What is HACCP? A Complete Guide for UK Food Businesses

If you run a food business in the United Kingdom, you are legally required to have food safety procedures based on HACCP principles. Yet many operators treat HACCP as a box-ticking exercise — a folder of laminated sheets that gathers dust behind the till. That approach puts your Food Hygiene Rating Scheme (FHRS) score, your reputation, and ultimately your customers at risk.

This guide explains what HACCP is, where it comes from, how it connects to the regulations Environmental Health Officers (EHOs) enforce, and — most importantly — how to build a plan that actually works in a busy UK kitchen.

What Does HACCP Stand For?

HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic, preventive approach to food safety that identifies physical, chemical, biological, and allergenic hazards at every stage of food production — then puts controls in place to reduce those hazards to acceptable levels.

A brief history

The HACCP concept was developed in the 1960s by the Pillsbury Company in partnership with NASA and the US Army Natick Laboratories. The goal was to produce safe food for space missions, where a case of food poisoning could be catastrophic. Rather than relying on end-product testing (which can only ever sample a fraction of output), the team designed a process-based system that prevented hazards from occurring in the first place.

In 1993, the Codex Alimentarius Commission — a joint body of the World Health Organisation and the Food and Agriculture Organisation of the United Nations — adopted HACCP as the international standard for food safety management. That Codex framework remains the foundation of food safety legislation worldwide.

HACCP in UK law

Within the United Kingdom, the requirement to implement HACCP-based procedures comes from Regulation (EC) No 852/2004 on the hygiene of foodstuffs, which was retained in domestic law after Brexit. Article 5 of that regulation states that food business operators must put in place, implement, and maintain a permanent procedure based on HACCP principles.

This obligation sits alongside the Food Safety Act 1990, which provides the overarching legal framework, and is enforced by local authorities through their Environmental Health teams. In practical terms, every food business — from a street-food trailer to a hotel restaurant — must demonstrate HACCP-based procedures when an EHO visits.

Why HACCP Matters for UK Food Businesses

Beyond the legal requirement, there are concrete commercial reasons to take HACCP seriously.

Your FHRS score depends on it

The Food Hygiene Rating Scheme, operated by the Food Standards Agency (FSA) in partnership with local authorities, assesses businesses on three criteria:

Hygienic food handling — preparation, cooking, reheating, cooling, and storage
Condition of the structure — cleanliness, layout, lighting, ventilation
Confidence in management — HACCP-based procedures, staff training, record-keeping

That third criterion — Confidence in Management — is where your documented HACCP plan (or lack of one) has a direct impact. A well-implemented, regularly reviewed plan signals to the inspecting officer that you understand and control the risks in your operation. A generic, outdated, or absent plan will drag your score down, potentially to a 2 or below.

Legal and financial consequences

Failing to comply with food safety regulations can result in:

Improvement notices requiring corrective action within a set timeframe
Hygiene emergency prohibition notices that force immediate closure
Prosecution under the Food Safety Act 1990, carrying unlimited fines and up to two years’ imprisonment
Civil liability if a customer suffers illness traced back to your premises

Customer trust

In an era when FHRS scores are visible on delivery apps, review platforms, and — in Wales and Northern Ireland — legally required to be displayed at premises, a low score is a visible signal to customers. Maintaining strong HACCP procedures protects not just health but revenue.

The 7 Principles of HACCP

The Codex Alimentarius framework defines seven principles. Below is each principle with a practical example relevant to a UK kitchen environment.

Principle 1: Conduct a hazard analysis

Examine every step in your food operation — from receiving deliveries to serving the customer — and identify what could go wrong. For each step, list the potential biological, chemical, physical, and allergenic hazards.

UK kitchen example: When receiving a chilled delivery of raw chicken, hazards include biological contamination (Campylobacter, Salmonella) if the product is above 8°C on arrival, and cross-contamination if it is stored alongside ready-to-eat foods.

Principle 2: Determine the Critical Control Points (CCPs)

A CCP is a step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. Not every step is a CCP — only those where loss of control would result in an unacceptable risk.

UK kitchen example: The cooking stage for chicken is a CCP. If the core temperature does not reach 75°C (or an equivalent time-temperature combination), harmful bacteria may survive.

