Hygiene in the kitchen: From the HACCP principle to a documented routine

Hygiene in the kitchen is regulated in a clearly defined legal framework in Germany. Regulation (EC) No. 852/2004 on food hygiene requires every food business operator to have a self-control system based on the principles of the HACCP procedure. The German Food Hygiene Ordinance (LMHV) specifies the requirements, the Infection Protection Act (IfSG) supplements them with personal obligations for employees, in particular Section 42 IfSG (activity and employment bans) and Section 43 IfSG (initial instruction and follow-up training). The municipal veterinary and food surveillance monitors compliance in unannounced inspections. Depending on the severity, violations lead to fines, operating bans or criminal proceedings according to Section 58 of the Food and Feed Code (LFGB).

The article organises the duties, describes a cleaning and training plan that stands up to the audit, and shows how a compliance platform and officer-as-a-service like CIVAC supports the hygiene officer technically and organizationally. It is aimed at kitchen managers in communal catering, care facilities, hotels, canteens, school catering and food production who not only practice hygiene but also have to demonstrate it. Read on to find out how the twelve HACCP steps can be translated into a weekly work rhythm, which temperatures and cleaning frequencies must be documented, which templates speed up an audit and how the reporting line to management can be set up so that deficiencies are not only noticed when the veterinary office is at the door.

Regulation (EC) No. 852/2004 is the basic standard for all food business operators in the European Union. In Article 5 it requires a self-control system according to HACCP principles: hazard analysis, determination of critical control points, setting of limit values, monitoring, corrective measures, verification and documentation. The German Food Hygiene Ordinance (LMHV) supplements these requirements with specific obligations, such as training staff in Section 4 LMHV and structural-functional separation in Annexes IV and V of the LMHV. The Infection Protection Act applies as soon as employees come into contact with perishable food, regardless of whether they prepare, portion or serve it.

§ 43 Para. 1 IfSG requires initial instruction from the health department or a designated doctor before starting work. The initial instruction must not be older than three months when you start work. Follow-up training must be carried out and documented by the employer at least every two years. Section 42 IfSG lists activity bans, for example in the case of salmonellosis, shigellosis, EHEC, hepatitis A and infectious skin diseases. The Hygiene Officer ensures that these instructions, prohibitions and re-instructions can be presented completely and with a date.

A lack of initial instruction leads to immediate conditions in the audit and can be punished with a fine of up to 25,000 euros according to Section 73 IfSG. The documentation does not belong in the kitchen manager's locker, but in a searchable system with a reminder function. Veterinary and food monitoring immediately recognises from the date of the last training whether the organisation is alive or only exists on paper. A well-managed system reduces inspection times to less than two hours. Anyone who adopts an existing self-monitoring system should first check that the instructions are up to date and that the shift sheets are complete. An initial inventory is possible in half a day.

The HACCP procedure consists of twelve steps described by the Codex Alimentarius: Formation of the HACCP team, product description, intended use, creation of the flowchart, verification of the flowchart on site, hazard analysis, determination of the critical control points (CCP), establishment of the critical limit values, monitoring of the CCPs, corrective actions, verification and documentation. In a commercial kitchen, the complexity is not reduced, but it must be broken down in a way that is suitable for everyday use so that employees on shift can actually live the plan.

Typical critical control points are the delivery of frozen goods (core temperature below minus eighteen degrees Celsius), the storage of fresh goods (between zero and seven degrees Celsius depending on the product), defrosting (in the refrigerator, not at room temperature), heating (at least seventy-two degrees Celsius for two minutes in the core for critical products), keeping warm (above sixty-five degrees Celsius) and reheating. Each of these points needs a documented measurement procedure with a time stamp, responsibility and correction path.

If you work with Excel lists, you risk lost records and illegible handwriting at the end of the shift. A digital self-monitoring system that is linked to Bluetooth thermometers and a shift system noticeably reduces the documentation effort and provides a complete time series for each CCP. Verification is typically carried out quarterly by the hygiene officer, external verification is carried out annually by an accredited auditor. Audit-proof, documented, HACCP-proof. Anyone who follows the twelve steps correctly and then maintains them has done the main work. The effort required for subsequent changes is low as long as the system takes care of versioning. New products or recipe changes are fed into the HACCP plan before they go live in the kitchen. This sequence protects against audit findings that cannot be remedied afterwards. In plain language: First the plan, then the shift, then the receipt.

The biggest entry route for pathogens into a kitchen is the staff. § 5 LMHV and the Codex Alimentarius require that people who handle food maintain appropriate personal hygiene. In practice this means: clean, preferably white or light-colored work clothing that is changed daily, closed shoes, headgear and the consistent removal of jewelry including rings, bracelets and watches. Long fingernails, artificial nails and nail polish are not permitted in direct food processing.

Washing your hands is the most important single step. Before starting work, after using the toilet, after breaks, after every change between raw materials and ready-to-eat products, after coughing or sneezing. Hand disinfection complements washing at critical points, such as when switching between poultry and salad preparation. The washing areas must be equipped with running warm water, liquid soap from the dispenser, disposable towels and a foot-operated or contactless waste container.

