How to Write a HACCP Plan for a Small UK Food Business

1. What is HACCP and why does it matter?

Foundation

HACCP stands for Hazard Analysis and Critical Control Points. It is a structured, proactive food safety management system that identifies potential hazards in your food production process and puts specific controls in place to prevent those hazards from causing harm. Rather than waiting for something to go wrong and reacting, HACCP asks you to think through your process systematically — from the raw ingredients that arrive at your door to the finished product that reaches the customer — and to identify at which exact steps something dangerous could happen.

The system was originally developed in the 1960s by NASA and Pillsbury to ensure the safety of food for the US space programme. By the 1990s it had been adopted internationally as the gold standard for food safety management. In the UK it was embedded in food hygiene law through EC Regulation 852/2004, which came into force in 2006 and has been retained in UK law following Brexit.

The reason HACCP matters is straightforward: foodborne illness is serious, and it is preventable. The Food Standards Agency estimates there are around 2.4 million cases of foodborne illness in the UK every year. Many of those cases could be prevented by proper cooking temperatures, correct storage, adequate cleaning, and good supplier practices — precisely the things HACCP is designed to ensure. A well-written HACCP plan is not a bureaucratic exercise. It is the document that proves you have thought carefully about the safety of your food and that you have controls in place to back that thinking up.

For small food businesses, the practical benefit is equally direct. When an Environmental Health Officer (EHO) visits your premises — and they will, especially after a complaint or a routine inspection — your HACCP plan and supporting records are the primary evidence that you are running a safe operation. A business with a clear, completed HACCP plan and well-kept monitoring records will almost always come away with a better food hygiene rating than one that is doing broadly the right things but has nothing written down.

2. Do small food businesses need a HACCP plan?

Legal requirement

The regulation is clear: if you produce, prepare, process, store, distribute or sell food, you are a food business operator and you must have a food safety management system based on HACCP principles. The law does, however, acknowledge that a proportionate approach is appropriate. For small businesses — particularly those in the catering and retail sectors — the Food Standards Agency has developed the Safer Food Better Business (SFBB) pack, which is accepted by EHOs across England, Wales and Northern Ireland as a simplified, proportionate HACCP system. Scotland has an equivalent called CookSafe.

What is Safer Food Better Business?

Safer Food Better Business is a free pack produced by the Food Standards Agency specifically for small catering businesses. It covers the key food safety issues — cross-contamination, cleaning, chilling, cooking and management — in a plain-language, practical format. The pack includes a daily diary for recording your checks, safe methods for common food processes, and guidance on what to do when things go wrong. If you complete it fully, keep it up to date and maintain the daily diary, it satisfies your legal obligation under Article 5.

You can download SFBB free from the Food Standards Agency website. It is available in versions tailored to different types of food business — catering, retail, childminders and others. For the vast majority of small food businesses — a home bakery, a small café, a mobile catering unit — the SFBB catering pack is the simplest and most practical route to compliance.

That said, many small food businesses benefit from writing a more structured HACCP plan, particularly those producing higher-risk products, operating in commercial kitchens, supplying wholesale, or seeking food safety accreditation. The rest of this guide walks through the full seven-principle approach, which can be applied at any scale.

3. The 7 HACCP principles explained

Core framework

HACCP is built on seven principles, each building on the previous. They are not optional steps you can pick and choose from — all seven must be addressed for a HACCP plan to be complete. Here is a clear, practical explanation of what each one means for a small food business.

