Global Standards and Certification Frameworks for Cashew Supply Chains

Why Are Standards So Important in Cashew Supply Chains?

Food safety and traceability standards establish a compliance baseline that cashew processors and exporters must meet to access regulated markets. They set out what buyers can reasonably expect from a supplier, what regulators require at the border, and what certification bodies audit against. Without them, claims about product safety, origin and handling have no common reference point.

In cashew specifically, the hazard profile makes robust food safety systems more than a market access formality. Aflatoxins — naturally occurring mycotoxins produced by Aspergillus moulds — are the most significant and persistent food safety risk in cashew supply chains, subject to strict EU maximum limits and routinely responsible for border rejections recorded in the RASFF database. Salmonella contamination, foreign body ingestion, allergen cross-contamination and chemical contaminants including pesticide residues are among the other principal hazards that cashew processors must systematically manage.

Beyond these established hazards, certification systems are increasingly expected to encompass control measures for emerging contaminants — MOSH and MOAH (mineral oil saturated and aromatic hydrocarbons), phthalates, heavy metals and processing contaminants. These aren't always specified individually in certification standards, but HACCP-based food safety management and robust supplier approval programmes must consider them as part of a comprehensive hazard analysis. European regulators and major retailers are paying close attention to these categories, and processors whose systems address only the established hazard list may find themselves under scrutiny as regulatory attention shifts.

In the EU and the UK, compliance with food safety legislation is mandatory. Although certification schemes such as BRCGS, IFS and FSSC 22000 are not legal requirements, they have become de facto market access requirements for suppliers wishing to sell to most major retailers and food-service operators. Buyers require evidence of compliance before contracts are signed and retailers require certification before products reach shelves. Food business operators must be able to demonstrate compliance with applicable food law, including traceability and food safety requirements, while many commercial buyers additionally require certification. The EU's Rapid Alert System for Food and Feed (RASFF) maintains a publicly searchable record of food safety notifications - covering border rejections, information notifications and alerts - including those involving cashew shipments, and that record is routinely consulted by buyers evaluating new suppliers.

A well-implemented food safety management system also generates operational data on process controls, audit findings and corrective actions that can support continuous improvement, reduce waste, and build the kind of documented track record that sustains long-term buyer relationships.

This module examines the main standards and frameworks that define that compliance baseline: BRCGS Food Safety, ISO 22005, GFSI benchmarking and Codex Alimentarius, covering what each requires, how they interact, and what they mean for processors and buyers in practice. It sits within the Supply Chain Transparency hub, which maps all six modules in this section.

Subsequent modules address how traceability data moves between parties (1.2, Traceability Protocols and Digital Systems), how data management and blockchain applications support data integrity (1.3), resilience case studies from global supply chain disruptions (1.4), procurement ethics and buyer confidence models (1.5), and metrics for trust from origin to wholesale verification (1.6).

BRCGS Food Safety - The Scope of this Standard and What It Requires

The BRCGS Global Standard for Food Safety is currently in its ninth issue (at time of writing) and it’s one of the most widely adopted food safety certification schemes in the world, with over 22,000 certified sites across more than 130 countries. It’s the standard most commonly required by UK retailers and it’s broadly recognised across European markets.

BRCGS Food Safety is a GFSI-benchmarked standard, which is examined in more detail in the following section. For cashew processors, holding a valid BRCGS certificate satisfies the food safety certification requirement of the large majority of European retail and food-service buyers. A valid BRCGS certificate is accepted by most European retail and food-service buyers as proof of food safety compliance.

What the Standard Covers

BRCGS Food Safety sets requirements across several operational areas relevant to cashew processing and packing:

• Senior management commitment and a documented food safety culture programme covering measurement, internal communication and observable behavioural indicators
• The hazard analysis and critical control point (HACCP) system, including documented hazard analysis, critical control point identification and monitoring procedures
• A food safety and quality management system covering document control, internal audits, supplier approval and corrective action processes
• Site standards covering layout, equipment, cleaning, pest control and environmental monitoring
• Product control covering specifications, inspection and testing, product release and management of non-conforming product
• Process control covering documented procedures for all processes affecting food safety and quality
• Personnel covering hygiene, training and medical screening

Issue 9 introduced strengthened requirements around food safety culture, requiring organisations to demonstrate how culture is assessed, embedded and improved over time. This covers measurable indicators, internal communication and observable behavioural change, rather than simply stating commitments in a policy document. It also strengthened existing provisions on food fraud vulnerability assessment, requiring sites to systematically assess and mitigate the risk of intentional adulteration or substitution. Food fraud requirements were present in Issue 8; Issue 9 raised the bar on the rigour and documentation of the vulnerability assessment process.

