HACCP temperature control: critical limits, monitoring and records

A HACCP plan turns each temperature step in a food business into a number, a check and a response. The number is the critical limit. The check is the monitoring procedure. The response is the corrective action. The records show that all three happened. This guide covers those four parts for chilled storage, frozen storage, cooking, cooling and hot holding, with the figures the regulators publish, and shows where an automated monitoring system helps and where it does not.

The law is short. Article 5 of Regulation (EC) No 852/2004 requires every food business operator in the EU to "put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles". The Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969, revised in 2020 and 2022) give the method in more detail. Northern Ireland follows the EU hygiene rules, and Great Britain kept Regulation 852/2004 in its own law after leaving the EU, so the same seven principles apply in Ireland and the UK.

The seven HACCP principles applied to temperature

Codex lists seven principles. Regulation 852/2004, Article 5(2), sets out the same steps in its own words.

Codex keeps the term "critical control point" for a step where a control measure is essential to control a significant hazard. Not every fridge is a CCP. Codex calls the other controls good hygiene practices, and some of them need "greater attention", which "may include a higher frequency of application, of monitoring and of verification". The 2022 Commission Notice on food safety management systems (2022/C 355/01) treats storage temperature in the same way. Whatever the label, the monitoring, the response and the record look the same.

Critical limits for each temperature step

A critical limit must be measurable and validated. Codex defines it as a criterion "which separates acceptability from unacceptability of the food". The figures below are the ones the authorities publish. Your own limits come from your hazard analysis, your products and the law where you operate, and they can be stricter.

The food storage temperature limits guide sets out the chilled, frozen and hot-holding rules country by country, with the date each was checked.

Two limits are better than one. Set an operating limit inside the critical limit, so that staff correct the process before food is at risk. A walk-in chiller can run at 3 °C, raise an alarm at 5 °C and have a critical limit of 8 °C. The alarm at 5 °C starts an investigation. A reading above 8 °C starts the corrective action in the plan.

The time matters as much as the temperature. The England regulations allow chilled food above 8 °C for a single period of up to 4 hours on service or display, and food below 63 °C for up to 2 hours on service or display. They also accept defrost cycles and breakdowns as unavoidable reasons for a limited period. A critical limit for storage is therefore often a temperature with a duration: "above 8 °C for more than 2 hours". Write the duration down.

Monitoring: how often and with what

Monitoring is "the act of conducting a planned sequence of observations or measurements" (Codex). For each CCP, the plan names what is measured, how, how often and by whom.

Codex is direct on frequency: "Where possible, monitoring of CCPs should be continuous." If it is not, the frequency must be enough to show that the critical limit was met. The Commission Notice adds that the method should take account of "a gradual increase of temperature in cold storage", and that when a critical limit is exceeded, "all the production since the last satisfactory monitoring must be checked".

That last rule decides the interval. With a manual check twice a day, a deviation found at 16:00 puts everything since the 08:00 check in question. With a reading every 5 minutes, the question covers 5 minutes.

Cooking and cooling are batch steps. The core temperature of the batch is the measurement, and a hand probe in the thickest part is often the best instrument. Storage and hot holding run all day and all night, which is where continuous logging is most useful. The Commission Notice says temperature "should be (automatically) recorded where relevant" and that alarms "should preferably be automatic", with a max/min thermometer acceptable for a smaller establishment.

What the probe measures matters as much as how often. A fridge's own display shows the air at the controller's sensor, which is placed for control, not for the warmest product. The temperature probe placement guide covers where to put an independent probe, when to use a buffered probe and how to set an alarm delay that survives a defrost.

Corrective actions

Codex defines a corrective action as any action taken when a deviation occurs "in order to re-establish control, segregate and determine the disposition of the affected product". Each has three parts:

1. Restore control. Close the door, reset the compressor, move the food to a working unit, adjust the oven.
2. Decide on the food. Use it now, re-chill it, re-cook it, or discard it, by a rule written before the event.
3. Record it. The Commission Notice lists the date, the time, the type of action, the person who acted and the follow-up check.

