7 HACCP Principles with Practical Examples for Restaurants

HACCP is not a folder of documents sitting on a shelf. It is a way of thinking about food safety: a structured, logical system that helps you identify where things can go wrong in your kitchen and put controls in place before they do. Whether you run a restaurant, a café, or a catering company, understanding the seven principles is the foundation of everything else. This guide walks through each one with concrete examples from food service operations.

Principle 1: Conduct a Hazard Analysis

Before you can control hazards, you need to identify them. A hazard analysis means looking at every step in your food production process and asking: what could go wrong here, and how serious would it be?

There are three categories of hazards to consider:

• Biological hazards: bacteria such as Salmonella and Campylobacter in raw poultry, Listeria monocytogenes in ready-to-eat products stored at refrigerator temperatures, E. coli O157:H7 in undercooked beef, norovirus from contaminated surfaces or an ill food handler.
• Chemical hazards: cleaning agents and sanitizing chemicals not properly rinsed from surfaces or equipment, pesticide residues on fresh produce, allergens transferred from one dish to another through shared equipment.
• Physical hazards: glass fragments from a broken bottle, metal shards from a damaged sieve or grinder, bone fragments in fish or poultry, stones in dried pulses.

Map your process from goods receiving through storage, preparation, cooking, cooling, holding, and service. At each step, list the plausible hazards. Not every theoretical hazard needs to become a critical control point, but every hazard must be considered.

Principle 2: Identify Critical Control Points (CCPs)

A critical control point is a step in your process where a control measure can be applied and is essential to prevent, eliminate, or reduce a food safety hazard to an acceptable level. The key word is "critical": not every step is a CCP, only those where failure would result in an unacceptable risk to the consumer.

Practical CCP examples for a restaurant:

• Cooking poultry: the core temperature must reach at least 74°C to destroy Salmonella and Campylobacter. This is a CCP because no later step will eliminate the hazard if cooking fails.
• Cooling cooked food: cooling from 60°C to 10°C within two hours prevents the growth of spore-forming bacteria such as Clostridium perfringens. This is a CCP in any operation that cooks in advance and chills for later service.
• Goods receiving: fish arriving above 3°C, chilled meat arriving above 5°C, or damaged or unlabelled packaging are grounds for rejection. Goods receiving is a CCP because accepting out-of-specification products can introduce hazards that are difficult to eliminate downstream.

Principle 3: Establish Critical Limits

Every CCP needs a critical limit: a measurable value that separates safe from unsafe. Vague limits like "cook until hot" are not acceptable. Limits must be specific and verifiable.

Examples of critical limits:

• Poultry core temperature: minimum 74°C
• Minced meat core temperature: minimum 70°C
• Fish on delivery: maximum 3°C core temperature
• Chilled storage: maximum 5°C (0°C to 4°C for high-risk ready-to-eat products)
• Freezer storage: maximum -18°C
• Cooling: from 60°C to 10°C within 2 hours
• Hot-holding: minimum 63°C throughout the holding period

Your critical limits should be based on food science: EFSA guidance, Polish GIS (Chief Sanitary Inspectorate) guidance, or recognised food safety textbooks. Do not set limits arbitrarily.

Principle 4: Establish Monitoring Procedures

Knowing your critical limits is not enough. You need a system for checking that those limits are being met, every day, every shift. Monitoring answers four questions: who checks, what they check, how often they check it, and what instrument they use.

Practical monitoring setup:

• Cooking CCP: the cook checks the core temperature of every batch of poultry with a calibrated probe thermometer before service. The reading is recorded in the temperature log at the time of checking, not at the end of the shift.
• Refrigerator CCP: the opening manager checks and records refrigerator and freezer temperatures every morning. A digital logger provides continuous data as a backup.
• Goods receiving CCP: the person receiving the delivery checks the core temperature of chilled products, inspects packaging, and records the result in the delivery register.

Thermometer calibration is part of your monitoring system. Probe thermometers should be calibrated at least quarterly, or whenever they are dropped or give suspect readings. Record calibration checks in your HACCP documentation.

Principle 5: Establish Corrective Actions

When monitoring shows that a critical limit has been breached, you need a pre-defined response. Corrective actions must be documented, not improvised in the moment - a ready-made HACCP documentation package gives you corrective action procedures to adapt rather than write from scratch.

