HACCP — a complete guide to the hazard analysis and critical control points system

The essence of HACCP is to recognise where in the process a risk to consumer health can arise and to monitor those points deliberately. The hazards the system evaluates are traditionally divided into three groups.

The preventive approach means that an operation thinks through the entire food flow in advance and at every step asks which of these hazards are present and what measure will keep them under control. Where a measure is essential to prevent, eliminate or reduce a hazard to an acceptable level, a critical control point arises. The classic example is heat treatment of meat: if a sufficient core temperature is not reached, the biological hazard is not eliminated and no subsequent step can put that right.

The European legal basis for HACCP is Regulation (EC) No 852/2004 on the hygiene of foodstuffs. Its Article 5(1) requires that "food business operators shall put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles". Article 5 itself is entitled Hazard analysis and critical control points.

Under Article 5(2) of Regulation (EC) No 852/2004 the preamble states "The HACCP principles referred to in paragraph 1 consist of the following:" followed by the seven principles as laid down in the Regulation:

• a) identifying any hazards that must be prevented, eliminated or reduced to acceptable levels;
• b) identifying the critical control points at the step or steps at which control is essential to prevent or eliminate a hazard or to reduce it to acceptable levels;
• c) establishing critical limits at critical control points which separate acceptability from unacceptability for the prevention, elimination or reduction of identified hazards;
• d) establishing and implementing effective monitoring procedures at critical control points;
• e) establishing corrective actions when monitoring indicates that a critical control point is not under control;
• f) establishing procedures, which shall be carried out regularly, to verify that the measures outlined in subparagraphs (a) to (e) are working effectively;
• g) establishing documents and records commensurate with the nature and size of the food business to demonstrate the effective application of the measures outlined in subparagraphs (a) to (f).

In practice this means the following. Principle a) is the starting point — without a rigorous hazard analysis no meaningful system can be built. Principle b) narrows attention to those steps where control is truly decisive, so that the operation is not burdened with monitoring points of no real importance. Principle c) translates the requirement into a measurable figure or criterion — for example a minimum core temperature or a maximum time at ambient temperature. Principle d) ensures that the critical point is genuinely monitored regularly and that measurement is never omitted.

Principle e) establishes what happens when a measurement shows that a limit has been exceeded — who acts and how, to prevent an unsafe food from progressing further. Principle f) is verification — regular checking that the entire system is functioning as it should (for example checking the accuracy of thermometers or reviewing records). Principle g) finally requires adequate documentation — records proportionate to the size and nature of the business, proving that the system is genuinely applied. Under Article 5(2), last subparagraph of Regulation (EC) No 852/2004, whenever a product, process or any step changes the operator must review the procedure and amend it where necessary.

The seven principles describe what the system must contain. Codex Alimentarius (CXC 1-1969) adds twelve application steps that describe how to build the system in practice. The first five steps are preparatory; steps six to twelve correspond to the seven HACCP principles.

The preparatory phase is often underestimated, yet it is the phase that determines the quality of the entire system. The HACCP team should be familiar with both the technology and the actual running of the operation; in a small operation it may even be a single experienced person with specialist support. The product description and intended use determine which hazards are relevant at all — the risks for an uncooked salad differ from those for roast meat served hot. The flow diagram captures every step through which the food passes, and verifying it on-site prevents the system from being based on a paper ideal rather than reality.

Only after this preparation does the true heart of the system follow — hazard analysis, identification of critical control points, limits, monitoring, corrective actions, verification and documentation. This procedure is universal: it applies equally to a small café and to a large production facility, differing only in scope and detail.

The terms that cause the most confusion in HACCP are critical control point and critical limit. It helps to explain them through simple definitions derived from the Codex (the formulations below are a working translation, not the official text).

• Critical control point (CCP) — a step in the process at which control is essential to prevent, eliminate or reduce a hazard to an acceptable level. If control is not applied here, no subsequent step can remove the risk.
• Critical limit — a measurable criterion that separates acceptability from unacceptability (for example core temperature, time, pH value). Exceeding the limit means the point is not under control.
• Monitoring — regular observation or measurement that demonstrates whether a critical control point is still within its limit.
• Corrective action — a predetermined intervention carried out when monitoring shows that a limit has been exceeded (for example extending the heat treatment or rejecting the batch).
• Verification — checking that the entire system is functioning (reviewing records, calibrating thermometers, auditing).
• Validation — evidence that a chosen measure is actually capable of controlling the hazard (for example that a given combination of temperature and time reliably destroys bacteria).

