HACCP Records for Small UK Food Businesses: What You Actually Need to Document

If you have already written your HACCP plan, you are ahead of many small food businesses. But many owners stop there, believing the plan itself is enough for compliance. It is not. If you have not yet written your plan, our HACCP plan guide for small food businesses covers the plan-writing process in full — this article picks up where that one leaves off, focusing entirely on the records and documentation you need once the plan is in place.

The distinction matters in practice: during an Environmental Health Officer (EHO) inspection, the first thing they will ask to see is not your HACCP plan — it is your records. Plans can be written in an afternoon and describe a perfectly controlled kitchen. Records reveal what is actually happening in that kitchen day to day. Without them, you have no evidence of implementation and no due diligence defence if something goes wrong.

Why HACCP Records Matter: What EHOs Check

When an EHO visits your food business, they are assessing whether you have effective food safety management in place. The Food Standards Agency's Safer Food, Better Business framework describes this as needing to demonstrate that you know what food safety hazards your business faces and that you are controlling them consistently. Records are the evidence of that consistency.

In legal terms, keeping adequate HACCP records is part of demonstrating "due diligence" — a defence available under the Food Safety Act 1990 if you are prosecuted for a food safety offence. The due diligence defence requires you to show that you took all reasonable precautions and exercised all due diligence to avoid the offence. Without written records, this defence is extremely difficult to mount, even if your kitchen is in fact run safely. The burden of proof in food safety prosecutions sits with the defence, not the prosecution.

EHOs typically check for the following when reviewing HACCP records:

• Are records being completed regularly and consistently, or in batches retrospectively?
• Do temperatures recorded match what would realistically be expected — are they suspiciously perfect, or do they reflect real variation?
• When things go out of range, is there a corrective action recorded?
• Are records signed and dated by a named individual?
• Is the record-keeping system being used by all relevant staff, or just the owner?
• Are supplier allergen declarations current and on file?

Your food hygiene rating — the score displayed on your premises under the Food Hygiene Rating Scheme — directly reflects the quality of your food safety management documentation. A business with good records and a few environmental issues will typically score better than a business with a clean kitchen but no paperwork. The scoring criteria explicitly include "confidence in management" as a category, which is assessed almost entirely through records.

The 7 Types of HACCP Records Every Small Food Business Needs

Most small food businesses need to maintain records in seven areas. The depth of documentation required in each area will vary depending on the nature and scale of your operation — a home baker producing ten cakes a week needs less than a sandwich shop serving two hundred customers a day — but all seven areas apply to virtually every registered food business.

1. Temperature Records

Temperature control is the single most important food safety control in most food businesses. Bacteria that cause food poisoning multiply rapidly between 8°C and 63°C — the "danger zone." Temperature records demonstrate that you are keeping food outside this zone at every stage.

Temperature records should cover:

• Fridge temperatures: Check and record at least once per day, preferably at the start and end of service. Record the actual temperature, the date, the time, and who checked it.
• Freezer temperatures: Check and record daily or at least weekly for low-turnover freezers. Target temperature is -18°C or below.
• Cooking temperatures: Record the core temperature of high-risk cooked foods (meat, fish, egg dishes) at the end of cooking. The target is 75°C core temperature for 30 seconds, or an equivalent time-temperature combination.
• Cooling temperatures: Food must be cooled from 60°C to below 8°C within 90 minutes where possible, and certainly within two hours. Record the temperature at the start and end of the cooling process.
• Hot holding temperatures: Food held hot for service must be maintained at 63°C or above. Check and record temperatures during service periods.
• Delivery temperatures: Record the temperature of chilled or frozen deliveries at point of arrival, particularly for raw meat, fish and dairy.

Each record should show the date, time, food or equipment being checked, actual temperature recorded, and the initials or name of the person who carried out the check. When a temperature is outside the acceptable range, the record must also show what corrective action was taken.

2. Cleaning and Disinfection Records

Cleaning schedules and their completion records demonstrate that your premises and equipment are being cleaned at the right frequency and with the right products. An EHO will check whether your cleaning schedule is realistic, whether it covers all surfaces and equipment, and whether it is actually being completed.

