HACCP Made Easy: How Small Food Producers Can Create a Food Safety Plan That Passes Any Audit

Introduction

If you're a small food producer in the UK gearing up for SALSA certification or just trying to stay on the right side of food safety law, you’ve likely heard the term HACCP. Don’t worry if it sounds complex – think of it as simply making a food safety plan for your business.

HACCP (Hazard Analysis and Critical Control Point) might be a legal requirement, but it’s also a practical tool to keep your customers safe and your product quality high​. In fact, SALSA (Safe and Local Supplier Approval) certification centres around having a solid HACCP-based system in place to prove you produce safe, legal food.

The good news is that HACCP doesn’t have to be overwhelming. With a bit of guidance (and maybe a cup of tea), even a time-strapped jam maker or local bakery can put together a HACCP plan that will impress any auditor.

In this post, we’ll walk you through HACCP in a friendly, step-by-step way – like a mentor guiding you. We’ll break down the process into simple steps, explain key terms in plain English, and give examples from real small food businesses (think a jam maker, a bakery, or a deli) to show how it works in practice. By the end, you’ll see that creating a HACCP plan for a small business is absolutely doable. Let’s get started on making food safety easy!

Why a HACCP and SALSA Matter for Small Producers

So, why all the fuss about HACCP? First, it’s the law. If you run a food business of any size, UK regulations say “you must have a plan based on the Hazard Analysis and Critical Control Point (HACCP) principles.” This food safety plan (another way to say HACCP plan) is your roadmap for keeping food safe from farm to fork. It helps you identify what could go wrong and how to prevent it. In practical terms, a HACCP-based system is what environmental health officers or SALSA auditors will ask to see when assessing your business.

SALSA certification, in particular, was created for small and micro food producers like you. SALSA’s standards mirror legal requirements and good practices – and guess what one of their core sections is? You got it: HACCP & Management Systems. This means to pass a SALSA audit, you need to demonstrate a working HACCP plan covering your production.

SALSA auditors will check that you’ve thought through your hazards, have controls in place, and keep records to prove it. It might sound like extra paperwork, but it’s really about showing that you run a safe, professional operation. Plus, having SALSA (or simply a strong food safety plan) can open doors to new buyers and give you and your customers peace of mind.

Alright, now that we know HACCP is important, let’s break it down into bite-sized steps. Remember: HACCP is basically a common-sense approach to food safety, written down. You’re probably already doing a lot of this intuitively – we just need to structure it. Here’s how to create a HACCP plan, step by step.

Step 1: Identify Hazards in Your Process

Hazards are anything that could make your food unsafe to eat – essentially, things that could go wrong and harm a customer. In plain English, a hazard could be a type of contamination or something dangerous in your product. There are three main types of food safety hazards:

1. biological (harmful bacteria or other microbes),

2. chemical (e.g. cleaning chemicals or allergens getting into food),

3. physical (foreign objects like glass or metal)​

At this stage, you don’t need fancy terms; just ask yourself, “What could go wrong at each step of making my product, and what could contaminate or spoil the food?”

• Make a list of your steps: Write down every step in your production process, from receiving ingredients to cooking, cooling, packaging, and storage. For a jam maker, steps might include: receiving fruit, washing and chopping, cooking/boiling, filling jars, sealing, labeling, and storing. For a bakery, you’d list steps like mixing, baking, cooling, decorating, packaging, etc. A deli producer (say, making ready-to-eat sandwiches or salads) would list steps such as chilling ingredients, prepping (slicing, assembling), cold storage, and so on.

• Identify hazards at each step: Now think about what hazards could appear at each step.

  
  

  For our jam maker example: during fruit receiving, a hazard could be spoiled or dirty fruit (a biological hazard); during cooking, the hazard might be not cooking the jam hot enough to kill moulds or bacteria; during jarring, a physical hazard could be glass chips from jars.

  
  

  In a bakery: during mixing, a hazard might be forgetting to declare an allergen (like nuts) in a recipe; during baking, a biological hazard could be undercooking (surviving bacteria), and a physical hazard might be something like a piece of equipment (e.g., a broken mixer blade) ending up in the dough.

  
  

  For a deli producer: a major hazard is bacterial growth if foods aren’t kept cold (imagine sandwich fillings sitting at room temp too long), or cross-contamination from raw meat to ready-to-eat items. Write down each hazard you can think of next to the step. At this point, list all reasonable hazards – you will later decide which are significant.