Principle 3: Establish critical limits

For each CCP, set a measurable boundary that separates acceptable from unacceptable. Critical limits should be based on scientific evidence, regulatory guidance, or industry best practice.

UK kitchen example: Core cooking temperature of 75°C for poultry. Chilled storage at 8°C or below (the legal maximum in England, Wales, and Northern Ireland), though best practice is 5°C or below.

Principle 4: Establish monitoring procedures

Define how you will check that each CCP remains within its critical limits, who will do the checking, and how often.

UK kitchen example: Using a calibrated probe thermometer to check the core temperature of the thickest part of a chicken breast at the end of cooking. Recording the reading, the time, and the initials of the person who took it.

Principle 5: Establish corrective actions

Decide in advance what you will do if monitoring reveals that a CCP has breached its critical limit.

UK kitchen example: If a probe reading shows a chicken breast has only reached 68°C, the corrective action is to continue cooking until 75°C is achieved, then re-probe. If food has been held in the temperature danger zone (8°C–63°C) for more than four hours, it must be disposed of.

Principle 6: Establish verification procedures

Verification confirms that the entire HACCP system is working as intended. This goes beyond day-to-day monitoring — it includes periodic reviews, audits, calibration checks, and testing.

UK kitchen example: Monthly calibration of probe thermometers using an ice slurry (should read 0°C +/- 1°C). Quarterly review of HACCP records to check for patterns, such as repeated corrective actions at the same CCP.

Principle 7: Establish documentation and record-keeping

Maintain written records that demonstrate your HACCP system is in place and functioning. These records are what an EHO will ask to see during an inspection.

UK kitchen example: Daily temperature logs for fridges and freezers, cooking temperature records, cleaning schedules, supplier delivery records, and staff training logs. Records should be kept for a minimum of 12 months, though many local authorities recommend longer retention.

How to Write a HACCP Plan Step by Step

Before you apply the seven principles, Codex Alimentarius specifies a series of preliminary steps. These are sometimes called the “five preliminary steps” or “six preliminary tasks,” depending on the source. Here is the full sequence.

Step 1: Assemble your HACCP team

Identify the people responsible for developing and maintaining the plan. In a small operation, this might be the owner-operator and the head chef. In a larger business, it could include representatives from the kitchen, front-of-house, procurement, and cleaning teams. The key requirement is that the team collectively understands the operation from end to end.

Step 2: Describe the product

For each product or product group you handle, document what it is, its ingredients, how it is processed, how it is packaged, its storage conditions, and its shelf life. This forces you to think carefully about the characteristics that affect safety.

Step 3: Identify the intended use

Who is the end consumer? This matters because some groups — young children, elderly people, pregnant women, immunocompromised individuals — are more vulnerable to foodborne illness. If your business serves a care home or a nursery, your critical limits and controls may need to be more stringent.

Step 4: Construct a flow diagram

Map out every step in your process, from receiving raw materials through storage, preparation, cooking, cooling, reheating, holding, and serving. Include steps that are easy to overlook, such as defrosting, portioning, and transporting food between sites.

Step 5: On-site verification of the flow diagram

Walk through your premises with the flow diagram in hand and confirm that it accurately reflects what actually happens. Processes often drift from what was originally documented — a step may have been added, removed, or changed. The flow diagram must match reality.

Step 6: List all potential hazards, conduct a hazard analysis, and determine control measures

This is where the preliminary work connects to Principle 1. For every step in your flow diagram, brainstorm the hazards, assess their likelihood and severity, and decide on the control measures. Then proceed through Principles 2–7 to complete the plan.

A thorough hazard analysis is the foundation of the entire system. If you need a deeper treatment of this topic, see our guide on identifying risks through hazard analysis.

HACCP and SFBB — How They Connect

If you run a smaller food business, you may have encountered Safer Food, Better Business (SFBB) — a food safety management system developed by the Food Standards Agency specifically for small and micro businesses such as restaurants, cafes, and takeaways.

SFBB is not an alternative to HACCP. It is a simplified, HACCP-based system. The FSA designed it so that businesses without formal food science training could still meet the legal requirement under EC 852/2004. SFBB uses plain language, photographs, and a diary-based approach to guide operators through the same principles — identifying hazards, controlling risks, and keeping records.