Your cleaning records should log:

• What was cleaned (surface, piece of equipment, area of the kitchen)
• The date and time of cleaning
• The product used and its dilution rate
• The contact time (how long the disinfectant was left before rinsing)
• Who carried out the cleaning

Many small businesses use a simple weekly or daily cleaning schedule chart where each task is ticked off and initialled when completed. This is entirely adequate. The key is that it is completed in real time — not filled in at the end of the week from memory.

3. Supplier and Delivery Records

Supplier records serve two functions: they demonstrate that you are sourcing food from approved, reliable suppliers, and they provide traceability information that is essential if a product needs to be recalled. For businesses producing food under food labelling requirements, supplier records are also the foundation of your allergen documentation.

Keep records of:

• The name and address of each supplier
• Delivery dates and the products received
• Batch numbers and date codes for key ingredients
• Temperature of chilled or frozen deliveries at receipt
• Any issues noted at delivery (damaged packaging, incorrect temperature, suspicious appearance) and what action was taken

For traceability purposes, you should be able to identify, within four hours, which batch of an ingredient went into which products sold on which date. This does not need to be complex — a simple delivery log with batch numbers, combined with a production log linking ingredients to batches, is sufficient.

4. Allergen Records

Allergen records are increasingly scrutinised by EHOs and are a critical part of your HACCP documentation, particularly if you produce PPDS-labelled food under Natasha's Law. Your allergen records need to demonstrate that you know exactly what allergens are present in each of your products, and that this information is kept current.

Allergen records should include:

• Full recipe records for each product, including all ingredients and their allergen status
• Supplier allergen declarations (product specification sheets) for every bought-in ingredient
• An allergen matrix showing which of the 14 allergens are present in each product you sell
• Records of when allergen information was last reviewed or updated
• Records of any supplier changes and how they were assessed for allergen impact

Using dedicated allergen matrix software makes this considerably easier to maintain. When a supplier changes an ingredient formulation, the impact cascades automatically across all affected recipes rather than requiring manual review of every product.

5. Staff Training Records

UK food hygiene law requires that all food handlers receive appropriate food hygiene training commensurate with their role. You are not required to hold a specific qualification, but you must be able to demonstrate that staff have been trained and that the training was adequate for the tasks they perform.

Training records should document:

• The name of each member of staff
• The date they were trained or completed an induction
• What training was provided (e.g. "Level 2 Food Hygiene Award", "in-house allergen awareness training", "temperature monitoring procedure")
• Who provided the training
• Any refresher training completed and when

For allergen training specifically — which is increasingly expected by EHOs following the introduction of Natasha's Law — keep a separate record confirming that each relevant staff member has received allergen awareness training and understands its importance to your specific products.

6. Pest Control Records

Whether you use a professional pest control contractor or manage pest control in-house, you need records. For most small food businesses, this means keeping copies of pest control contractor visit reports, any treatment records, and any pest sightings or evidence noted between visits.

If you have a contract with a pest control company, they will typically provide a service record book or digital report for each visit. Keep these on file. If you manage pest control in-house, keep a simple log of:

• Regular inspections of traps, bait stations and monitoring devices
• Any evidence of pest activity found and where
• Actions taken in response

7. Corrective Action Records

This is the record type that many small businesses neglect — and its absence is a significant red flag for EHOs. When something goes wrong (a fridge temperature is too high, a delivery arrives warm, a batch of food is cooked to insufficient temperature), you must record not just the problem but what you did about it.

A corrective action record should show:

• The date and nature of the problem
• The temperature or reading that triggered the corrective action
• What immediate action was taken (e.g. "chilled product moved to secondary fridge, engineer called, temperature normalised by 14:00")
• Any product that was discarded as a result and why
• Whether any customers may have been affected and what communication was made
• Steps taken to prevent recurrence

Paradoxically, a records system that shows occasional out-of-range readings with documented corrective actions is more reassuring to an EHO than one with suspiciously perfect readings every single time. It shows the system is being used honestly and that problems are being caught and managed.

How Long Must You Keep HACCP Records?

There is no single statutory retention period for all food safety records under UK law, but the Food Standards Agency recommends a minimum of two years for most HACCP records. The reasoning is that food safety incidents and complaints can arise some time after the food was produced, and records need to still be available when an investigation takes place.

