HACCP stands for Hazard Analysis and Critical Control Point. It is a system for finding the points in your process where something could make food unsafe, controlling those points, and keeping proof that you did. If you run a food business in the UK, having procedures based on HACCP principles is a legal requirement — not an optional standard.
It has a reputation for being bureaucratic. It does not have to be. For a small café, HACCP can be a completed Safer Food, Better Business pack and a temperature diary. For a factory it is a far bigger undertaking. The law is deliberately proportionate.
What does HACCP stand for?
HACCP stands for Hazard Analysis and Critical Control Point. It is usually pronounced “hassip”. Taken in two halves:
- Hazard Analysis — working out what could make food unsafe at each step of what you do: biological hazards (bacteria such as Salmonella or Listeria), chemical hazards (cleaning products, allergens), and physical hazards (glass, metal, packaging).
- Critical Control Point — the specific step where you can actually control that hazard, and where losing control would mean the food is unsafe. Cooking chicken to 75°C is a critical control point; wiping a surface is not.
The distinction matters: a critical control point is a step you must monitor, record and correct if it goes wrong. Everything else is a prerequisite — good practice that supports food safety without being the point of control itself.
Is HACCP a legal requirement?
Yes. Article 5 of Regulation (EC) No 852/2004, retained in UK law, requires food business operators to:
“put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles”
Three words in that sentence do a lot of work:
- “permanent” — not a document written once and filed. It has to be live.
- “implement” — a written plan nobody follows is a failure, not a defence.
- “based on the HACCP principles” — you need the principles applied, not a particular certificate or format.
Article 5 also builds in flexibility for small businesses, which is why the FSA’s simplified packs are a legitimate way to comply rather than a shortcut.
Primary production — farming, harvesting, catching — is treated separately and is not required to apply full HACCP.
Where HACCP came from
HACCP was developed in the 1960s for the US space programme, in a collaboration involving the Pillsbury Company and NASA. The problem was specific: you cannot make astronaut food safe by testing finished samples, because testing destroys the sample and you can never test everything. The answer was to control the process instead of inspecting the product.
That origin explains the whole philosophy. HACCP is preventive. It assumes end-product testing is too late.
How many HACCP principles are there? The 7 explained
| # | Principle | In plain English |
|---|---|---|
| 1 | Conduct a hazard analysis | What could go wrong, at every step? |
| 2 | Determine critical control points | Where is the last point you can actually stop it? |
| 3 | Establish critical limits | What number separates safe from unsafe? |
| 4 | Establish monitoring | Who checks it, how, and how often? |
| 5 | Establish corrective actions | What do you do when the limit is breached? |
| 6 | Establish verification | How do you know the system itself is working? |
| 7 | Establish documentation and records | How do you prove all of the above happened? |
Principle 1 — Hazard analysis
Walk your process from delivery to service and ask what could make food unsafe at each step. Hazards fall into four groups:
- Biological — bacteria, viruses, parasites
- Chemical — cleaning products, sanitiser residue, pest treatments
- Physical — glass, metal, plastic, bone, jewellery
- Allergenic — increasingly treated as a fourth category in its own right, because the controls are different
For each hazard, judge how likely it is and how serious the outcome would be. That is what tells you which ones need a critical control point.
Principle 2 — Critical control points
A CCP is a step where control is essential and where a failure cannot be corrected later. Cooking is the classic example: if chicken leaves the pass undercooked, nothing downstream fixes it.
Typical CCPs in catering: cooking, hot holding, chilling and cooling, reheating.
The most common mistake is naming too many. Handwashing, pest control and cleaning schedules matter enormously — but they are prerequisite programmes, the good practice your HACCP plan sits on top of. If everything is critical, nothing gets the attention it needs.
Principle 3 — Critical limits
A critical limit is a measurable value. “Cooked properly” is not a critical limit. “Core temperature 70 °C for two minutes” is.
Common limits in UK catering:
- Cooking: 70 °C for 2 minutes (or an equivalent time/temperature combination)
- Hot holding: 63 °C or above
- Chilled storage: 8 °C or below (legal maximum in England, Wales and NI; most operate at 5 °C)
- Freezing: −18 °C or below
- Reheating: 70 °C for 2 minutes (82 °C recommended in Scotland)
Principle 4 — Monitoring
Monitoring must be planned, not incidental: who does it, with what, how often, and where it gets written down. A probe thermometer checked against a known reference, a named person per shift, and a diary entry — that is monitoring. “The chef keeps an eye on it” is not.
Principle 5 — Corrective actions
Decide in advance what happens when a limit is breached, because nobody makes good decisions about this mid-service. Two parts to every corrective action:
- The affected food — continue cooking, reheat, discard
- The cause — fix the fridge, retrain the person, change the process
Record both. A pattern of the same corrective action is telling you the system is wrong, not the staff.
Principle 6 — Verification
Verification asks whether the system itself still works. Calibrating probes, reviewing diaries for gaps, internal audits, occasional independent testing, and re-checking the plan when you change a supplier, a menu or a piece of equipment.
Monitoring asks “is this batch safe?” Verification asks “is our whole approach still sound?”
Principle 7 — Documentation
If it is not written down, you cannot prove it happened — and proof is what an environmental health officer, an auditor or a court will want. Keep the plan itself, monitoring records, corrective actions, staff training records, and supplier and delivery checks.
Documented training is one of the cheapest and most persuasive parts of this. See food hygiene certificates.
HACCP for small businesses — the practical route
Most cafés, takeaways, pubs and small shops do not need a bespoke HACCP manual. The FSA publishes free packs that apply HACCP principles in a form small businesses can actually maintain:
- Safer Food, Better Business — England and Wales
- CookSafe — Scotland
- Safe Catering — Northern Ireland
Completing one properly and keeping the diary up to date satisfies Article 5 for most small operations. The diary is not busywork — it is the evidence half of the requirement.
The five most common HACCP failures
- The plan exists but nobody follows it. Article 5 requires implementation, not authorship.
- Too many CCPs. Fifteen “critical” points means none are watched properly.
- Vague critical limits. If it cannot be measured, it cannot be monitored.
- Gaps in the diary. Missing days read as “we stopped checking”, and that is how an inspector will read them.
- Never updated. New menu, new supplier, new fridge — the plan should change with them.
How HACCP relates to the 4 Cs
The 4 Cs are what staff do. HACCP is how the business identifies where those actions are critical, sets the numbers, checks them and proves it. One is practice; the other is the management system around it. Your food hygiene rating’s “confidence in management” score is largely an assessment of the second.
Further reading
HACCP training
Nexis CPD offers CPD-accredited HACCP Level 2 training for each setting:
Related reading: The 4 Cs of food hygiene · Do I legally need a food hygiene certificate?
£9 per course. CPD accredited, 100 % online, verifiable e-certificate on completion. Pay for 2, get 3 — any 3 courses for £18.
Please note: these are CPD-accredited awareness courses and general information, not legal advice. They are not Ofqual-regulated qualifications. If you are responsible for developing and maintaining your business’s HACCP procedures, check whether your scheme, client or local authority requires a regulated Level 3 qualification — always confirm your own requirements.