The 12 Steps of HACCP: A Plain-English Guide for Small UK Producers

Why 12 steps, not 7?

Most people who've heard of HACCP know about the 7 principles. But the full Codex Alimentarius methodology - the one SALSA auditors and food safety professionals actually use - has 12 steps. The first 5 are preparatory steps that set the foundation. The remaining 7 are the principles themselves.

If you're building a HACCP plan for a SALSA audit, a BRCGS audit, or simply to meet best practice, you need all 12. Here's what each one involves in plain English.

Step 1: Assemble your HACCP team

Before you write anything, decide who's responsible for your HACCP plan. In a small business, this might just be you - the owner. That's fine. What matters is that the people responsible for the plan have enough knowledge of your products, processes, and food safety to make informed decisions.

Your HACCP team should include:

• A team leader - the person who owns the plan and drives the process
• Someone with food safety knowledge - this could be the same person, or someone with a Level 3 food safety qualification
• People who know the production process - the people who actually make the food every day

For a business with 3-5 employees, your HACCP team might be two people. For a solo producer, it's you - but you should document that you sought external expertise where needed (a consultant, a mentor, or an AI tool like Sage).

Document your team: names, roles, qualifications, and what each person contributes to the HACCP plan.

Step 2: Describe your products

Write a detailed description for every product you make. This isn't your marketing blurb - it's a technical document that captures everything relevant to food safety.

For each product, document:

1. Product name - the full name as it appears on your label
2. Composition - all ingredients, including processing aids and additives
3. Physical and chemical characteristics - pH, water activity (Aw), salt content, preservatives - anything that affects how the product behaves microbiologically
4. Processing method - how the product is made (cooked, fermented, cured, raw, etc.)
5. Packaging - type of packaging, modified atmosphere if used, vacuum sealed, etc.
6. Storage conditions - ambient, chilled, frozen, and at what temperature
7. Shelf life - how long the product is safe to eat under the stated storage conditions
8. Distribution method - how you get the product to your customer (chilled delivery, ambient courier, customer collection)
9. Allergens - all 14 UK declarable allergens present in the product

This step takes time if you have many products, but it's essential. Your hazard analysis in later steps depends entirely on understanding what you're making.

Step 3: Identify intended use

Who is going to eat your product, and how? This matters because different consumers carry different levels of risk.

Document:

• Target consumer - general public, or a specific group?
• Vulnerable groups - is the product suitable for young children, elderly people, pregnant women, or immunocompromised individuals? If so, you may need stricter controls.
• Expected use - will the consumer eat it as-is, cook it first, or reheat it? This affects which hazards you need to control.
• Potential misuse - could someone reasonably use the product in a way you didn't intend? For example, eating a "cook before eating" product without cooking it.

Step 4: Construct a process flow diagram

Draw a visual map of every step your product goes through, from receiving raw materials to dispatching the finished product. Include:

1. Receiving and inspection of raw materials
2. Storage (ambient, chilled, frozen)
3. Preparation (weighing, mixing, cutting)
4. Processing (cooking, baking, fermenting, curing)
5. Cooling
6. Packaging
7. Labelling
8. Storage of finished product
9. Dispatch and distribution

Include any recycling loops (rework), waste disposal points, and points where different products share equipment or space.

The flow diagram doesn't need to be artistic. A simple box-and-arrow diagram is perfectly acceptable. What matters is that it accurately represents what actually happens in your production process.

Step 5: Verify the flow diagram on-site

This step is often overlooked but it's important. Walk through your production process with your flow diagram in hand and check that what you've drawn matches reality.

Things to verify:

• Does the sequence actually match what happens on the production floor?
• Are there any steps you missed?
• Are there any cross-over points where different products or processes interact?
• Does the layout of your premises match the flow you've described?

If you find differences, update the diagram. Sign and date the verified version.

Step 6: List all potential hazards (Principle 1)

This is where the real work begins. For every step in your flow diagram, identify every potential hazard - anything that could make the food unsafe.

Hazards fall into four categories:

1. Biological - bacteria (Salmonella, Listeria, E. coli, Campylobacter), viruses (Norovirus, Hepatitis A), parasites, moulds, yeasts
2. Chemical - cleaning chemicals, pesticide residues, allergens, heavy metals, veterinary drug residues, natural toxins (mycotoxins, histamine)
3. Physical - metal fragments, glass, stones, plastic, wood splinters, hair, insects, bones
4. Allergen - any of the 14 UK declarable allergens that could be present or cross-contaminate

For each hazard, assess:

• Likelihood - how likely is this hazard to occur at this step? (Low, Medium, High)
• Severity - if it did occur, how serious would the health consequence be? (Low, Medium, High)
• Risk score - likelihood x severity gives you a risk rating

This produces your hazard analysis table - one of the most important documents in your HACCP plan.