For products with longer shelf lives, the guideline is to retain records for the shelf life of the product plus one additional year. For a product with a two-year best-before date, that means three years of relevant production records should be retained. For canned or long-life ambient products, this can mean records going back several years.

If an EHO visits and asks to see records from a specific date and you cannot produce them, you are in a significantly weaker position. The inability to produce records is not itself a specific criminal offence, but it removes your due diligence defence and will almost certainly result in a lower food hygiene rating. If the records relate to a food safety incident that caused illness, the absence of records becomes a far more serious matter in any subsequent prosecution.

Paper vs Digital Records: What EHOs Accept

EHOs accept both paper and digital records, provided they are accurate, dated, and can be produced during an inspection. The choice between paper and digital is operational rather than legal — neither format has a compliance advantage over the other. What matters is completeness, consistency and accessibility.

Paper records are the default for most small food businesses. The FSA's Safer Food, Better Business pack includes ready-made paper record sheets that are widely used and universally accepted. The advantages of paper are simplicity and reliability — no login required, no internet dependency, no software updates. The disadvantages are storage (files accumulate), legibility (handwriting varies), and the risk of loss through fire, water damage or simple misplacement.

Digital records — kept in spreadsheets, apps, or kitchen management software — are increasingly common, particularly for temperature monitoring and allergen tracking. Digital records are easier to search, can be backed up automatically, and are harder to alter retrospectively (which EHOs appreciate). Many businesses use a combination: digital for recipe and allergen records, paper for daily temperature and cleaning logs.

Whatever system you use, the critical requirement is that records are completed at the time of the check — not filled in retrospectively. An EHO who finds a temperature log with 14 consecutive entries all made at the same time on Friday afternoon will treat it as a fabricated record, regardless of whether the temperatures themselves are plausible.

Temperature Monitoring in Detail

Temperature control sits at the heart of most HACCP plans, because temperature abuse is responsible for the majority of food poisoning outbreaks. Understanding exactly what temperatures you need to achieve — and how to document them — is essential for any food business.

Every temperature check requires a calibrated probe thermometer. The probe must be cleaned and disinfected between uses, particularly when probing different food types. Record the probe thermometer's calibration checks — at minimum, verify accuracy against ice water (0°C) and boiling water (100°C) at least monthly, and record the result. A probe that reads incorrectly makes every temperature record unreliable.

When a temperature is out of range, the corrective action decision tree is: (1) Is the food safe to eat? If uncertain, discard. (2) Can the problem be remedied? (e.g. return food to oven for further cooking.) (3) What caused the deviation? Record the cause and the preventive action to stop it happening again. All three answers must appear in your corrective action record.

Allergen Documentation as Part of HACCP

Allergen control is increasingly treated as a critical control point in its own right — not simply a labelling issue, but a food safety hazard that must be systematically managed. The Food Standards Agency now includes allergen management as a core component of food safety inspections, and EHOs are specifically trained to assess it.

Your allergen documentation within your HACCP system should cover four layers:

1. Ingredient specification records: For every ingredient you use, keep the supplier's product specification sheet or allergen declaration confirming the allergen status of that ingredient. This must be the current version — if a supplier updates their formulation, you need the updated spec on file.
2. Recipe allergen records: For every product you make, a complete record of all ingredients and their allergen contributions, resulting in a confirmed allergen status for the finished product. This is the foundation of your allergen matrix.
3. Label verification records: If you produce PPDS-labelled food, records showing that the label on each product correctly reflects the current recipe. This is where software that links labels to recipes — auto-updating when ingredients change — provides its biggest compliance benefit.
4. Supplier change records: A log of any changes to suppliers or ingredient formulations, the date of the change, the allergen impact assessment, and confirmation that all affected recipes and labels were updated before the new ingredient was used in production.

A common failure identified during inspections is businesses that have accurate allergen records for most products but have not updated them after a supplier change. A supplier switching from one brand of chocolate to another can silently introduce a soya allergen that was not present before. This type of change is the most common source of allergen mismatch incidents in small businesses, and documented supplier change procedures are the control that prevents it.

