HACCP plan: the 7 principles and a template to print

What the regulation actually requires

The basis is Art. 5 of EU Regulation 852/2004 on the hygiene of foodstuffs: every food business has to put in place, implement and maintain a permanent procedure based on the HACCP principles — they follow the Codex Alimentarius and apply directly in Austria as in Germany. “HACCP plan” is not a legal term of its own but the common name for exactly this procedure and its documentation. Important for small businesses: the regulation is deliberately flexible. According to recital 15, in some businesses no critical control points can be identified, and good hygiene practice can replace their monitoring; the documentation has to suit the nature and size of the business. A Viennese café therefore needs no corporate manual — but it has to be able to show that it has thought its workflows through and that the checks really happen.

Before you start: five preliminary steps

The regulation starts straight with the hazards. Before that, the European Commission recommends five steps that are not explicitly laid down in EU law but lay the foundation; together with the seven principles they make up the familiar twelve-step approach.

1. 1

   Pick the team

   Who is responsible for the plan. In a small business that is often a single person, with outside help if needed.

2. 2

   Describe the dishes

   Ingredients, possible allergens, preparation, storage, shelf life.

3. 3

   Clarify use and guests

   How is the food eaten, and who eats it, for example young children or people who are ill?

4. 4

   Draw the flow

   A flow diagram from goods in to service, including waiting times.

5. 5

   Check on site

   Walk the diagram during normal operation and correct it where practice differs.

The 7 HACCP principles: in practice and in the wording of the law

Art. 5(2) of the regulation lists them under points (a) to (g). For each principle you first see what it feels like in a small business, and below it the wording of the regulation. The order is also the blueprint for the template further down.

1. 1Analyse the hazards

   Walk the path of the food once from start to finish — from the supplier to the plate — and ask at every step: what can go wrong here? Biological (germs), chemical (cleaning agents, allergens), physical (glass splinters, metal). Allergens count as chemical hazards; some businesses find it easier to keep them as a fourth group of their own, the European Commission writes.

   Example: Raw poultry and ready-to-eat salad on the same chopping board — the classic cross-contamination.

   Art. 5(2)(a): “identifying any hazards that must be prevented, eliminated or reduced to acceptable levels”

2. 2Identify the critical control points (CCPs)

   Find the steps where a hazard has to be controlled right there — if the step fails, the risk reaches the guest. If the same measure still works at a later step, the earlier one is not a CCP. In small restaurants it is often impossible to identify one at all; then good hygiene practice carries the load, justified in the hazard analysis.

   Example: A typical candidate: cooking minced meat through — after that, no step follows that kills germs.

   Art. 5(2)(b): “identifying the critical control points at the step or steps at which control is essential to prevent or eliminate a hazard or to reduce it to acceptable levels”

3. 3Set critical limits

   For each CCP a limit you can check: a temperature, a time, a visible criterion. It does not always have to be a number — recital 15 of the regulation makes that clear, and the European Commission gives cooking through, which you can see, as an example.

   Example: A core temperature when heating, or “cooked through at the cut surface” — temperatures backed by sources are in the temperature log guide.

   Art. 5(2)(c): “establishing critical limits at critical control points which separate acceptability from unacceptability for the prevention, elimination or reduction of identified hazards”

4. 4Monitor

   The ongoing check of the CCPs: measure or look, write it down, sign it — promptly, not from memory at the end of the month. Whoever monitors signs the record, as the European Commission describes it. This is the principle that makes work every day.

   Example: Read the fridges once a day before work starts — as the Austrian hygiene guideline provides — and enter the value with your initials.

   Art. 5(2)(d): “establishing and implementing effective monitoring procedures at critical control points”

5. 5Set corrective actions

   Decide BEFOREHAND what happens when a limit is breached — so that nobody has to improvise under stress: move the food, reheat it, throw it away, call a technician. Every deviation is recorded with date, time, action, person and the later check; everything produced since the last good measurement is checked.

   Example: Fridge too warm → move the food to a working appliance, have the appliance checked, record the decision about the food.

   Art. 5(2)(e): “establishing corrective actions when monitoring indicates that a critical control point is not under control”

6. 6Verify

   Check regularly whether the whole thing really works: go through the logs, check the thermometers, ask after every incident whether the action took effect. Ideally someone other than the person measuring does the checking; in a micro business, the European Commission says, the manager's ongoing eye is often enough.

   Example: Leaf through the temperature logs once a month — gaps and deviations without an action stand out at once.

   Art. 5(2)(f): “establishing procedures, which shall be carried out regularly, to verify that the measures outlined in subparagraphs (a) to (e) are working effectively”

7. 7Document

   Keep records that suit the nature and size of the business — that is literally what the regulation says. No thick manual, but: the logs have to exist, be up to date and be findable in an inspection. The form is up to the competent authority (Art. 5(4)(a)).

   Example: Temperature log, cleaning record, goods-in check, training records — kept in order in one place.

   Art. 5(2)(g): “establishing documents and records commensurate with the nature and size of the food business to demonstrate the effective application of the measures outlined in subparagraphs (a) to (f)”

Is this step a CCP? Three test questions

Whether a step is a critical control point is decided by the business's hazard analysis. The Austrian hygiene guideline sets three questions for this (chapter 3.1): a step can only be a CCP if there is a procedure there that

1. 1can be controlled technically and checked,
2. 2every unit of this food goes through without exception,
3. 3is suitable for preventing or eliminating the hazard or reducing it to an acceptable level.

The European Commission adds a rule that rules out many candidates: if the same control measure also works at a later step, the earlier one is not a CCP. And not every hot pan is one: frying or grilling in a restaurant is possibly not a CCP, because the high temperature of the oil or fat is easy to observe (notice 2022, annex II no. 6).

Review and keep: who requires what

A plan is not a document for the drawer. The regulation requires a review with every change, and the Austrian hygiene guideline also at fixed intervals.

How long to keep which log, from temperatures to training, is set out with references in the guide “How long to keep HACCP and cleaning records”.

You write the plan once — you live it every day

Of the seven principles, one makes the daily work: monitoring. Measuring temperatures, signing off cleaning, checking best-before dates — every day, every shift, with person and time on the entry. That is exactly the part Venheim takes over; the hazard analysis remains the business's own thinking.

Related