HACCP — Hazard Analysis and Critical Control Points — is the internationally recognised system for identifying, evaluating and controlling food safety hazards before they reach a guest. Every serious commercial kitchen, food manufacturer and catering operation runs on some form of HACCP plan, whether they call it that or not.
The problem is that most kitchen teams treat HACCP as paperwork. A binder sits on a shelf, gets signed at the end of every month, and never touches the daily reality of the line. That is not a HACCP plan — that is a HACCP decoration. A real plan changes what happens at the prep counter, the chiller, the fryer and the pass, every single shift.
This guide breaks down the seven HACCP principles in the order they must be applied, with practical examples from a working commercial kitchen so you can see what each principle actually looks like when it is alive on the floor.
"A HACCP plan is not a document you write once and file away — it is a system you operate every shift, and it only works when the team understands the why behind every checkpoint."
01 What HACCP Actually Is — and Why It Exists
HACCP was developed in the 1960s by NASA and the Pillsbury Company to guarantee the safety of food for the space programme — where there was no room for a foodborne illness incident. The system was later adopted by the FDA, Codex Alimentarius, and food safety authorities worldwide, and is now the foundation of food safety management under regulations like EU Regulation 852/2004, the UK Food Safety Act, FSSAI in India, and the FDA Food Code in the USA.
Unlike end-product testing — where you cook a dish, test it for pathogens, and hope the rest of the batch is fine — HACCP is preventative. It identifies where hazards are likely to occur, sets controls at those specific points, and monitors them continuously. The point is to catch the problem before the food is served, not after a guest gets sick.
Before you can apply the seven principles, you must complete five preliminary steps:
- Assemble the HACCP team — chef, kitchen manager, food safety officer, and at least one person trained in HACCP methodology.
- Describe the product — what is being produced, who it is served to, and how it is stored and reheated.
- Identify intended use — who consumes it, and whether any group is vulnerable (children, elderly, immunocompromised).
- Construct a flow diagram — every step from receiving raw material to serving the guest.
- Verify the flow diagram on site — walk the kitchen and confirm every step is accurate, not just assumed.
Only after those five steps are complete do the seven principles come into play. Skipping them is the single most common reason a HACCP plan fails an audit — and, more importantly, fails to protect a guest.
02 Principle 1 — Conduct a Hazard Analysis
The first principle is to identify every biological, chemical and physical hazard that could realistically occur at each step of your flow diagram, and to evaluate how severe each one is and how likely it is to happen.
Biological hazards include bacteria (Salmonella, Listeria, E. coli, Clostridium), viruses (Norovirus, Hepatitis A), parasites (Toxoplasma, Anisakis) and moulds. Chemical hazards include cleaning agents, sanitiser residue, pest control chemicals, allergens and mycotoxins. Physical hazards include glass, metal fragments, bone, plastic, packaging material and personal items like plasters or jewellery.
For each hazard, ask three questions:
- What is the likelihood of this hazard occurring at this step?
- What is the severity if it does occur — mild illness, serious illness, or life-threatening?
- Is there an existing control measure already in place, and is it adequate?
Example: at the receiving step of raw chicken, the biological hazard is Salmonella and Campylobacter. The likelihood is high because raw poultry frequently carries these bacteria. The severity is serious — Campylobacteriosis can hospitalise vulnerable guests. The control is receiving temperature verification and supplier documentation. If either is missing, the hazard is uncontrolled and must be addressed in the next principle.
03 Principle 2 — Determine the Critical Control Points (CCPs)
A Critical Control Point is a step at which a control can be applied that is essential to prevent, eliminate or reduce a food safety hazard to an acceptable level. The key word is essential — not every step in a kitchen is a CCP, and treating every step as one makes the plan unusable.
The standard tool for deciding whether a step is a CCP is the Codex Decision Tree, a four-question sequence:
- Do control measures exist for this hazard?
- Does this step eliminate or reduce the hazard to an acceptable level?
- Could contamination occur at this step, or increase to an unacceptable level?
- Will a subsequent step eliminate the hazard or reduce it to an acceptable level?
If the answer to Q4 is yes, then this step is not a CCP — a later step will handle the hazard. If the answer is no, this step is a CCP.
Typical CCPs in a commercial kitchen include:
- Receiving — verifying cold chain temperature of incoming deliveries.
- Cooking — reaching a core temperature that kills pathogens (e.g. 75°C for poultry and reheated dishes).
- Cooling — reducing cooked food from 63°C to 5°C within a defined time window (typically 90 minutes to 2 hours for the first stage).
- Hot holding — maintaining cooked food at 63°C or above.
- Cold holding — maintaining chilled food at 5°C or below.
- Reheating — bringing cooked-chilled food back to 75°C or above.
- Chilling — blast chilling to below 5°C within the required time.
