HACCP in a hotel kitchen: the seven principles and what is actually required

HACCP (hazard analysis and critical control points) is a method for finding where food can become unsafe in your own kitchen and controlling those points with limits, checks and written records. Turkish food hygiene rules require procedures based on its seven principles, not a purchased certificate.

A consultant offers a HACCP certificate in a folder. The inspector, the tour operator's auditor and a bad night on the buffet line all ask a different question: can you show, from your own records, that you knew where the risk was and controlled it. After reading this article you will be able to tell the seven principles apart, know what Turkish law actually asks of a hotel kitchen, and decide what to write down and what to buy.

What does HACCP mean in a hotel kitchen?#

HACCP stands for hazard analysis and critical control points: a method for finding the places in your own kitchen where food can become unsafe, fixing a limit at each place, and writing down what you checked and what you did when the check failed. The method was codified internationally by the Codex Alimentarius Commission, a joint food-standards body of the Food and Agriculture Organization and the World Health Organization, in its General Principles of Food Hygiene (CXC 1-1969, FAO/WHO edition, Rome 2023).

A hazard is anything in food that can harm a guest: microbes, chemicals such as cleaning residue, and physical objects such as glass or bone. The analysis is a list of these, tied to your real menu and your real flow of food, from the delivery van to the plate. A control measure is the action that removes or reduces a hazard: cooking, rapid chilling, keeping cold food cold, separating raw and cooked.

A critical control point (CCP) is a step where control is essential and there is no later step to fix the mistake. A control point that is merely good practice is not a CCP, and calling everything a CCP is the most common way a plan becomes unusable, because nobody can monitor thirty points honestly. The practical test of understanding: a chef should be able to explain, without the folder, which three or four points in the kitchen decide whether the food is safe, and who checks each one.

Hazard, control measure, critical control point: three words that decide everything#

These three words are often used loosely in HACCP hotel plans, and the looseness costs money. A hazard that is not identified cannot be controlled. A control measure that exists but is not assigned to a step in the flow does not belong to anyone. A CCP that is not genuinely critical generates records nobody reads while the real risk sits elsewhere. Getting the vocabulary right is the cheapest improvement available in most kitchens.

Why the acronym matters less than the method#

In law, the Turkish text does not use the English acronym. The Food Hygiene Regulation asks for procedures based on HACCP principles, or one permanent procedure written on those principles (Gıda Hijyeni Yönetmeliği, Resmî Gazete 17 December 2011, No. 28145, Article 22(1)). What matters to the Ministry, to an auditor and to your guests is the method behind the letters: identify the hazards in your own operation, control them at defined points, and prove it with records.

What does Turkish food hygiene law actually require?#

It requires procedures based on HACCP principles, applied to your own operation, with records that suit your size; it does not require you to buy a certificate. The duty falls on food business operators carrying out one or more stages of production, processing and distribution after primary production, which covers a hotel kitchen, a buffet, a pastry section and a banquet operation (Food Hygiene Regulation, Article 22(4)).

The regulation scales the duty rather than exempting small businesses: the documents and records that prove the measures work must suit the business's structure and size (Article 22(2)(f)), and the operator supplies the Ministry with the information and documents it asks for, taking account of field of activity and size (Article 22(5)(a)). The exclusions in Article 2(3) concern private consumption, a producer's direct sale of small quantities of primary products, and raw material for gelatine and collagen. None of them covers a hotel kitchen.

The Ministry encourages good practice guides that combine HACCP principles with good hygiene practice, and these guides are voluntary (Article 24). Following one can simplify your plan; it does not replace the operator's own responsibility. Under the Veterinary Services, Plant Health, Food and Feed Law (Law No. 5996, Resmî Gazete 13 June 2010, No. 27610), the operator must meet and verify the law's requirements at every stage, keep the required records up to date and present them to the Ministry on request (Article 22). The same law separates approval from registration, and the Ministry decides which businesses fall under which (Article 30); its definition of retail covers catering, workplace and institutional canteens, restaurants and similar food-service places (Article 3).