Illnesses are subject to reporting. Anyone who suffers from salmonellosis, campylobacter, shigellosis, EHEC, hepatitis A or hepatitis E or is a shedder must not handle food. Management must establish a low-threshold reporting line so that illnesses can be reported without fear of loss of wages. There is also a documentation requirement for wound dressings on the hands and forearms: These must be waterproof, visible (typically blue) and noted in the shift book. The occupational medical care supplements the hygiene organisation with the occupational medical suitability examination in accordance with the professional association principle G 42 or G 23 where it is mandatory. The findings from occupational health care are incorporated into shift planning so that non-deployable employees are not accidentally scheduled at critical stations. A written separation between medical findings and personnel planning must be maintained; the supervisor only learns what he needs to know for personnel deployment planning.

A cleaning and disinfection plan is mandatory. For each area (preparation, cooking zone, scullery, cold rooms, storage, toilets, social rooms) it lists the frequency (daily, weekly, monthly), the agent (with concentration and exposure time), the method (wiping, spraying, dipping) and the person responsible with initials. The cleaning agents must be approved for use in the food environment; safety data sheets in accordance with Regulation (EC) No. 1907/2006 (REACH) must be kept available. Disinfectants should correspond to the VAH list or the recommendations of the Robert Koch Institute and be selected product-specific.

It is important to separate cleaning and disinfection. Cleaning removes visible dirt, disinfection reduces microorganisms. An area that has been disinfected but not cleaned is hygienically unacceptable because protein residue prevents most disinfectants from working. In areas with a risk of cross-contamination (poultry preparation, egg products), a four-field system of pre-cleaning, main cleaning, rinsing and disinfection applies. Each step is acknowledged on a shift sheet with time and initials.

The Hazardous Substances Officer ensures the compatibility of the chemicals used and their storage in the hazardous substances cabinet. Confusion between cleaning agents and disinfectants or unauthorized transfer into unlabeled containers are a common cause of complaint. Monthly verification of cleaning results through contact samples or ATP measurements complements the plan and provides objective data for reporting to management. Results above the established threshold trigger a corrective action that is documented and verified again the next month. Anyone who works with objective data has a much stronger argument in the audit than someone who can only present subjective cleanliness assessments. A cleaning plan without an associated verification result remains a plan, not a document. The verification results flow into the reporting line and show trends, such as a gradual deterioration in the scullery when capacity is high.

In addition to personal hygiene, the cold chain is the second major lever. The LMHV does not specify general temperatures, but refers to the manufacturer's product-specific specifications and the general requirements from Annex II of EC 852/2004. In practice, the following guidelines apply: frozen goods below minus eighteen degrees Celsius, fresh poultry a maximum of four degrees Celsius, fresh meat a maximum of seven degrees Celsius, minced meat a maximum of two degrees Celsius, fresh milk a maximum of eight degrees Celsius, fresh fish on melting ice at zero to two degrees Celsius.

Every refrigerator and freezer room needs a thermometer, ideally with recording and alarm. Manual temperature checks are carried out at least twice daily and documented in a logbook. In the event of power outages, door malfunctions or loading errors, gaps arise that are noticeable in the audit. Automated temperature monitoring with radio sensors and cloud connection closes this gap and allows a retrospective evaluation if necessary.

In the event of deviations, a corrective measure must be defined: When are goods discarded, when can they be used after the temperature has been restored, who decides? This decision belongs in the HACCP plan, not in the gut of the shift manager. The thermometers are verified (calibrated) against a reference thermometer at least annually; the records must be retained for three years. Deadline expires when we become aware of it: Anyone who notices a temperature deviation during a shift change must document and escalate it immediately, not the next morning. The escalation chain goes from the shift manager to the kitchen manager to the hygiene officer and, if necessary, to management. A written definition of this chain belongs in the HACCP folder. Escalations are documented with date, time, people involved and measures taken so that the process remains traceable afterwards.

Regulation (EU) No. 1169/2011 (LMIV) requires information about the fourteen main allergens: grains containing gluten, crustaceans, eggs, fish, peanuts, soy, milk, nuts, celery, mustard, sesame, sulfur dioxide and sulfites over ten milligrams per kilogram, lupins and molluscs. In Germany, labelling for loose goods is regulated by the Provisional Food Information Supplement Ordinance (VorlLMIEV): written allergen information at the point of delivery, verbal information is permitted on request, provided a written record is kept and presented upon request.

In the kitchen this means: every recipe must be allergen-tested, every change to the recipe triggers an update of the label. Traces of cross-contamination must be reported separately if they cannot be reliably excluded. There is an increased duty of care in school catering, hospitals and care facilities because those affected are often unable to inform themselves. Digital allergen management, which is linked to recipes and the weekly plan, prevents the most common source of errors: the manually updated notice board, which lags behind the reality in the kitchen by two weeks.