Write the decision rules in advance, so that the person on shift at 03:00 does not have to invent one. Base them on time and temperature. For example, FSAI Guidance Note 15 says that cook-chill food that rises above 5 °C, but not above 10 °C, is to be consumed within 4 hours. The FSAI cooling advice says that food still above 10 °C after 2.5 hours is to be served immediately or discarded. These are the authority's rules for those processes, not universal ones. Your plan sets your own.

Records that stand up to an inspection

Article 5(2)(g) of Regulation 852/2004 asks for "documents and records commensurate with the nature and size of the food business". A small business can use a short form. Recital 15 says the HACCP requirements "should provide sufficient flexibility to be applicable in all situations, including in small businesses". The Commission Notice allows simplified records, such as tick-box checklists and records made only when something goes wrong.

Whatever the format, a temperature record answers five questions:

• Which unit or batch, and which instrument?
• What was the temperature, and when was it measured?
• Was it inside the limit?
• If not, what was done, by whom and when?
• Who checked the record afterwards?

Codex asks for monitoring records to be signed or initialled by the person who does the monitoring. It also asks for verification by someone other than that person. A manager who reviews the week's records and signs them is doing verification.

Keep the records for an appropriate period. Regulation 852/2004 does not set one. Codex advises a period that "exceeds the shelf-life of the product". For quick-frozen food, Regulation (EC) No 37/2005 requires at least one year, or longer if the shelf life is longer. The EN 12830 guide covers the recording instruments that Regulation names.

Verification: proving the monitoring works

Verification checks that the monitoring would catch a problem. For temperature, it has three regular tasks:

• Check the thermometers. The SFBB pack checks a probe in iced water (−1 °C to 1 °C) and in boiling water (99 °C to 101 °C). FSAI gives a tighter tolerance of ±0.5 °C and checks at least twice a year.
• Test the alarms. Warm a probe and confirm that the alarm reaches the named person outside working hours.
• Review the records. Look for gaps, flat lines, repeated values and readings taken at the same minute every day.

A flat line at exactly 3.0 °C for a week is not a good record. It is a sign that someone wrote the target down instead of reading the thermometer, or that a sensor has failed.

What automated monitoring adds, and what stays with you

An automated system replaces the clipboard for storage and hot-holding steps. It does not replace the plan.

With EpiSensor, wireless TES probe temperature sensors report to a Gateway running Edge. The TES datasheet gives ±0.2 °C from −20 °C to 70 °C for the waterproof probe, 0.01 °C resolution and up to 70,000 readings held on the sensor if the radio link fails. Edge runs limit rules on the Gateway, with a time the condition must hold before the alarm opens, so a door opening does not page anyone. Its alerts record who acknowledged and resolved each one, and when, with an optional note. That note is where the corrective action goes.

The HACCP temperature monitoring guide sets out a kit for a kitchen or shop, and the food processing guide covers cooling, blast chilling and dispatch.

Some kitchens and stores already have a controller on every unit. Reading it over Modbus adds the setpoint, the defrost state and the evaporator temperature, which explain an excursion. The refrigeration controller guide shows how, and why the controller probe should not be the only HACCP signal.

A worked example: one night, one walk-in chiller

A restaurant's walk-in chiller holds cooked meats and dairy. The plan sets an operating range of 1 °C to 5 °C, a critical limit of 8 °C and a rule: product above 8 °C for less than 2 hours is used within 4 hours; for longer, it is discarded. One probe reads the air at the warmest point by the door. A second, in a bottle of glycol on the top shelf, follows the product.

The product probe never reached 8 °C, so the plan's rule kept the stock. Judged on the air probe alone, which passed 8 °C at about 03:30, the same rule would have required the stock to be used within 4 hours, by the morning service, or discarded. Without the alarm, the deviation would have been found at the 08:00 opening check, with six hours of stock in question.