For many small businesses, SFBB is entirely sufficient. However, there are situations where a full, bespoke HACCP plan is more appropriate:

Your operation involves complex processes (sous vide, smoking, fermentation)
You manufacture or process food for wholesale distribution
You serve high-risk populations (hospitals, care homes, nurseries)
Your business has grown beyond the scope that SFBB was designed for
A third-party auditor or supply-chain partner requires a formal HACCP plan

If you are currently using SFBB and want to understand it more thoroughly, our SFBB guide covers the pack structure, the diary system, and how EHOs assess it during inspections.

The 4 Types of Food Safety Hazards

Your hazard analysis must consider four categories of hazard. Missing any one of them leaves a gap in your HACCP plan.

1. Biological hazards

These are the most common cause of foodborne illness. They include:

Bacteria — Campylobacter (the most common cause of food poisoning in the UK), Salmonella, E. coli O157, Listeria monocytogenes, Clostridium perfringens
Viruses — Norovirus, Hepatitis A
Parasites — Cryptosporidium, Toxoplasma
Moulds and yeasts — particularly in stored grains, nuts, and dairy

Control measures include proper cooking temperatures, effective chilling, avoiding cross-contamination between raw and ready-to-eat foods, and good personal hygiene.

2. Chemical hazards

Chemical contamination can occur through:

Cleaning chemicals stored near food or used incorrectly
Pesticide residues on fruit and vegetables
Allergens introduced through shared equipment or poor labelling
Naturally occurring toxins such as mycotoxins in cereals or histamine in fish
Migration of chemicals from food-contact materials (packaging, containers)

Control measures include proper chemical storage, clear labelling, COSHH compliance, and verified supplier assurance schemes.

3. Physical hazards

Physical contaminants are foreign objects that can cause injury or choking. Common examples include:

Glass fragments from broken light fittings or containers
Metal shards from worn equipment or wire scourers
Plastic pieces from packaging
Hair, plasters, or jewellery from staff
Stones, insects, or bone fragments from raw ingredients

Control measures include equipment maintenance programmes, pest control, staff uniform policies, and visual inspections of incoming goods.

4. Allergenic hazards

Since October 2021, Natasha’s Law (the UK Food Information Amendment) requires food businesses that produce prepacked for direct sale (PPDS) food to include full ingredient lists with the 14 declarable allergens emphasised on the label. The 14 allergens are:

Celery
Cereals containing gluten
Crustaceans
Eggs
Fish
Lupin
Milk
Molluscs
Mustard
Nuts
Peanuts
Sesame
Soya
Sulphur dioxide and sulphites (at concentrations above 10mg/kg)

Even if your business does not produce PPDS food, you are still legally required to provide allergen information to customers. Your HACCP plan must include controls for allergen management — from supplier specifications and recipe management through to communication at the point of sale.

Common HACCP Mistakes UK Businesses Make

From working with food businesses, certain patterns of failure appear again and again. Avoiding these will put you ahead of the majority.

Using a generic, off-the-shelf plan

A HACCP plan downloaded from the internet or purchased as a template is not your HACCP plan. It does not reflect your menu, your kitchen layout, your equipment, your suppliers, or your processes. EHOs can spot a generic plan immediately, and it will undermine their confidence in your management — directly affecting your FHRS score.

Your plan must be specific to your operation. Templates can be a useful starting point, but they require thorough customisation.

No review schedule

A HACCP plan is a living document. If yours has not been reviewed since it was first written, it almost certainly no longer reflects your current operation. Menus change, suppliers change, equipment is replaced, staff turn over. Without a regular review cycle, gaps accumulate silently.

Poor staff training

A plan is only as effective as the people who implement it. If your kitchen team does not understand why they are taking temperature readings, or what to do when a reading falls outside the critical limit, the system fails at the point of execution.

Training should be ongoing, not a one-off induction item. New starters need training before they begin unsupervised work, and existing staff need periodic refreshers — particularly when processes change.

Treating HACCP as a one-off project

Some businesses invest effort in creating a HACCP plan for their opening or for a specific inspection, then let it stagnate. HACCP is a continuous system, not a project with a completion date. The monitoring, recording, verification, and review elements are ongoing responsibilities.

