Level 3 HACCP

Module 9: Implementation, validation and verification

Turn the plan into safe daily practice through role-specific training, active supervision, capable controls, verification and continuous improvement.

Video runtime: 12:30

What you will learn in this module
  • Implementation requires a real-process plan, suitable resources and clear responsibility in daily work.
  • Verification checks actual application and continued effectiveness; it is not interchangeable with validation.
  • Learn from evidence and near misses, support honest reporting and verify improvements that prevent repeat failures.

Load this video from YouTube. Your browser will connect to YouTube; embedding follows your cookie preferences.

Watch on YouTube (opens a new tab)

External playback does not record on-page study progress.

Module 9: Implementation, validation and verification

Module 9: Implementation, validation and verification

Turn the plan into safe daily practice through role-specific training, active supervision, capable controls, verification and continuous improvement.

Records your study progress, not an assessment result or certificate.

Browse course modules

Key points

  • Implementation requires a real-process plan, suitable resources and clear responsibility in daily work.
  • Role-specific training needs demonstrated understanding and refreshment after relevant changes.
  • Observe and question actual practice; strengthen supervision during changes, busy work and after failures.
  • Establish control capability before relying on it, using evidence suited to the actual food and process.
  • Verification checks actual application and continued effectiveness; it is not interchangeable with validation.
  • Review process and ingredient changes and brief staff before relying on the updated system.
  • Audit the actual workplace alongside records and turn findings into practical corrective improvements.
  • Learn from evidence and near misses, support honest reporting and verify improvements that prevent repeat failures.

Lesson guide

9.1 Implement the plan

Implementation means putting the written system into actual daily practice, including busy service and unexpected problems. Confirm that the flow, hazards, controls, monitoring, corrective actions and records reflect how food is really received, stored, prepared, cooked, served, packed or transported.

If the plan uses shallow-tray cooling, staff need the trays, instruction and suitable capacity. Assign responsibility for temperatures, record review, deliveries, allergen questions and failed-control decisions. Introduce the plan through clear instruction, training, supervision and checks, explaining why controls matter. A procedure cannot protect food simply by existing in a file; people must have the resources and understanding to follow it.

9.2 Train staff for their roles

A chef, assistant, server, cleaner, packer and delivery worker may need different HACCP instructions. Training should cover relevant hazards, controls, checks, records and corrective actions for each role. A fridge checker needs to know the unit, standard, recording method and failed-result response; an allergy-order handler needs current information and clear communication.

Do not treat training as only a signature. Ask staff to explain and demonstrate the procedure, including what they would do after a cooking failure. Provide further instruction where understanding is weak. Refresh training after changes to menus, suppliers, equipment, methods, forms or responsibilities so competence matches the actual job rather than the original induction alone.

9.3 Active supervision

Supervisors should observe staff, review records, ask questions and correct unsafe practice. Check temperatures, handwashing, cleaning, storage, deliveries and allergen communication and whether action follows failed limits. A completed cleaning form is not enough if food-contact equipment remains dirty.

Look for shortcuts such as copied or missed checks, food left out too long, unsuitable raw and ready-to-eat storage or guessed ingredients. Correct problems promptly and professionally with the aim of protecting customers and improving the system, not simply blaming staff. Busy service, staff changes, new menus and previous failures deserve particular attention. Supervision connects the required procedure with what actually happens.

9.4 Validation: capable controls

Validation establishes that a control is capable of controlling the hazard for its actual food and process when applied correctly. Do not rely on guesswork or a method that merely sounds sensible. Evidence may include relevant time and temperature information, manufacturer guidance, tested procedures, industry guidance or appropriate expert advice.

For cooking chicken, establish confidence in the method’s capability. For shallow-tray cooling, consider whether it works under normal batch and workplace conditions. For cleaning between products with different allergens, the method needs a sound basis for controlling that risk. Validation generally occurs before reliance on a control or after a relevant new product, process or equipment change. It is distinct from checking an individual shift’s record.

9.5 Verification: real effectiveness

Verification checks whether controls are being followed and the system remains effective in practice. Methods can include record reviews, observation, audits, equipment and calibration checks, complaint and corrective-action reviews and staff knowledge questions.

A capable cooking procedure still needs staff to apply it correctly, record honest results and act after a failure. An allergen matrix may have been accurate when created but needs checking that it is current, understood and used for orders. Verify regularly and after relevant changes, incidents, complaints or repeated failures. Compare apparently perfect records with real conditions and staff explanations instead of assuming the folder proves control.