By identifying hazards, you’re doing the “HA” (Hazard Analysis) of HACCP. This first step is all about being aware of what could go wrong. Don’t get anxious about the number of hazards – many are prevented by basic hygiene and good practices you likely already follow. The key is to be thorough. A little time spent thinking here means fewer surprises later.

Step 2: Determine Your Critical Control Points (CCPs)

Now that you have a list of hazards, the next step is to figure out which ones are critical to control – these points in your process are your Critical Control Points (CCPs).

A CCP is a step where you must act to prevent or eliminate a food safety hazard, or reduce it to a safe level. In other words, if something goes wrong at a CCP and you don’t catch it, someone could get sick. Not every step will be a CCP – only those where a hazard is not controlled before or after that step.

Think of CCPs as the essential “checkpoints” in your process. Here’s how to identify them in plain language:

• Review your hazard list and ask: “At which steps do I absolutely need to control the hazard to keep food safe?” These are usually steps where you can either kill a hazard or prevent it decisively.

  
  

  For example, for the jam maker: the cooking/boiling step is likely a CCP for biological hazards, because boiling the jam to a certain temperature will kill harmful organisms and ensure the product is shelf-stable. If the jam isn’t cooked sufficiently, it could spoil or grow bacteria when jarred – so cooking is critical. Another CCP might be the final pH or sugar concentration of the jam (since jam safety relies on high sugar or acidity), but to keep it simple, let’s focus on cooking temperature as the CCP.

  
  

  In the bakery example: if you make meat pies, the baking step where the filling reaches a safe internal temperature is a CCP (to destroy bacteria like salmonella). If you only bake bread or cakes (no risky fillings), you might not have a cooking CCP for pathogens, instead a more relevant CCP would be allergen control. For instance, if you make both gluten-free and regular products, the point at which you segregate ingredients to avoid gluten cross-contact could be considered critical.

  
  

  For a deli producer: keeping products cold is usually a CCP. The step where sandwiches or salads go into refrigeration is critical to prevent bacterial growth. Also, if you cook any ingredient (like roasting a chicken for a sandwich), the cooking step would be a CCP.

  
  

• Prioritise significant hazards: If a hazard can be controlled by a prerequisite program or standard practice (like cleaning or using food-grade materials), it might not need to be a CCP. CCPs are for the big stuff.

  
  

  For our purposes, focus on obvious critical steps: cooking, cooling/refrigeration, hot holding, or anything that is a last line of defence.

  
  

  For example: a jam producer might say, “Cooking to the right temperature is my CCP.” A sandwich maker might say, “Keeping my ingredients below 5°C is a CCP.”

  
  

  A baker might identify, “Making sure no nuts get into my nut-free cookies is critical, so my ingredient control/allergen procedure at mixing is a CCP.” Each business will have its own CCPs depending on the process. Most small producers end up with just a few CCPs (often 1 to 3) – and that’s fine. It’s better to have a few well-managed CCPs than to call everything a CCP.

  
  

By the end of this step, you should mark on your process flow which steps are CCPs and which hazards they control. These are the points you will monitor very closely to ensure safety.

Step 3: Set Critical Limits and Monitoring Procedures

For each CCP, you need to establish critical limits and monitoring. This sounds technical, but it’s basically setting a safety threshold and deciding how you will check it.

• Critical Limit: This is the maximum or minimum value that must be met to keep the food safe at that CCP. In plain terms, it’s the line in the sand that separates safe from potentially unsafe.

  
  

  For example, our jam maker will set a critical limit for the cooking CCP, such as “Boil jam to at least 105°C for 5 minutes” (or perhaps a target finish temperature or Brix level that ensures the jam’s water content is low enough to prevent microbial growth).

  
  

  For a bakery with a cooking CCP (like baking pies), a critical limit might be “Centre of pie reaches 75°C” (to ensure any bacteria are killed). For an allergen control CCP, a critical limit might be qualitative, like “No undeclared nuts present” – which is ensured by a strict process (though allergen controls are often managed as prerequisite programs rather than CCPs, you can still set a clear rule such as using separate color-coded utensils).

  
  

  In the deli scenario with a refrigeration CCP, the critical limit could be “Fridge must stay at 5°C or below at all times”. If you’re curing or fermenting foods, a critical limit could be a pH or water activity value that must be achieved. Essentially, ask: “What measurement or condition will tell me this step controlled the hazard?” – that measurement is your critical limit.

  
  

• Monitoring: Now decide how you will check that limit is met and how often. Monitoring needs to be a regular activity, either every batch, every day, or continuously – it depends on the step.

