HACCP is one of the most frequently heard acronyms in food businesses, yet it is often taken for the name of a certificate. It is in fact a way of thinking: a systematic answer to the question of where things can go wrong.
What does HACCP actually propose?
The classic approach is to test the finished product: produce a batch, take a sample, wait for the result.
That approach has two problems. The first is that it comes too late; by the time a problem is found the product exists. The second is sampling; five samples from ten thousand packs do not represent the batch.
HACCP inverts this. The whole process is examined, the steps where a hazard can arise are identified, and those steps are monitored continuously.
Safety then becomes an output produced throughout the process rather than a result measured at the end.
What are the seven principles?
The system is built in seven steps, and the order matters.
The first is hazard analysis. Biological, chemical and physical hazards are listed for every step.
The second is identifying critical control points: the steps where losing control means the hazard cannot be prevented.
The third is setting critical limits. A measurable boundary is set for each point: temperature, time, pH.
The fourth is the monitoring method. How the limit is checked, how often, and by whom.
The fifth is corrective action. What happens when a limit is exceeded is written down in advance.
The sixth is verification. Whether the system genuinely works is checked independently.
The seventh is record keeping. Every measurement and every intervention is documented.
How do critical control points differ from prerequisite programmes?
This distinction is the most commonly confused in practice.
Prerequisite programmes are the basic hygiene infrastructure of the business: the cleaning schedule, personnel hygiene, pest control, water quality, supplier assessment.
They are always required and have to be in place before HACCP. Without them a HACCP plan stays on paper.
A critical control point is a specific step that eliminates a particular hazard or reduces it to an acceptable level: cooking temperature, chilling rate, a metal detector.
The distinguishing question is this: if this step goes out of control, can a later step correct it? If the answer is no, that is a critical control point.
Declaring every step a critical control point is a common mistake. A thirty-point plan cannot be monitored, and a plan that is not monitored is useless.
| Concept | Scope | Example |
|---|---|---|
| Prerequisite programme | General hygiene infrastructure | Daily cleaning schedule |
| Critical control point | Step eliminating a specific hazard | 75 °C core in cooking |
| Critical limit | Measurable boundary | 75 °C, 30 seconds |
| Monitoring | Method and frequency | Thermometer every batch |
| Corrective action | What happens if exceeded | Continue cooking, record it |
How are temperature limits decided?
Limits are not arbitrary; they rest on microbiological data.
For hot holding, 63 degrees is a common boundary. Above it most pathogens cannot multiply.
For cold holding the boundary is usually 5 degrees. Below it, growth slows markedly.
The 5 to 63 degree range between them is called the danger zone. The total time a product spends there is limited.
For cooking, a common target is 75 degrees at the core. Lower temperatures can be acceptable, but then the time extends; two minutes at 70 degrees provides comparable safety.
In chilling, the rate matters. Bringing a cooked product from 63 to 10 degrees within four hours is a common requirement.
Why is record keeping stressed so heavily?
Because without records the system cannot be verified.
Saying a measurement was taken is not enough; when, by whom, and what value was recorded has to be written.
Records also show trends. If the temperature of the same cabinet has been creeping up for three weeks, it is noticed before the failure happens.
Records are the first thing an auditor looks at. Missing records create the impression that the practice is missing too.
The system does not have to be complex. A simple sheet filled in every day beats sophisticated software filled in once a week.
How does a small business apply this?
As scale falls the system simplifies, but it does not disappear.
Start by writing down the product flow. List every step in order from goods-in to service; in most kitchens that runs between twelve and twenty steps.
Then ask one question of each step: what can go wrong here? Group the answers under three headings: microbiological, chemical, physical.
Be stingy when selecting critical points. In most small kitchens three to five are enough: goods-in temperature, cold storage, cooking, chilling, reheating.
Create a single sheet for each point and name the person responsible. "Kitchen staff" is not responsible; a person is.
Review the records monthly. Rows left blank show where the system does not match real life.
What are the most common mistakes?
The first is taking the plan from a ready-made template. Another business's plan does not match your flow; the critical points differ.
The second is writing the plan and shelving it. It has to be updated when the menu changes, when new equipment arrives, or when a supplier changes.
The third is skipping thermometer calibration. Measurements are taken, but if the instrument is wrong the records are meaningless. Checking the zero point in iced water is the simplest verification that can be done monthly.
The fourth is failing to write down corrective action. What happens when a limit is exceeded is decided in advance, not in the moment.
The fifth is treating staff training as a one-off. In kitchens with high turnover, training is continuous work.
Is certification mandatory?
Establishing a food safety system based on HACCP principles is a legal obligation for food businesses.
Certification is a separate matter. A certificate from an independent body shows the system has been audited, and it is often requested when working with corporate customers.
The obligation can be met without a certificate; what matters is that the system exists and functions.
Asking a supplier for it is a reasonable practice. But the presence of a certificate is not enough on its own; its validity date and its scope need checking too.