A Week of HACCP Records: What It Looks Like in a Small Bakery

To make this concrete, here is a realistic example of what a week of HACCP record-keeping looks like for a small bakery producing a range of cakes, pastries and breads.

Monday (production day):

• 8:00 — Fridge temperatures checked and recorded: main display 3°C, prep fridge 2°C. Freezer: -20°C. All within range.
• 8:15 — Delivery arrives from flour supplier. Delivery temperature not applicable (ambient). Delivery log entry: supplier name, delivery note number, batch codes for flour, butter, eggs. Packaging condition checked — no issues noted.
• During baking — Core temperatures of custard tarts recorded at end of baking: 78°C, 79°C, 76°C. All above 75°C target. Entered in cooking temperature log.
• 13:00 — Custard tarts transferred to cooling rack. Cooling start temperature 68°C recorded. At 14:30, temperature re-checked: 7°C. Cooling complete within target time. Entered in cooling log.
• End of day — Daily cleaning schedule completed and signed. All surfaces, equipment and floors ticked off and initialled.

Tuesday (market day):

• 7:00 — Fridge temperatures checked before loading. All within range.
• PPDS labels verified against products loaded for market — label check completed and initialled on product checklist.
• End of day — Any unsold products that were removed from temperature control for more than 4 hours are discarded and recorded. Products returned to fridge noted.

Wednesday (office day):

• Fridge and freezer temperatures checked — all within range.
• Reviewed supplier email received on Monday: one ingredient supplier notified of a recipe change to their shortbread mix. Allergen impact assessed — new formulation contains sesame (not previously present). Updated ingredient record. Checked all recipes using this ingredient — two products affected. Recipe allergen records updated. PPDS labels for both products regenerated and printed. Old label stock destroyed.
• Corrective action record completed for the supplier change — noting the change, the allergen impact, and the steps taken.

Thursday and Friday (production days): Same as Monday routine. Temperature records, cooking logs, cooling logs, cleaning schedules completed.

Sunday (pest control inspection): Pest control contractor visit. Copy of report filed in pest control records folder. No issues identified.

This represents a realistic, manageable HACCP records routine for a small bakery. It takes perhaps 10–15 minutes of focused record-keeping per day — time that is well spent given the legal protection and operational clarity it provides.

What EHOs Look for in a HACCP Records Inspection

Understanding how EHOs approach a records inspection helps you ensure your documentation will hold up when it matters. EHOs are typically looking for evidence of a "suitable and sufficient" food safety management system — a standard that means the system is appropriate for the scale and nature of your business, and that it actually works in practice.

Common failures identified during records inspections of small food businesses:

• Gaps in records: Several days with no entries, or records that stop after a good initial period and then resume later, suggest inconsistent implementation.
• Suspiciously perfect temperatures: Every temperature reading exactly at the ideal value, with no variation over weeks, suggests records are being invented rather than measured.
• No corrective actions recorded: In any active food business, something will occasionally fall outside the acceptable range. A record system with zero corrective action entries over several months has either never had a problem (unlikely) or is not recording problems honestly.
• Unsigned or undated entries: Records without a date and a named individual cannot be verified and have reduced legal value.
• Allergen records not current: Specification sheets that are months or years old, or recipe records that do not reflect current ingredients, are one of the most commonly cited failures.
• Training records incomplete: New staff with no training records, or businesses where training records exist only for the owner.
• Cleaning records not matching the cleaning schedule: If your written cleaning schedule says you clean the oven daily but your records show it is cleaned weekly, the schedule is not being followed.

"Suitable and sufficient" means EHOs are not expecting a multinational manufacturer's food safety management system from a home baker or a two-person bakery. They are expecting a system that is proportionate to the risks of your specific operation and that is being used honestly and consistently. A simple, honestly kept paper-based system will always satisfy an EHO more than an elaborate system that clearly exists only on paper.

HACCP Records: Frequently Asked Questions

Further Resources

• Writing a HACCP plan for small UK food businesses — complete guide
• FoodCore allergen matrix software
• Recipe management and allergen tracking with FoodCore
• Natasha's Law PPDS labelling software
• Kitchen management software for small food businesses
• Food Standards Agency — Safer Food, Better Business (free templates)