How to Implement HACCP in a Small Food Business
Practical guide to implementing a HACCP system in a small food business with limited resources. Covers the 7 HACCP principles, EC 852/2004 requirements, team assembly, hazard analysis, CCP monitoring, and verification.
HACCP (Hazard Analysis and Critical Control Points) is a systematic approach to food safety that identifies, evaluates, and controls hazards throughout your food production process. Under EC Regulation 852/2004 (retained in UK law), all food business operators must implement food safety procedures based on HACCP principles. For many small businesses, this requirement feels overwhelming. The Codex Alimentarius guidelines that define the seven HACCP principles were originally developed for large-scale food manufacturing, and the terminology alone can be intimidating.
The reality is that HACCP for a small cafe, takeaway, or restaurant does not need to look like HACCP for a factory producing millions of ready meals. The Food Standards Agency recognises this and provides Safer Food Better Business (SFBB) as a simplified, HACCP-based system specifically designed for smaller operations. However, some businesses need or prefer a more structured HACCP plan: those with complex menus, multiple preparation methods, high-risk customer groups (care homes, nurseries), or those required by their local authority or a food safety audit scheme to have a formal HACCP plan.
This guide walks you through implementing HACCP in a small business context, applying the seven principles proportionately to your operation without the bureaucratic overhead of a large-scale manufacturing approach. The goal is a practical, working system that your team actually uses, not a 200-page document that sits in a drawer.
7 steps to complete
Assemble your HACCP team
In a large organisation, the HACCP team might include food scientists, engineers, and quality assurance managers. In a small business, your team may be just two or three people, and that is perfectly acceptable. You need someone with knowledge of your food operations (typically the head chef or kitchen manager), someone with food safety knowledge (this could be the same person if they hold a Level 3 Food Safety qualification), and ideally one other person who can provide a different perspective. If your in-house knowledge is limited, consider bringing in external expertise for the initial setup: your local authority environmental health team may offer free guidance, and food safety consultants can help you build the framework that your team then maintains. The key is that at least one person on the team has practical, day-to-day experience of your kitchen operations.
Describe your products and intended use
Before you can identify hazards, you need a clear picture of what you produce and who consumes it. For each category of food you prepare, document the ingredients used, the preparation and cooking methods, the storage conditions, the intended shelf life, and who your customers are. Pay particular attention to vulnerable groups: if you serve food to elderly residents, hospital patients, young children, or pregnant women, the risk profile is significantly higher and your HACCP plan must reflect this. For a small restaurant, you do not need to write a product description for every dish, but you should group products by process type: foods served raw, foods cooked and served hot, foods cooked and cooled for later service, and foods that are reheated.
Identify hazards at each step of your process
Map out each stage of your food handling process, from goods receipt through storage, preparation, cooking, cooling, reheating, and service. At each stage, identify the biological hazards (pathogenic bacteria such as Salmonella, E. coli O157, Listeria, Campylobacter; viruses such as norovirus), chemical hazards (cleaning chemical residues, allergens, naturally occurring toxins), and physical hazards (glass, metal, bone fragments, hair, plasters). For a small business, focus on the hazards that are realistically present in your operation. A cafe that does not handle raw poultry has a very different hazard profile from a restaurant with an extensive raw meat menu. The Codex Alimentarius framework recommends considering each hazard in terms of likelihood of occurrence and severity of harm.
Determine your Critical Control Points
A Critical Control Point (CCP) is a step in your process where control can be applied to prevent, eliminate, or reduce a food safety hazard to an acceptable level. Common CCPs in small food businesses include: cooking (ensuring core temperature reaches at least 75°C to destroy harmful bacteria), chilling (cooling food from 63°C to below 8°C within 90 minutes), cold storage (maintaining fridge temperatures between 0°C and 5°C), hot-holding (maintaining food above 63°C), and reheating (reaching 75°C core temperature, or 82°C in Scotland). Not every step is a CCP. Use a decision tree (available in the Codex Alimentarius guidelines and most HACCP textbooks) to determine whether each identified hazard requires a CCP or can be managed through prerequisite programmes such as cleaning, personal hygiene, and pest control.
