How to Write a HACCP Plan: A Step-by-Step Guide for UK Food Businesses

If the phrase “write a HACCP plan” makes you picture a hundred-page scientific document, take a breath. For most UK food businesses, a HACCP plan is a practical, working record of how you keep food safe — scaled to what you actually do. It is also a legal requirement, and it is one of the first things an inspector asks to see.

This guide walks through what a HACCP plan is, why UK law requires one, the seven principles every plan is built on, and a step-by-step method for writing yours — with a worked example and the free Food Standards Agency tools that mean you rarely have to start from a blank page. For the foundational overview, see our complete guide to what HACCP is.

What is a HACCP plan?

A HACCP plan is a documented food safety management system. HACCP stands for Hazard Analysis and Critical Control Point, and the approach is preventative: instead of testing the finished food and hoping for the best, you identify where things can go wrong in your process and put a control at each of those points.

Those “things that can go wrong” fall into three types of hazard:

• Biological — bacteria, viruses and other microorganisms, such as Salmonella on raw chicken
• Chemical — cleaning chemicals, allergens, or contaminants getting into food
• Physical — foreign objects such as glass, metal or packaging fragments

The plan records the hazards you have identified, the points in your process where you control them, the limits you work to, how you check those limits are met, and what you do when they are not. Done well, it is simply a written version of how a careful kitchen already runs.

Why you legally need a HACCP plan in the UK

Having a HACCP-based system is not optional, and it is not only for large manufacturers. It applies to cafés, takeaways, butchers, pubs, schools, care homes and one-person market stalls alike.

What the law says (Regulation EC 852/2004)

Article 5 of retained Regulation (EC) No 852/2004 — assimilated into UK law after Brexit — requires every food business operator to “put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles.” The same article makes clear the system should be proportionate: it must be commensurate with the nature and size of the business. A coffee shop is not expected to produce the same documentation as a chilled-ready-meal factory.

That proportionality is the single most reassuring fact for a small operator. The law sets the principles; you scale the paperwork to your risk. For many caterers and retailers, the FSA’s Safer Food, Better Business pack — completed honestly and kept up to date — is a fully compliant food safety management system.

EHOs, the FHRS and your “Confidence in Management” score

During a routine inspection, an Environmental Health Officer (EHO) from your local authority checks both that a documented system exists and that you are actually following it. This feeds directly into the Food Hygiene Rating Scheme — and in particular the “confidence in management” element, which assesses how well you manage food safety on paper and in practice.

In practical terms, a business with no documented system will struggle to score above a 1, however spotless the premises look on the day. A clean kitchen with no records is, from an inspector’s point of view, a kitchen that cannot prove it is consistently clean.

Before you start: get your prerequisites in place

Most guides jump straight to the seven principles. In reality, HACCP only works if the basics — the “prerequisite programmes” — are already in place underneath it. These are the everyday hygiene foundations your plan assumes are happening:

• Cleaning and disinfection schedules
• Pest control arrangements
• Supplier and delivery management — buying from reputable suppliers and checking goods in
• Staff training and personal hygiene
• Maintenance of equipment, including probe thermometers

Get these working first. If your cleaning schedule is fiction or your suppliers are unknown, no amount of HACCP documentation will keep food safe.

The 7 principles of HACCP explained

Every HACCP plan, from a sandwich bar to a factory, is built on the same seven principles.

Principle 1: Conduct a hazard analysis

Work through your process and list the biological, chemical and physical hazards that could realistically occur at each step — and how significant each one is. This is the foundation of the whole plan; our guide to hazard analysis and identifying risks walks through it in detail.

Principle 2: Determine the Critical Control Points (CCPs)

A CCP is a step where control is essential to keep food safe — where a control can prevent, eliminate or reduce a hazard to an acceptable level. In catering, the classic CCPs are cooking, cooling and hot holding.

Principle 3: Establish critical limits

For each CCP, set a measurable limit that separates safe from unsafe. These are often temperatures. Common UK examples: cooked food reaching a core temperature of 75°C, hot-held food kept at 63°C or above, and chilled food stored at 8°C or below.

