HACCP Audits & Reviews

Reviewing Your HACCP Plan After a Food Safety Incident

Post-Incident HACCP Review: How to Respond and Strengthen Your System

A food safety incident - whether it is a customer complaint, a confirmed case of foodborne illness, an allergen reaction, a positive laboratory result, or an EHO enforcement action - is the moment your HACCP system is truly tested. The incident itself is serious, but how you respond defines whether your business learns from it or repeats it. A thorough post-incident HACCP review is both a regulatory expectation and a practical necessity. This guide covers the structured approach to reviewing your plan after something has gone wrong, from immediate containment through to long-term preventive actions.

Key takeaways

Contain the immediate risk and preserve evidence before starting the HACCP review.

Root cause analysis should identify system failures, not just individual errors - use the "five whys" technique.

Produce both corrective actions (fix the immediate problem) and preventive actions (stop it recurring) with defined owners and deadlines.

Update your HACCP plan to reflect any gaps found: revised hazard analysis, moved CCPs, new critical limits, changed monitoring frequency.

Thorough post-incident documentation and genuine system improvement can rebuild confidence in management faster than a clean record with no evidence of learning.

Immediate Response: Containment and Evidence Preservation

Before you can review your HACCP plan, you need to contain the immediate risk. If potentially unsafe food is still in your operation, remove it from service, label it clearly ("DO NOT USE - under investigation"), and store it separately. Do not discard it yet - it may be needed for laboratory testing or as evidence. If a specific batch of food is implicated, identify all units from that batch and their current status (served, in storage, sent to other sites). Preserve all records from the period of the incident: temperature logs, delivery notes, cleaning records, staff rosters, and any CCTV footage. These are your evidence base for the root cause analysis. Notify the relevant people: your HACCP team leader, business owner or general manager, and (if legally required) your local authority. In England, food business operators must notify the local authority if they believe food they have placed on the market may be injurious to health. If the incident involves a suspected allergen reaction, take it extremely seriously: allergen reactions can escalate rapidly and have resulted in fatalities in UK food businesses. Record everything: what the customer reported, when, what food was consumed, what immediate actions you took. Do not admit liability at this stage, but do cooperate fully with any investigation.

Root Cause Analysis: Finding Where the System Failed

Once the immediate risk is contained, convene your HACCP team for a structured root cause analysis. The goal is not to assign blame to an individual but to understand where the system failed. Start by reconstructing the timeline: what food was involved, when was it received, stored, prepared, cooked, and served? What were the temperature records? Who was working at each stage? What were the conditions? Compare the timeline against your HACCP plan. Was every documented procedure followed? If yes, the plan itself may have a gap - a hazard that was not identified, a CCP that was not in the right place, or a critical limit that was not strict enough. If no, the plan was adequate but compliance failed - which points to training, supervision, workload, or equipment issues. Use the "five whys" technique to dig beyond surface explanations. Example: Why did the customer get ill? The chicken was undercooked. Why was it undercooked? The core temperature was not checked. Why was it not checked? The probe thermometer was broken. Why was it not replaced? Nobody reported it as broken. Why did nobody report it? There is no system for reporting faulty equipment. The root cause is not "the chef did not check the temperature" - it is a missing equipment reporting procedure.

Corrective Actions vs Preventive Actions

A corrective action fixes the immediate problem: replace the broken probe thermometer, retrain the staff member, discard the affected food. A preventive action stops the problem from happening again: implement a weekly equipment check, introduce a faulty equipment reporting system, redesign the cooking procedure to include a mandatory temperature verification step with a specific checkpoint in the workflow. Your post-incident review must produce both. Corrective actions should be implemented immediately or within days. Preventive actions may take longer to implement but should have a defined deadline, an assigned owner, and a verification step to confirm they are working. Document every action: what will be done, by whom, by when, and how you will verify it has been effective. If the incident reveals a gap in your hazard analysis, update it. If a CCP was in the wrong place, move it. If a critical limit was inadequate, revise it. If your monitoring frequency was insufficient, increase it. If your flow diagram does not show the step where the failure occurred, update the diagram. The revised plan must then be communicated to all relevant staff, with training on any new or changed procedures.

HACCP Audits & Reviews

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

Regulatory Reporting, Records, and Rebuilding Confidence

Depending on the severity of the incident, you may need to report to or cooperate with several bodies. Your local authority Environmental Health team should be notified of confirmed or suspected foodborne illness outbreaks and will investigate. Public Health England (or the devolved equivalents) may become involved for confirmed multi-case outbreaks. If the incident involves a product recall, the FSA has a specific incident reporting process. Trading Standards may be involved if allergen labelling is implicated. Keep records of all communications with regulatory bodies, your internal investigation, the root cause analysis, corrective and preventive actions, and any changes to your HACCP plan. These records serve multiple purposes: they demonstrate to regulators that you responded appropriately, they protect you legally by showing due diligence, and they provide a reference for future incidents. After a serious incident, your confidence in management score may take a hit at the next EHO inspection. The way to rebuild is to demonstrate that you investigated thoroughly, made meaningful changes, and can show evidence that those changes are being followed. An EHO who sees a business that had a problem, understood why, fixed the root cause, and can prove the fix is working will be more confident in your management than one who found no problems but sees a stale, unreviewed HACCP plan.

What to do next

Create a food safety incident response procedure

Document the steps to follow immediately after an incident: who to notify, how to preserve evidence, how to contain risk, and who convenes the investigation. Keep this procedure accessible and ensure all managers know it exists.

Practice the five whys on a past near-miss

Take a recent minor incident (a temperature reading that was out of range, a near-miss on allergen cross-contact) and apply the five whys technique. This builds the skill for when a serious incident occurs.

Review your incident records from the past 12 months

Compile all customer complaints, corrective actions, and near-misses from the past year. Look for patterns that might indicate an underlying system weakness before a serious incident forces the review.

Common mistakes to avoid

Mistake

Blaming an individual and moving on without investigating the system

Instead

If a staff member made an error, ask why the system allowed that error to occur unchecked. Retraining one person does not fix a systemic problem.

Mistake

Discarding potentially implicated food before it can be tested

Instead

Preserve food samples, packaging, and delivery records until the investigation is complete. Your local authority may want to test samples, and destroying evidence weakens your position.

Frequently asked questions

Do I have to report a food safety incident to my local authority?

If you have reasonable grounds to believe food you have sold or served is unsafe, you should notify your local authority. For confirmed or suspected foodborne illness affecting multiple customers, notification is a legal obligation under food safety regulations. For a single complaint without confirmation of illness, you are not legally required to report, but investigating internally and documenting your response is essential.

How long after an incident should the HACCP review be completed?

Begin the investigation immediately. Corrective actions should be implemented within 24 to 48 hours for critical issues. The full root cause analysis and any plan changes should be completed within two weeks. For complex incidents involving laboratory testing or regulatory investigation, the timeline may be longer, but interim controls should be in place immediately.

Will a food safety incident automatically lower my food hygiene rating?

Not automatically. Your rating is assessed at your next scheduled inspection, not in real time. However, a serious incident may trigger an unscheduled revisit. If the EHO finds that you have investigated the cause, made meaningful changes, and can demonstrate improved controls, the impact on your rating may be limited. If they find the same failures that caused the incident, expect a significant score increase on confidence in management.

HACCP Audits & Reviews