#	Principle	What it means in practice
1	Hazard analysis	Identify all biological, chemical and physical hazards that could occur at each step of your process. For each hazard, assess the likelihood and severity of harm if the hazard is not controlled.
2	Identify CCPs	Identify the steps in your process where a control measure can be applied and where that control is essential to prevent, eliminate or reduce a food safety hazard to an acceptable level. These are your Critical Control Points.
3	Set critical limits	For each CCP, establish the measurable limits that must be met for the control to be effective. For cooking, this is typically a minimum core temperature. For chilled storage, it is a maximum storage temperature. Limits must be specific and measurable.
4	Establish monitoring procedures	Define how, when and by whom each CCP will be monitored. Monitoring must be regular enough to detect a loss of control before it leads to an unsafe product reaching the customer.
5	Establish corrective actions	Define in advance what action will be taken if a critical limit is breached — for example, if a product does not reach the required cooking temperature, what happens to that batch? Corrective actions must address both the immediate problem and any product that may have been affected.
6	Verification	Establish procedures to confirm that the HACCP system is working effectively. This includes reviewing records, calibrating thermometers, and periodically checking that the process still matches the flow diagram.
7	Documentation and record-keeping	Maintain written documentation of the entire HACCP plan and keep records that demonstrate monitoring, corrective actions and verification activities have been carried out. Records are your proof of due diligence.

"A HACCP plan that isn't written down is just a good intention."

Step 1: Assemble your HACCP team and describe your product

Getting started

Before you analyse a single hazard, you need two things: the right people involved in the process, and a clear description of what you are making and how it will be used.

The HACCP team

In a large food factory, the HACCP team might be a group of 10 specialists spanning food science, engineering, quality assurance and production management. For a small food business, the "team" might be just you. That is perfectly acceptable. The principle behind assembling a team is simply that you should draw on all relevant knowledge about the product and process. If you have a second member of staff, involve them — they may know things about the day-to-day process that you don't. If you are a sole trader, it is still worth consulting with your food hygiene certificate training materials, the SFBB guidance, and where needed a food safety consultant or your local EHO's advisory service.

Document who has been involved in preparing the HACCP plan, their roles, and their relevant knowledge or qualifications. Even if that is just you, write it down.

Product description

Write a clear, specific description of each product you produce. This should include:

• What it is: name, composition, key ingredients.
• How it is made: a brief summary of the production method.
• How it is packaged: wrapped, boxed, loose, sealed.
• Storage conditions: ambient, chilled, frozen.
• Shelf life: use-by or best-before date and how it is determined.
• Intended consumers: the general public, or a specific group? Are vulnerable groups (children, elderly, immunocompromised) likely to eat it?
• Intended use: consumed directly without further cooking, or does the customer reheat it?

The intended consumer and intended use questions matter more than they might seem. A sausage roll sold at a café and eaten immediately has a different risk profile to a ready-to-eat salad sold to a care home kitchen, even if both products go through broadly similar production steps. Knowing your customer helps you calibrate how conservative your critical limits need to be.

Step 2: Create a process flow diagram

Map your process

A process flow diagram is a simple, step-by-step map of everything that happens to your product from raw ingredient delivery to the point it reaches the customer. It does not need to be a professional diagram — a hand-drawn list of numbered steps is completely acceptable. What matters is that it is accurate and complete.

The flow diagram is the backbone of your entire HACCP plan. Every subsequent step — hazard analysis, CCP identification, critical limits — is done against each step in this diagram. If a step is missing, any hazards that occur at that step will also be missed.

Typical process flow for a small bakery

To make this concrete, here is a representative process flow for a small bakery producing baked goods for direct sale:

1. Supplier selection and raw material delivery — ingredients arrive from suppliers
2. Goods-in inspection — check packaging integrity, dates, temperature (for chilled deliveries)
3. Raw material storage — dry goods in sealed containers, chilled items in refrigerator, frozen items in freezer
4. Weighing and preparation — ingredients measured, eggs cracked, butter softened
5. Mixing — batter or dough prepared
6. Pre-bake preparation — portioning, panning, lining
7. Baking / cooking — oven process at specified temperature and time
8. Cooling — product cooled on wire racks or in a cool area
9. Finishing / decoration — icing, glazing, garnishing
10. Portioning and wrapping — cutting to portions, wrapping in film, placing in boxes
11. Labelling — PPDS labels applied
12. Storage of finished product — ambient or chilled as appropriate
13. Sale / distribution — to customer directly, via market stall, or dispatch

Once you have drafted your flow diagram, verify it. Walk through your actual production process step by step and check that the diagram matches reality. This is called an on-site confirmation. If you find steps that are missing or that happen in a different order, update the diagram before proceeding.

