How to Prepare a HACCP Plan: 12 Steps and 7 Principles

Key takeaways from this guide

• HACCP is built on sound GHP and prerequisite programmes; a planning table cannot compensate for inadequate hygiene infrastructure.
• Hazard analysis must be specific to the product, process, consumer and intended use.
• Not every control point is a CCP; a CCP decision must be justified by a significant hazard and the necessity of the control.
• Validation demonstrates that a control can work; verification demonstrates that the system operates as planned.

The purpose and limits of HACCP

HACCP is a preventive approach that systematically identifies, evaluates and controls biological, chemical and physical food safety hazards. The FDA's principles guidance emphasizes hazard control from raw materials through production, distribution and consumption. Distinguish quality defects from food safety hazards that could harm consumers.

A HACCP plan is not a generic checklist copied into a facility. Differences in formulation, process technology, packaging, shelf life, distribution conditions, target consumers or intended use change the hazard analysis. The scope of the plan must clearly identify the product family and process line.

Before HACCP: GHP and prerequisite programmes

The Codex General Principles of Food Hygiene positions good hygiene practices as the foundation of a HACCP system. Programmes covering water quality, cleaning and sanitation, pest control, personnel hygiene, maintenance, supplier approval, glass and brittle plastic, chemical management and allergen control keep the overall facility environment safe.

If a general hygiene problem is managed as a separate CCP at every product step, the plan becomes bloated and critical controls become harder to see. Define each prerequisite's owner, frequency, acceptance criteria, records and verification. An ineffective prerequisite must be reconsidered in the hazard analysis.

The five preliminary HACCP steps

The Codex application sequence includes five preliminary steps before the seven principles. A multidisciplinary team should include people who understand the product and process. External expertise may be used when necessary, but the business retains ownership of the plan. Product description goes beyond a name and packaging: record composition, characteristics such as aw/pH, processing, packaging, storage and shelf life.

Intended use and consumer group are particularly important for vulnerable groups. The flow diagram should cover every step from reception to dispatch, including rework and holding points. The HACCP team should confirm it on the floor across shift and product variations. An undocumented bypass or rework flow can invalidate the hazard analysis.

• Assemble the HACCP team.
• Describe the product and distribution conditions.
• Identify the intended use and consumer.
• Prepare the process flow diagram.
• Confirm the flow diagram on the production floor.

The seven HACCP principles

After preparation, apply the seven principles in sequence. They are not independent boxes: if a significant hazard is identified incorrectly, CCP selection, critical limits, monitoring and corrective action will also be wrong. Retain the scientific or technical basis for each decision in the plan file.

The HACCP table is an output; the real value lies in recording the team's discussions and supporting evidence. Evaluate the likelihood and severity of a hazard using a defined method. A control may be managed through a prerequisite, an operational control or a CCP; the rationale must be clear.

• 1. Conduct a hazard analysis.
• 2. Determine critical control points.
• 3. Establish verifiable critical limits.
• 4. Define the monitoring system.
• 5. Specify corrective actions in advance.
• 6. Establish validation and verification procedures.
• 7. Maintain documentation and records.

How do you conduct a hazard analysis?

Identify reasonably foreseeable biological, chemical and physical hazards at every process step. Allergens may also be addressed specifically as chemical hazards. Sources include raw material history, industry alerts, legal limits, scientific literature, complaints, recalls, process validations and observations on the floor. Instead of a generic phrase such as 'microbial hazard', use a definition specific enough to support decisions, such as Salmonella, Listeria monocytogenes or toxin formation.

Do not base significance solely on a numerical matrix score. Consider likelihood, severity, vulnerable consumers, subsequent control steps and legal requirements together. A control measure must prevent or eliminate a hazard, or reduce it to an acceptable level. A combination of measures may be necessary.

CCPs and critical limits: how they differ from operational targets

A CCP is a step at which applying control is essential to control a significant hazard. A decision tree is a supporting tool, rather than an automatic answer generator. Cooking, metal detection or pH adjustment may be CCPs in some processes; the same step may not be a CCP for another product because the risk and subsequent controls differ.

A critical limit separates safe from unsafe conditions and must have a scientifically verifiable basis. Use measurable criteria such as time and temperature, pH, water activity, metal detector test pieces or chemical concentration. An operational limit can be tighter to allow intervention before a deviation occurs; do not confuse it with the critical limit.

Monitoring and deviation management

The monitoring procedure specifies what is measured, how, how often, by whom and where the record is kept. Continuous monitoring is preferable; where it is not possible, justify a frequency capable of detecting a hazardous deviation in time. Measuring devices should be calibrated or verified at appropriate intervals.

Correcting a setting alone is not enough when a critical limit is exceeded. Address the cause, identify and hold products made while control was lost, have a competent person decide their disposition, and record every step. Repeated deviations require reassessment of the plan, equipment, training or validation.

Validation, verification and reassessment

Validation evaluates scientific and technical evidence that control measures and critical limits can control the hazard. Verification consists of activities showing that the plan is valid and day-to-day implementation follows it, such as record review, internal audits, device checks, sampling results and direct observation.

Reassess the plan when products, raw materials, recipes, processes, equipment, packaging, distribution, legislation or scientific knowledge change. An annual review can be a useful baseline, but a significant change should not wait until year-end. Connect change management to HACCP decisions.

Evidence quality in digital HACCP records

Records should be legible, timely, linked to the operation and protected by a retained change history. Pre-filled values and shared user accounts weaken evidence. A digital form can visually flag a nonconforming value, automatically quarantine a product and assign an action to an authorized person.

Automation does not replace human judgment. Alarm thresholds, sensor connections and the scope of affected products require validation. Provide a controlled backup recording method and a subsequent data-entry procedure for system outages. Access controls, backups and restoration tests are part of maintaining food safety records.

Compilation sources

1. Codex Alimentarius (FAO/WHO) — General Principles of Food Hygiene (CXC 1-1969)
2. U.S. Food and Drug Administration — HACCP Principles & Application Guidelines
3. U.S. Food and Drug Administration — Managing Food Safety: A Manual for the Voluntary Use of HACCP Principles
4. Codex Alimentarius (FAO/WHO) — Hygienic food, healthy sales: HACCP implementation case study
5. Food and Agriculture Organization of the United Nations — Codex and standards for food hygiene and HACCP

Related guides