Read the two duties together: registration is about existing in the Ministry's records, HACCP-based procedures are about how you work. Passing one does not satisfy the other. The registration side, including what happens when activity stops, is covered in our article on hotel kitchens and food law in Türkiye: registration, hygiene rules and records.

Registration, approval and the operator's own duty#

Approval means the Ministry's permission before operating; registration means the business's records are held by the Ministry. An operator that stops all or part of its activities must notify the Ministry within three months, or the approval or registration is cancelled, and premises that fail to register face an administrative fine (Law No. 5996, Articles 30 and 41). These are separate questions from whether your HACCP-based procedure is any good.

What the regulation does not ask for#

The seven principles on one buffet line#

The same seven principles apply to a cold buffet as to a factory, and the buffet is where most hotel kitchens can see them most clearly. The Codex General Principles of Food Hygiene set out the seven principles in Section 17, and the buffet line is a good place to make each one concrete.

Principle 1, hazard analysis: list the hazards for each dish on the line, not for "food" in general. Cooked meats, dairy desserts, cut fruit, salads with dressing and ice all carry different risks and different control measures. Principle 2, critical control points: decide where control must happen and cannot be recovered later. Holding temperature on the line is one; rapid chilling of a sauce made the day before is another; receiving temperature of a chilled delivery is a third.

Principle 3, critical limits: each CCP needs a limit that has been validated, meaning there is a reason to believe it works, not a number copied from another hotel's plan. This article deliberately quotes no temperatures, because the right figure depends on the product and must come from your own validation and your adviser. Principle 4, monitoring: say who checks, how, how often and where it is written. A check nobody records is a check that cannot be shown to an inspector or an auditor.

Principle 5, corrective action: decide in advance what happens to the food when a limit is missed, who decides and what is written down. The decision must be taken before the busy service, not during it. Principle 6, validation and verification: validation asks whether the plan would work if followed; verification asks whether it is actually being followed. Calibration of probes, a periodic record review and an internal walk of the line belong here, and they are not the same as the daily monitoring check. Principle 7, documentation and records: keep the procedures and the records that match these principles and your operation. Codex lists this last, but it is the part an inspector reads first.

A worked example: the cold buffet#

The table below is an example, not a template. Your dishes, equipment and staff decide your own entries.

If the buffet line is where you plan quantities, the same records feed other work: see our article on buffet food waste in all-inclusive hotels: measuring it and planning quantities from covers.

Monitoring is not verification#

Monitoring is the daily check by the person doing the work. Verification is someone else confirming, periodically, that the checks happen and the results make sense. A kitchen can have a year of monitoring sheets and still fail verification because the sheets were signed in advance, the probe was never calibrated or the deviations were never acted on. Keep the two separate on paper and in people's minds.

Why prerequisites come before the plan#

Because a HACCP plan cannot hold on top of a kitchen that is not clean, not maintained and not supplied safely. Codex states plainly that HACCP will not be effective unless prerequisite programmes, including good hygiene practices, are in place first (CXC 1-1969, Section 18).

Prerequisites are the everyday conditions: cleaning and disinfection schedules, pest control, personal hygiene and staff health, maintenance of equipment, safe water, waste handling, and control of suppliers. Supplier control is where most hotel risk enters the building. An approved supplier list, a receiving check and a record of what was rejected do more for safety than a longer plan document; our article on hotel purchasing and receiving: a procedure from order to storeroom covers that flow in detail.

Training belongs here too: a plan is only as good as the person holding the probe at 07:00 on a Sunday. The trade-off is real: prerequisites cost time every day, while a plan document costs money once. Hotels that buy the document and skip the prerequisites end up with a folder that describes a kitchen they do not have. A quick diagnostic: if your cleaning schedules, pest reports, calibration records and supplier list are not current, fix those before rewriting the HACCP plan. The plan will be shorter and truer afterwards.

A small kitchen and a resort kitchen: same logic, different paper#

Both must work on the seven principles; what changes is the number of processes, the number of CCPs and the volume of records, because the regulation asks for documents suited to the business's structure and size (Article 22(2)(f)).