The Audit Cycle

BRCGS certification is renewed annually through an external audit by a BRCGS-approved certification body. The audit grade (AA, A, B, C, D) determines the frequency of subsequent audits. Unannounced audits are available as a voluntary option, at customer request, or as a scheme-specific requirement; they're not awarded as a reward for high grades, though some buyers place additional value on suppliers who opt for them. Between external audits, sites are required to conduct internal audits and management reviews at defined intervals.

A certificate shows that a site's documented systems met the standard's requirements at the time of audit. It doesn’t guarantee outcome quality on every individual lot, which buyers should bear in mind when interpreting a certificate against a specific shipment.

ISO 22005 - Designing a Traceability System

ISO 22005:2007, Traceability in the feed and food chain, is a guidance standard rather than a certifiable food safety management system standard. Where BRCGS Food Safety sets requirements for a food safety management system and audits against them, ISO 22005 provides a framework for thinking through what a traceability system needs to do and how it should be documented. It's a tool for system design, and this distinction is relevant to how the two standards are used together in practice.

What ISO 22005 Addresses

This standard defines the objectives a traceability system should be designed to meet, the information it should be able to retrieve, and the documentation needed to demonstrate that it works as intended. Key design questions it prompts include:

• What is the defined scope of the traceability system - which products, which stages of the chain, and which information flows?
• What are the identification and recording requirements at each stage?
• How will the system perform under recall or withdrawal conditions - can a lot be traced forward and backward within a defined time window?
• How will the system be tested and verified?

For cashew processors, ISO 22005 is often applied alongside food safety certification schemes rather than instead of them. A processor holding BRCGS certification will typically have traceability procedures embedded within their food safety management system; ISO 22005 provides a complementary framework for ensuring those procedures are systematically designed and documented.

The module on traceability protocols and digital systems (1.2) builds on this foundation, examining how information about cashew lots is structured, transferred, and verified as it moves between parties in the supply chain.

GFSI Benchmarking - Equivalence and Recognised Standards

The Global Food Safety Initiative (GFSI) does not itself provide certification. Instead it operates a benchmarking process that evaluates food safety certification schemes against a defined set of requirements, and schemes that meet those requirements are described as GFSI-benchmarked or GFSI-recognised.

The practical effect of this benchmarking is to create a layer of recognised equivalence between participating schemes. A buyer who accepts GFSI-benchmarked certification as evidence of food safety compliance will, in principle, accept a valid certificate from any GFSI-recognised scheme - whether BRCGS, SQF, FSSC 22000, IFS, or another. This reduces the burden on suppliers who might otherwise need to hold multiple certificates to satisfy different buyers.

Currently GFSI-Recognised Schemes Relevant to the Cashew Industry

• BRCGS Food Safety (Issue 9)
• FSSC 22000 (version 6)
• IFS Food (version 8)
• SQF Food Safety Code

Each scheme has a different emphasis and audit approach, and buyer preferences vary by market. BRCGS is most commonly required by UK retailers; IFS is more prevalent among German and French retailers; and FSSC 22000 has strong adoption in the Netherlands, Italy, and Scandinavia.

Source: GFSI benchmarking; BRCGS, IFS, FSSC 22000 and SQF scheme owners.

How to Read a GFSI-Recognised Certificate

When evaluating a supplier's GFSI-recognised certificate, buyers should check:

• The certification body: Is it accredited to certify against the relevant GFSI-benchmarked scheme?
• The scope: Does it cover the specific products and processes relevant to the supply relationship?
• The audit grade and date: What grade was awarded, when was the audit conducted, and when does the certificate expire?
• The audit type: Announced or unannounced?

A certificate that's out of scope, expired, or issued by a body not accredited for the relevant scheme provides no meaningful assurance. Directories of accredited certification bodies are maintained by each scheme owner: BRCGS, FSSC 22000 and IFS each publish searchable databases of certified sites and accredited certification bodies.

It’s also worth noting that GFSI benchmarking addresses food safety management systems and does not assess traceability system design to the depth of ISO 22005. Nor does it cover social compliance, environmental performance or product quality characteristics, all of which may be subject to separate buyer requirements.

Codex Alimentarius and Other Public-Sector Frameworks

Codex Alimentarius is a joint programme of the Food and Agriculture Organization of the United Nations (FAO) and the World Health Organization (WHO) that develops internationally recognised standards, guidelines and codes of practice for food safety and quality.

Codex standards are not themselves legally binding, but serve as the reference baseline for national food safety legislation in many countries, and are explicitly referenced in the World Trade Organization's Agreement on Sanitary and Phytosanitary Measures (SPS Agreement).

