Allergen mismanagement is the leading cause of food recalls worldwide, and the trend shows no sign of slowing. For food manufacturers, the consequences extend far beyond the direct costs of a recall—reputational damage, loss of retailer confidence, and in the most tragic cases, preventable consumer harm.
Historically, HACCP plans focused heavily on microbiological pathogens. But regulatory bodies and GFSI scheme owners have now made one thing clear: allergen management is not an optional add-on. It is a fundamental component of your food safety management system.
The revised Codex Alimentarius General Principles of Food Hygiene explicitly incorporates allergen management as an essential part of food safety practices, and Regulation (EU) 2021/382 amended EU hygiene legislation to include allergen control as a mandatory requirement alongside food safety culture.
This guide explains how to correctly integrate allergen management into your HACCP plan, distinguishing between prerequisite programs and true Critical Control Points (CCPs), and ensuring compliance with UK and EU expectations.
Part 1: Understanding Allergens as a Chemical Hazard
Within the HACCP framework, allergens are classified as chemical hazards. However, they behave differently from other chemical risks like cleaning residues or pesticides. Allergen cross-contact can occur at nearly every stage of production: raw material receipt, storage, weighing, mixing, processing, rework addition, and packaging.
The 14 regulated allergens under Regulation (EU) No 1169/2011 (retained in UK law) must be declared and controlled. These include:
- Cereals containing gluten (wheat, rye, barley, oats)
- Crustaceans
- Eggs
- Fish
- Peanuts
- Soybeans
- Milk
- Nuts (almonds, hazelnuts, walnuts, cashews, pecans, Brazil nuts, pistachios, macadamia nuts)
- Celery
- Mustard
- Sesame
- Sulphur dioxide/sulphites (>10 mg/kg)
- Lupin
- Molluscs
Part 2: The Two-Tier Approach — PRPs vs. CCPs for Allergens
A common mistake is attempting to manage all allergen risks exclusively through CCPs or, conversely, treating them all as basic GMP issues. The correct approach distinguishes between systemic controls (PRPs) and point-specific controls (CCPs).
Tier 1: Allergen Prerequisite Programs (The Foundation)
Most allergen controls are best managed as Prerequisite Programs (PRPs)—the operational conditions that create a safe manufacturing environment. GFSI standards including BRCGS Issue 9 and IFS Food Version 8 require robust allergen assessments and mitigation plans as part of certification criteria.
| PRP Category | Allergen Control Requirement |
|---|---|
| Supplier Approval | Raw material allergen specifications must be documented, reviewed, and verified. Changes in supplier formulation must trigger a HACCP reassessment. |
| Storage and Segregation | Allergenic ingredients must be physically segregated in storage. Dedicated scoops, containers, and colour-coded equipment prevent cross-contact. |
| Production Scheduling | Schedule production to minimise changeovers. Run non-allergen products first, followed by allergen-containing products, with full cleaning between incompatible allergen categories. |
| Cleaning Validation | Allergen cleaning procedures must be validated (proven effective) and verified (regularly tested). Swab testing for protein residues provides objective evidence. |
| Rework Control | "Like into like" policy only. Rework containing allergens must never be added to allergen-free products. |
| Training and Competency | All personnel—from purchasing to production to sanitation—must understand allergen risks and their specific responsibilities. |
Tier 2: Allergens as CCPs (Point-Specific Controls)
While PRPs manage the environment, a Critical Control Point (CCP) is required when a specific, measurable step is the last opportunity to prevent an undeclared allergen from reaching the consumer.
The most common—and critical—allergen CCP is label verification at packaging.
Why Label Verification is a CCP:
- Hazard: Undeclared allergen due to incorrect label application or packaging mix-up.
- Control: Verification that the product matches the label's allergen declaration.
- Last Chance: Once the product is sealed and leaves the facility, there is no further opportunity to correct a labelling error.
Example CCP for Allergen Control:
- Process Step: Labelling / Packaging
- CCP Number: CCP-4 (Chemical)
- Significant Hazard: Undeclared allergen due to incorrect label or packaging material
- Critical Limit: Label allergen declaration must match product formulation; barcode scan must match approved packaging specification
- Monitoring: Barcode scanning system at point of application; visual check of printed allergen declaration at line start-up and every label reel change
- Corrective Action: Stop production; quarantine affected product; verify correct label; rework or destroy mislabelled product; document root cause
Part 3: Conducting an Allergen Hazard Analysis
When performing your hazard analysis (Codex Principle 1), assess every ingredient and every process step for allergen risks.
Step 1: Ingredient Hazard Analysis
For each raw material, document:
- Is the ingredient itself an allergen?
- Does the supplier handle allergens in their facility?
- Is there a risk of cross-contact at origin?
- Is the allergen specification documented and verified?