Examples:

• Poultry core temperature below 74°C: return the batch to the oven, re-check after a further five minutes. If the second check also fails, discard the batch. Record the incident in the corrective actions log.
• Fish delivery above 3°C: reject the delivery and record the rejection in the delivery register, noting the supplier, the measured temperature, and the action taken.
• Refrigerator above 5°C: move high-risk products to a working unit immediately. Assess whether any products have been held at elevated temperatures long enough to be unsafe. Discard if in doubt. Call the refrigeration engineer. Record everything.

The phrase "when in doubt, throw it out" is a valid corrective action, but it must be written down. Sanepid inspectors will look for evidence that you responded to failures, not just that you recorded temperatures when everything was fine.

Principle 6: Establish Verification Procedures

Verification is how you confirm that your HACCP system is actually working. It is separate from monitoring. Monitoring checks the process in real time; verification checks that the monitoring itself is adequate and effective.

Verification activities for a restaurant:

• Internal audits: monthly review of all monitoring records to check that they are being completed correctly and consistently
• Reviewing corrective action logs to look for recurring problems that suggest a systemic issue
• Swab testing of food contact surfaces to verify that your cleaning and sanitizing procedures are effective
• For operations with autoclaves (e.g., some catering operations): Sporol spore tests to verify sterilisation performance
• Reviewing the HACCP plan whenever you introduce a new dish or process to check that existing CCPs and limits still cover the new hazards

Principle 7: Establish Record-Keeping and Documentation

Documentation is both a legal requirement under EU Regulation 852/2004 and a practical tool. Without records, you cannot prove that your system is working, and you cannot investigate a problem after it occurs.

Your HACCP documentation should include the following - a complete HACCP, GMP and GHP documentation pack covers all of these elements:

• The HACCP book (księga HACCP): the permanent document containing your hazard analysis, CCP identification, critical limits, monitoring and corrective action procedures, and verification plan. See our guide at How to Fill In the HACCP Book: Step-by-Step Guide.
• Temperature registers: daily fridge, freezer, and cooking temperature logs
• Goods receiving register: every delivery recorded with supplier, date, temperature, and acceptance/rejection decision. For a template, see Delivery Register for Food Businesses: Template and Instructions.
• Cleaning and sanitizing register: daily and weekly cleaning schedules, signed off when completed
• Training records: dates of food safety training, topics covered, and names of food handlers trained
• Corrective actions log: every incident where a critical limit was breached, the action taken, and the outcome

Running registers should be kept for a minimum of two years. The HACCP book itself should be kept as long as the business operates.

Common Mistakes to Avoid

• Confusing hazard analysis with risk assessment: hazard analysis identifies what could go wrong. A formal risk assessment assigns probability and severity scores. HACCP uses hazard analysis; you do not need a formal quantitative risk assessment for a restaurant HACCP plan.
• Treating HACCP as a one-time document: your HACCP plan is a living system. If it sits in a drawer and is never updated, it does not reflect your actual operation and provides no real protection.
• Not updating when the menu changes: adding a new dish that uses raw eggs, undercooked meat, or a new allergen requires a review of your hazard analysis and CCPs before the dish goes on the menu, not after an inspection finding.
• Monitoring forms that nobody fills in: blank or retrospectively completed records are worse than no records. If your monitoring system is too burdensome to follow in practice, simplify it so that it gets done.

Frequently Asked Questions

Does a small bistro need full HACCP?

Yes, but the system can be proportionate to the size and complexity of your operation. EU Regulation 852/2004 requires all food businesses to implement and maintain hygiene procedures based on HACCP principles. For very small operations, a simplified approach using pre-requisite programmes and a basic hazard analysis is acceptable, but you still need documented procedures and records.

Can I do HACCP myself or do I need a food technologist?

You can do it yourself if you understand the principles and have time to do it properly. Many small operators use ready-made templates (like those from GastroReady) and adapt them to their own menu and processes. A food technologist is useful if your menu is complex, you have multiple CCPs, or you want someone to verify that your plan is technically correct. Expect to pay PLN 500 to 2,000 for a professionally prepared HACCP book.

How often do I update the HACCP plan?

Update your HACCP plan whenever you: add or remove dishes, change suppliers, install new equipment, change processes, or receive an inspection finding that identifies a gap. As a minimum, review the plan annually to check that it still reflects your operation.

What does the Sanepid inspector check in the HACCP file?

Inspectors typically check: that a hazard analysis has been carried out, that CCPs have been identified with documented critical limits, that monitoring records are being completed consistently and correctly, that corrective actions have been recorded when limits were breached, and that staff training records are up to date. An incomplete or generic plan that does not reflect your actual menu will be flagged.