  
  

  For the jam maker, monitoring could be checking the jam temperature with a thermometer each batch and writing it in a log. Or it might be using a refractometer to ensure the sugar concentration is high enough.

  
  

  For the bakery, if the CCP is baking temp, you might probe the internal temperature of a sample pie from each batch. If it’s allergen control, monitoring might be supervising cleaning and doing a quick swab test or visual check before starting the nut-free batch.

  
  

  For the deli producer with a fridge CCP, monitoring could be as simple as checking and recording fridge temperatures twice a day. Some use digital thermometers or alarms that monitor continuously – use whatever fits your resources. The key is to consistently check that the critical limit is not being breached.

  
  

• Who and How: Assign responsibility – who will do the monitoring and with what tool or method. If it’s just you, then it’s on you to remember to take that temperature or verify that step each time. Create simple forms or checklists to remind yourself to do it. For example, have a daily log sheet for “Jam Boil Temp” and “Fridge AM/PM Temp”, etc.

  
  

Setting clear limits and monitoring procedures might feel like extra work, but it ensures you catch any problems in real time. And come audit day, this will shine: you can show the auditor your logs to prove every batch was cooked safely or the fridge was always cold – exactly what they want to see.

Step 4: Establish Corrective Actions (What to Do If Something Goes Wrong)

Even with the best plan, things can occasionally go off track. A corrective action is the step you’ll take to fix a problem if your monitoring shows that a critical limit wasn’t met. In simple terms, corrective actions are your “plan B” for when a CCP goes out of control. This way, a slip-up doesn't turn into a food safety disaster.

Ask yourself for each CCP: “If this goes out of spec, what will I do with the product and how will I correct the process?”

• For the jam maker: Suppose you check the jam and the temperature only reached 90°C, not the 105°C you required. The corrective action could be “re-boil the jam until it hits the target temperature, then re-check.” If you can’t achieve it or you’re not confident, the action might be “do not sell that batch”. The plan might also include investigating why it happened (e.g., the thermometer was faulty or the batch was too large for the pot), but the immediate action is what matters to keep food safe. Another example: if you find a cracked jar (physical hazard) during filling, your corrective action is “stop, remove the affected product and any adjacent jars (in case of glass shards), and only continue when area is cleared and safe”. Essentially, stop the line, fix or remove the issue, and make sure the product is safe before resuming.

• For the bakery: If your oven probe shows a pie only reached 70°C internal instead of 75°C, the corrective action is “cook it longer until 75°C is reached, then re-check another one”. If for some reason a batch can’t be fully cooked (oven broke, etc.), you’d discard that batch rather than risk undercooked product reaching customers. If your issue is allergen cross-contact (say you discover mid-process that a spoon used had traces of nuts), the corrective action could be “halt production, segregate or discard any possibly contaminated product, clean down thoroughly, then resume”. Also, perhaps alert customers if product went out with an undeclared allergen – but ideally your checks prevent that far earlier.

• For the deli: If the fridge temperature log shows it went up to 10°C for two hours (maybe someone left the door ajar), the corrective actions might be: “Move the food to a working fridge or cooler with ice immediately, call maintenance for the fridge, and assess the food.” Potentially, discard any high-risk food that has been in the danger zone too long. Basically, restore control (get the temperature down) and deal with the possibly affected food (don’t use anything unsafe). Then note what you did in your record.

  
  

Each CCP should have a clear corrective action written in your plan. The mindset to have is: no plan is fool proof, so be ready with a fix. Auditors love to see that you’ve thought about “what if” scenarios. It shows you are proactive and prepared. Also, if you ever do have to take a corrective action, write down what happened and what you did about it. These records will be part of your HACCP documentation and demonstrate that issues are handled properly (and hopefully prevented from recurring).

Step 5: Verify the Plan and Keep Records

This last part of HACCP often gets forgotten by busy small businesses, but it’s crucial: verification and record-keeping. In short, you need to verify that your HACCP plan is working as intended, and you need to document the whole system (the plan itself and the day-to-day records of checks). A food safety plan isn't just a one-time exercise – it should become part of your routine. Here’s how to tackle this:

• Verification (Proving it works): Verification is like a regular check-up on your HACCP system. It means doing things like reviewing your records, inspecting your operations, or testing your product to make sure all your hazard controls are actually effective. For a small business, verification can be simple. For example, review your monitoring logs weekly to ensure all temps were in range and corrective actions were taken when needed.

  
  

  If you’re a jam maker, you might periodically test and verify the pH or water activity is in the safe range, or just taste and check that seals are holding (no spoilage).

