How to Write a HACCP Plan for a Small Kitchen

I've written HACCP plans for a 400-cover banquet operation and for a six-seat private-dining setup run out of a converted domestic kitchen. The banquet plan was thirty pages. The private-dining one was two. Both passed audit. The difference wasn't rigour — it was scope. A small kitchen has fewer processes, fewer hazards, and fewer places to hide a shortcut, which is exactly why writing its plan is simpler than the consultants who sell templates want you to believe.

The mistake most small operators make is buying a generic plan, printing it, signing it, and shelving it. An auditor spots that in about ninety seconds, because the plan describes equipment you don't own and steps you don't do. A plan you wrote yourself, even a clumsy one, beats a polished template every time — because it matches your kitchen and because you can explain it when someone asks.

HACCP — Hazard Analysis and Critical Control Points — is seven principles. That's it. Below I'll walk each one in plain language, sized for an operation with one or two cooks and a menu you can hold in your head. The framework is the same one the US FDA lays out in its HACCP Principles & Application Guidelines, which itself follows the Codex Alimentarius standard used worldwide. You don't need to read the source document to write your plan, but it's there if an auditor challenges your interpretation.

First, the ground you build on: prerequisite programs

Before principle one, there's a layer HACCP assumes you already have. These are your prerequisite programs — the everyday hygiene disciplines that stop most hazards before they ever become a control point. Skip these and your HACCP plan is a roof with no walls.

For a small kitchen, three prerequisites carry most of the weight:

• Cleaning and sanitising. A written schedule — surface, frequency, chemical, dilution, who signs. Clean removes soil; sanitise kills what's left. They're two steps, not one. If your plan can't say when the slicer was last broken down and sanitised, that's a gap an inspector will find.
• Pest control. Proofing, a bait-station map if you use a contractor, and a log of sightings. One mouse dropping near the flour bin turns a good inspection bad.
• Supplier and delivery control. Approved suppliers, and a receiving check at the door — temperature, packaging, date codes. Your cold chain is only as strong as the moment goods cross the threshold.

Get these running as normal habits and the HACCP plan on top of them stays short, because most of your hazards are already handled by good practice. The plan then only has to control the few steps where good practice alone isn't enough proof.

Principle 1 — Conduct a hazard analysis

Walk your menu from delivery to plate and, at every step, ask one question: what could make someone ill here, and is it likely enough to matter? Hazards come in three types — biological (bacteria, viruses), chemical (cleaning agents, allergens, toxins), and physical (glass, bone, metal). For most small kitchens, biological hazards from temperature abuse are the giant; the other two are real but rarer.

The trap here is listing everything. A hazard analysis that flags forty risks is useless, because you can't monitor forty things during a Friday service. The discipline is to separate significant hazards — reasonably likely to occur and capable of causing real harm — from the trivial. A splinter of packaging is a hazard; it is not a significant one if you visually check on receiving. Salmonella surviving in undercooked chicken is significant, full stop.

Principle 2 — Determine the critical control points

A critical control point (CCP) is a step where you can apply control and it's essential to prevent or eliminate a significant hazard — a step where, if you get it wrong, there's no later step to catch it. That last clause is the filter. Chilling is a CCP because nothing downstream fixes food that sat in the danger zone too long. Garnishing is not a CCP, because it controls nothing biological.

Codex publishes a decision tree for this, and it's worth using once to train your instinct, but for a small hot-and-cold menu the CCPs almost always land on the same handful of steps:

Notice most of these are temperature steps. That's not an accident — in a small kitchen, temperature is where the real risk lives, and it's also the one thing you can measure with a £15 probe. Keep your CCP list tight. Four to six is normal for a small operation. If you've written twelve, you've mislabelled some prerequisites as CCPs.

Principle 3 — Establish critical limits

Every CCP needs a number that separates safe from unsafe. Not "hot enough" — a figure, from your local food code. These are the ones most kitchens work to (check your own jurisdiction; the UK, EU, US and Gulf codes differ by a degree or two):

A critical limit has to be measurable in real time. "Chicken looks done" is not a critical limit; "core temperature ≥ 75 °C held for 30 seconds" is. The whole point is that you can stand at the station, probe the thickest part, read a number, and know instantly whether you passed or failed. If you can't measure it during service, it isn't a usable critical limit — rewrite it until it is.

Principle 4 — Establish monitoring

Monitoring answers three questions for each CCP: what you measure, how often, and who does it. For temperature CCPs this is a calibrated probe and a log. For a small kitchen the frequency should be realistic — you will not probe every single portion, and a plan that says you will is a plan you'll be caught lying about.

Set frequencies you can actually keep: fridge and freezer temps twice a day (open and close), cooking probed on the first batch of each protein and spot-checked after, cooling logged at the two checkpoints, hot-holding checked at the start of service and every two hours. Write those frequencies into the plan, then keep to them. Calibrate the probe — ice water should read 0 °C, boiling water 100 °C (adjust for altitude) — and log the calibration, because an auditor will ask when you last did it.

