How does HACCP work in food production environments?

Every food business in the UK is required to have an HACCP plan in place. However, HACCP isn’t a document. It’s a way of controlling a process, and that’s where much of the confusion about it lies. 

The HACCP system was developed in the 1960s for the US space programme, where there was zero tolerance for contamination and no way to treat food poisoning in orbit. It’s since become the basis for food safety law across most of the world, and for the certification schemes that many food businesses now need to supply retailers and large caterers.

This blog explains what HACCP is and how it works, what the law requires and where HACCP plans fail in practice most often.

What is HACCP? 

HACCP stands for Hazard Analysis and Critical Control Point. It’s a preventative system. 

Instead of testing a sample of finished product and hoping the whole batch is safe, HACCP’s job is to identify where hazards can enter your process and build controls at the specific points where those hazards can be prevented, eliminated or reduced to a safe level. 

The hazards covered by HACCP fall into three main categories: 

• Biological (including Salmonella, Listeria, Campylobacter, E. coli, norovirus, etc)

• Chemical (such as cleaning residues, allergens and mycotoxins)

• Physical (like metal, glass, plastic fragments, etc) 

The current HACCP framework comes from the Codex Alimentarius, a collection of internationally recognised food standards, guidelines and codes of practice that was formalised by the Food and Agriculture Organisation and the World Health Organisation in 1963. Its job is to protect consumer health and ensure fair practice in food trade by giving countries a common reference point for food safety and quality. 

Rather than being law in itself, the Codex is a set of standards that individual countries and trading blocs draw on when writing their own regulations. UK law, BRCGS and SALSA all build their HACCP requirements around the Codex framework. 

The seven principles of HACCP are:

• Hazard analysis: Walk every step of your process and identify the biological, chemical and physical hazards present, along with any cross-contamination risks.

• Determine critical control points (CCPs): Pinpoint the steps in your process where a control can be applied to prevent, eliminate or reduce each hazard to an acceptable level. 

• Establish critical limits: Set the measurable line between safe and unsafe at each CCP and validate it against a credible source.

• Establish monitoring procedures: Document how each CCP is checked, how often and by whom, and what gets recorded. This is the basis of the temperature logs and checklists most food businesses keep.

• Establish corrective actions: Think about what happens the moment a critical limit is breached. Isolate the product, identify the cause, correct it and decide what happens to anything made before the deviation was caught.

• Establish verification procedures: Check the whole system works as designed, through internal audits, calibration checks and periodic revalidation.

• Documentation and record-keeping: Keep accurate records of everything, such as temperature logs, cleaning schedules, monitoring checks, corrective actions and supplier approvals. These provide the evidence your business will rely on at audit, and in court if it comes to that.

Where HACCP plans can fall down

Writing an HACCP plan and running it effectively are two different things. Your plan only counts for something if your team works to it. 

Not every step in your process will qualify as a CCP, so don’t overcomplicate things for the sake of it. Cooking chicken to a validated core temperature is a CCP. Wiping down a worktop is good hygiene practice, but it isn’t a CCP unless it’s the only barrier against a specific, significant hazard.

If your HACCP pack was copied from a template and still has blank sections, an auditor or inspector will treat it as evidence of a poorly implemented system.  

Your records need to be honest, too. If you’re filling in temperature logs the night before an inspection rather than as you go, it will show. Environmental health officers are used to spotting back-filled records. Any inconsistency here is one of the clearest signs that your system isn’t being followed day to day.

Finally, don’t set your critical limits once and leave them. UK law requires you to review and update your plan whenever your product, process or any step in it changes. 

The legal position

Every food business in the UK, except primary producers like farmers or growers, is legally required to put HACCP-based procedures in place. The requirement comes from Article 5 of assimilated Regulation (EC) 852/2004, which was introduced by the EU and retained in UK law after Brexit without being watered down.

The law asks for procedures ‘based on’ HACCP principles, which allows smaller food businesses to follow simplified procedures like Safer Food, Better Business rather than run a system built for large manufacturers. 

Breaches are prosecuted under the Food Safety and Hygiene (England) Regulations 2013 and its equivalents in Scotland, Wales and Northern Ireland. Magistrates’ courts can fine up to £5,000 per offence and impose up to six months’ imprisonment, while crown courts can impose unlimited fines and up to two years. However, local authorities can issue Hygiene Improvement Notices and Hygiene Emergency Prohibition Notices before a case ever reaches court. 

In April 2025, a major UK supermarket chain was fined £410,000 plus around £20,500 in costs after 62 expired items were found across two of its stores. The court found that while it did have written HACCP procedures in place, they weren’t being followed. That case underlines the crucial point we made earlier, that having a HACCP document isn’t the same as running an HACCP system effectively. 

Under UK food law, the burden of proof falls on the accused to demonstrate they took every reasonable precaution. So, saying ‘we have a food safety policy’ isn’t enough. You must be able to prove it’s implemented, monitored and enforced. A well-run, properly recorded HACCP system is the strongest evidence your business can have if something goes wrong and you need to show you did everything you reasonably could.

HACCP and certification

If you’re working towards BRCGS or SALSA certification, HACCP is the foundation that both schemes are built on. Under BRCGS Issue 9, certified sites must establish a food safety team, develop a food safety plan based on Codex principles, and determine their CCPs with validated critical limits and monitoring procedures. 

Issue 9 also added a new requirement to validate the plan and establish formal verification procedures, reflecting the Codex’s recommendation on validating food safety controls. So, if your HACCP plan was written for an earlier issue of BRCGS, it’s worth checking that it still complies with the more stringent Issue 9 requirements. 

SALSA and BRCGS both require a working HACCP-based plan, but they’re built for food businesses operating at different scales. SALSA was designed to be achievable for smaller, less-resourced businesses without diluting the underlying requirement, while BRCGS is the standard most larger retailers and multiple caterers require as a condition of supply.

How can Beacon Compliance help?

Building an HACCP plan that holds up to scrutiny means designing a system around your specific process, and checking it stays that way as your business changes. Working through that alone can be challenging, especially if you don’t have any in-house technical expertise. That’s where Beacon Compliance can help. 

Our team has more than 80 years’ combined industry experience working with food businesses of every size across the UK. We can help you build an HACCP system that reflects how your food business operates, get you ready for certification and make sure your documentation stands up if it’s ever tested. Get in touch to book a free, no-obligation consultation.