HACCP for small cafés: the simplified version we used at Welsh Back

The first HACCP plan we had at Welsh Back was 38 pages long and described a kitchen that did not exist. I had downloaded a template the night before we opened, filled in the blanks at the kitchen table with a glass of wine, and printed it out in a plastic folder that lived on top of the fridge. It mentioned a blast chiller (we did not have one), sous-vide procedures (we did not do any), and a delivery bay (we had a back door onto a cobbled lane).

The EHO came in about six weeks after we opened. She was polite, picked up the folder, flicked through maybe four pages, and put it back down. Then she asked me to walk her through what happened to a chicken from the moment it arrived to the moment it went out as a sandwich. I started talking and within about a minute I was contradicting my own plan. She did not write me up for it, she was kind, but she said something I have repeated to every operator I have worked with since: "Your paperwork has to describe your kitchen, not someone else's."

We rebuilt that plan three times over the next year before it actually matched how we worked. This guide is the version I wish I had started with. It is HACCP for a small café, stripped of the consultancy padding, in the words an operator actually uses.

Why this matters

Under Regulation (EC) 852/2004, retained in UK law, every food business has to have food safety procedures based on HACCP principles. That is a legal duty, not a suggestion. If you serve food to the public, you need a plan, you need to follow it, and you need to be able to show it to an inspector. The Food Standards Agency and your local authority enforce this, and your Food Hygiene Rating (the 0 to 5 score in the window) is partly based on how well your documented system reflects what is happening in the kitchen.

The thing that catches people out is the second part. Having a plan in a binder is not the point. The inspector wants to see that the plan describes your actual kitchen, that your team knows what is in it, and that you can produce the records to prove you have been doing what you said you would do. A perfect-looking plan with no fridge temperature logs behind it is worse than a scruffier plan with two months of completed checks.

The good news is that for a small café, the FSA explicitly accepts that your system should be proportionate to the size and complexity of your business. You do not need the manual a hotel kitchen needs. You need something honest and usable.

HACCP in plain English: three things, not seven

Before we get to the seven principles, here is what HACCP actually is when you strip the jargon out.

• Find the risks. Where in your kitchen could food make someone ill? Walk through every step from delivery to plate and ask: what could go wrong here?
• Decide what you do about them. For each risk, what is the thing you do that keeps it safe? Cook the chicken to 75°C. Keep the fridge below 5°C. Wash your hands after handling raw meat.
• Prove you do it. Write it down. Temperature logs, cleaning schedules, training records. The boring bit, but the bit inspectors look at hardest.

That is it. Everything else, the seven principles, the CCPs, the decision trees, is just a more formal way of describing those three things. The documentation industry has made it scarier than it needs to be because there is money in selling courses and folders.

The seven principles in operator language

Here is the formal HACCP framework, translated. If your plan covers these in a way that matches your kitchen, you have a HACCP plan.

1. Hazard analysis (find the risks)

Sit down with whoever runs your kitchen and list every step a piece of food goes through. Delivery, storage, prep, cook, hold, serve, leftovers. For each step, ask what could make someone ill. Biological (bacteria, mainly), chemical (cleaning products, allergens) and physical (bits of packaging, hair, blue plasters). At Welsh Back our biggest hazards were always the same three: undercooked chicken on the brunch menu, cross-contamination on the prep bench when we were slammed, and the chiller drifting warm in summer because the condenser was on a sunny wall.

2. Identify your CCPs (critical control points)

A CCP is a step where, if you get it wrong, food becomes unsafe and there is no later step to fix it. For most cafés there are only two or three real CCPs:

• Cooking (especially meat, eggs, anything reheated)
• Chilled storage (fridges, displays, anything held cold)
• Hot holding if you do it (above 63°C)

Allergen control is sometimes added as a CCP and increasingly inspectors expect to see it called out clearly. Everything else, like cleaning or pest control, is important but is a prerequisite, not a CCP. Do not try to make every step a CCP. A plan with 14 CCPs is a plan no one will follow.

