HACCP, ISO 22000 and Food Safety Compliance: Document Management Guide

Food safety compliance in the UK requires documented evidence across every stage of production: hazard analyses, critical control point records, supplier certificates, traceability logs and corrective action reports. Businesses operating in the food sector must satisfy at least three overlapping documentary regimes simultaneously — statutory obligations under UK food hygiene law, the requirements of their chosen food safety management standard (HACCP, ISO 22000 or a GFSI-benchmarked scheme), and the commercial audit criteria set by their retail or foodservice customers. A gap in any layer — an unrecorded CCP deviation, a missing Certificate of Analysis from a supplier, or an outdated Prerequisite Programme review — can result in a failed Environmental Health Officer inspection, a suspended retail listing or a product recall that costs hundreds of thousands of pounds.

Document fraud in food supply chains is accelerating. Our platform has processed over 2.4 million verified documents with a fraud detection recall rate of 94.8%, and our analysis shows a 23% year-on-year increase (2024–2025) in fraudulent food safety certificates — including fabricated BRC certificates, doctored CoAs and forged supplier audit reports. Automated document verification is therefore not a convenience but a control measure in its own right.

This guide explains what each documentary layer demands, how the main UK certification schemes compare, and how food businesses are using document management platforms to cut audit preparation time by up to 83% across 85+ enterprise clients.

This article is provided for informational purposes only and does not constitute legal, financial or regulatory advice. Consult a qualified professional for questions relating to your specific situation.

HACCP: The 7 Principles and Their Documentation Requirements

HACCP (Hazard Analysis and Critical Control Points) is not a certification scheme — it is a systematic method mandated by law for all food businesses in the UK under the Food Hygiene (England) Regulations 2006 (SI 2006/14) and underpinned by Regulation (EC) No 852/2004, retained in UK law following the EU Withdrawal Act 2018. The Food Standards Agency (FSA) provides official guidance for UK operators and is the primary enforcement body at the national level.

Each of the seven HACCP principles generates specific documentary outputs that must be maintained, reviewed and made available to inspectors on request.

The FSA specifies a minimum retention period of 12 months for most records, extended to shelf-life plus six months for short-shelf-life products. For non-perishable goods, five years is the industry norm and the requirement under most GFSI-recognised schemes. Environmental Health Officers will ask to see all seven document types during an unannounced visit.

Prerequisite Programmes (PRPs) — cleaning schedules, pest control contracts, maintenance logs, supplier approval records, allergen management plans — sit alongside the HACCP plan and are equally inspectable. A HACCP plan that references a cleaning procedure but cannot produce the signed cleaning schedule for the past three months will generate a non-conformity.

ISO 22000:2018: The International Standard for Food Safety Management

ISO 22000:2018 integrates HACCP with a full management system framework aligned to the ISO High Level Structure (HLS), making it compatible with ISO 9001 and ISO 14001. Where standalone HACCP focuses on operational control, ISO 22000 adds documented requirements for context analysis, leadership commitment, competence management, communication planning, emergency preparedness and management review.

The standard applies to all organisations in the food chain — growers, manufacturers, packers, transporters, caterers and retailers — and is accredited in the UK by the UKAS (UK Accreditation Service), which approves the certification bodies authorised to issue ISO 22000 certificates.

Key documentary requirements specific to ISO 22000:2018 include:

• Scope statement (clause 4.3): a documented description of the products, processes and sites covered by the FSMS.
• Hazard control plan (clause 8.5.4): the output of the hazard analysis, specifying control measures categorised as CCPs or Operational PRPs (OPRPs), with associated monitoring procedures, critical limits or action criteria, and corrective action triggers.
• Traceability system (clause 8.3): documented procedures showing one-step-back/one-step-forward traceability for raw materials, ingredients, packaging and finished products.
• Management review records (clause 9.3): minutes and action logs from at least one annual review by top management.
• Internal audit programme (clause 9.2): a risk-based schedule of internal audits, audit reports and evidence that non-conformities were addressed.
• Competence records (clause 7.2): training matrices, certificates and records of on-the-job assessment for all personnel affecting food safety.

ISO 22000 certification does not automatically satisfy the requirements of major retail customers such as Tesco or Sainsbury's, who impose BRCGS Food Safety as a condition of listing. However, it is widely accepted by food manufacturers operating in international B2B markets, and many FSSC 22000 audits build directly on an existing ISO 22000 foundation.

See our vendor compliance certificate verification guide for practical advice on collecting and verifying ISO 22000 certificates from your supply chain.

Food Traceability: UK Legal Requirements and Key Documents

Traceability is the legal obligation most likely to be tested in a food safety emergency. Under Article 18 of Regulation (EC) No 178/2002 — retained in UK law as assimilated legislation — food business operators must be able to identify any person who supplied them with a food, feed, food-producing animal or any substance incorporated into food. They must also identify all businesses to which their products have been supplied. This one-step-back/one-step-forward requirement must be demonstrable within hours during a product recall or withdrawal.

