What is HACCP and who does it apply to?
HACCP — Hazard Analysis and Critical Control Points — is a systematic preventive approach to food safety that identifies, evaluates, and controls hazards that could cause harm to consumers. In the UK, all food businesses are legally required under Regulation (EC) 852/2004 to implement food safety management procedures based on HACCP principles.
HACCP applies to any business that prepares, handles, stores, or sells food — including restaurants, cafes, hotels, school canteens, hospital kitchens, commissaries, care homes, and food production facilities. The level of documentation and formality is proportionate to the size and risk profile of the operation.
Smaller food businesses in the UK can use the Food Standards Agency's Safer Food, Better Business (SFBB) pack as an equivalent HACCP-based system. Larger or higher-risk businesses are expected to implement a more formal documented HACCP plan.
The 7 HACCP Principles
Conduct a Hazard Analysis
Identify all potential biological, chemical, and physical hazards at every step of your food preparation process — from delivery, through storage, preparation, cooking, holding, and service. For each hazard, assess its likelihood and severity.
Identify Critical Control Points (CCPs)
A Critical Control Point is a step in the process where a control measure can be applied to prevent, eliminate, or reduce a food safety hazard to an acceptable level. Common CCPs in professional kitchens include: receiving deliveries (temperature check), refrigerated storage (temperature monitoring), cooking (core temperature), hot holding, and cooling.
Establish Critical Limits
For each CCP, define the maximum and minimum values that must be maintained. In the UK: chilled storage ≤8°C (best practice 1–5°C), frozen storage ≤-18°C, cooking core temperature ≥75°C (or ≥70°C for 2 minutes), hot holding ≥63°C, cooling from 60°C to 8°C within 90 minutes.
Establish Monitoring Procedures
Define how each CCP will be monitored, how frequently, and who is responsible. Manual approaches (probe thermometers, fridge checks) are valid but rely on staff availability and compliance. Automated IoT sensor systems monitor continuously and record data without human input — removing the risk of missed checks.
Establish Corrective Actions
Document exactly what must happen when a critical limit is breached. For a fridge temperature excursion: isolate affected stock, assess food safety risk, take corrective action (repair, transfer, discard), and record the incident including time, affected products, action taken, and the outcome. Corrective action logs are reviewed by EHOs.
Establish Verification Procedures
Regularly verify that the HACCP system is working as intended. This includes calibrating temperature equipment, reviewing monitoring records, auditing corrective actions, and periodically reviewing the HACCP plan itself when processes, menus, or equipment change.
Establish Record-Keeping and Documentation
Maintain records of your HACCP plan, monitoring data, corrective actions, verification activities, and staff training. Records must be available for inspection on request. The minimum retention period for most food safety records is one year.
Temperature Monitoring: Manual vs Automated
Temperature control is the most common and most critical CCP in professional kitchens. Most food safety failures stem from temperatures going out of safe range — either during storage, during cooking, or during cooling. How you monitor temperature determines how reliably you detect and respond to these failures.
Manual Temperature Logging
- —Checks happen at scheduled times only (not continuously)
- —Depends on staff availability — gaps during service or overnight
- —Relies on staff not forgetting or skipping checks under pressure
- —Paper records can be lost, damaged, or backdated
- —No alert if a fridge fails at 2am on a Sunday
- —Manual preparation required before EHO inspections
Automated IoT Monitoring
- Continuous monitoring — every few minutes, 24/7
- No reliance on staff — operates overnight and during service
- Instant alerts via app, email, or SMS when limits are breached
- Cloud-stored records — tamper-proof and always accessible
- Audit-ready reports generated in seconds, not hours
- Covers out-of-hours periods with complete evidence
UK food law does not mandate automated monitoring, but EHOs regard continuous digital records as better evidence than manual logs. Several enforcement authorities have noted that automated systems provide stronger due diligence defence in the event of a food safety incident.
7-Step HACCP Implementation Checklist
Use this checklist when setting up or reviewing your HACCP system.
Map your food preparation process
List every step from goods-in to service. Include all products and all kitchen areas.
