How to Write HACCP Step by Step — Complete 2026 Guide (with Free Template)

Writing HACCP documentation from scratch can feel overwhelming — especially if you're opening your first restaurant or catering business in Poland. But HACCP is not optional: EU Regulation 852/2004 on the hygiene of foodstuffs requires all food business operators to implement and maintain a food safety management system based on HACCP principles. The good news is that a well-structured, step-by-step approach makes the process manageable, even for small and medium-sized businesses.

This guide walks you through all 12 steps of writing a complete HACCP plan — from describing your facility to training your team and updating your records. Whether you're running a restaurant, food truck, catering company, or cloud kitchen, the logic is the same. Follow these steps carefully, and you'll have a document that satisfies both your local Sanepid (sanitary inspectorate) and the spirit of EU law.

Important: HACCP documentation is not a one-time exercise. It is a living system. Once written, it must be implemented, monitored, verified, and updated whenever your processes change.

What HACCP Documentation Is — and What It Must Contain

HACCP stands for Hazard Analysis and Critical Control Points. It is a preventive approach to food safety that identifies physical, chemical, and biological hazards in your food production process — and establishes controls at points where those hazards can actually be prevented, eliminated, or reduced to an acceptable level.

Under EU Regulation 852/2004, Article 5, food business operators must:

• Create and implement one or more permanent procedures based on the HACCP principles
• Keep documents and records demonstrating the effective application of these procedures
• Update procedures whenever changes are made to the product, process, or any step

In practice, your HACCP documentation package should contain:

• A description of your facility and its activities
• A product description and intended use
• A process flow diagram
• A hazard analysis for each process step
• Identification of Critical Control Points (CCPs)
• Critical limits for each CCP
• Monitoring procedures
• Corrective action procedures
• Verification procedures
• A documentation and record-keeping system
• Staff training records
• A schedule for reviewing and updating the plan

This corresponds directly to the 7 HACCP principles defined in Codex Alimentarius, extended with prerequisite programs (GHP/GMP) that must be in place before the formal HACCP analysis begins.

Steps 1–3: Facility Description, Flow Diagram, and Process Description

Step 1: Describe Your Facility and Business Activity

Your HACCP document must start with a clear description of who you are and what you do. This section is the foundation on which everything else rests. Include:

• Business name, address, and contact details
• Type of food business (restaurant, catering, bakery, food truck, etc.)
• Description of premises: kitchen layout, storage areas, staff facilities, sanitary rooms
• Equipment list: refrigerators, freezers, ovens, blast chillers, dishwashers
• Water supply (municipal or private well — if private, regular microbiological testing is required)
• Waste management system
• Pest control arrangements

If your facility serves multiple cuisine styles or operates multiple menus (e.g., a main menu plus a catering offer), each product group should be listed separately. Include the maximum number of covers or production capacity, as this affects the scale of your hazard analysis.

Step 2: Create a Product Description

For each product or product group you handle, you need a brief description covering:

• Product name and category (raw, cooked, chilled, frozen, ambient)
• Ingredients and raw materials used
• Physical and chemical properties: pH, water activity (aw), preservation method
• Packaging and labeling
• Shelf life and storage conditions
• Intended use and target consumer group (including any vulnerable groups: elderly, children, immunocompromised)
• Method of distribution and service

In a restaurant setting, it is acceptable to group similar products — for example, "hot cooked meat dishes," "cold salads," "desserts." You do not need a separate HACCP plan for every item on the menu, but the groups must share similar hazard profiles and process steps.

Step 3: Draw a Process Flow Diagram

The flow diagram is a visual map of every step your food goes through — from raw ingredient delivery to service or dispatch. It is one of the most important documents in your HACCP plan because all subsequent hazard analysis is based on it.

A typical restaurant flow diagram includes:

1. Goods reception
2. Raw material storage (chilled, frozen, dry goods)
3. Preparation (thawing, washing, cutting, portioning)
4. Thermal processing (cooking, roasting, frying, steaming)
5. Cooling (if applicable)
6. Re-heating (if applicable)
7. Assembly and plating
8. Service or packaging for delivery

The diagram must be verified on-site — walk through your actual kitchen and confirm that the diagram matches reality. Inspectors will cross-check it against your physical setup. Add decision points where relevant (e.g., "Is raw meat stored separately from ready-to-eat foods?").

Steps 4–6: Hazard Analysis, CCP Identification, and Critical Limits

Step 4: Conduct a Hazard Analysis

Hazard analysis is the intellectual core of HACCP. For each step in your flow diagram, you must identify all potential hazards — biological, chemical, and physical — and assess their significance.

Biological hazards include pathogenic bacteria (Salmonella, Listeria monocytogenes, Campylobacter, E. coli), viruses (norovirus, hepatitis A), and parasites. They are the most common cause of food-borne illness in gastronomy.

Chemical hazards include cleaning and disinfection agent residues, pesticides in vegetables, allergen cross-contact, and non-food-grade lubricants from equipment.

Physical hazards include glass, bone fragments, metal particles, plastic pieces, and stones.