Principle 4: Establish monitoring procedures

Decide how you will check each CCP is within its critical limit, how often, and who does it. For cooking, that usually means probing the thickest part of the food with a clean, calibrated thermometer and recording the result.

Principle 5: Establish corrective actions

Decide in advance what happens when a limit is not met. If cooked chicken reads below 75°C, the corrective action is to keep cooking until it reaches the limit — and to record that it happened.

Principle 6: Establish verification procedures

Verification confirms the whole system is working as intended — for example, a manager reviewing the temperature logs, calibrating probes, and carrying out periodic internal checks. Structured internal audits are one of the most effective ways to verify your plan reflects what really happens at service.

Principle 7: Establish documentation and record-keeping

Document the plan itself, and keep records of your monitoring, corrective actions and verification. This is a legal requirement — and from an inspector’s perspective, the records are the only proof that everything else is being done. If it is not written down, as EHOs put it, it did not happen.

How to write your HACCP plan: a step-by-step guide

With the principles understood, here is a practical order to actually build the plan.

Step 1: Assemble your team and describe your products

Even in a small business, involve the people who know the kitchen. Briefly describe what you make and how it is served — for example, “ready-to-eat sandwiches assembled on site and chilled,” or “hot meals cooked to order.”

Step 2: Create a process flow diagram

Map every step your food takes, from delivery and storage through preparation, cooking, cooling, hot holding and service. A simple flow diagram makes the next steps far easier and stops you missing a stage.

Step 3: Identify hazards for each step (Principle 1)

Go through the flow diagram step by step and note the biological, chemical and physical hazards at each one.

Step 4: Identify your CCPs and set critical limits (Principles 2 and 3)

Pick out the steps where control is essential, and assign a measurable limit to each — such as the 75°C core cooking temperature.

Step 5: Document monitoring, corrective actions and verification (Principles 4, 5 and 6)

For each CCP, write down how it is checked, what to do if the limit is missed, and how the system is verified.

Step 6: Set up your record-keeping system (Principle 7)

Decide what records you will keep and where. The aim is records captured at the point of the task — a temperature logged when the food is probed, a fridge check signed off when it is done — not filled in retrospectively to look tidy for an inspection.

A worked example: cooking chicken for a sandwich

It helps to trace one item through all seven principles:

• Hazard (P1): raw chicken may carry Salmonella or Campylobacter — a biological hazard.
• CCP (P2): the cooking step.
• Critical limit (P3): a core temperature of 75°C.
• Monitoring (P4): probe the thickest part of each batch with a clean, calibrated thermometer and record the reading.
• Corrective action (P5): if it reads below 75°C, keep cooking until it reaches the limit; do not serve any batch you cannot verify.
• Verification (P6): the manager reviews the cooking log and calibrates the probe regularly.
• Records (P7): the temperature log, which is your evidence the control worked.

The same logic applies to chilling that cooked chicken down and holding the finished sandwiches at 8°C or below.

Free tools for UK businesses: SFBB and MyHACCP

You do not have to write a plan from scratch. The FSA provides free, practical templates:

• Safer Food, Better Business (SFBB) is a ready-made food safety management system for small caterers and retailers. Completed properly, the pack and its diary satisfy your HACCP obligation. Our SFBB guide explains how to use it well.
• MyHACCP is a free web tool that walks small manufacturers through the seven principles and helps generate a documented plan.

Both are sourced from the FSA’s wider HACCP business guidance, which is the authoritative starting point.

How often should you review your HACCP plan?

A HACCP plan is a living document. The FSA recommends reviewing it at least once a year. You should also review it whenever something significant changes — a new menu, a new supplier or ingredient, new equipment, or a change to how you prepare or serve food. A plan that describes a menu you stopped serving months ago is worse than useless at inspection.

The practical bottom line

Writing a HACCP plan is less about scientific precision and more about honest, consistent record-keeping that matches what actually happens in your kitchen. Start with your prerequisites, map your process, work through the seven principles, and lean on the free FSA tools where you can.

Whether you keep your records on an SFBB pack, a folder of printouts or a digital system, the test is always the same: do the records reflect reality, and could you prove it to an inspector tomorrow? Get that right and the plan stops being a paperwork chore — it becomes the everyday evidence that the food you serve is safe.