Step 2: Process Step Hazard Analysis
Evaluate each step in your flow diagram for cross-contact risks:
| Process Step | Potential Allergen Hazard | Control Type |
|---|---|---|
| Receiving | Spillage, damaged packaging causing cross-contact | PRP (Segregation, inspection) |
| Weighing/Scaling | Airborne dust, shared utensils | PRP (Dedicated equipment, dust extraction) |
| Mixing/Processing | Shared equipment residue | PRP (Validated cleaning, scheduling) |
| Rework Addition | Wrong rework added to allergen-free batch | PRP ("Like into like" policy, traceability) |
| Packaging/Labelling | Wrong label applied; incorrect allergen declaration | CCP (Label verification) |
Step 3: Determining Significance
Not every theoretical allergen hazard requires a CCP. Use the Codex decision tree to assess likelihood and severity:
- Severity: Allergic reactions range from mild to life-threatening anaphylaxis. Severity is always high.
- Likelihood: This depends on your specific controls. If you have robust PRPs in place (segregated storage, validated cleaning, scheduling), the likelihood of cross-contact may be low.
Part 4: Validation and Verification of Allergen Controls
Auditors will scrutinise whether your allergen controls actually work. This requires both validation and verification.
| Activity | Definition | Allergen Example |
|---|---|---|
| Validation | Scientific proof that a control measure can work | Cleaning protocol validated by protein swab testing after three consecutive changeovers; results demonstrate residue below detectable limits |
| Verification | Ongoing checks that the control measure is working | Routine ATP swabs before allergen-free production; periodic ELISA testing of finished product; label barcode scan records reviewed weekly |
Documentation Required:
- Validation study report for allergen cleaning procedures
- Routine verification records (swab results, label scan logs)
- Annual reassessment of allergen controls
- Supplier allergen specification review records
Part 5: Common Allergen Management Failures and How to Avoid Them
Failure 1: Treating "May Contain" as a Control Measure
Precautionary allergen labelling (PAL) such as "May contain nuts" is not a substitute for proper risk assessment and control. PAL should only be used where cross-contact risk is demonstrably unavoidable despite robust controls, and even then, it must not be applied indiscriminately.
Fix: Conduct a thorough risk assessment. Document why cross-contact cannot be eliminated. Use PAL only as a last resort, not as a blanket statement.
Failure 2: Inadequate Cleaning Validation
Many facilities rely on visual cleanliness ("looks clean") for allergen changeovers. Protein residues are invisible.
Fix: Validate cleaning procedures using specific allergen swab tests (ELISA or lateral flow devices). Establish acceptance criteria based on detection limits.
Failure 3: Undocumented Supplier Changes
A supplier reformulates a seasoning blend, adding mustard without notification. The manufacturer continues production, unaware of the new allergen.
Fix: Require written notification of any formulation change from suppliers. Review all raw material specifications annually as part of HACCP reassessment.
Failure 4: Confusing Label Verification Responsibility
The label CCP is assigned to a packer who does not understand which products contain allergens.
Fix: Training must be specific. Operators must know which SKUs contain which allergens and what to do if a mismatch occurs.
Failure 5: Rework Without Traceability
Rework containing milk is added to a "dairy-free" product because the operator assumed it was the same base.
Fix: All rework containers must be clearly labelled with allergen content and batch traceability. "Like into like" must be a documented, trained, and enforced policy.
Part 6: Audit Expectations for Allergen Management
Whether you are facing a BRCGS, IFS, FSSC 22000, or local authority EHO inspection, auditors will focus on these evidence points:
| Audit Focus Area | Expected Evidence |
|---|---|
| Hazard Analysis | Allergens identified for all raw materials and process steps; documented justification for significance decisions |
| CCP Determination | Clear rationale for labelling CCP; monitoring records showing compliance with critical limits |
| Cleaning Validation | Validation study report; ongoing verification swab results; corrective actions for any failures |
| Supplier Control | Approved supplier list with allergen specifications; change notification procedure |
| Traceability | Ability to trace allergen-containing ingredients from receipt through to finished product |
| Training | Records showing allergen awareness training for all relevant staff; competency assessments |
| Reassessment | Evidence that allergen controls are reviewed annually and whenever changes occur |
Next step
- Read next: What UK food inspectors actually expect from a small food business
- Use this template: Allergen matrix template
- Create a free account: Organise allergen information, updates, and supporting records more clearly.
Key Takeaways for Your HACCP Plan
- Allergens are chemical hazards requiring systematic analysis within your HACCP plan, supported by robust Prerequisite Programs.
- Most allergen controls are PRPs—segregation, scheduling, cleaning validation, supplier management—not CCPs.
- Label verification is the critical CCP—the last chance to prevent undeclared allergens from reaching consumers.
- Validation and verification are non-negotiable—you must prove your cleaning works, not just assume it does.
- PAL is a last resort—never a substitute for proper controls and risk assessment.
- Regulatory expectation has changed—allergen management is no longer optional. It is embedded in Codex, EU law, and all GFSI schemes.
By embedding allergen management systematically within your HACCP plan and supporting PRPs, you not only satisfy auditor expectations—you protect your customers and your business from the most common cause of food recalls in the industry today.