ISO 22000:2018 Implementation Guide for Small Food Businesses in India 2026

By Prashant Chavhan | Updated: July 2026

For small and medium food business operators (FBOs) in India, ISO 22000:2018 certification is no longer a “nice to have” — it’s becoming a competitive necessity. With FSSAI increasingly harmonising with international standards and major retailers demanding certified suppliers, obtaining ISO 22000 certification opens doors to organised retail, export markets, and institutional contracts.

Yet most small FBOs find the standard intimidating. This guide breaks down the implementation process into actionable steps, tailored specifically for Indian small and medium enterprises.

---

What Is ISO 22000:2018?

ISO 22000:2018 is the international standard for Food Safety Management Systems (FSMS). It specifies requirements for any organisation in the food chain — from primary producers to retailers — to:

• Plan, implement, operate, maintain, and update a food safety management system
• Demonstrate compliance with statutory and regulatory food safety requirements
• Evaluate and assess customer requirements and demonstrate conformity
• Effectively communicate food safety issues throughout the food chain

ISO 22000:2018 vs ISO 22000:2005 — Key Changes

Parameter	ISO 22000:2005	ISO 22000:2018
Structure	ISO 22000-specific structure	High Level Structure (HLS) — Annex SL
Risk approach	HACCP-based risk assessment only	Two-tier risk: organisational + operational (HACCP)
PDCA cycle	Implicit	Explicit — two separate PDCA cycles (management + operations)
Leadership	Management representative required	Top management directly accountable; no mandated representative
Communication	Defined external communication	Expanded — interested parties, emergency preparedness
Documented information	Documents and records separately	Unified “documented information” concept
Interaction with other standards	Limited	Fully integrated — aligns with ISO 9001, ISO 14001, ISO 45001

Source: ISO.org, ISO 22000:2018 Standard Document

---

The High Level Structure (HLS) Explained

ISO 22000:2018 follows Annex SL — the same 10-clause structure used by all modern ISO management system standards:

1. Scope — Standard scope and applicability
2. Normative references — Referenced documents
3. Terms and definitions — Key terminology
4. Context of the organisation — Internal/external issues, interested parties, scope of FSMS
5. Leadership — Policy, roles, responsibilities
6. Planning — Risks, opportunities, objectives
7. Support — Resources, competence, awareness, communication, documented information
8. Operation — Planning, PRPs, traceability, emergency preparedness, HACCP, verification
9. Performance evaluation — Monitoring, audit, management review
10. Improvement — Nonconformity, corrective action, continual improvement

Why this matters for small FBOs: The HLS structure means that once you understand ISO 22000, you’re 60% of the way to understanding ISO 9001 (quality) or ISO 14001 (environment). Integration becomes straightforward.

---

The PDCA Cycle in ISO 22000:2018

The standard introduces two interconnected PDCA (Plan-Do-Check-Act) cycles:

Cycle 1: Management PDCA (Clauses 4–7)

• Plan: Understand context, set policies, plan for risks and opportunities
• Do: Implement plans, allocate resources
• Check: Monitor management system performance
• Act: Management review, corrective action

Cycle 2: Operational PDCA (Clause 8) — HACCP-based

• Plan: PRPs (Prerequisite Programmes), hazard analysis, operational PRPs, critical limits
• Do: Implement control measures
• Check: Verification activities, monitoring of control measures
• Act: Corrections, corrective actions

The two PDCA cycles run in parallel — management PDCA provides the framework within which the operational (HACCP) PDCA operates.

---

Step-by-Step Certification Process for Small FBOs

Step 1: Gap Analysis (Week 1–2)

Before implementing, understand where you stand:

• Compare your current food safety practices against ISO 22000:2018 clauses
• Identify missing documentation, training gaps, infrastructure deficiencies
• Estimate resource requirements

Cost: ₹15,000–₹50,000 (consultant-driven) or self-assessment using free ISO gap analysis templates

Step 2: Define Scope & Policy (Week 2–3)

• Define the scope of your FSMS (which products, processes, locations?)
• Draft your Food Safety Policy — a one-page document signed by top management
• Identify interested parties (customers, regulators, suppliers, employees)

Step 3: Build Prerequisite Programmes (Week 3–6)

PRPs form the foundation of your FSMS. Common PRPs for small FBOs:

PRP	What It Covers	Typical Documents
Infrastructure & Layout	Building design, workflow, drainage	Site plan, maintenance schedule
Water & Air Quality	Potable water, compressed air	Water test reports, air filter log
Cleaning & Sanitation	Cleaning procedures, chemical control	SSOPs, cleaning schedule, MSDS
Pest Control	Pest management programme	Pest control contract, pest sighting log
Personnel Hygiene	Handwashing, uniforms, medical fitness	Hygiene policy, medical records
Training	Competence requirements, training records	Training register, induction checklist
Waste Management	Waste segregation, disposal	Waste disposal contract, manifest
Supplier Control	Approved supplier list, raw material specs	Approved vendor list, CoA files
Storage & Transport	Temperature control, FIFO	Temperature logs, vehicle checklist
Recall & Traceability	Forward/backward trace, mock recall	Traceability diagram, recall procedure

Step 4: Conduct Hazard Analysis (Week 6–8)

This is the core of your FSMS:

1. Hazard identification — Biological, chemical, physical, and allergen hazards at each process step
2. Hazard assessment — Severity × likelihood scoring
3. Control measure selection — Determine which hazards need CCPs (Critical Control Points), which need oPRPs (operational PRPs), and which are covered by PRPs

Step 5: Establish CCPs, Critical Limits & Monitoring (Week 8–10)