Set critical limits and establish monitoring procedures
For each CCP, define the critical limit that separates safe from unsafe. These limits must be measurable and specific: a cooking CCP might have a critical limit of 75°C core temperature for at least 30 seconds; a cold storage CCP might have a critical limit of 5°C maximum. Then establish how you will monitor each CCP: what measurement is taken, how often, by whom, and using what equipment. In a small business, monitoring is typically straightforward: probe thermometer checks at cooking, twice-daily fridge and freezer temperature readings, and visual checks at goods receipt. The important thing is that monitoring is consistent, documented, and assigned to specific individuals. A monitoring procedure that relies on whoever remembers is a monitoring procedure that will fail.
Define corrective actions for each CCP
For every CCP, decide in advance what happens when a critical limit is not met. Corrective actions must address both the immediate product safety issue and the underlying cause. For example, if a fridge temperature reading is 8°C, the immediate corrective action is to check food temperatures with a probe (food above 5°C for more than four hours should be discarded), adjust or repair the fridge, and increase monitoring frequency until the fridge is stable. The root cause investigation might reveal a faulty door seal, overloading, or a staff member propping the door open. Document every deviation, the corrective action taken, and the outcome. This documentation is evidence that your HACCP system is working as intended.
Verify the system and keep it current
Verification confirms that your HACCP plan is working effectively. In a small business, verification activities include: reviewing monitoring records regularly (at least weekly) to check they are complete and within limits, calibrating thermometers monthly against a known reference, observing staff practices to ensure they match documented procedures, and reviewing the entire HACCP plan at least annually or whenever you make significant changes to your menu, processes, equipment, or suppliers. Verification is distinct from monitoring. Monitoring is the day-to-day checking of CCPs; verification is stepping back to confirm the whole system is effective. Keep all verification records as evidence of due diligence. Your local authority inspector will want to see both monitoring records and evidence of periodic verification.
Tips for success
Common mistakes to avoid
Frequently asked questions
Do I need a formal HACCP plan or is SFBB sufficient?
For most small food businesses in England and Wales, SFBB (Safer Food Better Business) is designed to satisfy the HACCP-based requirements of EC 852/2004. SFBB is built on HACCP principles but presented in a more accessible format. However, you may need a formal HACCP plan if your local authority or a food safety audit scheme (such as those required by major retailers or contract caterers) specifically requires one, if you serve vulnerable groups (care homes, nurseries, hospitals), or if your operations are sufficiently complex that SFBB does not adequately cover your processes. When in doubt, ask your local environmental health officer.
What are the 7 HACCP principles?
The seven HACCP principles as defined by the Codex Alimentarius Commission are: (1) Conduct a hazard analysis, (2) Determine the Critical Control Points (CCPs), (3) Establish critical limits for each CCP, (4) Establish a monitoring system for each CCP, (5) Establish corrective actions for when a CCP is not under control, (6) Establish verification procedures to confirm the HACCP system is working effectively, and (7) Establish documentation and record keeping. These principles form the backbone of any HACCP system, whether applied in a multinational food manufacturer or a small independent cafe.
How many CCPs should a small restaurant have?
There is no fixed number, but most small restaurants have between three and five CCPs. Typical CCPs include cooking (75°C core temperature), chilling/cooling (63°C to below 8°C within 90 minutes), cold storage (0-5°C), hot-holding (above 63°C), and reheating (75°C core, or 82°C in Scotland). The exact number depends on your menu and processes. A simple sandwich shop may have two CCPs; a restaurant with an extensive cooked menu, raw preparations, and reheated dishes may have five or six.
Can I implement HACCP without a food safety consultant?
Yes, provided someone on your team has sufficient food safety knowledge (a Level 3 Food Safety qualification is recommended for the person leading the HACCP development). The FSA, local authority environmental health teams, and industry bodies like the Chartered Institute of Environmental Health (CIEH) all provide free guidance and resources. A consultant can be helpful for the initial setup, but the ongoing maintenance of your HACCP system must be done by your own team because they are the ones who understand your daily operations.
How often should I review my HACCP plan?
Review your HACCP plan at least annually as a scheduled activity. You must also review it immediately after any significant change: a new menu or dish category, a change in suppliers, new equipment, alterations to your premises, new staff in food safety roles, a food safety incident, or updated regulatory guidance. Each review should be documented with the date, what was reviewed, any changes made, and who conducted the review.
Ready to simplify compliance?
Paddl automates the processes described in this guide. Digital records, automatic alerts, and complete audit trails for your hospitality business.
Full access to all features · Dedicated onboarding support · Cancel anytime