Building a HACCP plan your EHO will respect

By Zynthio. Published 15 July 2026, updated 12 September 2026. Editorial policy

General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.

A HACCP plan that survives inspection is built on records, not paperwork filled in once. Here is how to construct one that holds up.

A HACCP plan that stands up to inspection is a live record rather than a document written once and filed. It sets out the hazards at each stage of the food's journey through the business, the critical limits that control them, the monitoring that proves those limits are being met, and the corrective action taken when one is breached. An environmental health officer reads that record far more closely than the prose around it, and the distance between having a plan and being able to prove it is where most kitchens come unstuck.

Every food business operator in the UK has to put food safety management procedures in place based on HACCP principles, a duty set by Article 5 of Regulation (EC) 852/2004, now assimilated law. In England that duty is enforced through the Food Safety and Hygiene (England) Regulations 2013, and Wales, Scotland and Northern Ireland each enforce it through their own equivalent instruments. For the large majority of pubs, cafes and independent restaurants, the Food Standards Agency's Safer Food, Better Business pack, which applies to England and Wales, is an accepted route to meeting that duty; Northern Ireland uses the Safe Catering guidance and Scotland uses CookSafe. All of them are built around the same underlying discipline used in full HACCP: identify the hazards, decide where they can actually be controlled, and keep evidence that control is happening.

What a HACCP plan actually has to contain

A workable HACCP plan is shorter than most operators expect. It needs a hazard analysis for each stage of the food's journey through the business, from delivery to service; a list of the critical control points where a hazard can be prevented, eliminated or reduced to an acceptable level; the critical limit at each point, usually a temperature or a time; how that limit is monitored; what happens when it is breached; and how the whole system is checked periodically to confirm it is still fit for purpose. What it does not need is unnecessary length. An officer reading a long plan with no records behind it will draw exactly the same conclusion as one reading a short plan with no records behind it: the paperwork exists, the practice may not. A useful test when drafting one is to walk the physical route a delivery of raw chicken takes through the building, from the back door to the plate, and write down every point along that route where something could go wrong and where a person could actually intervene. Anywhere that route crosses a route taken by ready-to-eat food, such as a shared chopping board or a shelf below fresh salad, becomes a control point in its own right.

The seven principles, applied to a working kitchen

HACCP rests on seven principles, set out in Article 5 itself: conduct a hazard analysis, identify the critical control points, set critical limits, monitor those points, define corrective actions, verify that the system works, and keep records. Translated into a working kitchen, the critical control points are usually familiar ones. Cooking and reheating must reach a core temperature of 75 degrees Celsius in England, Wales and Northern Ireland, while in Scotland reheated food must reach 82 degrees Celsius. Hot food held for service must stay at 63 degrees Celsius or above, though it may sit below that for a single period of up to two hours for display or service, after which it must be used, chilled down or thrown away. Food that needs refrigeration must be kept at 8 degrees Celsius or below, with a similar single tolerance of up to four hours above that for display or service, which is why most kitchens run their fridges nearer 5 degrees Celsius to leave some headroom. Raw and ready-to-eat foods have to stay physically separate, on different shelves, boards and equipment. None of this is exotic; it is the same handful of numbers most kitchen staff could recite from memory. The value of writing them into a formal plan is that it forces a decision about who checks each one, how often, and what the fallback is when the equipment itself is the problem, such as a hot cupboard that will not hold temperature during a busy Saturday lunch.

The table sets out the limits themselves. How often each one is checked is a judgement the business makes when it writes the plan, not a frequency fixed in law, so the plan has to state the frequency and the records have to match what it states.

Where inspectors actually find the gaps

Inspectors rarely fault the plan itself. They fault the evidence behind it. A folder that was filled in diligently for the first few weeks and then quietly abandoned tells its own story, and the distance between saying that temperatures are checked and producing a continuous run of dated, signed checks is precisely the gap an environmental health officer is trained to look for. The same pattern shows up around allergen information, cleaning schedules and supplier checks, which is one reason a HACCP plan works best sitting alongside the wider record set covered in our guide to due diligence records rather than as a standalone binder nobody else in the business looks at. New staff are another common weak point: a plan that assumes everyone already knows the critical limits, without any record of who has actually been trained on them, leaves an obvious question unanswered if a temperature check is later found to be missing or wrong.

Making monitoring records that survive scrutiny

Monitoring only proves anything if it is dated, attributable to a named person, and consistent over time. A probe reading with no time, no name and no context is close to worthless as evidence, however accurate the number itself might be. Two supporting habits make monitoring credible: keeping the thermometer itself calibrated, which we cover in detail in our piece on probe calibration, and running fridge and freezer checks on a fixed schedule rather than whenever someone remembers, a point explored further in our guide to cold chain records. Where these habits sit inside a single digital system for HACCP monitoring and corrective actions, every entry is timestamped and named as it is made, and a reading outside a critical limit opens a corrective action instead of waiting to be noticed. The frequency is still the business's own decision: monitoring frequency on a critical control point is free text in Zynthio and is not enforced, so a complete record continues to depend on staff following the plan. What a digital record does remove is the temptation, common with paper sheets, to fill in a plausible run of numbers at the end of a shift rather than at the moment each check actually happened.

Verification and review: proving the system still works

Verification is the principle most plans skip entirely, yet it is the one that shows an inspector the system is more than a set of forms. It means periodically checking that monitoring is actually happening as designed, that corrective actions are proportionate and effective, and that the plan itself still matches what the kitchen does day to day. A menu change, a new supplier or a refit that moves the chiller can all quietly invalidate parts of an existing plan. A short written review, recorded with the date and the name of whoever carried it out, is usually enough to satisfy an environmental health officer that the business is not simply running an old document on autopilot. That review should also ask whether the frequency of checks written into the plan still matches reality; a control point the plan says is watched through the day but that is only glanced at once during a busy trading period is a gap worth closing before an inspector finds it first.

Corrective actions and the paper trail behind them

Every critical limit will be breached occasionally, and that is not itself a failure. What matters is what happens next and whether it is recorded. A chilled unit reading above 8 degrees Celsius should trigger a defined response: move the stock, adjust or repair the unit, and record both the deviation and the action taken against it, with a name attached. A written corrective action turns an isolated problem into evidence that the business caught and controlled a hazard, which is exactly the argument a due diligence defence rests on if a complaint or an incident is ever investigated. Businesses that struggle here tend to be the ones logging temperatures without ever building in the habit of writing down what was done when a number fell outside range, which leaves a record of the problem but none of the fix. A simple rule helps: no out-of-range reading should ever be the last entry on a page. It should always be followed by a second line recording what was done about it.

If you run more than one site

Consistency is the real test across multiple sites: the same critical limits, the same corrective action habits and the same review discipline need to hold whether an environmental health officer visits the flagship site or the smallest satellite kitchen. A single platform for logging HACCP monitoring and corrective actions across every location, such as the HACCP software built into Zynthio, lets a group hold a master plan at organisation level and clone it down, so the second kitchen is not built from scratch and every site produces the same shape of evidence.

See how Zynthio handles this