ISO 22000 for small food businesses: a right-sized system without the bureaucracy

What ISO 22000 requires of a small food business

ISO 22000 was written for any organisation in the food chain, whatever its size, and its requirements do not change with headcount. What changes is how much it takes to meet them. The standard says what must be achieved, from scope and policy through prerequisite programmes, hazard analysis, a validated hazard control plan, traceability and recall to internal audit and management review. It rarely says how many documents, meetings or people that takes. Small does not mean thin, though: the auditor tests the controls just as hard.

A single site, a short product list and few process flows produce a short hazard analysis and a compact plan. The detail of every requirement sits in our guide to the ISO 22000 requirements; this guide is about sizing them.

The food safety team: small, but multidisciplinary

ISO 22000 requires top management to appoint a food safety team and a team leader, and it expects the team, taken together, to have the multidisciplinary knowledge and experience needed to develop and run the system. That is a requirement about competence, not headcount. In a small business it might be the manager, the production lead, the purchasing lead and whoever runs cleaning and maintenance. Between them they need to understand the products, the process, the equipment, hygiene, the relevant hazards and the legal requirements that apply.

Where a gap exists, often in microbiology, allergens or validation, the business can bring in outside expertise such as a food technologist or a laboratory. The standard allows this, but the evidence has to show that the external contribution is agreed, that its competence is known and that the food safety team still understands and owns the result. A hazard analysis written entirely by an outsider, which nobody on site can explain, will not survive the audit.

The team leader needs the authority to hold product and the training to lead a hazard analysis; in a small firm that is often the production lead rather than the owner.

What can be combined, and what must stay separate

One daily sheet for the prerequisite checks

Large plants often run a separate form for each prerequisite programme. A small business can combine the daily items into one sheet per area or shift: hygiene checks, fridge and freezer temperatures, cleaning completed, pest devices inspected, foreign-body checks done. Weekly and monthly items can sit on a second sheet. Every line needs an owner, a frequency, a limit where one applies and space to record the action taken when a check fails. The content of each programme is in our guide to prerequisite programmes.

One hazard control plan per product family

Products that share ingredients, process steps and hazards can be grouped into families, with one flow diagram, one hazard analysis and one hazard control plan per family, plus notes for any product that differs. Group by hazard, not by sales category: a cream-filled pastry and a dry biscuit from the same oven face different hazards after baking. The method for OPRPs and CCPs is covered in our guide to the hazard control plan.

How many people, how much time, and what the certification body does

Expect three to five people to carry the work, each for part of their week, with the food safety team leader carrying the most. The usual four to nine months still applies, because validation and a record history take time, not the writing. Sound premises and an existing HACCP plan point to the shorter end; building works or a first hazard analysis point to the longer end.

On the certification side, audit time is set by the certification body under the ISO 22003-1 rules, which take account of the food chain category, the number of HACCP studies, the number of employees and the number of sites. A single-site business with few product families therefore sits at the lower end of the scale, but it still receives a Stage 1 readiness review and a Stage 2 audit on site, followed by annual surveillance. Expect the auditor to walk the process, trace a batch and interview people on shift. Choosing the body and reading its quote are covered in our guide to choosing an ISO 22000 certification body.

A worked example: a right-sized system for a 15-person bakery

Consider an illustrative single-site bakery with fifteen people across two shifts, producing bread and rolls, cream-filled pastries kept chilled, and packaged biscuits sold to local retailers and cafés. It shows proportion, not a template; real hazards and limits come from each business's own analysis.

The outcome is a short procedure set, three plans and a handful of forms that shift staff recognise because they helped design them.

Mistakes small food businesses make

• Starting from a template pack. A downloaded set of procedures describes someone else's kitchen. Staff cannot follow it, and auditors spot the mismatch quickly.
• Making the owner the only HACCP person. When one person holds all the knowledge, the team exists on paper only, the multidisciplinary requirement is not met, and the system stops whenever that person is away.
• Never testing the recall. A timed mock recall usually shows gaps owners did not expect, and the auditor expects to see one.
• Copying critical limits instead of validating them. A temperature taken from a textbook is not validation of your oven, your product or your load.

ISO 22000 for small food businesses: questions buyers ask