Step 3: Hazard analysis — identify the dangers at each step

Hazard Analysis

Now comes the core intellectual work of HACCP. For each step in your process flow diagram, you must ask: what could go wrong here that would make the food unsafe? Hazards fall into three categories: biological, chemical and physical.

Biological hazards

Biological hazards are living organisms — primarily bacteria, but also viruses and parasites — that can cause illness. For most small food businesses, bacterial contamination is the primary biological concern. Key pathogens to be aware of in a UK food business context include Salmonella (most commonly associated with raw eggs and poultry), Listeria monocytogenes (associated with ready-to-eat foods, particularly chilled products), E. coli O157 (associated with raw meat and cross-contamination), and Staphylococcus aureus (associated with poor hand hygiene and handling of food after cooking).

Bacterial hazards can enter your product through contaminated raw ingredients, contaminated surfaces and equipment, contaminated hands, contaminated water, or from pests. They can then multiply if food is held at the wrong temperature, or be destroyed by adequate cooking.

Chemical hazards

Chemical hazards in a small food business context include:

• Cleaning chemical residues — inadequately rinsed surfaces or equipment leaving traces of detergent or sanitiser on food contact surfaces.
• Pesticide residues — in fruit, vegetables or grains, particularly if sourcing from non-approved suppliers.
• Allergens — the cross-contamination of food with one of the 14 major allergens, or the failure to declare an allergen present in a recipe, causing a serious or fatal reaction in an allergic consumer. For food businesses in the UK, allergens are treated as a chemical hazard within the HACCP framework.
• Veterinary drug residues — primarily relevant if using raw dairy or meat.
• Food fraud / adulteration — mislabelled or substituted ingredients from unverified suppliers.

Physical hazards

Physical hazards are foreign objects that could cause injury or illness if present in food. Common physical hazards in a small food business include:

• Glass — from broken containers, light fittings, glasses or measuring vessels.
• Metal fragments — from worn or damaged equipment, mixer blades, baking tins.
• Bone — relevant if using bone-in meat or poultry.
• Plastic — from packaging, bags or equipment.
• Wood — from wooden utensils or chopping boards.
• Pest contamination — droppings, hair, insect parts.
• Personal items — jewellery, plasters (use blue detectable plasters), pen lids.

Documenting your hazard analysis

For each step in the flow diagram, list the potential hazards (biological, chemical, physical), assess the likelihood and severity of each hazard, and note whether a control measure exists at that step. This does not need to be a complex scoring exercise — a simple table with columns for Step, Hazard Type, Hazard Description, Likelihood (high/medium/low), Severity (high/medium/low), and Control Measure is sufficient for most small businesses.

Step 4: Identify Critical Control Points (CCPs)

CCPs

Not every step in your process that has an associated hazard is a Critical Control Point. A CCP is specifically a step where a control measure can be applied, and where that control is essential to prevent, eliminate or reduce the hazard to an acceptable level. The key word is "essential" — if the hazard could be controlled at a later step, or if it is already being controlled by a prerequisite programme, the step is not a CCP.

CCPs vs prerequisite programmes

This distinction confuses many small food businesses. A prerequisite programme (PRP) is a foundational good-practice control that reduces food safety hazards generally — things like cleaning and disinfection schedules, pest control, personal hygiene requirements, staff training, and supplier approval processes. PRPs are essential and legally required, but they are not CCPs. They create the hygienic environment in which HACCP operates.

A Critical Control Point is a process step where a specific, measurable control is applied to a specific, identified hazard, and where failure of that control would directly result in an unacceptable food safety risk. The most common CCP for a small food business — and often the only one — is the cooking step, where sufficient heat is applied to destroy pathogenic bacteria.