A 40-room hotel with one kitchen and a breakfast buffet can often run on one permanent procedure: a short hazard list, three or four CCPs, one monitoring sheet per shift and a weekly review. A resort with several outlets, banqueting, a pastry section, pool bars and room service needs a separate flow for each operation, because the hazards differ. The principles stay the same; the paper multiplies.

Group properties can standardise the method centrally but must keep monitoring records per outlet, because the person who checks and the equipment being checked are local. The most common failure in a large property is a central plan nobody at outlet level has read. The most common failure in a small one is no written record at all, only habit. Codex explicitly encourages flexible approaches for small and less developed businesses, provided all seven principles are considered (Section 18). Flexibility is about scale, not about dropping a principle.

Is a HACCP certificate required, and where does ISO 22000 fit?#

The hygiene regulation requires procedures, not a certificate; a certificate is a private commercial document issued by a certification body, and ISO 22000 is a voluntary management-system standard a hotel may choose to be audited against.

The legal duty is the operator's, under Law No. 5996 Article 22 and the Food Hygiene Regulation Article 22. No certificate transfers that duty to a third party. A HACCP certificate usually means a certification body has audited the hotel's food safety system against a scheme. It can be useful evidence in a commercial conversation, and it is not what the regulation asks for.

ISO 22000 is a food safety management system standard: it wraps HACCP principles inside a management system with policy, objectives, internal audit and management review. A hotel that already runs a documented quality system may find it a natural extension; a small hotel may not need it at all. A tour operator or agency may ask for a food safety certificate in a supplier questionnaire, because a certificate is quick to check. That is a commercial requirement, not a legal one, and it is worth separating the two when you decide what to buy.

Before paying for any certification, ask what the auditor will want to see on the day. In practice it is the same evidence an inspector wants: current records, named responsibilities and corrective actions that were actually carried out. Confirm with your own adviser which scheme, if any, your contracts require; this article does not recommend a scheme, a body or a price.

What a certificate does and does not prove#

A certificate proves that a body audited your system on a date and found it conforming to a scheme at that time. It does not prove the food served next Sunday was safe, and it does not replace the monitoring record for that Sunday. Treat the certificate as a signal to third parties and the records as the substance.

Separating a legal duty from a commercial one#

Write the two columns separately in your decision: what the law requires from your kitchen, and what your contracts require from your paperwork. Spending on the first is compliance; spending on the second is a commercial choice with a return you can estimate from the contracts it makes possible.

Which records prove the system works?#

The records that let a stranger reconstruct a normal day and an abnormal one: what was checked, by whom, what the reading was, what was done when it failed, and who confirmed the fix.

Monitoring records per CCP should be signed and time-stamped, with the actual value written rather than a tick. A column of ticks with no numbers proves nothing. A corrective action log names the food involved, the decision taken, the person who took it and what happened to the product. Verification records cover calibration of measuring equipment, internal review of the monitoring sheets and a note of what was changed as a result. Prerequisite records cover cleaning schedules, pest control reports, supplier approvals and receiving checks, and training records for the people who monitor.

The regulation asks for documents and records suited to the business's structure and size (Article 22(2)(f)) and for the operator to keep required records up to date and present them to the Ministry on request (Law No. 5996, Article 22). A record that cannot be produced is a record that does not exist. Keep the record set small enough that a busy shift will actually complete it: two well-kept sheets beat ten blank ones, and a short set survives a staff change.

What to do next#

Start with the prerequisites and one buffet line, not with a folder. Write the hazards for the dishes you actually serve, fix three or four CCPs with limits your adviser can defend, name the person who checks each one, and keep a record short enough to survive a busy Sunday. Then decide separately whether a commercial certificate is worth buying, and confirm your own position on registration, records and any certification scheme with a food safety adviser and your legal adviser.

The primary sources behind this article are the Food Hygiene Regulation (Gıda Hijyeni Yönetmeliği, consolidated text, mevzuat.gov.tr) (opens in a new tab), the Veterinary Services, Plant Health, Food and Feed Law No. 5996 (mevzuat.gov.tr) (opens in a new tab) and the Codex Alimentarius General Principles of Food Hygiene, CXC 1-1969 (FAO) (opens in a new tab). Read the regulation text yourself before acting on any detail, and confirm your own case with an adviser.