9.6 Review after changes

Menus, suppliers, ingredients, equipment, packing, labels, staff roles, preparation methods, layout, delivery arrangements and customer groups can change hazards or make controls unsuitable. Review before new risks reach customers, checking flow, analysis, CCPs, monitoring, actions and records.

A café adding on-site prepacked sandwiches may need appropriate labelling, chilled display, date and allergen controls. A takeaway adding delivery needs transport, packaging, holding and correct-order arrangements. Changed sauces, breads or spice mixes can alter ingredients, storage or shelf life. Brief staff and verify revised practice: an updated file is weak if the old method continues. Use current applicable guidance for the specific labelling category rather than infer it from a product name alone.

9.7 Internal audits and inspections

An internal audit should look at documents and workplace reality together. Review the plan, flow, hazard analysis, monitoring, corrective actions, training, cleaning, pests, maintenance, allergens, suppliers and traceability, then walk through, observe staff, check equipment and ask questions.

Complete fridge records may coexist with overload and unsafe storage; staff may know how to fill a sheet but not what to do after failure. Use findings to retrain, repair, update or review controls, with appropriate follow-up. Inspection preparation should mean maintaining real standards every day, not last-minute tidying. A useful audit discovers weaknesses before they harm customers or are found by others.

9.8 Continuous improvement and culture

Use records, audits, complaints, near misses, staff feedback, inspections, equipment failures and corrective trends to improve the system. Repeated cooling delays require investigation of capacity, container size, understanding or process design rather than recording the same issue indefinitely.

Management behaviour shapes food safety culture. Encourage honest entries, questions, early reporting and stopping unsafe food; avoid pressure to rush, hide mistakes or copy results. Lead by following the controls and correcting problems fairly. Learn from near misses before serious incidents occur. Improvement should address causes and be checked in practice so the next shift does not face the same predictable failure.

In practice

A valid method is not followed

Source teaching example rewritten as a formative scenario; not a real reported incident

The business has evidence that its cooking method works, but staff use a different batch loading and record guessed values.

Does validation alone establish safety in daily work?

Supervise, check actual application and corrective action, and review whether the current process still matches the validated method.

Capability and verified application are distinct requirements.

Repeated cooling delays

Source teaching example rewritten as a formative scenario; not a real reported incident

Cooling records regularly show delay; staff lack space and suitable containers.

Should the manager only remind them again?

Investigate resources and process design, improve the method and verify the changes in normal work.

Continuous improvement uses evidence to prevent repeat failures.

Reflect on your learning

What is validation concerned with?

Select one answer.

What is verification concerned with?

Select one answer.

What should training establish?

Select one answer.

What should an internal audit include?

Select one answer.

For your own learning — not the certification assessment.

FAQs

When should a control be validated?

Before it is fully relied on and after relevant new processes, products or equipment changes, using evidence suited to the food and hazard.

Why observe staff after training?

A signature does not establish that they understand or can perform the procedure, especially the action after failure. Demonstration and supervision help check competence.

What should happen after a menu or supplier change?

Review affected hazards and controls, update relevant information and records, brief staff and verify the changed practice before new risks reach customers.

Further reading

  • Food safety management systems for businesses (opens a new tab)

    Supplementary overview of HACCP-based procedures, checks and records.

    UK Government / Food Standards Agency. Applicable jurisdiction: UK overview; check the relevant national regulator and business-specific rules. Supplementary reading; checked 2026-10-07.

  • CookSafe: House Rules (opens a new tab)

    Role-specific training and practical hygiene, maintenance, temperature, stock and allergen controls.

    Food Standards Scotland. Applicable jurisdiction: Scotland; catering businesses. Supplementary reading; checked 2026-10-07.

  • CookSafe: keeping food safety records (opens a new tab)

    Supplementary guidance on monitoring, corrective action, verification and review records.

    Food Standards Scotland. Applicable jurisdiction: Scotland; catering businesses. Supplementary reading; checked 2026-10-07.

