ISO 22000 for small and medium-sized enterprises – does it make sense?

There is a widespread belief amongst food producers that ISO 22000 is a standard intended for large facilities – with extensive quality departments, dedicated representatives and budgets allowing for implementation projects lasting several months. This is a myth that effectively discourages small and medium-sized enterprises from seeking certification, even though they often already operate in accordance with HACCP requirements and are ready to take the next step. The reality is more pragmatic: ISO 22000 was designed as a scalable standard, and its implementation in SMEs is not only possible but, in many cases, makes good business sense.

What does the standard say about the size of an organisation?

ISO 22000:2018 explicitly states that it is intended for all organisations in the food chain, regardless of their size and complexity. The standard does not impose a specific organisational structure, number of procedures or volume of documentation – instead, it requires that the food safety management system be appropriate to the scale and nature of the business.

In practice, this means that a small meat processing plant employing 15 people and a large tinned food manufacturer employing 500 staff implement the same standard – but the documentation, number of procedures and complexity of the HACCP system will be proportionate to the actual processes and hazards at the facility in question. The standard does not require a separate quality department – in a small company, the role of food safety representative may be fulfilled by the owner or production manager, provided they possess the relevant competence.

A helpful tool for smaller organisations is ISO 22001 – the official guide to the application of ISO 22000 for small and medium-sized enterprises, which provides practical guidance on a simplified approach to the standard’s requirements without compromising their substantive level.

When is ISO 22000 appropriate for SMEs?

Not every small business needs ISO 22000 certification – but there are situations in which obtaining it is a strategically sound decision.

A requirement from a customer or business partner. An increasing number of companies in the HoReCa sector, wholesalers and processors require their suppliers to have a documented food safety management system. ISO 22000 certification is recognised proof of such a system and eliminates the need for each customer to carry out their own audits.

Export expansion. Companies planning to sell to foreign markets – particularly in the EU, but also in the Middle East or Asia – often encounter a requirement for food safety system certification as a condition for admission to tenders or for establishing cooperation with local distributors. ISO 22000, as an ISO standard, is recognised globally and requires no explanation in an international context.

Preparation for FSSC 22000 or BRC/IFS. For companies planning to enter the retail channel within the next few years, implementing ISO 22000 is the optimal first step. It builds the system, team competencies and a food safety culture, and subsequent expansion to include the requirements of FSSC 22000 or another GFSI standard is significantly less costly than building a system from scratch.

Internal organisation and risk reduction. Even without an external certification requirement, implementing ISO 22000 enables a small business to systematise its food safety management, reduce the risk of complaints and incidents, and lay the foundations for scaling up its operations without compromising quality control.

How much does it cost and how long does it take?

This is the question SMEs ask most often – and rightly so, as resources are limited. The answer depends on the company’s starting point, but a typical timeframe can be outlined.

The starting point is crucial. A company with an implemented and functioning HACCP system, documented PRPs and trained staff is in a much better position than one starting from scratch. In the first case, implementing ISO 22000 mainly involves supplementing the system with HLS requirements – organisational context, organisational risk analysis, external and internal communication, and formal system objectives. In the second case, the scope of work is broader and involves building the system from scratch.

The approximate implementation time depends primarily on the starting point and the team’s commitment. With effective cooperation with an experienced consultant and management commitment, the process can be completed in as little as two months.

Certification costs depend on the size of the company (number of employees and location), the chosen certification body, and the scope of the certificate. For a small company employing up to 50 people, the annual cost of certification (audit + certificate maintenance) is usually in the range of a few to several thousand zlotys – comparable to the costs of a single serious quality incident or a series of complaints.