For a small bakery producing ambient-stable baked goods, the most likely CCPs are:

• Cooking / baking — the oven step where pathogens are destroyed by heat. This is almost always a CCP for any business that bakes or cooks food.
• Chilled storage of high-risk products — if any product contains or is topped with fresh cream, custard, mascarpone or other high-risk ingredients, the chilling step may also be a CCP.

Cleaning, personal hygiene, pest control and allergen management are typically controlled through prerequisite programmes, not CCPs, because they reduce the general level of risk across the whole process rather than controlling a specific hazard at a specific step.

Step 5: Set critical limits

Temperature & limits

For each CCP, you must define the critical limit — the measurable threshold that separates safe from unsafe. Critical limits must be specific, measurable and based on scientific evidence or recognised guidance. They are not targets or guidelines; they are the line that must not be crossed.

The UK Food Standards Agency and food safety legislation provide clear, scientifically validated critical limits for the most common food safety controls. Every small food business should know these numbers by heart.

Control measure	Critical limit	Notes
Cooking (core temperature)	≥ 75°C at the centre	The standard UK limit for most cooked foods. Scotland requires ≥ 82°C. An alternative is 70°C held for at least 2 minutes — equivalent lethality.
Reheating	≥ 75°C at the centre	Same limit as initial cooking. Applies every time food is reheated — a product must hit 75°C on each reheating occasion.
Hot holding	≥ 63°C	Food kept hot for service must not drop below 63°C. The 2-hour rule applies: hot food served below 63°C must be consumed within 2 hours or discarded.
Chilled storage	< 5°C	Fridges and chilled display units should be set to maintain below 5°C. Some high-risk products require ≤ 3°C or ≤ 2°C — check product-specific guidance.
Cooling after cooking	From 63°C to below 8°C within 90 minutes	Food must not be left to cool slowly at room temperature. Use blast chillers, shallow containers or ice baths to achieve the 90-minute target.
Frozen storage	≤ −18°C	Freezers must maintain −18°C or colder. Defrosting must be done under refrigeration, not at room temperature.

These limits should be written clearly in your HACCP plan against the relevant CCPs. They should also be physically visible in the appropriate areas of your kitchen — a laminated temperature reference card inside the oven door, fridge temperature targets on the fridge, and so on.

Step 6: Monitoring, corrective actions and verification

Ongoing control

Identifying CCPs and setting critical limits is only half the job. The HACCP system only works if you actually monitor those limits every time, and if you have pre-planned responses ready for when a limit is breached.

Monitoring procedures

For each CCP, your HACCP plan must specify:

• What is being monitored — the specific measurement (core temperature, fridge temperature, etc.)
• How it is monitored — the instrument used (calibrated probe thermometer, fridge thermometer, data logger)
• When it is monitored — the frequency (every batch, every 2 hours, once per day at the same time)
• Who monitors it — by name or role
• Where the result is recorded — the specific record sheet or system

Monitoring must be frequent enough to give you confidence that the CCP is under control between checks. For a cooking CCP in a bakery, monitoring every batch is appropriate. For chilled storage, monitoring twice daily (morning and close of day) is the minimum; a continuous data logger is even better.

Corrective actions

Every CCP must have a documented corrective action — the step you take if the critical limit is not met. Corrective actions must address two things: what happens to the product that has been compromised, and what action is taken to prevent the problem recurring.

For a cooking CCP: if a core temperature check shows the product has not reached 75°C, the corrective action is to return it to the oven for further cooking, re-check the temperature, and only release the product once the limit is confirmed. The product must not leave the kitchen until the limit has been reached. If the product cannot be brought to the required temperature — for example because it has been out of the oven too long — it must be discarded.

