Ask a supplier what their retailer requires and most will name one thing: a GFSI-recognized certification as a prerequisite for entering their supply chains.
That answer is correct, but it is also incomplete.
A GFSI-recognized certification is the baseline condition for doing business with a major retailer. Major retailers view GFSI standards as the bare minimum framework and layer their own unannounced audits, compliance rules, category-specific safety hurdles, and ongoing testing rights on top of it. Unfortunately, suppliers who treat the GFSI certificate as the end of the conversation are the ones who get caught out at renewal, at audit, or at delisting.
Do major retailers require GFSI certification?
Most major retailers, including Walmart and Costco, expect suppliers to hold a GFSI-recognized certification as a condition of doing business, though the exact rule varies by retailer, product category, and brand type. GFSI does not issue certificates directly. Instead, it benchmarks certification schemes that meet its requirements, and retailers generally accept any of these schemes as proof of a sound food safety system. The main schemes suppliers encounter are SQF, BRCGS, FSSC 22000, IFS, GLOBALG.A.P., and PrimusGFS, each covering different sectors and supply chain stages. GFSI publishes the current list of recognized certification programs.
SQF is one of the most common schemes for suppliers to major US retailers, and manufacturers most often certify to its Food Safety Code (still widely called Level 2) or add its Quality Code (still widely called Level 3).
But certification alone does not close the file. Retailers layer their own requirements on top of it.
Retailers add their own rules on top of GFSI
Costco is a clear example. Costco expects suppliers to hold a GFSI-recognized certification and to add the Costco Addendum, a set of Costco-specific requirements audited alongside the GFSI scheme. That combined audit must be unannounced every year, and sites without a GFSI-recognized certification go through Costco's own unannounced food safety audit instead. A GFSI certificate gets a supplier in the door. It does not exempt a supplier from Costco's own audit.
Walmart follows a similar pattern. Walmart's compliance framework is multi-layered, covering everything from the factory floor to the store shelf. It includes federal and state regulatory compliance, Walmart-specific internal standards, third-party product safety and quality testing, and GFSI-recognized certification for private brand products and higher-risk categories. For national brands outside those categories, Walmart encourages GFSI certification and requires an annual approved food safety audit, and a supplier that lets that audit lapse can lose its vendor number. Depending on the product and a supplier's past performance, Walmart may also require a risk-based site review, and suppliers may need to share verification testing results with Walmart Food Safety on request. Walmart can also sample products at any time to test for authenticity, and it sets extra requirements for higher-risk categories such as deli meats, shell eggs, frozen berries, and raw ground beef.
The pattern behind the requirements
Three things repeat across retailers, whatever scheme a supplier holds:
1. A GFSI-recognized certification is the expected baseline.
No approved certification or audit means no vendor number, in most cases.
2. The retailer's own audit sits on top of the certification.
Costco's Addendum and Walmart's risk-based review are conditions of the relationship. They are the retailer checking its own risk, on its own terms.
3. Ongoing testing does not stop at onboarding.
Retailers keep the right to test, resample, and request data from suppliers throughout the relationship. Audits and sampling often happen unannounced.
For a supplier, this means a testing program built for one certification is not automatically a testing program built for a specific retailer relationship. The certificate proves a baseline system. The retailer's own audit and sampling prove that the system holds up under their specific rules.
Where this leaves supplier testing programs
Most testing programs are built around passing the certification audit once a year. That satisfies the foundation of a product safety program. It does not satisfy the retailer's ongoing right to test, sample, and request documentation. The suppliers who avoid delisting are the ones who treat the retailer's addendum and testing cadence as a standing requirement that runs all year.
Questions to ask about your current program
Before your next retailer audit or renewal, answer these questions:
- Which retailer-specific addenda apply to your accounts, beyond your GFSI certification?
- How would your program respond to an unannounced audit tomorrow?
- Who on your team tracks each retailer's testing cadence separately from the certification renewal date?
- If a retailer requested product testing results directly, how long would it take to produce them?
The bottom line
A GFSI-recognized certification opens the door. It does not keep a supplier on the shelf. Retailers add their own audits, addenda, and ongoing testing rights on top of certification, and a program built only to pass the annual audit will not hold up to that.
This is the gap Genista is built to close: one operating system for product safety, with accredited testing, robotic automation, connected software, and services in one closed loop, instead of stitching together 3+ vendors to keep up with what each retailer actually asks for.
