HACCP explained: build a food safety system around real hazards

HACCP stands for Hazard Analysis and Critical Control Points. It is a way to identify food-safety hazards, decide where control is essential, monitor those controls and act when they fail. The aim is to prevent unsafe food reaching the customer rather than discover a problem only after a complaint or inspection. A small cafe and a complex manufacturer may use different levels of documentation, but both need procedures suited to the food they handle.

Article 5 of the UK version of Regulation (EC) 852/2004 requires food business operators to put in place, implement and maintain permanent procedures based on HACCP principles. The Food Standards Agency's MyHACCP guidance explains how these principles can be applied. This article gives the conceptual map. It does not certify a particular menu, process or food business as compliant.

What HACCP is and is not

HACCP starts with the food, process and people actually involved. Hazards may be biological, chemical, physical or allergen-related. The business looks at where they could enter, grow, survive or be passed to another food, then chooses controls. Some hazards are managed through routine hygiene practices such as cleaning, supplier assurance and staff instruction. Others may need a defined critical control point with a measurable limit and clear response if the limit is missed.

A HACCP document is not a guarantee of safe food. People must carry out the procedure, use suitable equipment and respond to failures. A fridge log filled in from memory or a cooking temperature checked after service is over provides little control. The system needs to match actual shifts, deliveries, menu changes and equipment. It also needs to be reviewed when those things change.

Article 5 does not mean every small operation must create an elaborate factory-style manual. The FSA's MyHACCP tool is aimed mainly at small food manufacturers. It points simple retail and catering operations to Safer Food, Better Business, or other suitable packs, as a simpler approach. Those packs are regulator guidance and tools for applying HACCP-based management; they are not a separate legal exemption from food hygiene duties.

The seven HACCP principles

Article 5(2) sets out the principles. First, identify hazards that must be prevented, eliminated or reduced to acceptable levels. Map the food journey from receipt and storage through preparation, processing, serving and disposal. Ask what can go wrong at each step. A hazard list copied from another business may miss your actual ingredients or equipment.

Second, identify critical control points, or CCPs, where control is essential. Not every useful control is a CCP. A prerequisite hygiene programme can manage many hazards. A CCP needs a clear reason: if control fails at that step, later steps may not reliably remove the hazard. Specialist food-safety judgement can be necessary for complex processes.

Third, establish critical limits at each CCP. A limit separates acceptable from unacceptable control at that point. It must be based on reliable evidence for the food and process, not on a value copied from an unrelated recipe. This guide intentionally does not prescribe one cooking or chilling number for every product. Check current FSA guidance, product requirements and competent process validation.

Fourth, establish monitoring procedures. Decide what is measured or observed, by whom, how often and with what instrument. A limit without a practical way to monitor it cannot drive action. Make the monitoring frequency fit the risk and the pace of production.

Fifth, establish corrective action when monitoring shows a CCP is not under control. The response may include isolating affected food, fixing equipment, changing a process, retraining or seeking specialist advice. State who decides what happens to food already made. A completed log is not enough if a failed reading is ignored.

Sixth, establish verification procedures to confirm the HACCP approach works. This can involve record review, observation, equipment checks, investigation of complaints or other suitable methods. Verification asks whether the system is effective, while monitoring checks an individual control during operations. The two should not be confused.

Seventh, establish documents and records appropriate to the nature and size of the business. Article 5 uses proportionality. A small business still needs enough evidence to show what it does and that it works. A large or technically complex operation may need more detailed hazard analysis and validation. Records should be legible, current and available when an inspector or manager needs them.

Build from the real process

Start by describing products, intended customers, ingredients, packaging and how food is used. Map each process step. Walk the route rather than relying on an old flowchart. Include deliveries, temporary storage, rework, cleaning, waste, allergens, maintenance and transport where relevant. Confirm the flow with people who perform the work.

Identify the hazards at each step and the preventive controls already in place. Consider supplier approval, separation of raw and ready-to-eat food, cleaning, temperature control, safe water, pest prevention, staff illness and allergen communication. Decide which controls are routine prerequisites and which require a critical point. Record the reasoning so a later manager can understand why a CCP exists or why one was not selected.

Set the limits and monitoring method for each CCP. Make it possible for staff to respond during the process, not after food has left the premises. Calibrate or check measuring equipment as appropriate. Train workers in what a failed result means and what action they are allowed to take. If a manager must decide whether to discard a batch, make that person reachable when production occurs.

Keep the system proportionate and current

The FSA's SFBB packs help many smaller operations in England and Wales document safe methods, diary checks and review. Other jurisdictions and sectors may use different official resources. The pack must be adapted to what the business actually does. A pack left blank or completed generically is not a working food-safety system.

Review when the menu, ingredient, supplier, process, premises, equipment, packaging, distribution or vulnerable customer group changes. A new allergen-containing ingredient can affect cross-contact controls and communication. A longer shelf life may change the evidence needed for a process. An equipment failure may reveal that monitoring or corrective action was inadequate. Check whether the underlying hazard analysis still fits, rather than changing only the page date.

Invite staff feedback. They may know that a probe is unavailable on the evening shift or that delivery temperatures are not checked when the site is busy. A good procedure can be followed during normal operations. If it cannot, redesign the workflow or controls. Enforcement and inspection focus on actual implementation, not merely a polished binder.

Example: a small sandwich business

A sandwich shop receives chilled ready-to-eat ingredients, prepares food and displays it for sale. It maps receipt, storage, preparation, display and disposal. It identifies risks from unsuitable temperature, cross-contamination, allergens and staff illness. It uses suitable prerequisite hygiene controls and decides where monitoring is essential for its process. It records what staff will do when a delivery is too warm or a display unit fails, and it reviews the system when a new ingredient or preparation method is introduced.

The example shows the method. It does not prescribe the correct critical limits or CCPs for every sandwich business. Those decisions depend on the actual products, process and current food-safety evidence.

Use the existing food hygiene checker as a prompt for questions, and evaluate Complys food safety compliance software if comparing ways to organise records and actions. Ask the product team to demonstrate current functionality.