Identify hazards at each step
Consider biological (bacteria, viruses), chemical (cleaning products, allergens), and physical (glass, metal, bone) hazards.
Determine Critical Control Points
Use the CCP decision tree: Is control necessary at this step? Can a control measure be applied? Is this the last step where control is possible?
Set critical limits for each CCP
Based on legal requirements and food science. Document the minimum and maximum acceptable values.
Set up monitoring for each CCP
Define the method (probe, sensor, visual check), frequency, and responsible person for each CCP. Consider automated monitoring for temperature CCPs.
Document corrective action procedures
Write down what to do for each possible failure. Include stock isolation, food safety assessment, reporting, and record-keeping steps.
Establish a review schedule
Review the HACCP plan whenever: a new product is introduced, equipment changes, a supplier changes, a food safety incident occurs, or at minimum annually.
Preparing for an EHO Inspection
Environmental Health Officers (EHOs) inspect food businesses under the Food Standards Act 1999 and Food Safety Act 1990. Inspections are unannounced. The EHO will assess: food hygiene standards, food safety management (your HACCP system and records), and the structural condition of your premises.
Having your records available and organised is as important as the records themselves. If you cannot produce temperature logs, corrective action records, or cleaning schedules on the day of inspection, the officer must treat them as if they do not exist.
Records EHOs Most Commonly Ask For
- Fridge and freezer temperature logs
- Cooking and cooling temperature records
- Corrective action logs
- Cleaning schedule and completion records
- Delivery receipt and temperature records
- Staff food hygiene training certificates
- Allergen management records
- Written HACCP plan or SFBB pack
With a digital system, all records are stored in the cloud and can be accessed and printed within minutes of an inspector arriving. Automated systems also provide continuous records covering overnight periods — a common area of scrutiny during inspections.
Common Questions
What are the 7 HACCP principles?
The 7 HACCP principles are: (1) Conduct a hazard analysis — identify biological, chemical, and physical hazards at each process step. (2) Identify Critical Control Points (CCPs) — the points where control is essential to prevent or eliminate a hazard. (3) Establish critical limits — the maximum and minimum values for each CCP (e.g., cooking temperature of 75°C). (4) Establish monitoring procedures — how each CCP will be monitored, how often, and by whom. (5) Establish corrective actions — what to do when a CCP is not within its critical limit. (6) Establish verification procedures — confirm the HACCP system is working correctly. (7) Establish record-keeping and documentation — maintain records of the HACCP plan and monitoring activities.
What temperature should food be stored at?
UK food safety law requires that chilled food be stored at or below 8°C, with best practice being 1–5°C. Frozen food should be stored at -18°C or below. Hot food being held for service must be kept at 63°C or above. These temperatures are Critical Control Points in most kitchen HACCP plans. Monitoring should be continuous — manual checks every 4 hours at minimum, or automated with IoT sensors.
How often should temperature logs be completed?
UK Food Standards Agency guidance recommends temperature checks at least twice daily for refrigeration equipment (opening and closing) and at least once for cooking processes (at the point of cooking). In practice, best practice is continuous automated monitoring via IoT sensors, which captures every fluctuation rather than point-in-time readings. Continuous monitoring also provides evidence for out-of-hours periods when no staff are present.
What records do I need for an EHO inspection?
Environmental Health Officers typically want to see: temperature monitoring logs (fridge, freezer, cooking, hot holding), cleaning schedules and completion records, delivery records, corrective action logs (what went wrong and what you did about it), staff food hygiene training records, allergen management records, and your written HACCP plan or equivalent Food Safety Management System. Digital records are equally valid as paper and are generally easier to present during an inspection.
What is the difference between HACCP and a Food Safety Management System?
HACCP (Hazard Analysis and Critical Control Points) is a specific systematic approach to identifying and controlling food safety hazards. A Food Safety Management System (FSMS) is the broader framework within which HACCP sits — it includes policies, procedures, records, training, and management responsibilities. For most UK food businesses, "Safer Food, Better Business" (SFBB) — the FSA's simplified FSMS pack — provides an equivalent to HACCP that meets legal requirements for smaller operators.