For each identified hazard, assess:

• Likelihood — how probable is it that this hazard actually occurs at this step?
• Severity — how serious would the health consequences be if the hazard reached the consumer?
• Significance — combination of likelihood and severity determines whether the hazard is significant enough to require a control measure

Document your reasoning. Inspectors want to see that you have thought through the analysis, not just listed hazards without justification.

Step 5: Identify Critical Control Points (CCPs)

A Critical Control Point is a step in the process where a control measure can be applied and is essential to prevent, eliminate, or reduce a food safety hazard to an acceptable level. Not every hazard identified in Step 4 leads to a CCP — many hazards are controlled through prerequisite programs (GHP/GMP) rather than formal CCPs.

The standard tool for identifying CCPs is the CCP Decision Tree from Codex Alimentarius. It asks four questions for each significant hazard:

1. Do control measures exist for this hazard at this step?
2. Is this step specifically designed to eliminate or reduce the hazard to an acceptable level?
3. Could contamination occur or increase to unacceptable levels?
4. Will a subsequent step eliminate or reduce the hazard to an acceptable level?

In a typical restaurant operation, common CCPs include:

• Thermal processing — cooking to a core temperature that eliminates pathogens (e.g., 75°C for poultry)
• Chilled storage — maintaining temperature at or below 4°C to prevent bacterial growth
• Cooling of cooked food — rapid cooling from 60°C to below 10°C within a specified time window
• Re-heating — heating pre-cooked food to a safe core temperature before service

Keep the number of CCPs realistic and manageable. Over-complicating your HACCP plan with dozens of CCPs makes it impossible to monitor properly in a real kitchen environment.

Step 6: Establish Critical Limits for Each CCP

For every CCP, you must define critical limits — the maximum or minimum values to which a biological, chemical, or physical parameter must be controlled to prevent, eliminate, or reduce the occurrence of a food safety hazard.

Critical limits must be:

• Measurable (a number, not a vague description)
• Science-based (referenced to regulation, scientific literature, or industry guidance)
• Achievable in practice with your equipment

Examples of critical limits in restaurant operations:

• Core temperature of poultry after cooking: minimum 75°C
• Core temperature of cooked pork: minimum 72°C
• Storage temperature for raw meat: maximum 4°C
• Storage temperature for frozen products: maximum −18°C
• Cooling time from 60°C to below 10°C: maximum 2 hours
• Hot holding temperature: minimum 63°C

Polish food safety legislation incorporates EU temperature requirements. Your Sanepid inspector will verify that your critical limits align with current standards — so always reference the applicable regulation or guidance in your documentation.

Steps 7–9: Monitoring, Corrective Actions, and Verification

Step 7: Establish a Monitoring System

Monitoring is how you confirm, in real time, that each CCP is actually under control. Your monitoring system must specify:

• What is being measured (temperature, time, pH, visual check)
• How it is measured (calibrated probe thermometer, pH meter, timer)
• How often — frequency per shift, per batch, per day
• Who is responsible for the measurement
• Where results are recorded

Monitoring does not always require laboratory testing. In most restaurant kitchens, monitoring consists of temperature measurements using calibrated probe thermometers, with results recorded in simple paper or digital logs. The key requirement is that monitoring is systematic and documented.

Make sure your thermometers are calibrated regularly (at least annually, or after any drop or damage) and that calibration records are kept. An uncalibrated thermometer is as good as no thermometer from an inspector's perspective.

Step 8: Define Corrective Actions

Corrective actions are predetermined steps your team takes when monitoring shows that a CCP is out of control — that is, a critical limit has been breached. Every CCP must have documented corrective actions.

A corrective action procedure must address two things:

1. The affected product — what happens to food that was produced while the CCP was out of control? Options include: additional cooking, reclassification, or disposal.
2. The root cause — what caused the deviation, and how will it be prevented from recurring?

Example: If a probe thermometer reading on a cooked chicken breast shows 68°C (below the 75°C critical limit), the corrective action might be: return the product to the oven for a further 5 minutes, re-measure, and document the deviation and outcome. If equipment failure is suspected, take the item off the production line and call for equipment maintenance.

Corrective actions must be recorded. An inspector reviewing your HACCP records will look specifically for evidence that deviations were caught and handled correctly — not just that monitoring was done when everything was fine.

Step 9: Establish Verification Procedures

Verification is the process of confirming that your HACCP system is working as intended. It is distinct from monitoring (which happens in real time) and happens at a higher level, periodically reviewing whether the system as a whole is effective.

Verification activities include:

• Internal audits of HACCP records (weekly or monthly review of temperature logs)
• Review of corrective action records to identify recurring deviations
• Microbiological testing of finished products or environmental swabs (at intervals appropriate to your risk level)
• Calibration checks for monitoring equipment
• Annual (or more frequent) full review of the entire HACCP plan

Verification is your internal "audit" of the HACCP system. If monitoring catches individual failures, verification identifies systemic problems — and triggers updates to the plan itself.