For cashew, relevant Codex material includes the Code of Practice for the Prevention and Reduction of Aflatoxin Contamination in Tree Nuts, which addresses good manufacturing and hygiene practices throughout the supply chain, and the General Principles of Food Hygiene (CXC 1-1969), which establish the HACCP framework that underlies most food safety certification schemes.

EU and UK Regulatory Anchoring

The EU's General Food Law (Regulation (EC) No 178/2002) establishes the overarching legislative framework for food safety in the European Union, covering food safety principles, traceability obligations, the responsibility of food business operators and the requirements for recalls and withdrawals. The requirement to implement HACCP comes from a separate instrument, Regulation (EC) No 852/2004 on the hygiene of foodstuffs, which requires food business operators to put in place, implement and maintain procedures based on HACCP principles. Together, these two regulations form the core of the EU's food safety legislative framework relevant to cashew processors and exporters targeting European markets.

For cashew specifically, this framework is supplemented by Regulation (EU) 2023/915 on maximum levels for contaminants including aflatoxins, and by the EU's maximum residue level (MRL) regulations for pesticides, both of which are directly relevant to processors and exporters targeting European markets.

UK food safety legislation has maintained broad alignment with EU frameworks since the end of the Brexit transition period, though some divergence has emerged and importers targeting both markets should verify current requirements separately.

ISO 22000 and FSSC 22000

ISO 22000 is an internationally recognised standard for food safety management systems, published by the International Organization for Standardization. Unlike BRCGS, which was developed by and for the retail sector, ISO 22000 is a generic management system standard applicable across all food chain sectors. It defines the requirements for a food safety management system but does not prescribe the specific operational controls that BRCGS requires.

FSSC 22000 - one of the GFSI-recognised schemes listed above - is built directly on ISO 22000, adding sector-specific prerequisite programmes and additional requirements developed by the Foundation FSSC. For a cashew processor already certified to ISO 22000, the pathway to FSSC 22000 certification involves adding these extra requirements rather than building an entirely new system. This relationship explains why FSSC 22000 has strong adoption among manufacturers who have historically used ISO standards rather than retail-developed schemes.

BRCGS Packaging

BRCGS publishes a separate standard for packaging and packaging materials - BRCGS Packaging Issue 6 - which applies to suppliers of packaging used in contact with food. For cashew processors evaluating their supply chain risk, the packaging supplier is a relevant tier: contamination or integrity failures in packaging materials can compromise product safety downstream. Buyers with developed supplier approval programmes increasingly extend GFSI-recognised certification requirements to packaging suppliers as well as direct food manufacturers.

Organic Certification

Organic certification for cashew is governed by different regulatory frameworks depending on the destination market. EU organic certification operates under Regulation (EU) 2018/848, which requires electronic certificates of inspection (e-COI) for all organic imports. US organic certification operates under the USDA National Organic Program (NOP). Schemes such as ECOCERT certify against both frameworks, allowing a single audit process to generate certificates recognised in multiple markets. Organic certification sits alongside food safety certification rather than replacing it: an organically certified cashew processor still requires GFSI-recognised food safety certification for most European retail channels.

Fairtrade

Fairtrade certification operates under standards published by Fairtrade International, covering farmer cooperatives, hired-labour operations and the traders and companies that buy and sell Fairtrade products. For cashew, Fairtrade Standards include minimum price protections for kernels from African origins, requirements on cooperative governance and democratic decision-making, and provisions on labour conditions for hired workers. As with organic certification, Fairtrade sits alongside rather than substituting for food safety certification. A Fairtrade-certified cashew exporter still needs GFSI-recognised food safety certification to access most European retail channels.

SMETA

SMETA (Sedex Members Ethical Trade Audit) is an audit methodology rather than a certification standard. This distinction matters: completing a SMETA audit does not result in a certificate in the way that BRCGS or FSSC 22000 certification does. Instead, it produces an audit report documenting performance against the ETI Base Code, covering labour rights, health and safety, environment and business ethics. This is shared through the Sedex platform with buyers who have requested it. Many European retailers and brand owners require their cashew suppliers to have a current SMETA audit on file, making it a practical market access requirement even though it carries no certification status of its own.

How the Standards Interact in Practice

A cashew processor targeting European retail markets is unlikely to be working with a single standard in isolation. In fact the compliance picture typically involves several overlapping frameworks operating at different levels.

