HACCP — Hazard Analysis and Critical Control Points — is the foundational methodology for food safety management worldwide. It is referenced in food safety law in most countries (US FSMA, EU Regulation 852/2004, UK Food Safety Act, equivalents in most jurisdictions), required by every food safety management standard from ISO 22000 to FSSC 22000 to BRCGS, and implemented by every food business of any size in some form. The universality of HACCP can produce an impression of routine — every food business has a HACCP plan, every regulator inspects against it, every certification audit verifies it. The methodology underneath is more demanding than routine implementations suggest, and the gap between mechanical and rigorous implementation produces meaningful safety outcomes.
The Seven Principles, Stated Precisely
Conduct a hazard analysis. Determine the Critical Control Points (CCPs). Establish critical limits at each CCP. Establish monitoring procedures. Establish corrective actions. Establish verification procedures. Establish record-keeping and documentation procedures. The seven principles look simple. Their implementation requires substantive analytical work at each step, and shortcuts at any step undermine the overall plan.
Prerequisite Programmes: The Foundation HACCP Sits On
HACCP does not stand alone. It rests on prerequisite programmes (PRPs) — the foundational hygienic practices that make food safety management possible. Cleaning and sanitation, pest control, supplier control, personal hygiene, facility maintenance, allergen management, training. Without functional PRPs, HACCP cannot work — too many hazards become CCPs because no other layer addresses them. Implementations that have weak PRPs and ambitious HACCP plans typically fail in inspection precisely because the plan compensates for missing foundation work that should have been done first.
Identifying CCPs Honestly
A Critical Control Point is a step where control is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. The discipline is identifying CCPs honestly — neither under-counting (leaving real CCPs out because they would be inconvenient to monitor) nor over-counting (treating every operational checkpoint as a CCP, which dilutes the focus on the genuinely critical ones). The CCP decision tree in Codex Alimentarius provides structured guidance; applying it rigorously distinguishes operational quality checkpoints from genuine food safety CCPs.
A pattern in audited HACCP plans: every cooking step in the process is identified as a CCP, every refrigeration step is identified as a CCP, every metal detection step is identified as a CCP. The plan has fifteen CCPs and the operational team cannot maintain meaningful monitoring on all of them. The audit finds monitoring gaps. The remediation is not better monitoring — it is honest re-evaluation of which steps are genuine CCPs versus which are operational controls. Fewer CCPs, monitored seriously, beat many CCPs monitored as paperwork.
Critical Limits That Can Be Monitored
A critical limit must be measurable in real time and capable of distinguishing safe from unsafe conditions. "Adequate cooking" is not a critical limit. "Internal temperature reaches 75°C for at least 15 seconds" is. The limit must be supported by validation evidence — scientific, regulatory, or technical documentation showing the limit is adequate to control the hazard. Plans that set critical limits without validation evidence may be wrong about what is actually safe, and the auditor will ask for the validation source.
Verification vs Monitoring vs Validation
Three distinct activities that get conflated. Monitoring is the routine measurement of critical limits during operation — frequent, fast, performed by the operating team. Verification is periodic checking that the monitoring is working as intended — independent confirmation that the plan is operating. Validation is the upfront establishment that the controls in the plan are scientifically adequate to control the hazards — done before the plan is finalised, revisited when the plan changes. Implementations that confuse these three produce gaps in one or more of them.
Practical Components of a HACCP Plan That Holds Up
- Documented prerequisite programmes that actually function in operation
- Hazard analysis that considers biological, chemical, physical, and allergen hazards for the specific products and processes
- CCP identification using a defensible decision tree, with the rationale documented for each
- Critical limits with validation evidence supporting them
- Monitoring procedures executable by the operational team in real time
- Corrective actions specified for deviations, with disposition rules for affected product
- Verification activities documented and performed independently of the routine monitoring
- Records that allow traceability from production through delivery