Keystone
by CloudVoro
Guide · Compliance

BRCGS vs SALSA:
which certification does your buyer actually require?

For small and mid-size producers in Ireland and the UK, the certification question usually reduces to two candidates: SALSA, the proportionate scheme for smaller suppliers, and BRCGS, the GFSI-benchmarked standard the national multiples expect. Choosing wrong wastes a year and a five-figure sum in one direction, or blocks a contract in the other. Here's the practical comparison.

9 min read Updated 2026-07-08By the CloudVoro team

What each scheme actually is

SALSA (Safe and Local Supplier Approval) was created by UK food industry bodies specifically for small and micro producers supplying locally and regionally, farm shops, delis, independents, foodservice, and regional retail listings. Its standard covers HACCP-based food safety, traceability, supplier control and premises at a depth proportionate to a small operation, audited by SALSA-approved auditors.

BRCGS Food Safety (currently BRCGS traceability requirements) is a GFSI-benchmarked global standard, audited by accredited certification bodies, and is the de facto entry requirement for own-label supply to national multiples and for many export customers. Its requirements are deeper everywhere: documented systems, the 4-hour traceability test with mass balance, vertical audits, unannounced audit options, and graded certificates.

The side-by-side

DimensionSALSABRCGS Food Safety (BRCGS traceability requirements)
Designed forSmall & micro producers, local/regional supplySuppliers to multiples, export, own-label
RecognitionUK/IE buyers, regional retail, foodserviceGFSI-benchmarked, global retailers & manufacturers
Typical all-in costHundreds to low thousands per yearSeveral thousand per year plus preparation cost
Audit depthProportionate; ~1 dayDeep; 1.5–3+ days; graded; unannounced options
Traceability askLot-level, both directions, tested exerciseSame plus 4-hour timed test, mass balance, vertical audit
Who typically requires itFarm shops, delis, independents, some wholesalersTesco, Sainsbury's, M&S, Aldi, Lidl own-label; many exporters

The decision rule

Ask your three biggest current buyers and your one dream buyer what they require, certification is a commercial door-opener, not a trophy. If your pipeline is independents and regional listings, SALSA is almost always the right first badge: proportionate cost, achievable in months, and it professionalises the same systems BRCGS will later deepen. If a multiple's own-label contract is on the table, BRCGS is usually non-negotiable and you should build toward it directly.

The trap to avoid is buying BRCGS-depth systems and consultancy before any buyer requires it, or, conversely, treating SALSA so lightly that the records wouldn't survive a step up.

The step-up strategy
SALSA first, BRCGS when a contract demands it, is the common path, and it works cleanly if your records are lot-level from day one. The step up adds timing evidence, mass-balance tolerances and audit depth; it should not require a different kind of record. Producers who kept product-level (not lot-level) records under SALSA effectively start again.

The traceability core is the same climb

Both schemes test the identical fundamental: connect what came in, through what you made, to who received it, with records, in reasonable time, in both directions. SALSA checks it proportionately; BRCGS times it, quantifies it and picks the lot for you. This is why the systems decision matters more than the scheme decision: lot-level goods-in, batch records that name their inputs, and dispatch lines that carry batch codes serve both audits without modification. Keystone produces exactly that evidence shape, which badge is on the certificate changes the paperwork template, not the preparation.

Key takeaways
  • SALSA = proportionate scheme for small/local suppliers; BRCGS = GFSI-benchmarked passport to multiples and export.
  • Let your buyers decide: certification is a commercial requirement, not a trophy.
  • The traceability fundamentals are identical, lot-level records in both directions, tested.
  • Keep records lot-level under SALSA and the step up to BRCGS adds depth, not rework.
  • Budget honestly: SALSA is hundreds-to-low-thousands annually; BRCGS is several thousand plus preparation.
Free 5-part email course
Get audit-ready in five short emails.
The 18-point checklist PDF, the 30-second traceability test, what BRCGS auditors actually flag, and how Cashel Blue got audit-ready, one email every few days. No spam, one-click unsubscribe.
GDPR-friendly: we store your email for this course only. Unsubscribe link in every email.

Frequently asked questions

Can I supply a supermarket with only SALSA?
Sometimes regionally, several multiples run local/regional supplier programmes that accept SALSA for small listings. National own-label supply almost always requires BRCGS (or another GFSI-benchmarked standard). Ask the retailer's technical team before investing either way.
How long does SALSA certification take?
Producers with working HACCP-based systems and reasonable records typically reach audit-readiness in 2–4 months. The audit itself is around a day, with corrective actions handled afterwards.
How much does BRCGS cost compared to SALSA?
SALSA runs hundreds to low thousands per year all-in. BRCGS certification (audit fees, certification body, plus preparation and any consultancy) typically lands at several thousand per year, and the internal preparation effort is the bigger real cost.
Is SALSA recognised in Ireland?
SALSA is a UK-origin scheme and is used by producers on the island of Ireland supplying UK and NI buyers. Irish producers supplying Irish multiples more often go straight to BRCGS; check what your specific buyers accept.
Do I need software for either scheme?
No, both certify paper and spreadsheet systems regularly. Software earns its place when records are slow or person-dependent, or when you're preparing the step up to BRCGS timing and mass-balance evidence.

See this done in software, on real production data.

Keystone runs the full chain, supplier delivery → batch → dispatch → customer, in under 30 seconds. 20-minute discovery call, no sales pitch.

Compliance & trust

How we keep your
data and your audits safe.

Enterprise-grade controls as standard, encryption, MFA for every user, tenant isolation and tamper-evident audit trails, on EU cloud or your own servers. Privacy queries go to privacy@cloudvoro.com. Sub-processor list at /legal/sub-processors. Full security posture at /site/security.

Live
Hosted in EU / Ireland, or on-premise
Customer data resides on AWS Ireland (eu-west-1) and never leaves the EU. Local on-premise deployment available where policy requires it.
Live
GDPR · Privacy Contact named
Internal Data Protection Lead handles subject access requests. Owner is ADPO Ireland member.
Live
MFA for every user
TOTP multi-factor authentication across all roles, with rate limiting, brute-force lockout and reCAPTCHA bot protection on public forms.
Live
ISO 27001 · aligned controls
Security controls mapped to the ISO/IEC 27001:2022 Annex A framework, access management, encryption, logging, incident response.
Live
NIS2 · supporting evidence
Tenant isolation, MFA and tamper-evident audit trails give customers in NIS2 scope direct supporting evidence for their obligations.
Live
Encryption · at rest & in transit
TLS 1.3 in transit, industry-standard symmetric ciphers at rest, KMS-managed keys.