A representative compliance stack for a cashew processor might include BRCGS Food Safety (or FSSC 22000 or IFS, depending on target market) as the core food safety management system certification; internal traceability procedures referencing ISO 22005 principles to document how lots are identified, recorded, and retrievable across the processing and packing operation; ongoing regulatory compliance with EU contaminant regulations, MRL limits, allergen labelling requirements, and import documentation; and scheme-specific sustainability or social compliance requirements such as Fairtrade Standards or organic certification under EU Regulation 2018/848, each carrying their own audit cycles and documentation requirements. The environmental and social dimensions of those sustainability requirements are examined in Part 2, Sustainability and Regenerative Practices.

Managing these overlapping frameworks requires coordination between quality, operations, procurement and commercial teams. The most common problem is a gap between documented systems and actual practice - something internal audits are designed to catch before an external auditor does.

Common Audit Findings and What They Tell You

BRCGS publishes guidance on common audit findings, and patterns in those findings offer a useful indicator of where food safety management systems most frequently fall short. For cashew processors, the most commonly cited areas include the following.

Documentation gaps: Procedures exist but are not consistently followed or recorded. Monitoring records are incomplete or retrospectively filled, and corrective action logs are not closed out in a timely or evidenced manner.

HACCP plan maintenance: The initial HACCP study is conducted but not reviewed when processes, raw material sources, or product specifications change. Critical control point monitoring frequencies are not re-validated following process modifications.

Supplier approval: The approved supplier programme is incomplete or not current; a finding that extends beyond raw cashew nut suppliers to packaging materials, processing aids, lubricants, fumigation services and contracted laboratories. All suppliers of materials or services that could affect product safety or quality fall within the scope of BRCGS supplier approval requirements, and gaps at any tier can generate findings at audit.

Internal audit effectiveness: Internal audits are conducted on schedule but findings don’t generate meaningful corrective actions, or the same findings recur across consecutive audit cycles without being resolved.

Pest control: Monitoring records are maintained but trend analysis is not conducted, and recommendations from the pest control contractor are not acted upon within agreed timeframes.

For buyers evaluating a cashew supplier's audit history, a pattern of recurring minor findings in the same area over multiple cycles can be more informative than a single major finding, as it may indicate a systemic issue the site has not prioritised resolving.

Maintaining Certification Beyond the Audit Window

Certification status is maintained between external audits through a programme of internal audits, management reviews and continuous improvement activity. This ongoing work is where the operational value of a food safety management system is generated or lost.

Internal audits: Should cover all applicable clauses of the standard on a defined schedule, with findings recorded, root causes identified, and corrective actions assigned, tracked and closed out. An internal audit programme that generates no significant findings over multiple cycles is unlikely to be functioning effectively.

Management reviews: Are required at defined intervals and should draw on data from internal audits, customer complaints, RASFF alerts relevant to the product category, regulatory changes and supplier performance. The output should include decisions and resource allocations, not simply a record that the meeting took place.

Continuous improvement: In the context of food safety certification this means using audit data, complaint data and operational monitoring to identify and address trends before they become non-conformances. Sites that treat certification as an annual event rather than a continuous programme tend to experience more significant findings at external audit and higher rates of corrective action under time pressure.

For processors in origin countries, maintaining certification between audits may involve additional logistical considerations around laboratory access, digital record systems, and the availability of qualified internal auditors, all of which require planning and resourcing.

What This Means for Buyers Evaluating a Cashew Supplier

For procurement leads assessing a cashew supplier's food safety and traceability credentials, a valid GFSI-recognised certificate is a necessary starting point but not a sufficient basis for supplier approval on its own. Practical questions worth asking at the evaluation stage include:

• Which GFSI-recognised scheme does the supplier hold, and is it accepted by your retail or food-service customers?
• What is the audit grade, and when was the most recent external audit conducted?
• Was the audit announced or unannounced?
• What is the scope of the certificate - does it cover the specific products and processes relevant to your supply relationship?
• Can the supplier provide the most recent audit report, or a summary of findings and corrective actions?
• How does the supplier's internal audit programme work, and how are findings tracked and closed out?
• How does the supplier manage food safety and traceability requirements with its own raw material suppliers, including in-shell nut producers at origin?

The last question is particularly relevant in cashew supply chains, where the distance between origin and processing can be significant and where raw material supplier management is a common area of audit finding. A processor with strong internal systems but weak upstream supplier controls may represent a higher risk than a certificate grade alone would suggest.

For a broader view of how food safety credentials fit into the supplier evaluation process, the module on procurement ethics and buyer confidence models (1.5) examines how buyers translate standards requirements into sourcing policies and ongoing supplier management. Or you can move onto module 1.2, Traceability Protocols and Digital Systems.

For enquiries about contributing traceability or food safety standards data or case studies, or to request expert comment, please get in touch.

Evidence and methodology: You can learn about our source vetting standards, data attribution policy, editorial independence and amendment policy here.