  
  

  A bakery might do a monthly allergen swab test on equipment to verify cleaning is effective (especially if dealing with allergens).

  
  

  A deli might do a self-audit checklist every quarter to ensure the fridges, cleaning, and procedures are all in good shape.

  
  

  Also, an annual review of the whole HACCP plan is wise – update it if you introduce a new product or process, or if something in your business changes. SALSA auditors, for instance, will look to see that you are keeping the plan up-to-date and that you validate your controls. Essentially, ask “Is my plan still effective and being followed?” and “Have there been any changes or incidents that show I need to tweak it?”.

  
  

• Record-Keeping: This is the proof that you are following your food safety plan. As the saying goes, “if it isn’t written down, it didn’t happen.” Auditors and inspectors will request to see your records. What records? At a minimum, keep:

  • Monitoring logs for each CCP (e.g. cooking temperature record, fridge temperature log, etc., with date, time, result, and any corrective action noted).

  • Verification records such as internal audit checklists, calibration records for your thermometer (even if just noting that you tested it in boiling water monthly), or lab test results if any.

  • HACCP plan document itself – a written summary that includes your hazard analysis, identified CCPs, critical limits, monitoring and corrective actions, plus who is responsible. This can be a simple table or several pages – whatever makes sense for you. Keep it tidy and accessible.

  • Prerequisite program records (if any) – like cleaning schedules, pest control logs, staff training records. These support your HACCP plan by showing basic hygiene is managed.

    
    

For documentation, templates are your friend. You don’t need to design everything from scratch. You can find simple HACCP plan templates online (for example, the Food Standards Agency provides a free HACCP plan template and even a web tool called “MyHACCP” to guide small businesses through writing a plan ​food.gov.uk).

A template will typically have a table where you can fill in your hazards, controls, CCPs, etc. There are also generic HACCP examples for jam, baked goods, etc., that you can use as a starting point – just make sure to customise them to match what you do. For daily records, print out or create basic forms. For instance, a one-page fridge log with days of the week, or a cooking log sheet where you jot down the batch number and final cook temperature. Keep these sheets in a binder or folder labelled “Food Safety Records” or similar. Or better yet, use a digital tool like FoodSafe to simply and efficiently track and record all this critical data.

Practical tips for managing documentation:

• Set aside a few minutes each day to fill in your logs. It’s much easier than trying to backfill data at month-end.

• If you prefer digital, you can use a spreadsheet or a notes app on a tablet – but ensure it’s backed up and accessible for an audit (some auditors still love paper, but digital is acceptable if organized).

• Use checklists for things like opening/closing hygiene checks – many small producers tape these checklists on the wall and tick them daily.

• Don’t overcomplicate it. Record what matters: the safety-critical info. For example, you don’t need to record every detail of production – just those related to your controls (e.g., you don’t need a log for “mixing time” if it’s not safety-related).

  
  

By verifying and documenting, you’ll not only be audit-ready but also more confident in your operation. You can sleep at night knowing you have proof that your food safety plan is working. Plus, if an issue ever arises, your records help you pinpoint what went wrong and show that you handled it responsibly.

Wrapping Up: You’ve Got This! (And We’re Here to Help)

Crafting a HACCP plan might have sounded scary at first, but look how far you’ve come – it’s really about breaking down the process and applying common-sense actions to ensure food safety. Whether you’re boiling jam, baking bread, or assembling deli treats, the principles are the same. You identify what could go wrong, put measures in place to prevent it, and keep evidence that you’re doing things right.

With this approach, your HACCP plan will serve as a robust food safety plan for your small business, satisfying SALSA auditors and environmental health officers alike.

Remember, even the best of us continuously learn and improve. HACCP is meant to be a living process. Start simple and build on it. If at any point you feel stuck or unsure, that’s completely normal – and help is available. Many small producers have been in your shoes and achieved SALSA certification or passed inspections with flying colours after getting a little guidance.

If you're building out your HACCP plan and looking for a smarter way to stay compliant, FoodSafe is here to support your process. Our platform is purpose-built to help small food producers record and manage all the essential data required for audits and certification. From our structured Record Sheets to our centralised Document Module, everything is designed to keep your food safety compliance organised, accessible, and audit-ready - all in one place.

Let FoodSafe help you stay on top of the paperwork and daily records that prove your commitment to safety. Sign up today and turn food safety into one less thing to worry about. You’ve got this - and we’ve got your back.

Get Started. It's FREE!