The hygiene officer ensures that allergen management is linked to staff training and that new employees countersign the allergen list before their first shift. Violations of the LMIV are prosecuted in accordance with the Food and Feed Code (LFGB) and can trigger fines of up to 50,000 euros. In cases of personal injury, such as anaphylactic shock caused by an unidentified trace of peanuts, criminal proceedings are also brought against those responsible. Clean documentation is not only a plus point, but also a prerequisite for relieving the burden on management. Anyone responsible who cannot provide proof of the allergen bears the burden of proof to prove that they are not at fault in the event of damage. This burden of proof can only be met with complete documentation, ideally with linked versioning between the recipe, training and notice board.

Effective pest monitoring is a mandatory part of structural-functional hygiene. Annex II Chapter IX No. 4 of EC 852/2004 requires appropriate measures to keep pests away. In practice, this means: regular inspections, documented pest control by a knowledgeable service provider in accordance with DIN 10523 (control of pests in food establishments), a map of the bait and trap sites, a monitoring protocol with findings and a list of measures, as well as a trend analysis for repeated findings. Records must be retained for at least three years, longer in regulated areas such as hospital canteens.

Incoming goods is the first critical control point. The following is checked here: temperature (with sample measurement in the core), packaging condition, best-before date, identity (according to order), cleanliness of the means of transport and, if necessary, a visible complaint such as thawing or mold. Complaints are documented, the supplier is informed and the goods are rejected if necessary. Consistent traceability in accordance with Regulation (EC) No. 178/2002 is mandatory: Each batch must be clearly identifiable and both a step forward (buyer) and a step backward (supplier) must be documented in the system.

The pillar here is called the supplier audit. The audit templates in the CIVAC workspace cover the typical supplier categories (wholesale, direct supplier, caterer subcontractor) and reduce the audit time per supplier. The appointment certificate, signed, filed, verifiable, applies not only to the hygiene officer's own order, but also to supplier relationships. Anyone who cannot provide a signed delivery contract with hygiene requirements risks having their own right to self-control broken at the interface in an emergency. Supplier audits are conducted at a frequency appropriate to the criticality of the supplier, typically annually for primary suppliers and every two years for downstream suppliers. Findings from supplier audits are linked to the respective contract in the CIVAC workspace and supplement your own risk assessment.

§ 4 LMHV requires training in food hygiene according to the activity. § 43 IfSG supplemented by the two-year follow-up instruction. In practice, a three-stage system is recommended: entry instruction on the first day of work, in-depth training after three months, annual refresher with documented learning success monitoring. The training content should be product specific and not consist of a generic PowerPoint. Those who prepare sushi need different content than those who serve school lunches. A training matrix distributes the mandatory content throughout the year and ensures that every employee completes their assigned modules.

The reporting line to the management is not explicitly required in the IfSG, but is actually indispensable due to the general duty of care and the compliance requirements of the management in accordance with Section 130 OWiG. The hygiene officer reports at least quarterly on the number of complaints, temperature deviations, training levels, outstanding measures from the last audit and pest findings. A written reporting line modelled on the ISO/IEC 27001:2022 ISMS structure is recommended because it clearly distributes responsibilities and defines the escalation path.

Others run compliance like a filing cabinet. We run it like software. This applies in particular to training courses: In the CIVAC workspace, training participation is documented with a time stamp, training content and signature, and the reminder of the follow-up training is triggered automatically. Anyone who misses a training course falls through the shift system, not through a subsequent audit. The reporting line is handed over to the management on a quarterly basis, archived and is available in the audit at the click of a button. Experience has shown that anyone who closes a gap here closes the most common cause of complaint in veterinary and food inspection. Audits regularly show that the reporting line is the weakest link, not the cleaning itself.

Hygiene in the kitchen is the sum of many small steps. It holds up if the steps are documented, chained and verifiable. Anyone who only organises cleaning but does not maintain the HACCP plan is insufficiently prepared. Anyone who maintains the HACCP plan but does not have a reporting line runs the risk of defects coming to nothing. Anyone who puts everything together has a hygiene organisation that stands up to audits and works in everyday life. The auditor calls, the evidence is ready.

CIVAC works as a compliance platform and officer-as-a-service. The platform provides the templates for cleaning plans, training certificates, goods receipt protocols and reporting lines. Licence the workspace for your internal representatives, or have our representatives order it. In the Officer-as-a-Service variant, the external hygiene officer takes over the appointment certificate, the maintenance of the self-control system, the quarterly reporting line to the management and the preparation of external audits. The order is usually placed within two working days of placing the order, instead of the industry standard two to six weeks.

Turn reading into a mandate. A short email to info@civac.de with the industry, location, number of employees and existing hygiene level is enough for the first appointment. If you prefer to use the contact form, you can find it linked via the FAQ page. What you don't get: a sales appointment. What you get: concrete feedback on what gaps there are in your self-control and how these can be closed in the next thirty days, with measurable progress and clear responsibility. The appointment certificate, signed, filed, verifiable. If you choose the external variant, you can activate the order in two working days and start taking inventory immediately, without a week-long start-up phase.