The distinction between verification and validation is crucial in practice: validation answers the question "is our measure set correctly?", while verification answers "are we doing what we set out to do, and is it working?". Not every step in an operation is a critical control point — many risks are already covered by good hygiene practice. That is precisely why it is important to identify critical points sensibly and not to overload the system with unnecessary measurement where rigorous hygiene is sufficient.

HACCP does not stand in a vacuum. Beneath it lies the broader foundation of what are called prerequisites or good hygiene practice (GHP) and good manufacturing practice (GMP) — standard hygiene measures that must be in place before it even makes sense to speak of critical control points. These include, for example, cleaning and disinfection, pest control, personnel hygiene, equipment maintenance, provision of drinking water and waste management.

Regulation (EC) No 852/2004 divides these general hygiene requirements by stage of production. Article 4(1) together with Annex I covers the general hygiene requirements for primary production, while Article 4(2) together with Annex II applies to all other stages of production, processing and distribution. These requirements apply to every operation regardless of whether it has formally identified critical control points.

From this follows an important rule: if hygiene practice is weak, even the most carefully prepared HACCP plan will not safeguard food safety. Conversely, in a small, simple operation the emphasis on safety may lie precisely in rigorous hygiene, supported by adequate — but not unnecessarily complex — documentation. The connection between HACCP and other areas of safety, including fire protection in catering operations, is also covered in our fire-protection guide.

The obligation to introduce a procedure based on the HACCP principles applies under Article 5(1) of Regulation (EC) No 852/2004 to food business operators — that is, to everyone who, as part of a business, handles food at stages following primary production. In practice this means restaurants, cafés, pastry shops, buffets, fast-food stalls, canteens, hotel kitchens, food retail outlets, warehouses, distributors and production facilities.

An important exception concerns primary production. Under Article 5(3) of Regulation (EC) No 852/2004, the obligation to introduce a procedure based on the HACCP principles applies only to stages after primary production; primary production itself (for example crop growing, animal husbandry or hunting) is exempt from this obligation and is covered by the general hygiene requirements of Annex I. This does not mean that primary producers have no hygiene obligations — they do, just not in the form of a full HACCP system.

For small operations the aforementioned flexibility under Article 5(5) and recital 15 of Regulation (EC) No 852/2004 applies. This means that the scope of documentation and the number of critical control points is appropriately adapted to the size and nature of the business — a small café does not need a system as extensive as a large production hall. Alpha Safety will prepare a specific solution for your type of operation as part of the bespoke HACCP service; the specifics of catering operations are also covered in our BOZP guide for gastro.

Although the HACCP obligation derives directly from European regulation (which is binding and directly applicable in all Member States), Slovak law supplements and bridges it through the concept of own control. The key piece of legislation is Act No. 152/1995 Coll. on foodstuffs (as in force from 1 January 2026).

Under § 4 ods. 1 of Act No. 152/1995 Coll. an operator has obligations at all stages of production, processing and distribution under this Act and special regulations — which includes EU regulations including Regulation (EC) No 852/2004. § 4 ods. 2 then requires the introduction of own control of food safety and quality and the keeping of records thereof, the keeping of records on disinfection, disinfestation and deratisation (DDD) and the instruction and training of employees in food hygiene. This "own control" is the domestic bridge to HACCP and good hygiene practice.

For collective catering establishments (catering operations) Act No. 355/2007 Coll. on the protection, support and development of public health also applies, together with the implementing Decree of the Ministry of Health of the Slovak Republic No. 533/2007 Coll. on detailed requirements for collective catering establishments. Under § 26 ods. 4 písm. c) of Act No. 355/2007 Coll. the operator of a collective catering establishment must apply the principles of good manufacturing practice and monitor critical operations.

The question of who in practice checks compliance with HACCP depends on the type of operation. Slovak legislation divides supervision between two systems of authorities. Under § 21 ods. 1 of Act No. 152/1995 Coll. the official food-control authorities are the Ministry of Agriculture, the Ministry of Health, the public health authorities, the State Veterinary and Food Administration (ŠVPS) and the regional veterinary and food administrations (RVPS).