Jump to a key moment
Transcript

[0:00] Welcome to lesson 9.1. Implementing a
[0:02] hacked plan in the workplace.
[0:05] Implementing a hacked plan means putting
[0:07] the written food safety system into real
[0:09] daily practice. At level three, managers
[0:12] and supervisors need to understand that
[0:14] a hacked plan is only useful if staff
[0:16] can follow it during normal work, busy
[0:18] service, and unexpected problems.
[0:21] Implementation should begin by making
[0:23] sure the plan matches the actual
[0:25] workplace.
[0:26] The process flow, hazards, controls,
[0:29] monitoring checks, corrective actions,
[0:31] and records should reflect how food is
[0:33] really delivered, stored, prepared,
[0:36] cooked, served, packed, or transported.
[0:39] For example, if the hack plan says
[0:41] cooked food is cooled in shallow trays,
[0:43] managers must make sure shallow trays
[0:45] are available, staff know when to use
[0:47] them, and there is enough fridge space
[0:49] for safe cooling. Implementation also
[0:52] includes assigning responsibilities.
[0:55] Staff should know who checks
[0:57] temperatures, who reviews records, who
[0:59] handles delivery problems, who manages
[1:01] allergen questions, and who decides
[1:03] corrective action when limits are not
[1:05] met. Managers should introduce the
[1:07] hacked plan through training, clear
[1:09] instructions, supervision, and regular
[1:11] checks. Staff should understand why the
[1:14] controls matter, not just what forms to
[1:16] complete. The key message is hacked
[1:19] implementation turns paperwork into
[1:21] practice. A plan only protects customers
[1:24] when staff understand it, have the
[1:26] resources to follow it, and are
[1:27] supervised properly. Welcome to lesson
[1:30] 9.2. Training staff on hacked
[1:33] procedures.
[1:34] Staff training is essential because hack
[1:36] depends on people following the correct
[1:38] procedures every day. At level three,
[1:41] managers and supervisors must make sure
[1:43] staff are trained for their actual role.
[1:46] A chef, kitchen assistant, server,
[1:49] cleaner, packer, and delivery worker may
[1:51] all need different hack instructions.
[1:54] Training should cover the hazard staff
[1:55] may face, the controls they must follow,
[1:58] the checks they must complete, the
[2:00] records they must fill in, and the
[2:01] corrective action they must take when
[2:03] something goes wrong. For example, a
[2:06] staff member responsible for fridge
[2:07] checks must know which fridge to check,
[2:09] what temperature is acceptable, how to
[2:11] record the result, and what to do if the
[2:13] fridge is too warm. A staff member
[2:16] handling allergen orders must know where
[2:18] allergen information is kept, how to
[2:20] communicate allergy requests, and why
[2:22] they must never guess. Training should
[2:24] not be only a signature on a sheet.
[2:27] Managers should check whether staff can
[2:29] actually explain and follow the
[2:30] procedure. For example, a supervisor may
[2:34] ask a worker what they would do if
[2:35] cooked food failed a temperature check.
[2:38] If the worker does not know, more
[2:40] training is needed. Training should also
[2:43] be refreshed when menus, suppliers,
[2:45] equipment, processes, records or
[2:47] responsibilities change. The key message
[2:51] is hack training must be practical and
[2:53] role specific. Staff should know what to
[2:56] do, why it matters, and when to report
[2:58] problems.
[2:59] Welcome to lesson 9.3, supervising hack
[3:02] compliance.
[3:04] Supervising hack compliance means
[3:06] checking that staff are following food
[3:08] safety procedures correctly in real
[3:10] work. At level three, managers and
[3:12] supervisors should not assume that a
[3:14] procedure is being followed just because
[3:16] it exists in a folder. They need to
[3:19] observe staff, review records, ask
[3:21] questions, and correct unsafe practice.
[3:24] Supervision may include checking
[3:26] temperature records, watching
[3:28] handwashing and cleaning practices,
[3:30] checking storage, monitoring allergen
[3:32] communication, reviewing delivery
[3:34] checks, and making sure corrective
[3:35] action is taken when limits are not met.
[3:38] For example, if records show that
[3:40] cleaning is completed every day, a
[3:42] supervisor should still check whether
[3:44] the equipment and surfaces are actually
[3:46] clean. A tick on a form is not enough if
[3:48] the work has not been done properly.
[3:51] Supervisors should also look for signs
[3:53] that staff are taking shortcuts.
[3:56] This may include copied records,
[3:58] mischecks, food left out too long, raw
[4:00] and ready to eat food stored
[4:02] incorrectly, or staff guessing allergen
