safety. FDA calls flour a raw food: processing raw grains into flour doesn't kill harmful bacteria such as E. coli and Salmonella, so flour isn't safe to eat raw. Legally, though, milled flour is a processed food, not a raw agricultural commodity (21 U.S.C. 321(gg)), so mills follow FDA's Part 117 rules. CDC has linked outbreaks to flour, including one in 2016 that CDC calls the first E. coli outbreak definitively linked to flour. In SQF and FSSC 22000, your hazard analysis treats flour as raw unless you apply a treatment, and SQF requires any kill step to be validated (2.5.1, Mandatory).

Yes, unless an exemption applies, such as for a qualified facility. FDA counts milling as manufacturing or processing (21 CFR 117.3), so a flour mill follows FDA's good manufacturing practices and keeps a written food safety plan with a hazard analysis and preventive controls, prepared or overseen by a preventive controls qualified individual (PCQI). The exemption for facilities solely engaged in storing raw agricultural commodities (117.5(j)) covers grain storage, not milling. SQF or FSSC 22000 certification doesn't replace the plan.

No federal regulation sets one; FDA's levels are guidance. FDA may consider human food with more than 20 ppb total aflatoxins adulterated (CPG 555.400), its advisory level for deoxynivalenol (DON, or vomitoxin) is 1 ppm in finished wheat products such as flour, bran and germ, and its guidance levels for total fumonisins in dry-milled corn products range from 2 to 4 ppm. FDA sets no DON level for wheat intended for milling. In SQF, set mycotoxin limits in your raw material and finished product specifications (2.3.2.2 and 2.3.2.9), approve suppliers (2.3.4, Mandatory), and test with external labs accredited to ISO/IEC 17025 or in-house labs that follow its requirements (2.4.4.2).

Not necessarily. A facility solely engaged in storing raw agricultural commodities other than fruits and vegetables, such as grain, for further distribution or processing is exempt from FDA's food safety plan requirements (21 CFR 117.5(j)), and a facility that only holds or transports such commodities is also exempt from FDA's good manufacturing practices in subpart B (117.5(k)(1)(iii)). SQF certification is voluntary, and no SQF food sector category names grain elevators, so the certification body sets the scope. Silos on a mill site are part of the mill's SQF site scope.

The SQF Food Safety Code: Primary Plant Production. SQF puts the cleaning and packing of grain and pulse products in FSC 4: Fresh Produce, Grain, and Nut Packhouse Operations (Module 10), and grain farming in FSC 5: Extensive Broad Acre Agricultural Operations (Module 8: GAP for Farming of Grains and Pulses). Milling puts you in FSC 22 under the Food Manufacturing code. SQFI's annual registration fee for Primary Plant Production is $250, capped at $800 if you hold two or more codes.

Yes. SQF treats a site as seasonal when its major production activities run no more than five consecutive months in a calendar year, and the initial certification audit then takes place during the peak operational part of the season (Edition 9 Part A, 8.3). A grain receiving and cleaning site that operates only around harvest may qualify; a mill that runs year-round doesn't.

If flour is sold as enriched, FDA's standard of identity (21 CFR 137.165) requires each pound to contain 2.9 milligrams of thiamin, 1.8 milligrams of riboflavin, 24 milligrams of niacin, 0.7 milligrams of folic acid and 20 milligrams of iron. Calcium is optional; if it's added, the total calcium must be 960 milligrams per pound. Flour that isn't labeled enriched doesn't have to meet these levels. In SQF, product formulation falls under 2.3.1 and label accuracy under 2.3.2.7.

Yes, for now. FDA's standards of identity for flour and whole wheat flour allow azodicarbonamide as an optional bleaching ingredient up to 45 ppm (21 CFR 137.105 and 137.200), so flour made with it must be labeled "bleached." In May 2026, FDA requested information on its safety as part of a post-market review, so check FDA's current status before you plan around it.

Wheat is the only cereal grain among the nine U.S. major food allergens (21 U.S.C. 321(qq)); soybeans and sesame are also on the list. Barley and rye aren't major food allergens, but they count as gluten-containing grains for gluten-free claims; oats are neither. A gluten-free claim is voluntary: the food can't contain wheat, rye, barley or their crossbreeds, or ingredients made from them that weren't processed to remove gluten, and any unavoidable gluten must be below 20 ppm (21 CFR 101.91). In SQF, allergen management, including changeover cleaning and its validation, is Mandatory (2.8.1).

FDA's defect action levels for wheat flour are an average of 75 or more insect fragments, or 1 or more rodent hairs, per 50 grams (CPG 578.450). For cornmeal, they're an average of 1 or more whole insects (or equivalent) per 50 grams, 25 or more insect fragments per 25 grams, 1 or more rodent hairs per 25 grams, or 1 or more rodent excreta fragments per 50 grams (Food Defect Levels Handbook). The levels don't make poor practices acceptable: FDA requires defects to be kept at the lowest level currently feasible (21 CFR 117.110).

No. FDA's Food Traceability List under FSMA section 204 doesn't include flour, wheat or other grain; sprouted grains appear only as sprouts. Congress directed FDA not to enforce the traceability rule before July 20, 2028. SQF still requires one-step-forward, one-step-back traceability (2.6.2 Product Trace, Mandatory).

No. OSHA's grain handling standard (29 CFR 1910.272) covers grain dust fires and explosions at grain elevators, feed mills, flour mills, rice mills and dry corn mills; it's a worker safety rule. SQF and FSSC 22000 are food safety programs, and SQF's dust, insect and pest proofing clause (11.1.5) is about protecting food.

SQF requires you to document and implement how you use, monitor, maintain and calibrate the screens, sieves, filters or other technologies you use to remove or detect foreign matter (11.7.4.1). Metal detectors and other detection equipment you use must be monitored, validated and verified (11.7.4.3). SQF doesn't name magnets; which controls you need depends on your hazard analysis.