For most catering operations the key supervisory authority is therefore the regional public health authority (RÚVZ), which exercises state health supervision over public catering (the jurisdiction of RÚVZ under § 6 of Act No. 355/2007 Coll.). By contrast, for production and processing facilities and for placing foodstuffs on the market, the competent authority is the State Veterinary and Food Administration of the Slovak Republic together with the regional veterinary and food administrations. Alpha Safety can accompany an operation professionally during a RÚVZ inspection and prepare it for the inspectors' questions.

Breaching food-safety obligations is not a minor formality — it can lead to significant fines. The exact amount depends on which regulation applies and which supervisory authority is involved.

For a catering operation the most relevant sanction is the one under § 57 ods. 43 písm. a) of Act No. 355/2007 Coll. — a fine from €150 to €20,000, on a repeat breach up to double. This penalty is imposed by the regional public health authority for, among other things, hygiene deficiencies, missing or out-of-date operational rules, or non-compliance with the principles of good manufacturing practice.

For production and processing operations the scale of sanctions under § 28 of Act No. 152/1995 Coll. applies, graduated by severity: from €100 to €1,000 for less serious breaches (ods. 1), through higher bands (ods. 2 from €100 to €100,000, ods. 3 from €500 to €200,000) up to €500,000 for the most serious breaches such as placing unsafe foodstuffs on the market or obstructing official control (ods. 4). For repeat breaches the fines are further multiplied under ods. 6 to 8. For a natural person who is not a trader the milder § 29 applies (up to €2,000, on repetition up to €4,000, on-the-spot fine up to €500).

Several terms are frequently mentioned alongside HACCP that are worth distinguishing. The most important difference is between a statutory obligation and a voluntary standard.

• HACCP is a statutory obligation arising from Article 5 of Regulation (EC) No 852/2004 — every operation handling food after primary production must have it.
• ISO 22000 is an international voluntary certifiable standard for a food safety management system that incorporates the HACCP principles. It is not a statutory requirement; a business introduces it voluntarily, particularly if required by commercial partners or to use it as a competitive advantage.
• Good hygiene practice guides/guidelines are voluntary sector aids that under Article 5(5) of Regulation (EC) No 852/2004 may help operators in implementing procedures based on the HACCP principles.

In other words, HACCP is the indispensable foundation that everyone must have. ISO 22000 is a superstructure for those who wish to demonstrate, beyond the legal requirement, systematic food-safety management through a certificate from an independent certification body. Good hygiene practice guides then serve as a practical aid — particularly for smaller operations that do not have their own specialist capacity. None of these tools, however, replaces the obligation to have a functioning HACCP procedure in place that corresponds to the specific operation.

The same deficiencies recur time and again during inspections. Most of them arise not from ill will but from treating HACCP as a one-off formality rather than a living system.

• Outdated and unrevised plan — documentation describes a state that no longer applies (the menu, technology or equipment has changed). Yet Article 5(2), last subparagraph of Regulation (EC) No 852/2004 expressly requires the procedure to be reviewed whenever a product, process or step changes.
• Formal critical control points without real monitoring — CCPs are defined in the plan but nobody actually measures temperatures or records values.
• Missing or retrospectively completed records — records are not kept continuously; they are filled in retrospectively before an inspection, thereby losing their evidential value (principle g means real, not fictitious, records).
• Undefined corrective actions — when a limit is exceeded the staff do not know what to do, and an unsafe food continues further along the chain.
• Untrained staff — employees are unaware of their obligations in the area of food hygiene, even though their training is required under § 4 ods. 2 of Act No. 152/1995 Coll.
• A plan that is either overly complex or completely empty — either a copied universal template with no relevance to the operation, or a system so complicated that nobody follows it in practice.

The solution is not more paperwork but a bespoke system — one that matches the actual running of the operation, is proportionate to its size and is understood by the staff. This requires regular employee training and updating of documentation whenever anything changes. We provide staff education in hygiene and safety through our courses and training; specialist terminology is explained in our glossary. If you need HACCP documentation drawn up, implemented or updated, contact Alpha Safety — we will prepare a solution tailored to the character of your operation.