How to Write a HACCP Plan for a Small Food Business in South Africa

You Don't Need to Be a Food Scientist to Write a HACCP Plan

If you've been told you need a HACCP plan — maybe by a retailer, a certifier, or a health inspector — and you have no idea what that means, you're in exactly the right place.

HACCP stands for Hazard Analysis and Critical Control Points. Don't let the name intimidate you. In plain language, it's a written plan that shows how your food business identifies things that could make people sick, and what you do to stop those things from happening.

It's not a once-off form you fill in. It's a living document — something you build, test, update, and keep on file. In South Africa, HACCP-based food safety systems are required under Regulation R638 (the main regulation governing food premises) and are the foundation of standards like SANS 10330 (the South African national standard for HACCP systems).

This guide will walk you through every step in plain language. We'll define every term the moment we use it. By the end, you'll know exactly what a HACCP plan contains, how to build one for your specific product, and where to get help.

---

Step 1: Assemble Your Food Safety Team (Even If That's Just You)

The first step in writing a HACCP plan is forming a food safety team — the group of people responsible for building and maintaining the plan.

In a large food factory, this might be a team of five or ten people. In a cottage-industry business or small startup, it might just be you — and that's fine. What matters is that whoever is responsible for the plan actually understands how your product is made, what ingredients go in, and what equipment is used.

Write down the team members (even if it's just your name), their roles, and their relevant experience or training. This forms the first section of your HACCP plan document.

Why this matters: Auditors and retailers want to know that a real human being is accountable for food safety decisions — not just that a document exists.

---

Step 2: Describe Your Product Fully

The next section of your HACCP plan is a product description — a detailed written summary of exactly what your product is.

This needs to cover:

• What it is: e.g. "a shelf-stable chilli sauce made from fresh chillies, vinegar, garlic, and salt"
• How it's processed: cooked, blended, bottled, pasteurised, etc.
• Packaging type: glass jar, plastic pouch, vacuum-sealed bag, etc.
• Storage conditions: refrigerated, frozen, ambient (room temperature)?
• Shelf life: how long is it safe and of good quality?
• Intended consumer: is it for the general public, or are there groups who should not eat it (e.g. people with nut allergies, young children, immunocompromised individuals)?
• Intended use: is it eaten straight from the pack, or does the consumer cook it further?

That last point — intended use — matters a lot. A product that gets cooked again before eating (like a raw marinated chicken) has a different risk profile than one eaten straight from the pack (like a ready-to-eat dip).

---

Step 3: Draw a Process Flow Diagram

A process flow diagram is simply a step-by-step map of how your product is made — from receiving raw ingredients to the finished product leaving your premises.

It doesn't need to be fancy. A hand-drawn diagram or a simple numbered list is fine, as long as it captures every step. Here's an example for a homemade jam:

1. Receive fruit and sugar from supplier
2. Store fruit in cool room / fridge
3. Wash and sort fruit
4. Peel, chop, and weigh fruit
5. Cook fruit and sugar to temperature
6. Test set point (gel test)
7. Fill into sterilised glass jars while hot
8. Seal lids and invert jars
9. Cool jars to ambient temperature
10. Label and batch-code jars
11. Store in cool, dry storeroom
12. Dispatch to retailer or customer

Once you've drawn the diagram, you need to verify it on the floor — meaning you actually walk through your production process while looking at the diagram, and confirm it's accurate. This step is required under SANS 10330 and must be documented.

---

---

Step 4: Conduct a Hazard Analysis

This is the heart of the HACCP plan — and the step most people find most confusing. Let's break it down.

A hazard in food safety is anything that could make a person sick or cause injury if it ends up in your food. There are three types:

• Biological hazards: bacteria, viruses, moulds, parasites — the things that cause food poisoning. Examples: Salmonella, E. coli, Listeria.
• Chemical hazards: pesticides, cleaning chemicals, allergens (substances that cause allergic reactions), excessive preservatives.
• Physical hazards: pieces of glass, metal, bone, plastic, or other foreign objects that could injure someone.

A hazard analysis means going through every step of your process flow diagram and asking: "At this step, what could go wrong? What hazard could be introduced, increased, or not controlled here?"

For each hazard you identify, you then assess:

• Likelihood: How likely is it that this hazard will actually occur?
• Severity: If it did occur, how serious would the harm be?

This is usually recorded in a table — one row per process step, with columns for the hazard type, description, likelihood, severity, and what control measure (if any) addresses it.

A control measure is anything you do that prevents or reduces a hazard. Cooking to a safe internal temperature is a control measure for biological hazards. Using a metal detector is a control measure for metal contamination. Allergen segregation is a control measure for chemical hazards.

---

Step 5: Identify Your Critical Control Points (CCPs)

Not every step in your process is a Critical Control Point. A Critical Control Point (CCP) is a step where a control measure is essential — where if that control fails, there is no later step that will catch or eliminate the hazard before the product reaches the consumer.

The standard tool used to identify CCPs is called the CCP Decision Tree — a series of yes/no questions you answer for each significant hazard. The questions essentially ask:

1. Does a control measure exist for this hazard at this step?
2. Is this step specifically designed to eliminate or reduce the hazard to an acceptable level?
3. Could contamination occur or increase to an unacceptable level?
4. Will a later step eliminate or reduce the hazard?