For a chilled storage CCP: if a fridge is found to be above 5°C, the corrective action is to check all products stored in it, separate out any high-risk products that have been above temperature for more than 4 hours (and discard them), investigate the cause (door left open, fridge overloaded, thermostat failure), repair or replace the fridge, and restore correct temperatures before restocking.

Verification

Verification is the process of confirming that your HACCP system is actually doing what it is supposed to do. It is different from monitoring: monitoring checks that a specific CCP is under control right now, whereas verification checks that the whole system is functioning correctly over time.

Verification activities for a small food business include:

• Reviewing monitoring records — do the records show consistent compliance? Are there any unexplained gaps?
• Calibrating thermometers — check probe accuracy in ice water (should read 0°C) at least monthly, or after any drop or impact.
• Reviewing corrective action records — are corrective actions being triggered appropriately, resolved and recorded?
• Reviewing the process flow diagram — has anything changed in your production process that is not reflected in the HACCP plan?
• Reviewing supplier approvals — are your approved suppliers still meeting your standards?
• Checking that staff training is current — does everyone who operates a CCP understand what they are doing and why?

For a small food business, a quarterly review of the full HACCP plan — checking all of the above — is usually sufficient. Always review the plan when you introduce a new product, change a process, move premises, or experience a food safety incident.

"Monitoring tells you the system is working today. Verification tells you it's been working all along."

Step 7: Documentation and record-keeping

Documentation

The seventh principle is often the one that small food businesses find most burdensome — and the one that matters most when an EHO knocks on the door. Without records, you have no evidence that any of the other six principles have been implemented. With well-kept records, you can demonstrate due diligence even if something has gone wrong.

What records do you need to keep?

Your documentation system should include two categories: the HACCP plan itself (a standing document describing your system) and the monitoring records generated by your day-to-day operations.

The HACCP plan document should contain:

• Product descriptions for all products made
• The process flow diagram, confirmed on-site
• The hazard analysis — step by step, hazard by hazard
• The list of CCPs with critical limits for each
• Monitoring procedures for each CCP
• Corrective action procedures for each CCP
• Verification procedures and schedule
• A review history showing when the plan was last updated and why

The operational records generated daily should include:

• Temperature monitoring logs — cooking temperatures, fridge/freezer temperatures, delivery temperatures
• Corrective action records — one for each incident where a limit was not met
• Cleaning records — completed cleaning schedule with sign-off
• Supplier delivery records and goods-in checks
• Allergen management records — batch records showing which allergen-containing ingredients were used
• Staff training records — who has been trained, in what, and when
• If using SFBB: the completed daily diary pages

How long do you need to keep records?

The Safer Food Better Business guidance recommends keeping completed diary pages and monitoring records for a minimum of three months. However, for businesses producing higher-risk products — anything chilled, anything involving meat or dairy — a retention period of two years is more prudent, as this covers the statute of limitations for most food safety prosecutions. As a practical minimum, never discard records less than three months old. If you have the storage space (and a digital system makes this essentially free), keep two years as standard.

Common HACCP mistakes small food businesses make

Avoid these

Having reviewed hundreds of small business HACCP plans, the same mistakes appear over and over. Avoiding them is straightforward once you know what to look for.

A note on FoodCore's HACCP Plans module

FoodCore feature

If you're running a UK food business and want to manage your HACCP documentation digitally, FoodCore's Food Safety module includes a dedicated HACCP Plans section. It lets you build and maintain your HACCP plan within the platform — creating process steps, recording hazard assessments, defining Critical Control Points, and logging monitoring records against each CCP. The structure is designed around UK food safety law requirements, so the plan you build follows the seven-principle framework described in this guide.

The HACCP Plans section is part of a broader Food Safety module that also covers Daily Due Diligence checks (with a calendar view showing completion status across the month — green for complete, amber for partial, red for flagged), a Monitoring Records log for ongoing temperature checks and cleaning records outside of the daily due diligence sessions, and a Corrective Actions register where each incident is documented with the product affected, batch code, quantity, action taken, root cause, preventive measure, product disposition and resolution status.