3. Set your critical limits

For each CCP, what is the number that means safe? Cook chicken to 75°C core, or equivalent (70°C for 2 minutes). Fridges at or below 5°C, freezers at or below -18°C. Hot hold at or above 63°C. These are the FSA's standard limits and there is no need to invent your own.

4. Monitor

How do you check? A probe thermometer for cooked food. A fridge thermometer (digital, ideally with a min/max). A visual check on hot holding. Decide how often. Cooking gets probed every time for the first portion of a batch. Fridges checked twice a day, morning and evening.

5. Corrective action

What do you do when something is out of limits? If the fridge reads 8°C, you do not just write it down and move on. You move the stock to another fridge, you call the engineer, and you bin anything that was clearly in the danger zone for too long. Your plan needs to say what you do, so a new team member knows.

6. Verification

Someone (you, or whoever is responsible) reviews the records. Weekly is fine for a small café. You are checking that the logs are actually being filled in, that nothing has been missed, and that any corrective actions were closed off.

7. Documentation

The records. Temperature logs, cleaning checks, training records, supplier list, allergen matrix. The plan itself, written down. Kept for long enough to cover an inspection, which in practice means at least 12 months.

SFBB: the simpler option for very small cafés

If your operation is small and you do not do anything unusual (no sous-vide, no cook-chill, no vacuum packing), the FSA's Safer Food, Better Business pack might be enough. SFBB is essentially a pre-built HACCP system designed for small caterers. You work through the safe methods, tick what applies, and use the daily diary as your record.

We used SFBB at Welsh Back in the early days and it was fine for about a year. As soon as we added a proper brunch service with poached eggs, cured fish and a hot hold counter, we needed something more bespoke. The rule of thumb: if your menu fits into SFBB's standard categories, use it. If you are doing things SFBB does not cover, you need a tailored HACCP plan.

Both are legally acceptable. The FSA confirms this on its website. Do not let a consultant tell you SFBB is "not real HACCP" because they want to sell you a bound document.

What your plan should actually contain

For a small café, a workable HACCP plan is maybe 8 to 15 pages. It should have:

• A short description of your business and menu
• A list of your suppliers
• A flow diagram of how food moves through your kitchen (a literal diagram, hand-drawn is fine)
• Your hazard analysis (a table is easiest)
• Your CCPs, with critical limits and monitoring methods
• Corrective actions for each CCP
• Your prerequisite programmes: cleaning, pest control, personal hygiene, training, allergen management
• A list of the records you keep, and where

Then, separately, the records themselves. Daily temperature logs, opening and closing checks, weekly cleaning verifications, training records signed by each staff member.

Common mistakes

• Downloading a template and not editing it properly. This is what I did. The plan mentioned equipment we did not have and procedures we did not follow. An inspector spots this in under a minute, and it undermines everything else in the document.
• Making every step a CCP. If you have ten CCPs in a café that does sandwiches and a brunch menu, your plan is too complicated to follow and no one will. Stick to the genuine ones: cooking, chilled storage, hot holding, allergens.
• Writing the plan and never reviewing it. Menus change, equipment changes, staff change. A plan from three years ago that has not been touched is a red flag. Review it at least annually, and any time you change something significant.
• Keeping records that no one fills in honestly. Logs that show 4°C every single day for six months, taken at exactly 9am, look fake to an inspector because they are fake. Real records have variation, occasional gaps with corrective actions noted, the odd messy handwriting. Honesty looks more credible than perfection.
• Confusing the plan with the records. The plan describes what you do. The records prove you did it. You need both. A plan with no records is just a wish. Records with no plan are just numbers.
• Not training your team on it. Your chef should be able to tell an inspector where the plan is and what the critical limits are for cooking. If they cannot, your plan is yours, not the kitchen's.