Steps 10–12: Documentation, Training, and Keeping HACCP Up to Date

Step 10: Build Your Documentation and Record-Keeping System

EU Regulation 852/2004 explicitly requires that you keep documents and records to demonstrate the effective application of your HACCP procedures. In practice, this means two categories of documents:

Procedural documents (written once, updated when processes change):

• The HACCP plan itself
• GHP/GMP prerequisite programs (cleaning schedules, pest control procedures, allergen management, supplier approval)
• Standard Operating Procedures for key tasks
• Corrective action procedures
• Calibration procedures

Records (completed during operations, kept for a defined retention period):

• Temperature logs (refrigerators, freezers, cooking, cooling, reheating)
• Goods reception records (supplier, date, batch number, temperature at delivery)
• Cleaning and disinfection records
• Corrective action records
• Calibration records
• Pest control reports
• Staff training records
• Supplier audit records

For records, the general guidance is to keep them for at least one year for short-shelf-life products, and longer for products with extended shelf life. Check with your local Sanepid or legal advisor for specific requirements in your sector.

Your records can be paper-based or digital. Digital systems (apps, spreadsheets) are increasingly common and accepted by inspectors — but whatever format you use, records must be legible, dated, and signed by the responsible person.

Step 11: Document Staff Training

A HACCP system is only as strong as the people implementing it. Your documentation must include evidence that all food handlers have received appropriate training in food hygiene and, where relevant, in the specific procedures related to their role.

Training records should include:

• Name and job title of the employee
• Date and content of training
• Name and signature of the trainer
• Employee's signature confirming attendance
• Any assessment or competency check conducted

In Poland, food handlers must have a valid health certificate (orzeczenie lekarskie do celów sanitarno-epidemiologicznych) or a declaration that they have no contraindications. These certificates must be kept on file and available for inspection.

Training is not a one-off event. New employees must be trained before starting work with food. Refresher training should occur at least annually, or whenever procedures change significantly. Document every training session, no matter how informal.

If your team includes non-Polish-speaking staff, your procedures and training materials must be available in a language they understand. Sanepid inspectors in areas with a high proportion of international workers have increasingly flagged language barriers as a food safety risk.

Step 12: Review and Update Your HACCP Plan

HACCP documentation must be a living system. You are required to review and update your plan whenever there are changes that could affect food safety. Triggers for a mandatory review include:

• Introduction of a new product or product category
• Changes to raw materials, ingredients, or suppliers
• Changes to the production process, layout, or equipment
• Changes to packaging, storage conditions, or distribution methods
• A food safety incident or customer complaint related to food safety
• Changes in applicable legislation or scientific guidance
• Results of verification activities revealing systematic failures

Even if nothing significant changes, it is good practice to conduct an annual review of the entire HACCP system — including all prerequisite programs — and document that the review took place and that the system remains appropriate.

Record the review date, who conducted it, what was reviewed, any changes made, and the rationale for those changes. This review record is one of the first things a thorough Sanepid inspector will ask to see.

Free Template and What Inspectors Check First

What Inspectors Look For in the First 15 Minutes

When a Sanepid inspector arrives unannounced, they typically start with a visual check of the premises and then move to your documentation. Based on common inspection patterns, the first things they examine are:

1. The HACCP plan itself — does it exist, is it facility-specific (not a generic internet download with another company's name), and has it been reviewed recently?
2. Temperature logs — are they being filled in consistently, or only when an inspection is expected? Gaps in records are a red flag.
3. Corrective action records — has anything ever been flagged? A plan with zero deviations recorded over months of operation looks unrealistic and raises suspicion.
4. Staff health certificates — are they valid and on file for all food handlers?
5. Training records — can you demonstrate that staff have been trained, including any non-Polish-speaking employees?
6. Cleaning schedules and records — are they facility-specific, and are they actually being followed?

The most common finding in inspections is not a missing document, but documents that exist on paper but are not implemented in practice. Inspectors are trained to spot the difference between a plan that is actively used and one that was written, filed, and forgotten.

Using a HACCP Template — the Right Way

Starting from a professional template is entirely legitimate and widely practised — even by consultants. The critical rule is that you must customize every section to reflect your actual facility, your actual processes, and your actual hazards. A template is a framework, not a finished product.

When using a template:

• Replace all placeholder names, addresses, and descriptions with your own
• Draw your own flow diagram based on your actual kitchen layout
• Verify that the CCPs and critical limits match your equipment and processes
• Adapt the monitoring frequency to your operation's scale
• Ensure the corrective actions are realistic for your team to actually carry out
• Add any product groups or process steps that are not covered in the template

A well-customized template completed in a week is far more valuable than a perfect document written from scratch over three months. Start with a solid structure, then make it yours.

If you need a professionally structured starting point, GastroReady offers ready-made HACCP documentation templates that cover the full 12-step system described in this guide. The templates are available with instructions in both Polish and English — making them particularly useful for international restaurant owners and multilingual kitchen teams operating in Poland. You can find them at gastroready.pl.

The goal of HACCP documentation is not to satisfy a bureaucratic requirement — it is to give you and your team a clear, practical system for producing safe food every day. When written and implemented properly, it also gives you confidence during inspections, reduces liability, and demonstrates to your customers that you take food safety seriously. Start with your facility description today, and work through the 12 steps one at a time. The structure will come together faster than you expect.