For each CCP:
– Define critical limit (e.g., core temperature ≥ 75°C for cooked products)
– Define monitoring method, frequency, and responsibility
– Define corrective actions when limits are exceeded
– Example CCPs: cooking, cooling, metal detection, X-ray inspection

Step 6: Create Documentation (Week 8–12)

Documented information required:

Document Type	Examples
Mandatory documents	Food Safety Policy, FSMS scope, Hazard analysis, HACCP plan
Mandatory records	Verification results, monitoring records, corrective actions, internal audit reports, management review minutes
Reference documents	PRP manuals, SSOPs, work instructions, specifications, calibration records
Supporting records	Training records, pest control logs, cleaning records, temperature logs

Step 7: Implement & Train (Week 10–14)

• Train all employees on relevant SOPs
• Run the system for 2–3 months to generate records
• Conduct at least one internal audit
• Hold a management review meeting

Step 8: Certification Audit (Week 14–16)

• Choose an accredited certification body (see table below)
• Stage 1 audit: Documentation review (often remote) — 1 day
• Stage 2 audit: On-site implementation verification — 2–4 days depending on size
• Close any nonconformities within agreed timeline (typically 30–60 days)
• Certificate issued — valid for 3 years, with annual surveillance audits

---

Cost Breakdown for Small FBOs (2026 Estimates)

Component	Estimated Cost (₹)
Consultant fees (12–16 weeks)	50,000–2,00,000
Employee training (internal)	15,000–40,000
Documentation setup	20,000–60,000
Infrastructure upgrades (if needed)	50,000–5,00,000
Pre-assessment audit	15,000–30,000
Certification audit (Stage 1 + Stage 2)	75,000–1,50,000
Annual surveillance audit	40,000–60,000
First-year total investment	₹2,25,000–₹10,40,000
Recurring annual cost (Year 2+)	₹55,000–₹1,00,000

Note: Costs vary significantly by FBO size, complexity, and certification body. These are estimates for a small FBO with 10–25 employees. Government schemes under MSME may subsidise certification costs partially.

---

Accredited Certification Bodies in India (NABCB Approved)

India has several NABCB-accredited certification bodies for ISO 22000:2018:

Certification Body	Headquarters	Small FBO Friendly	Notes
Bureau Veritas (India)	Mumbai	Yes	Pan-India presence
TÜV SÜD South Asia	Mumbai	Yes	Strong food sector focus
SGS India	Mumbai	Yes	Global network
Intertek India	Mumbai	Yes	Competitive pricing
BSI Group India	New Delhi	Yes	Original standard developer
Lloyds Register Quality Assurance	Mumbai	Moderate	Larger FBOs preferred
TQ Cert Services	New Delhi	Yes	Smaller, flexible
QRO Certification	Bengaluru	Yes	Mid-range pricing

Recommendation for small FBOs: Request quotes from at least 3 bodies. Smaller certifiers often offer better service and flexibility for small businesses. Verify accreditation status at nabcb.qci.org.in.

---

Integration with Other Management Systems

ISO 22000:2018’s HLS structure makes integration straightforward:

Standard	Integration Area	Combined Benefits
ISO 9001:2015 (Quality)	Shared HLS clauses, document control, internal audit	Reduced duplicate documentation, single audit possible
ISO 14001:2015 (Environment)	Waste management, operational planning, emergency preparedness	Unified environmental + food safety PRPs
ISO 45001:2018 (Safety)	Personnel hygiene training, facility layout, incident reporting	Single training and incident management system
FSSAI compliance	PRPs align with Schedule 4 requirements	Built-in compliance; FSMS audit satisfies FSSAI inspection readiness

Many Indian FBOs use ISO 22000:2018 + FSSAI Schedule 4 Compliance as their starting point and later add ISO 9001.

---

Common Challenges for Indian Small FBOs

1. Documentation burden — Keep it lean. Start with 15–20 essential documents and build over the year.
2. Employee literacy — Use pictorial SOPs, morning meeting training, and local-language materials.
3. Infrastructure gaps — Not all fixes need capital. Good hygiene practices and cleaning discipline compensate for many shortcomings.
4. Supplier compliance — Include food safety requirements in supplier agreements; conduct simple supplier audits for key raw materials.
5. Top management commitment — Without owner/CEO buy-in, implementation fails. The FSMS starts at the top.

---

Key Takeaways

• ISO 22000:2018 follows the HLS structure (10 clauses) and uses two PDCA cycles — one for management system, one for operational (HACCP) activities.
• Small FBOs can achieve certification in 14–16 weeks with dedicated effort and basic external consulting.
• First-year total cost ranges from ₹2.25 lakh to ₹10 lakh depending on current infrastructure and FBO size.
• The standard integrates naturally with FSSAI compliance, ISO 9001, and ISO 14001 — making it a strategic long-term investment.
• Choose a NABCB-accredited certification body — verify accreditation status before signing any contract.
• Certification is valid for 3 years with annual surveillance audits; start with core documentation and improve incrementally.

---

References

1. ISO 22000:2018 — Food safety management systems — Requirements for any organization in the food chain. International Organization for Standardization.
2. NABCB (National Accreditation Board for Certification Bodies). Directory of Accredited Certification Bodies — FSMS. Quality Council of India, 2026.
3. FSSAI (2025). Guidance Document on Food Safety Management Systems for Small and Medium Food Business Operators. Food Safety and Standards Authority of India.
4. Codex Alimentarius (2022). General Principles of Food Hygiene (CXC 1-1969), Rev. 2022. FAO/WHO.
5. ISO (2019). ISO 22000:2018 — A Practical Guide. ISO/TC 34/SC 17.