[4:04] information.
[4:06] When poor practice is seen, it should be
[4:08] corrected quickly and professionally.
[4:10] The aim is to protect customers and
[4:12] improve the system, not simply blame
[4:14] staff. Supervision should be strongest
[4:17] during busy times, staff changes, new
[4:20] menu launches, and after previous
[4:21] failures. The key message is hacked
[4:24] compliance needs active supervision.
[4:27] Managers must check what happens in
[4:29] practice, correct unsafe behaviour, and
[4:31] make sure procedures are followed
[4:33] consistently.
[4:34] Welcome to lesson 9.4. Validation.
[4:37] Proving controls are capable. Validation
[4:40] means proving that a food safety control
[4:42] is capable of controlling the hazard it
[4:44] is designed for. In simple terms,
[4:47] validation asks, will this control work
[4:50] if staff follow it correctly? At level
[4:52] three, managers and supervisors should
[4:55] understand that control should not be
[4:56] based on guesswork. The business should
[4:59] have confidence that the control is
[5:01] suitable for the food process and
[5:03] hazard.
[5:04] For example, if a business uses a
[5:06] cooking procedure for chicken,
[5:07] validation means being confident that
[5:09] the method can cook the chicken safely.
[5:12] This may be based on time and
[5:13] temperature evidence, manufacturer
[5:15] guidance, tested procedures, industry
[5:18] guidance, or expert advice. Cooling
[5:21] procedures also need validation.
[5:23] If a business says cooked food can be
[5:25] cooled safely in shallow trays, it
[5:27] should be confident that the method
[5:28] actually cools the food quickly enough
[5:30] under normal working conditions.
[5:33] Allergen controls may also need
[5:35] validation.
[5:36] If the business says equipment can be
[5:38] cleaned safely between allergen and
[5:40] non-allergen products, it must be
[5:41] confident that the cleaning method
[5:43] removes the allergen risk. Validation
[5:46] normally happens before a control is
[5:48] fully relied on or when a new process,
[5:50] product or piece of equipment is
[5:52] introduced.
[5:53] The key message is validation proves
[5:56] that a control is suitable before the
[5:57] business depends on it. A control that
[6:00] sounds good but cannot actually control
[6:02] the hazard is not reliable.
[6:05] Welcome to lesson 9.5. Verification.
[6:08] Checking the system works. Verification
[6:11] means checking that the hacked system is
[6:12] working in real life. Validation asks
[6:16] whether a control can work. Verification
[6:19] asks whether the control is actually
[6:21] being followed and whether the system
[6:22] remains effective. At level three,
[6:25] managers and supervisors may verify
[6:27] hacked through record reviews, staff
[6:29] observations, internal audits, equipment
[6:32] checks, calibration checks, customer
[6:34] complaint reviews, corrective action
[6:36] reviews, and staff knowledge checks. For
[6:39] example, a cooking procedure may be
[6:41] valid because it can safely cook the
[6:43] food. Verification checks whether staff
[6:46] are using the procedure correctly,
[6:48] recording the results honestly, and
[6:49] taking corrective action when food does
[6:51] not meet the required standard.
[6:54] Another example is allergen control. The
[6:57] allergen matrix may be accurate when
[6:59] created, but verification checks whether
[7:01] it is still current, whether staff use
[7:03] it properly, and whether customer
[7:04] requests are handled safely.
[7:07] Verification should happen regularly and
[7:09] whenever there are changes, incidents,
[7:11] complaints, or repeated failures.
[7:14] Managers should also check whether
[7:15] records match reality. If records look
[7:18] perfect but staff cannot explain the
[7:20] checks, the system may not be working
[7:22] properly. The key messages, verification
[7:25] proves that hack is working in practice.
[7:29] Managers must check records, staff
[7:31] behaviour and real food safety
[7:33] conditions, not just assume the system
[7:35] is effective.
[7:36] Welcome to lesson 9.6, reviewing hack
[7:39] after changes. A hack system must be
[7:42] reviewed when the business changes. At
[7:45] level three, managers and supervisors
[7:47] need to understand that changes can
[7:49] create new hazards or make existing
[7:51] controls unsuitable.
[7:53] Changes may include new menu items, new
[7:56] suppliers, new ingredients, new
[7:58] equipment, new packaging, new labels,
[8:01] new staff roles, new preparation
[8:03] methods, layout changes, delivery
[8:05] changes, or different customer groups.
[8:08] For example, if a cafe starts selling
[8:10] prepacked sandwiches made on site, the
[8:13] hacked system may need to include PPDS
