HACCP for small restaurants: a plain-English guide

What HACCP means for a small kitchen

HACCP stands for Hazard Analysis and Critical Control Point. Strip away the acronym and it's a simple idea: work out what could make your food unsafe, decide the points where you control it, set a clear limit at each point, check it, and write down what you did.

The legal requirement comes from Article 5 of Regulation (EC) 852/2004, which still applies in UK law. Food business operators must put in place, implement and maintain a permanent procedure based on HACCP principles. Crucially for small restaurants, the same regulation says HACCP requirements should be flexible enough to apply in all situations, including small businesses, and that records should be commensurate with the nature and size of the business.

So a 40-cover bistro doesn't need the 80-page plan a ready-meal factory has. It needs a system that fits what it actually cooks.

Your options in each nation

All of these are HACCP-based. SFBB and CookSafe are written for small caterers and are free. MyHACCP is the FSA's free online tool for building a formal plan. If your business is larger or higher-risk, GOV.UK suggests asking your local food safety team whether you need a full HACCP plan. See Safer Food, Better Business digital for how the SFBB diary works.

The seven principles, with a real kitchen

The FSA's MyHACCP guidance sets out the seven principles in this order. To make them concrete, take a small restaurant: 40 covers, open Wednesday to Sunday, a chef-owner plus two in the kitchen, menu built around a slow-cooked beef shin that's cooked in the morning, cooled, portioned and reheated to order.

1. Identify hazards and control measures

List what could go wrong at each step, from delivery to plate. Hazards are biological (bacteria), chemical (cleaning products, allergens), physical (glass, bone, plastic) and allergenic.

Beef shin example: bacteria surviving undercooking; bacteria multiplying during slow cooling; cross-contamination from raw meat to cooked; celery and wheat in the braise (allergens).

2. Determine the critical control points (CCPs)

A CCP is a step where control is essential to prevent, remove or reduce a hazard to a safe level, and where there's no later step that would fix it.

Beef shin example: cooking, cooling, chilled storage, reheating. Cooking kills bacteria; cooling and chilling stop survivors multiplying; reheating kills anything that grew.

3. Establish critical limits

The measurable line between safe and unsafe at each CCP.

You choose your own limits, as long as they keep food safe. CookSafe gives the example of deciding your fridge should run at 5°C, which then becomes your critical limit.

4. Monitor the CCPs

Decide how, when and by whom each limit is checked.

Beef shin example: the chef probes each batch at the end of cooking; cooling trays are probed at set intervals the first time to prove the method, then spot-checked; fridges are read at opening and before service; each reheated portion is probed before plating.

5. Corrective action

What you do when a limit is missed, decided in advance so nobody has to think about it at 8pm on a Saturday.

Beef shin example: undercooked batch goes back in; a batch that cooled too slowly is binned; a fridge reading 9°C triggers moving stock and calling the engineer; a portion that won't reach temperature isn't served.

6. Validation, verification and review

Check the system works. Validation is proving your limits and methods are right in the first place (the SFBB "Prove it" approach: probe the shin as it cools and see how long it takes). Verification is checking you're doing what you said: the head chef looks over the week's records. Review is updating the system when something changes.

7. Documentation and record keeping

Write down the plan, and keep records that show it's followed: temperature logs, cooling checks, corrective actions, cleaning, training, supplier details. If there's ever a food safety incident, GOV.UK says you'll need to show your records as evidence of how you keep food safe.

Prerequisites: the boring stuff HACCP sits on

HACCP only works on top of good basic hygiene. MyHACCP stresses that the preparatory steps must be in place before you work through the principles, and SFBB covers most of the basics in its cross-contamination, cleaning and management sections:

• Cleaning and disinfection, with a cleaning schedule and disinfectants meeting BS EN 1276 or BS EN 13697
• Personal hygiene and fitness to work, including staying off for 48 hours after diarrhoea or vomiting
• Pest control
• Maintenance of equipment and premises
• Supplier control and traceability records
• Allergen management, with accurate information for every dish
• Training, appropriate to each person's role, and recorded

If these aren't in place, no amount of critical limits will save you.

How proportionate is "proportionate"?

The flexibility in the law is real, but it isn't a loophole. For a small restaurant it typically means:

• You don't need a HACCP team or a flow chart for every dish. SFBB doesn't use them.
• You may not need to probe every item every time if you've proved your method works. CookSafe notes that certain foods may not need to be probed each time they're cooked, cooled or reheated, but occasional checks are still essential.
• Critical limits don't always have to be a number. "Cook until steaming hot throughout" can be enough where you've proved it.
• Records can be simple. SFBB's minimum is the daily diary; your business may need more.

What it doesn't mean: no system, no records, or a system that describes a different menu.

Mistakes small restaurants make

• Buying a generic HACCP plan online that lists processes you don't do and misses the ones you do.
• Writing it once and never touching it. The menu has changed four times since.
• Only the chef knows it. If the chef's off, nobody knows the cooling method.
• Proving nothing. "We cool it quickly" isn't evidence. A probed cooling curve is.
• Records with no corrective actions. A month of perfect readings is less believable than one bad reading with a clear note of what you did.

A HACCP checklist for a small restaurant

• Food safety system chosen (SFBB, CookSafe, MyHACCP or your own) and completed for your current menu
• Hazards listed for each process, including allergens
• CCPs identified with clear critical limits
• Monitoring decided: who, when, how
• Corrective actions written down in advance
• Methods proved (cooling times, hot-hold temperatures)
• Records kept daily and reviewed weekly by the person in charge
• System reviewed at every menu, supplier or equipment change
• Every member of the kitchen trained on it

Keeping the records without the binder

Principle 7 is where most small kitchens fall over, because records rely on busy people writing things down. ShiftComplete helps with the repeating parts: fridge, freezer and hot-hold readings logged on a phone with breaches flagged, opening, closing and due-diligence checklists that differ by weekday with named, timestamped ticks and optional photos, incidents logged with resolution notes for your corrective actions, and a weekly report for the person reviewing the records. It's not a HACCP plan and isn't endorsed by the FSA; it helps you keep the records your plan says you'll keep.