Quick answer
You build an HACCP plan in seven steps: describe the business, analyse the hazards, identify the critical control points (CCPs), set critical limits, define monitoring and corrective actions, schedule verification, and keep all the documentation. The law does not require a consultant, but the plan must reflect your real kitchen, not a generic template. Below is the operational sequence and the mistakes that fail inspections.
What an HACCP plan is and why you need one
An HACCP plan, also called a food safety management plan, is the document describing how you keep hygiene risks under control in your business. HACCP stands for Hazard Analysis and Critical Control Points. It is a preventive system, not an after-the-fact check: instead of testing the finished dish, you identify in advance where things can go wrong and decide how to stop them.
In Europe it has been mandatory since Regulation EC 852/2004. In plain terms: anyone who produces, processes, transports, stores or serves food must have a written food safety plan and actually apply it. The plan is the first thing an inspector asks to see.
Step 1 — Describe the business and the team
Before hazards, the plan photographs the operation. You need:
- legal name, address, venue type and number of covers;
- list of products handled (raw, cooked, stored, allergens managed);
- kitchen layout with the workflow (where goods come in, where you work, where waste goes out);
- equipment list (fridges, blast chiller, ovens, dishwasher);
- who owns the food safety system and who does what.
This part looks like paperwork, but the hazard analysis that follows depends entirely on what you cook and with which equipment.
Step 2 — Hazard analysis
For every step, from goods-in to service, you list the hazards and sort them into three categories:
- biological: bacteria (Salmonella, Listeria, E. coli), viruses, moulds, parasites;
- chemical: cleaning residues, undeclared allergens, mycotoxins;
- physical: glass shards, metal fragments, bone, plastic.
For each one you assess likelihood and severity. A pizzeria serving only cooked products has a different risk profile from a sushi bar handling raw fish. Never copy another venue's analysis: real hazards depend on your menu.
Step 3 — Identify the CCPs
Critical control points (CCPs) are the steps where control is essential to remove or reduce a hazard and cannot be recovered later. Not every step is a CCP. In hospitality the most common ones are:
- goods-in for perishables;
- cold storage (cold chain);
- cooking to core temperature;
- cooling and blast chilling;
- hot holding during service.
Step 4 — Set critical limits
Each CCP needs a measurable value that separates acceptable from unacceptable. In hospitality these are almost always temperatures and times.
| CCP | Critical limit | Reference | |---|---|---| | Chilled goods-in | < 4 °C | Reg. EC 852/2004 | | Frozen goods-in | < -18 °C | Reg. EC 852/2004 | | Fridge | 0–4 °C | Reg. EC 852/2004 | | Freezer | < -18 °C | Reg. EC 852/2004 | | Cooking (poultry/meat) | > 75 °C core | EFSA guidance | | Hot holding | > 63 °C | Reg. EC 852/2004 | | Blast chilling | 60 °C to 10 °C within 2 hours | Regional guidance |
The practical rule to memorise: the danger zone sits between 4 °C and 63 °C. In that band bacteria multiply, and food must not stay there for more than two hours in total.
Step 5 — Monitoring and corrective actions
For each CCP write down who checks, how, when and where it is logged. A concrete monitoring sheet:
| CCP | Frequency | Tool | Owner | |---|---|---|---| | Fridge temperature | Twice a day | Digital thermometer | Chef on shift | | Core cooking temperature | Every at-risk cook | Probe | Chef | | Goods-in | Every delivery | Probe + delivery note | Goods-in staff |
Then define the corrective action for each breach. Worked example: the fridge reads 7 °C instead of 4 °C. You check how long: if the seal was left open for 20 minutes, the product is recoverable; if the fault has lasted hours, discard the perishables and log everything with date, time and signature.
Step 6 — Periodic verification
At least once a year (ideally every six months) verify that the system actually works: re-read the temperature logs, check expiry dates in storage, review cleaning procedures and, if you want, run microbiological tests on surfaces and food (150–300 EUR per set). Verification is also when you update the plan if anything has changed.
Step 7 — Documentation
A plan without completed records is worthless. Keep for at least two years:
- fridge and freezer temperature logs;
- cleaning and sanitation sheets;
- supplier delivery notes and invoices for traceability;
- staff HACCP training certificates.
A well-made plan is short: 20–40 pages. It is the daily records that prove you actually apply it.
Common mistakes
- Copy-paste plan: downloaded and never adapted. Inspectors immediately notice it describes a different kitchen.
- Records filled in at the desk: identical temperatures all written the same day before the inspection. That is worse than having none.
- Wrong CCPs: too many (everything becomes critical and nothing is really controlled) or too few (you skip cooking or chilling).
- A frozen plan: you changed menu, suppliers or equipment but the document is the opening-day version.
- Untrained staff: anyone handling food without a valid certificate triggers an immediate penalty.
- Confusing plan and records: you have the document but not the daily logs, or the reverse. You need both.