[8:15] labelling, till display controls,
[8:17] allergen information, date control, and
[8:19] label checks. If a takeaway starts
[8:22] offering delivery, the hacked system may
[8:24] need to consider transport time,
[8:26] packaging, hot holding, cold holding,
[8:28] and making sure allergen orders reach
[8:30] the correct customer. Supplier changes
[8:33] can also affect HAP. a new source,
[8:36] bread, spice mix, or prepared ingredient
[8:39] may introduce different allergens,
[8:41] storage requirements, or shelf life
[8:43] rules. The review should check whether
[8:45] the flow diagram, hazard analysis, CCPs,
[8:49] controls, monitoring checks, corrective
[8:51] actions, and records are still correct.
[8:54] Staff should also be briefed after
[8:56] changes. A system update is weak if
[8:59] staff continue following the old
[9:01] process. The key message is hacked must
[9:04] change when the business changes.
[9:06] Managers must review the system before
[9:08] new risks reach customers.
[9:11] Welcome to lesson 9.7. Internal audits
[9:14] and inspection preparation.
[9:16] Internal audits help a business check
[9:18] its own hack system before problems are
[9:20] found by customers or inspectors. At
[9:23] level three, managers and supervisors
[9:25] should understand that an audit is not
[9:27] only about looking at paperwork.
[9:29] It should check whether food safety
[9:31] controls are working in practice. An
[9:34] internal audit may review hack
[9:36] documents, flow diagrams, hazard
[9:38] analysis, monitoring records, corrective
[9:41] actions, staff training, cleaning, pest
[9:43] control, maintenance, allergen controls,
[9:46] supplier records, and traceability.
[9:49] It should also include walking through
[9:50] the workplace, observing staff, checking
[9:53] equipment, looking at storage areas, and
[9:55] asking staff questions.
[9:58] For example, an audit may find that
[10:00] fridge records are complete, but the
[10:01] fridge is overloaded and food is not
[10:03] stored safely. It may also find that
[10:06] staff know how to complete records, but
[10:08] do not know what to do when a check
[10:10] fails.
[10:11] Inspection preparation should be based
[10:13] on real standards, not last minute
[10:15] tidying. Food safety inspectors may look
[10:18] at food handling, premises condition,
[10:21] management systems, records, staff
[10:23] knowledge, and whether procedures are
[10:25] followed.
[10:26] Managers should use audit findings to
[10:28] correct problems before inspection.
[10:31] This may involve retraining staff,
[10:33] updating documents, repairing equipment,
[10:36] improving cleaning, or reviewing hack
[10:38] controls. The key message is internal
[10:41] audits prepare the business by finding
[10:43] weaknesses early. Good inspection
[10:45] preparation means having real food
[10:47] safety control every day, not only when
[10:49] an inspector visits.
[10:52] Welcome to lesson 9.8, 8. Continuous
[10:54] improvement and food safety culture.
[10:57] Continuous improvement means regularly
[10:59] reviewing and improving the hacked
[11:01] system instead of waiting for something
[11:02] to go wrong. At level three, managers
[11:05] and supervisors should use evidence to
[11:07] improve food safety. This may include
[11:10] records, audits, complaints, near
[11:13] misses, staff feedback, inspection
[11:16] findings, equipment failures, and
[11:17] corrective action trends.
[11:20] For example, if cooling records often
[11:22] show delays, the business should not
[11:24] simply keep recording the same problem.
[11:26] Managers should investigate the cause.
[11:29] There may be too little fridge space,
[11:31] containers may be too deep, staff may
[11:34] not understand the procedure, or the
[11:36] process may need redesigning.
[11:38] Food safety culture is the way people
[11:40] think and behave around food safety. A
[11:43] strong culture encourages staff to
[11:45] report problems, complete records
[11:47] honestly, ask questions, follow
[11:49] procedures, and stop unsafe food from
[11:51] being served. A weak culture may
[11:54] pressure staff to rush, hide mistakes,
[11:56] copy records, or ignore failed checks.
[11:59] Managers shape the culture through their
[12:01] behaviour. If managers take shortcuts,
[12:04] staff will follow. If managers support
[12:07] honest reporting and correct problems
[12:09] fairly, staff are more likely to speak
[12:11] up. Continuous improvement also means
[12:14] learning from near misses before they
[12:16] become serious incidents. The key
[12:18] message is hack should keep improving. A
[12:22] strong food safety culture, honest
[12:24] records, and regular review help the
[12:26] business prevent repeat failures and
[12:27] protect customers.