Principle 5 — Establish corrective actions

Monitoring will, eventually, catch a failure. The plan has to say — in advance — what you do when it happens. A CCP without a written corrective action is half a control. Two things always get recorded: what you did to the food, and what you did to stop it recurring.

Worked example. The walk-in reads 9 °C at morning open. Your critical limit is ≤5 °C. Your corrective action, written before it ever happened, might be:

1. Probe the actual food, not just the air. Product core still ≤5 °C and door was ajar overnight? Move it, close the door, monitor recovery.
2. Food core above 8 °C with unknown duration? Discard it. A £40 loss is cheaper than a food-poisoning claim, every time.
3. Log the reading, the action, the disposal, and — this is the part people skip — the fix: door seal replaced, engineer called, staff retrained on the close-down check.

The corrective-action record is the single thing auditors scrutinise hardest, because a range-exceeded reading with a blank action box tells them your monitoring is decorative. A failure caught, acted on, and closed out shows the system working. Auditors would rather see three corrective actions handled well than a suspiciously perfect log with none.

Principle 6 — Establish verification

Monitoring proves the CCP was in control today. Verification proves the whole system is working over time — it's you checking the checker. In a big operation this is a quality manager and third-party labs. In a small kitchen it's you, once a week and once a year, doing three concrete things:

• Review the logs weekly. Are they complete? Any gaps? Any pattern of near-misses on one fridge? Sign the review — that signature is your verification record.
• Re-calibrate probes on a set schedule and after any drop.
• Reassess the plan whenever the menu, equipment, or suppliers change — and at least once a year even if nothing did. New dish with a new cooling step? The plan is out of date the day it goes on the menu.

Verification is the principle small operators forget, because monitoring feels like enough. It isn't. Monitoring is the reading; verification is the audit of your own readings. Without it, you can log religiously and still not notice that the same freezer has crept up half a degree a week for two months.

Principle 7 — Record-keeping

The last principle is the one everyone thinks HACCP is: the paperwork. It's actually the smallest, if you set it up right. Records exist for one reason — to prove, after the fact, that your controls ran. If you can't prove it, in law and in an auditor's eyes, it didn't happen.

Here's the honest split between paperwork you genuinely need and paperwork that's theatre:

The theatre column is worse than useless — it eats time you could spend cooking and, when it's obviously copied or back-dated, it actively damages your credibility with an inspector. Keep the records that prove control. Bin the rest.

How long to keep them? Follow your local rule, but a practical default is the shelf life of the product plus a margin, or a rolling twelve months for daily logs — long enough to cover an investigation into an illness reported weeks after a meal.

A worked flow for a small menu

Let's make it real. Say your menu is a roast-of-the-day, a soup batch-cooked and reheated to order, and a cold mezze plate. Three flows, and the entire HACCP plan falls out of them:

• Roast (cook-serve): receive (CP) → cold store (CCP, ≤5 °C) → cook (CCP, core ≥75 °C) → hot hold or serve (CCP, ≥63 °C). Monitor: first-batch probe, holding every 2 h.
• Soup (cook-cool-reheat): cook (CCP, ≥75 °C) → cool (CCP, 60→21 °C in 2 h, →5 °C by 6 h) → cold store (CCP) → reheat to order (CCP, ≥75 °C). This flow has the most CCPs because it re-enters the danger zone twice — it deserves the most attention.
• Mezze (cold prep): receive (CP) → cold store (CCP) → prep and cold hold (CCP, ≤5 °C). No cook step, so the whole risk is temperature and cross-contamination; allergen segregation is the chemical hazard here.

That's the entire plan in three lines. The soup flow tells you cooling is your highest-risk process — which is exactly why it's the one most likely to fail an audit, and worth its own detailed procedure. Everything else is receiving, storage, and cooking, all handled by habits you should already have.

What "done" looks like

A finished small-kitchen HACCP plan is a few pages: a one-line description of your operation, your prerequisite programs, a hazard analysis grouped by flow, a CCP table with limits and monitoring, your corrective actions, and how you verify. Behind it sit the daily logs. That's a complete, defensible food safety plan for a small restaurant — and it's genuinely writable in an afternoon if you know your own menu.

Don't let the word HACCP make it bigger than it is. The seven principles are just a structured way of asking where food can hurt someone, deciding how you'll stop it, and keeping proof you did. The kitchens that fail audits rarely fail on the plan's design. They fail because the plan was somebody else's, or because the logs stopped in March.

"The auditor didn't read my plan front to back. She opened the temperature logs, found a gap in the middle of a busy month, and asked what happened that week."

Write your own plan, keep it short, and keep the logs alive. A two-page plan you follow beats a fifty-page one you signed and shelved. Every time.