For most small food businesses, common CCPs include:

• Cooking / heat treatment — killing harmful bacteria
• Chilling / cold storage — preventing bacterial growth
• Metal detection — if you use one
• pH control (for acidified products like pickles or sauces) — acidity that prevents bacterial growth

Keep the number of CCPs realistic. Many small businesses have two to four CCPs. If you find yourself listing ten or fifteen, you may be confusing CCPs with general Prerequisite Programmes (PRPs) — the everyday hygiene and operational practices that support your HACCP system (things like handwashing, pest control, and supplier management).

---

Step 6: Set Critical Limits for Each CCP

For every CCP, you need a critical limit — a measurable boundary that separates safe from unsafe.

Critical limits are always expressed as numbers you can measure. Examples:

• Internal cooking temperature: minimum 75°C for at least 15 seconds
• Cold storage temperature: maximum 5°C
• pH of an acidified sauce: maximum pH 4.6 (below this, most dangerous bacteria cannot grow)
• Water activity (moisture availability in the product): maximum aw 0.85

These limits must come from validated sources — meaning scientific evidence or regulatory guidance, not guesswork. South African regulations, Codex Alimentarius (international food safety guidance), published food science literature, or a qualified food technologist can all provide validated critical limits.

---

Step 7: Establish Monitoring Procedures

Monitoring means regularly checking that your CCPs are actually under control — that you're staying within your critical limits.

For each CCP, your plan must specify:

• What you monitor (e.g. internal product temperature)
• How you monitor it (e.g. calibrated probe thermometer)
• How often you check (e.g. every batch, every hour)
• Who is responsible for checking
• Where you record the results

This is where records become critical. Monitoring without records is almost worthless in a food safety system. If you can't show it was checked, from a legal and audit perspective, it wasn't checked.

Records don't have to be digital. A simple paper log sheet works fine for small operations — as long as it's filled in accurately, signed, dated, and kept on file.

---

Step 8: Define Corrective Actions

A corrective action is what you do when monitoring shows that a critical limit has been breached — when something has gone wrong.

Your HACCP plan must document this in advance, not make it up on the day. For every CCP, ask: "If this limit is breached, what do I do?"

Corrective actions typically involve two things:

1. What happens to the affected product? Is it re-cooked? Re-chilled? Destroyed? Put on hold pending further testing?
2. What do you do to fix the process? Recalibrate the oven? Repair the refrigerator? Retrain the staff member?

Every corrective action must be recorded — what happened, what you did about it, and what the outcome was.

---

Step 9: Set Up Verification Activities

Verification is the process of checking that your HACCP system is actually working — that your monitoring is being done properly, your corrective actions are effective, and your overall plan reflects what really happens in your kitchen or facility.

Verification activities for a small business might include:

• Reviewing monitoring records weekly or monthly
• Periodic calibration of thermometers and other measuring equipment (calibration means checking that your equipment is giving accurate readings)
• Periodic product testing (sending samples to an accredited laboratory)
• Internal audits — walking through your process and comparing it to your documented plan

Verification is different from monitoring. Monitoring is the day-to-day check ("is the temperature right?"). Verification is the higher-level check ("is our monitoring system actually telling us what we need to know?").

---

Step 10: Document Everything and Keep Records

The final piece — and the one most small businesses underestimate — is documentation and record-keeping.

Your HACCP plan is a set of documents. Your records are the proof that you're following the plan. Both are required.

The core documents in a HACCP plan include:

• Food safety team list
• Product description sheet(s)
• Process flow diagram(s)
• Hazard analysis table(s)
• CCP summary table (sometimes called the HACCP Control Chart)
• Monitoring procedures and log sheets
• Corrective action records
• Verification records

Keep records for a minimum period after the product's shelf life — a common rule of thumb is at least one year, or as specified by your retailer or certification body.

---

A Quick Word on Prerequisite Programmes

Your HACCP plan doesn't stand alone. It sits on top of a foundation of Prerequisite Programmes (PRPs) — the basic hygiene and operational practices that every food business should have in place regardless of HACCP.

PRPs include things like:

• Personal hygiene (handwashing, no jewellery, clean uniforms)
• Pest control
• Cleaning and sanitation schedules
• Supplier management and incoming goods inspection
• Equipment maintenance
• Allergen management
• Waste management
• Water quality

If your PRPs aren't in place, your HACCP plan will have gaps. Think of PRPs as the floor your HACCP plan stands on.

---

Common Mistakes Small Businesses Make With HACCP Plans

• Copying someone else's plan without adapting it. A HACCP plan must reflect YOUR product, YOUR process, and YOUR premises. A template from a different product type is useless — or worse, misleading.
• Listing too many CCPs. If everything is critical, nothing is. Many things are controlled by PRPs, not CCPs.
• No records. A plan with no monitoring records is not a functioning HACCP system.
• Never reviewing the plan. Your HACCP plan must be reviewed whenever you change your product, process, equipment, or ingredients — and at least annually even if nothing has changed.
• Using unvalidated critical limits. Guessing that "cooking until it looks done" is good enough is not a critical limit.

---

Do You Need a Consultant to Write Your HACCP Plan?

Not necessarily — but it depends on your product and your confidence level. Many small food businesses with straightforward products (jams, sauces, baked goods, dried products) can build a solid HACCP plan themselves if they have the right guidance and templates.

More complex products — raw meat, dairy, ready-to-eat meals, products for vulnerable consumers (babies, the elderly, immunocompromised people) — carry higher risk and may genuinely benefit from professional input.

If you're working toward a formal certification like SANS 10330 or a GFSI-recognised scheme (GFSI stands for the Global Food Safety Initiative, which oversees internationally recognised food safety standards), a trained auditor or food safety consultant will need to verify your plan anyway. But you can do most of the groundwork yourself.

---