The Food Safety Act 1990 provides the overarching statutory framework in Great Britain, under which prosecutions for failures in traceability systems can be brought.

The documentary evidence required to demonstrate traceability compliance includes:

• Goods received records: supplier name and address, product name, lot or batch number, quantity, date received. These must be cross-referenced to purchase orders and delivery notes.
• Batch production records: which raw material batches (with lot numbers) were used to produce which finished product batches on which date, by which operator, on which line.
• Finished goods dispatch records: which finished product batches were shipped to which customers, on which date, via which carrier, under which delivery note or invoice number.
• Recall and withdrawal procedures: a documented procedure tested at least annually, with mock recall records retained as evidence.

Post-Brexit, the UK operates its own product alert mechanism that mirrors the EU's RASFF (Rapid Alert System for Food and Feed). Businesses must have documented procedures for responding to alerts from the Food Standards Agency and, where relevant, Food Standards Scotland (FSS). RASFF participation as an EU mechanism is no longer available to UK operators, making internal traceability systems more critical.

UK Retailer Certifications: BRCGS, SALSA and the Approved Supplier Process

Statutory compliance is the floor, not the ceiling. Securing and retaining a listing with UK food retailers requires satisfying scheme-specific audit criteria that go well beyond the legal minimum. The main schemes relevant to the UK market are:

BRCGS Food Safety Issue 9 is the dominant scheme in the UK. Tesco, Sainsbury's, Marks & Spencer and Waitrose all require their direct suppliers to hold a current BRCGS certificate from a UKAS-accredited certification body. An Issue 9 audit will examine the HACCP plan in granular detail, test the supplier approval programme (including whether CoAs are reviewed against product specifications before use), and assess the effectiveness of the product safety culture programme — a relatively new documentary requirement introduced in Issue 8 and strengthened in Issue 9.

SALSA is designed for smaller producers who cannot yet meet the full demands of BRCGS. It provides a proportionate route to demonstrating competence, and a SALSA certificate is accepted by the Co-operative Group's local sourcing programme and numerous regional foodservice operators.

IFS Food v8 is less common than BRCGS as a UK retailer requirement but is demanded by some retailers for export into France, Germany and the Netherlands, making it relevant for businesses that supply both domestic and European markets.

The approved supplier process — the mechanism by which a food manufacturer demonstrates that its own ingredient and packaging suppliers are under control — generates a high volume of documents: supplier questionnaires, CoAs per lot, audit reports, allergen declarations, specification sheets and ongoing review records. This is where document management automation delivers the greatest operational value.

Automating Food Safety Document Management

Two questions appear repeatedly in food safety practitioner forums: "How do I collect Certificates of Analysis from 200 active suppliers without chasing emails for three weeks?" and "How do I prove that every PRP review was completed on time when the IFS auditor asks to see three years of records tomorrow morning?"

Both questions describe the same underlying problem: food safety document management remains, in most businesses, a manual process built on shared drives, email chains and spreadsheets. The consequences are predictable. Documents are missing or unversioned, supplier CoAs are filed against product names rather than lot numbers, and PRP review sign-offs exist in a paper folder that nobody can locate during an unannounced inspection.

Our platform reduces audit preparation time by 83% for the 85+ enterprise food clients who have deployed it. The mechanism is not complex: every document — supplier certificate, CoA, calibration record, corrective action form — is ingested at source, assigned to the correct supplier, product and lot reference, and verified against expected parameters before it enters the approved document set. The 94.8% fraud detection recall rate means that a forged BRC certificate or a CoA with a manipulated microbiological result is flagged at intake rather than discovered during an audit.

Practical capabilities that address common pain points:

• Automated CoA collection and matching: suppliers receive a secure upload link triggered at each delivery. The platform matches the CoA to the purchase order and checks that the reported values fall within the approved specification range. Non-compliant or missing CoAs generate an automatic hold on the associated lot.
• PRP review scheduling and evidence capture: cleaning records, pest control reports and maintenance logs are collected on a defined schedule with automated escalation if a record is overdue. The audit trail shows not just whether a record exists but when it was uploaded and who reviewed it.
• Certificate expiry monitoring: supplier ISO 22000, BRCGS and IFS certificates are tracked against expiry dates. Procurement teams receive alerts 90, 60 and 30 days before a certificate lapses, preventing approved supplier lists from going stale.
• Mock recall support: traceability queries — "show me all finished goods batches that contain ingredient lot X" — are resolved in seconds rather than hours, giving operations teams the confidence to run effective mock recalls.

For related guidance on how document compliance works in adjacent supply chain functions, see our article on transport and logistics document compliance and the broader industry verification guide.