For a broader look at why food safety systems break down over time, see our article on why food safety systems fail.

How to Keep Your HACCP Plan Up to Date

Scheduled reviews are important, but certain events should trigger an immediate review of your HACCP plan, regardless of where you are in the review cycle.

Triggers for review

Menu changes — New dishes may introduce new hazards, new allergens, or new processes that your current plan does not cover.
New equipment — A new combi oven, blast chiller, or vacuum packer changes your process flow and may affect existing CCPs.
Supplier changes — A new supplier may have different product specifications, different packaging, or different delivery schedules.
After a food safety incident — If a customer falls ill, a product is recalled, or a near-miss occurs, your plan must be reviewed to determine whether the existing controls are adequate.
Regulatory changes — Updates to FSA guidance, changes to allergen legislation, or new local authority requirements may affect your plan.
Structural changes — Renovations, kitchen reconfigurations, or changes to workflow patterns.
Staffing changes — Particularly if key members of your HACCP team leave the business.

Practical approach to reviews

Set a minimum review frequency — quarterly is good practice for most operations. At each review:

Compare the documented plan against current operations
Check that flow diagrams still match reality
Review monitoring records for trends or recurring issues
Confirm that all staff have received appropriate training
Update any sections that no longer reflect your operation
Sign and date the review to create an audit trail

Keeping digital records can make this process significantly more manageable, particularly if your team can log checks in real time rather than transcribing paper notes at the end of a shift. Tools like Forkto are designed to handle exactly this — replacing paper-based systems with digital monitoring that keeps your HACCP records organised, timestamped, and ready for inspection.

HACCP FAQs

Is HACCP a legal requirement in the UK?

Yes. Under Regulation (EC) No 852/2004 (retained in UK law), all food business operators must implement food safety procedures based on HACCP principles. The only exemption is for primary producers (farmers and growers), who must follow general hygiene requirements but are not required to implement full HACCP-based procedures.

Do I need a HACCP plan if I use SFBB?

SFBB is a HACCP-based system, so using it correctly satisfies the legal requirement. However, SFBB is designed for smaller, simpler operations. If your business has outgrown SFBB — for example, you now operate multiple sites, carry out complex processes, or supply other businesses — you should consider developing a bespoke HACCP plan.

How often should I review my HACCP plan?

There is no legally mandated frequency, but industry best practice is to review at least annually, with many food safety professionals recommending quarterly reviews. You should also review the plan whenever a significant change occurs (new menu items, new equipment, supplier changes, after incidents).

What will an EHO look for regarding HACCP?

During an inspection, an Environmental Health Officer will typically check that:

You have a documented food safety management system based on HACCP principles
The system is specific to your business and reflects your actual operations
You are actively monitoring your CCPs and keeping records
Staff understand the system and their role within it
You have a process for reviewing and updating the plan
Corrective actions are documented when things go wrong

Can I do HACCP myself, or do I need a consultant?

There is no legal requirement to use a consultant. If you have sufficient knowledge of food safety principles and understand your operation thoroughly, you can develop and maintain your own HACCP plan. The FSA provides free resources, and SFBB is specifically designed for self-implementation. That said, complex operations — particularly those involving high-risk processes or vulnerable consumers — often benefit from specialist input.

What is the difference between HACCP and HARPC?

HACCP is the internationally recognised system used in the UK and across Europe. HARPC (Hazard Analysis and Risk-Based Preventive Controls) is a US-specific framework introduced by the FDA under the Food Safety Modernisation Act. If your business exports to the United States, you may need to understand both systems. Our comparison of HACCP and HARPC explains the key differences.

Taking the Next Step

Whether you are building your first HACCP plan or reviewing one that has been in place for years, the fundamental principle remains the same: understand the hazards in your operation, control them at the points that matter, and keep records that prove you are doing it consistently.

If your current approach relies on paper diaries and memory, consider whether a digital system would help your team stay on top of daily checks, temperature logs, and corrective actions. Forkto was built for exactly this kind of operational food safety — helping UK kitchens maintain their HACCP records without adding administrative burden.

For a broader perspective on how HACCP fits within a complete food safety management system, read our guide on food safety management systems.