Sage, FoodSafe's AI food safety expert, comes with 98 pre-verified hazards across all four categories. When you describe your production process, Sage applies the relevant hazards automatically using deterministic food safety logic - so you don't miss anything and the risk scoring is consistent.

Step 7: Determine Critical Control Points (Principle 2)

Not every hazard needs a CCP. A CCP is a point in your process where you can apply a control that is essential to preventing, eliminating, or reducing a hazard to an acceptable level.

The standard method for determining CCPs is the Codex decision tree - a series of yes/no questions for each significant hazard:

1. Do control measures exist for this hazard?
2. Is this step specifically designed to eliminate or reduce the hazard to an acceptable level?
3. Could contamination occur at this step, or increase to an unacceptable level?
4. Will a subsequent step eliminate or reduce the hazard?

Common CCPs in small food production include:

• Cooking - achieving core temperature to kill pathogens
• Chilling/cooling - reducing temperature to prevent bacterial growth
• Metal detection - removing physical contaminants before packing
• pH control - in fermented or acidified products

Most small producers will have 2-5 CCPs. If you're identifying 15 or more, you're probably confusing CCPs with prerequisite programmes (general hygiene controls that apply across the board).

Step 8: Establish critical limits for each CCP (Principle 3)

Every CCP needs a measurable critical limit - a boundary that separates safe from unsafe.

Examples:

• Cooking CCP: core temperature must reach 75°C
• Chilling CCP: product must reach below 8°C within 4 hours
• Metal detection CCP: detector must identify ferrous particles of 1.5mm or larger
• pH CCP: product pH must be below 4.6

Critical limits must be measurable and validated. "Cook until done" is not a critical limit. "Core temperature of 75°C" is.

Step 9: Establish monitoring procedures (Principle 4)

For each CCP, define how you'll check that the critical limit is being met:

• What will be monitored? (Temperature, pH, time, visual check)
• How will it be monitored? (Probe thermometer, pH meter, timer, metal detector)
• When/how often will it be monitored? (Every batch, every hour, continuously)
• Who is responsible for monitoring?

Monitoring must be documented. Every check, every reading, every time.

Step 10: Establish corrective actions (Principle 5)

When a critical limit is breached, what happens? Define the corrective action for each CCP before it's needed - not in the moment of crisis.

For each CCP, document:

1. Immediate action - what to do with the affected product (hold, rework, dispose)
2. Investigation - determine the cause of the breach
3. Fix - correct the problem so the CCP is back under control
4. Prevention - what changes will prevent this from happening again
5. Recording - document the breach, the action taken, and the outcome

FoodSafe's notifications module automatically creates a corrective action record when a critical limit breach is detected, linking it to the specific reading and prompting the responsible person through the resolution process.

Step 11: Establish verification procedures (Principle 6)

Verification confirms that your HACCP system is actually working. This is different from monitoring (which checks individual CCPs) - verification looks at the system as a whole.

Verification activities include:

• Internal audits - periodic review of your entire HACCP system
• Record review - checking that monitoring records are complete and consistent
• Equipment calibration - ensuring your measuring instruments are accurate
• Product testing - occasional microbiological testing of finished products
• Complaints review - analysing customer complaints for food safety trends
• HACCP plan review - annual review of the plan itself, plus a review whenever products, processes, or premises change

Step 12: Establish documentation and record keeping (Principle 7)

Everything in your HACCP plan needs to be documented. The plan itself. The monitoring records. The corrective actions. The verification activities. All of it.

Your documentation should include:

• The HACCP plan - all the documents produced in steps 1-11
• Monitoring records - temperature logs, CCP checks, cleaning records
• Corrective action records - breach reports, investigation outcomes, preventive actions
• Verification records - internal audit reports, calibration certificates, test results
• Modification records - any changes to the plan, when they were made, and why

Keep records for a minimum of 12 months, or product shelf life plus 12 months - whichever is longer.

FoodSafe's digital record-keeping system handles this automatically. Every temperature check, every breach, every corrective action is timestamped, stored securely, and available for audit at the click of a button.

Putting it all together

Twelve steps sounds like a lot. But when you break it down, each step is logical and builds on the one before it. The first five steps are about understanding your products and processes. The seven principles are about identifying risks and putting controls in place.

For a small producer making a handful of products, you can work through the entire methodology in a matter of days - not months. And if you use Sage on FoodSafe, the conversation guides you through each step naturally, producing the documentation as you go.

The result is a HACCP plan that's genuinely yours - built from your products, your processes, your specific hazards. Ready for your SALSA auditor, your EHO, or simply your own peace of mind.

Food safety compliance, handled.