Prerequisite programmes — pest control, allergen management, cleaning schedules, supplier approval and staff training — are managed in a dedicated PRPs section. The full module can be exported as a PDF report for a chosen date range, giving you a print-ready document suitable for an EHO inspection. Temperature thresholds for your specific fridges, freezers and process steps are configured in Settings and are then used automatically across HACCP records and monitoring logs.

The result is that your HACCP documentation, daily checks and corrective actions all live in one place, with no risk of paperwork being mislaid, and a clear export ready whenever an inspection is due.

Frequently asked questions

Do small food businesses in the UK legally need a HACCP plan?

Yes. EC Regulation 852/2004 Article 5, retained in UK law, requires all food business operators to put in place, implement and maintain a food safety management system based on HACCP principles. This applies to every food business regardless of size — including home bakers, market traders, small caterers and cottage food producers. Small businesses can use the Safer Food Better Business (SFBB) pack as an accepted simplified HACCP system.

What is the difference between a CCP and a prerequisite programme?

A Critical Control Point (CCP) is a specific step in your process where a control measure can be applied and is essential to prevent, eliminate or reduce a food safety hazard to an acceptable level. A prerequisite programme (PRP) is a foundational good-practice measure — such as pest control, cleaning, personal hygiene or supplier approval — that reduces hazards generally but does not control a specific identified hazard at a specific process step. Most small food businesses have one to three CCPs; everything else is managed through PRPs.

What are the critical temperature limits in a HACCP plan?

Standard UK critical limits are: cook to a core temperature of at least 75°C (or 70°C for 2 minutes — equivalent lethality), hold hot food at 63°C or above, chill food to below 5°C, cool cooked food from 63°C to below 8°C within 90 minutes, and freeze at −18°C or below. These limits are set by UK food hygiene law and FSA guidance.

Can I use Safer Food Better Business instead of writing a full HACCP plan?

Yes. The Food Standards Agency's Safer Food Better Business (SFBB) pack is accepted by Environmental Health Officers across England, Wales and Northern Ireland as a simplified, proportionate HACCP system for small catering businesses. Scotland has an equivalent called CookSafe. Complete the pack fully, keep the daily diary and maintain records for at least three months, and it satisfies the legal requirement under Article 5 of EC 852/2004.

How long do I need to keep HACCP records?

The SFBB guidance recommends keeping completed diary pages and monitoring records for a minimum of three months. For businesses producing higher-risk products, two years is more prudent, as this covers the statute of limitations for most food safety prosecutions. As a practical rule: never discard records less than three months old. Digital records make long-term retention essentially cost-free.

What are biological, chemical and physical hazards in a HACCP plan?

Biological hazards include bacteria (Salmonella, Listeria, E. coli), viruses and parasites that can cause foodborne illness. Chemical hazards include cleaning product residues, pesticide residues and allergens — allergen cross-contamination is treated as a chemical hazard within the UK HACCP framework. Physical hazards are foreign objects that could cause injury, such as glass, metal fragments, bone, plastic or packaging material.

How many CCPs does a small food business typically have?

Most small food businesses have one to three CCPs. A common example for a small bakery is the cooking step — ensuring baked products reach a safe core temperature. Businesses producing chilled ready-to-eat products may have a second CCP for chilled storage. Fewer CCPs with well-managed prerequisite programmes is often a sign of a well-designed, proportionate HACCP plan.

What happens if an EHO inspects and I have no HACCP plan?

Operating without a food safety management system based on HACCP principles is a legal breach of Regulation 852/2004. An EHO can issue a Hygiene Improvement Notice requiring you to implement one within a specified period. Continued non-compliance can result in a Hygiene Emergency Prohibition Notice, prosecution and fines, and a poor food hygiene rating displayed publicly on the FSA website. Not having a HACCP plan is also one of the primary reasons a business scores a 0, 1 or 2 on the food hygiene rating scale.