04 Principle 3 — Establish Critical Limits
For each CCP, you must define a critical limit — the measurable boundary between safe and unsafe. Critical limits must be specific, measurable, and based on scientific evidence or regulatory standard, not on what a kitchen "usually does."
| CCP | Critical Limit | Basis |
|---|---|---|
| Receiving — chilled goods | 5°C or below | EU 852/2004, FDA Food Code |
| Receiving — frozen goods | -18°C or below | Codex Alimentarius |
| Cooking — poultry & reheated dishes | 75°C core, held 30 seconds | UK FSA, FSSAI |
| Cooling — cooked food | 63°C to 5°C in 90 min max | UK FSA guidance |
| Hot holding | 63°C or above | UK FSA, EU 852/2004 |
| Cold holding | 5°C or below | EU 852/2004 |
| Reheating | 75°C core, held 30 seconds | UK FSA |
Where regulations differ by region, always apply the stricter standard. A critical limit that is not measurable is not a critical limit — it is a slogan.
05 Principle 4 — Establish Monitoring Procedures
Monitoring is what turns a critical limit from a number into a system. For every CCP, define:
- What is being measured (core temperature, air temperature, time, pH, water activity).
- How it is measured (probe thermometer, data logger, visual check).
- When it is measured (every delivery, every 2 hours, every batch).
- Who is responsible (named role, not "the kitchen team").
Monitoring must be frequent enough to catch a deviation before the product leaves the CCP. If you check hot holding once at the start of service, you have no idea what happened at 8pm — and that is exactly when a bain-marie fails. The right frequency for most hot and cold holding CCPs is every two hours, logged on a written sheet or a digital system.
Calibrate every probe thermometer weekly. A thermometer that reads 3°C off is worse than no thermometer at all, because it produces false confidence.
06 Principle 5 — Establish Corrective Actions
A corrective action is what happens when monitoring shows a critical limit has been breached. This must be pre-defined, written down, and trained — not improvised at the moment of failure.
For each CCP, define:
- What to do with the affected product — hold, re-cook, chill further, or discard. Never serve product that has breached a critical limit without a documented corrective process.
- How to restore control — adjust the equipment, move the product, restart the process.
- What to record — the deviation, the action taken, the person responsible, and the outcome.
- What to review — whether the deviation indicates a systemic issue that needs a change to the plan.
Example: a chiller reads 9°C at the 4pm check. The corrective action is: move all product to a working chiller or blast chiller immediately; probe each item to confirm it has not exceeded 5°C for more than the safe window; discard anything that has; call refrigeration maintenance; log the deviation; review whether the frequency of monitoring needs to increase.
07 Principle 6 — Establish Verification Procedures
Verification is how you confirm the HACCP plan is actually working — not just that it is being followed, but that it is effective. It is distinct from monitoring: monitoring checks the CCP, verification checks the system.
Verification activities include:
- Reviewing monitoring records weekly to spot patterns or missed checks.
- Calibrating thermometers and other measurement equipment.
- Observing staff performing CCP monitoring to confirm correct technique.
- Taking occasional microbiological swabs or samples to confirm controls are working.
- Annual full review of the plan against current regulations and any changes to the menu or process.
- Internal or third-party audit against the written plan.
Verification is also where you update the plan. If a new dish is added, a new supplier is onboarded, or equipment is replaced, the HACCP plan must be reviewed and revised before the change goes live.
08 Principle 7 — Establish Record Keeping and Documentation
The final principle is the one that most kitchens under-invest in, and the one that auditors focus on most. If it is not recorded, it did not happen. Records must be:
- Accurate — recorded at the time of the check, not filled in at the end of the week.
- Legible — signed and dated by the person who made the check.
- Retained — typically for at least 12 months, or per local regulation.
- Accessible — available for inspection at any time.
At minimum, a commercial kitchen HACCP file should contain:
- HACCP team and responsibilities.
- Product descriptions and flow diagrams.
- Hazard analysis worksheet.
- CCP determination and critical limits.
- Monitoring logs (temperature, time, calibration).
- Corrective action logs.
- Verification records (audits, calibration, reviews).
- Supplier approval records.
- Staff training records.
- Cleaning and sanitation schedules.
- Pest control records.
Keep it visible: laminated CCP cards at each monitoring point do more than a binder in the office.
Train the why: staff who understand the danger zone retain the numbers; staff asked to memorise a table do not.
Review monthly: a 15-minute review of the monitoring logs each month catches drift before it becomes a pattern.
Own it from the top: HACCP fails when it is delegated to a junior. The head chef must own the plan.
HACCP is not a document. It is a way of running a kitchen — one that assumes hazards are real, controls are non-negotiable, and every shift is a chance to either protect a guest or fail them. The seven principles give you the structure. The discipline of applying them every day is what makes the difference.
Nigel A. Thomas, F&B and Hospitality Operations Professional | India · Middle East · USA
Nigel A. Thomas
30+ years in F&B and hospitality operations across India, the Middle East, and the USA. Founder of JobLynk.live, India's careers platform for hospitality and maritime professionals.