HACCP Record Keeping: What Auditors Actually Want to See

A plan is a promise. Records are the proof.

Your HACCP plan describes what you intend to do to keep food safe. Your records prove you actually did it. When an auditor sits down with you, the plan tells them what should be happening, and the records tell them whether it really is. A beautiful plan with thin records is a red flag. A modest plan backed by consistent, honest records is reassuring.

Most small producers know they should keep records. Where they struggle is knowing exactly which records matter, what good ones look like, and how long to hold on to them. Here's what auditors actually want to see.

The records that prove your CCPs are under control

These are the most important records you keep, because they relate directly to your critical control points. For every CCP in your plan, you should have monitoring records that show:

1. What was checked - the specific CCP and critical limit
2. The actual value recorded - the real reading, not "OK" or a tick
3. When it was checked - date and time
4. Who checked it - a name or initials
5. What happened if it was out of limits - the corrective action taken

That second point is where producers most often fall down. Recording "fine" or a tick tells an auditor nothing and can't be verified. Recording an actual fridge temperature of 4.1°C is evidence. The difference between a tick and a number is the difference between a record that proves control and one that proves nothing.

Corrective action records

When a check falls outside its critical limit, what you do next is at least as important as the breach itself. A corrective action record should show what went wrong, what you did about the affected product, what you did to fix the underlying cause, and who authorised it.

Auditors don't expect a perfect record with zero breaches. A log with no breaches at all over a long period can actually look suspicious, because real operations have the occasional fridge that drifts or delivery that arrives warm. What reassures an auditor is seeing that when something went wrong, you caught it and dealt with it properly. A breach with a clear corrective action is a sign of a system working, not failing.

Supporting records and prerequisite programmes

Beyond your CCPs, auditors want to see the records that support your prerequisite programmes:

• Temperature records for fridges, freezers, and hot holding
• Cleaning records showing your cleaning schedule is being followed
• Delivery and goods-in checks including temperatures of chilled and frozen deliveries
• Supplier approval records and current certificates for your approved suppliers
• Pest control records including any monitoring visits and actions
• Staff training records showing food hygiene and allergen training with dates
• Calibration records for thermometers and probes
• Traceability records that let you trace a batch one step back and one step forward

You don't need every record imaginable. You need the records that correspond to the controls in your plan. If your plan says you check delivery temperatures, there must be delivery temperature records. The plan and the records must match.

How long to keep records

For most small food businesses, the practical answer is to keep records for at least the shelf life of the product plus a margin, and as a general rule at least 12 months. Some standards and some product types require longer, particularly for products with a long shelf life. If your product has a two-year shelf life, your records need to outlast it.

The safe default for a small producer is to keep records for a minimum of one year, and longer where your shelf life or your certification standard requires it. If in doubt, keep them longer rather than shorter; storage is cheap and an auditor never complained that records went back too far.

What "good" looks like

Auditors assess records on a handful of qualities, and it's worth knowing them because they're easy to meet once you're aware of them:

1. Consistency - records completed every day, with no unexplained gaps
2. Accuracy - real values recorded, not placeholders
3. Timeliness - completed at the time of the activity, not filled in later from memory
4. Completeness - every field filled: date, time, who, what, result
5. Legibility - readable, whether handwritten or digital
6. Accessibility - findable quickly when asked, not buried in a drawer

That last point is quietly important. On audit day, being asked for a specific record from three months ago and producing it in seconds tells an auditor your system is genuinely in use. Shuffling through a folder for ten minutes tells them the opposite, even if the record exists.

Why paper records cost you on audit day

Paper records can absolutely be compliant, and plenty of excellent producers run entirely on paper. But they carry some predictable weaknesses. They can be filled in late and backdated, which auditors are alert to. They develop gaps when someone forgets. They're slow to search, and compiling them for an audit means hours of collating across folders.

Digital records remove most of these weaknesses by design. Entries are timestamped automatically, so they can't be quietly backdated. Missing checks can prompt a reminder rather than simply being forgotten. And when audit day comes, everything can be compiled instantly. FoodSafe's records are timestamped as they're entered, and its audit pack generator compiles every record, document, and certificate into a single professional PDF ready to hand to your auditor, which turns what used to be a stressful week of preparation into a single click.

The records mistake that undoes good producers

The most common way a genuinely safe producer gets caught out isn't a dangerous practice. It's a gap in the records. They were doing the right thing, but they didn't write it down at the time, or they wrote "OK" instead of a value, or they couldn't find the record when asked. From an auditor's point of view, a control you can't evidence is a control that, as far as the audit is concerned, didn't happen.

The lesson is simple: do the checks, record the real values at the time, and keep them where you can find them. That's the whole game. A plan tells the auditor what you meant to do. Your records are the only thing that proves you did.

If you're still running on paper and weighing up the switch, our guide to going paperless walks through how to migrate your records without losing your history or your nerve.

Food safety compliance, handled.