The CheckFile platform is designed to integrate with existing ERP and quality management systems via API, making it possible to extend automated document verification to food safety records without replacing existing infrastructure. Details of security architecture and data handling are available at /securite, and pricing information for food sector deployments is at /tarifs.

FSA Inspections: What Environmental Health Officers Check

Environmental Health Officers (EHOs) employed by local authorities carry out food safety inspections under powers granted by the Food Safety Act 1990 and associated regulations. Inspections may be announced or unannounced. The Food Hygiene Rating Scheme (FHRS) scores each premises on a scale of 0 to 5 based on the inspection findings. In Wales and Northern Ireland, display of the FHRS sticker is a legal requirement; in England and Scotland, display is voluntary but widely expected by consumers.

During an inspection, an EHO will typically examine:

• The HACCP plan: Is it documented? Has it been reviewed following any change in product, process or premises? Are the critical limits scientifically justified? Are monitoring records complete and signed?
• Temperature records: Are refrigeration and cooking temperatures being logged at the required frequency? Are there corrective action records for any out-of-range readings?
• Cleaning and disinfection: Is there a written schedule? Are cleaning records current? Are cleaning products used at the correct concentration and contact time?
• Allergen management: Is there a documented allergen management procedure? Are allergen declarations for all ingredients current and cross-referenced to recipes?
• Supplier approval: Can the business demonstrate that it buys from approved suppliers and that certificates and CoAs are being reviewed?
• Training records: Can the business show that all food handlers have received appropriate food hygiene training? Are records of training, including dates and competency assessments, maintained?
• Calibration records: Are thermometers and other measuring equipment calibrated on a documented schedule?

A business that holds a valid BRCGS or FSSC 22000 certificate will typically have all of the above in place, but the certificate does not exempt the business from statutory inspection. EHOs inspect against the legal baseline, and a certified business that has allowed its operational records to deteriorate between certification audits will still receive a poor FHRS score.

The most common documentary failures observed in FSA-published enforcement data are: incomplete CCP monitoring logs (particularly temperature records with unexplained gaps), allergen management procedures that have not been updated to reflect recipe changes, and supplier approval records that are not maintained as an active document (i.e. the initial questionnaire was completed but CoAs are not being collected or reviewed on an ongoing basis).

Frequently Asked Questions

What documents must a UK food business maintain for HACCP compliance?

At minimum: the hazard analysis worksheet, the HACCP plan identifying all CCPs and their critical limits, CCP monitoring logs, corrective action records, verification and validation records (including calibration logs), and documented Prerequisite Programmes covering cleaning, pest control, allergen management, supplier approval, maintenance and staff training. The FSA guidance sets out these requirements in detail. Retention periods are typically a minimum of 12 months for operational records, shelf-life plus six months for records relating to short-shelf-life products, and five years for the HACCP plan and associated technical documents.

Is ISO 22000 certification accepted by UK supermarkets instead of BRCGS?

For direct supply to the major UK multiples (Tesco, Sainsbury's, M&S, Waitrose), BRCGS Food Safety Issue 9 from a UKAS-accredited certification body is the standard requirement. ISO 22000 certification alone does not satisfy this requirement. FSSC 22000 v6 is GFSI-recognised and accepted by most major retailers as equivalent, but individual retailer approval should always be confirmed in writing before relying on it as a listing condition.

How long must food traceability records be kept in the UK?

Regulation (EC) No 178/2002 (retained in UK law) requires that traceability information be available on demand. While the regulation does not specify a retention period, the industry norm enforced by BRCGS and FSSC 22000 is five years for records relating to non-perishable goods, and shelf-life plus six months for perishable products. The FSA recommends a minimum of 12 months for most records.

What is the FHRS and does a poor score have legal consequences?

The Food Hygiene Rating Scheme is a national scheme administered jointly by the FSA, FSS and local authorities. Scores run from 0 (urgent improvement necessary) to 5 (very good). In Wales and Northern Ireland, displaying the most recent FHRS sticker is a legal requirement. In England and Scotland, display is voluntary. A score of 0 or 1 does not automatically trigger closure, but it may prompt an EHO to carry out a follow-up inspection at shorter notice, and some retail and foodservice customers require a minimum score of 3 or above as a contractual condition.

How can a business automate the collection of Certificates of Analysis from a large supplier base?

The most efficient approach is a supplier portal that triggers a secure document upload request at the point of purchase order confirmation or goods receipt. Automated matching against purchase order references and product specifications ensures that each CoA is linked to the correct lot and that out-of-specification results are flagged before the goods enter production. Our analysis of enterprise food clients shows that this approach reduces CoA processing time by over 80% compared with manual email-based collection and eliminates the most common source of missing CoA records at audit. The CheckFile platform supports this workflow for businesses managing supplier bases from 20 to over 2,000 active suppliers. See /tarifs for deployment options.