In the food industry, you cannot "test" your way to safety. Waiting for finished product lab results is too slow and reactive — the product has already been packaged or shipped. The core philosophy of a Hazard Analysis and Critical Control Point (HACCP) plan is to prevent hazards before they occur, rather than relying solely on end-product inspection.
A well-designed HACCP plan is your business's best defence against foodborne illness, recalls, and regulatory non-compliance. While the process requires attention to detail, it follows a logical, internationally recognised framework of 12 steps — 5 preliminary steps and 7 core principles. Here is how to develop a plan that is both audit-ready and operationally practical.
Part 1: Laying the groundwork (the 5 preliminary steps)
Before diving into hazard analysis, you must establish a solid foundation. Skipping these steps is like building a house without a blueprint.
Step 1: Assemble a cross-functional HACCP team
HACCP is not a one-person job. You need a multi-disciplinary team that understands the product, the process, and the potential risks.
- Who to include: Operations/Production, Quality Assurance, Sanitation, Maintenance/Engineering, and Procurement
- Key action: Document each member's name, title, and specific responsibility — for example, "Production Manager: verifies flow diagram accuracy and monitors CCPs." This establishes accountability from day one
Step 2: Describe the product and its intended use
Create a full profile of the food product. The more detail, the better your analysis will be.
- Components: product name, ingredients (including allergens), pH/water activity (Aw), processing methods, packaging type, storage conditions, and shelf life
- Intended use: specify the target consumer. Is it ready-to-eat or does it require cooking? Is it intended for a vulnerable population such as infants, elderly people, or immunocompromised individuals?
A frozen burger intended to be cooked by the consumer carries different hazards than a deli salad meant to be eaten cold.
Step 3: Construct a process flow diagram
Map out every single step the product takes from receiving to shipping.
- Scope: receiving raw materials → storage → preparation → processing → packaging → finished product storage → distribution
- Do not forget: include often-overlooked steps such as rework loops, equipment downtime, and waste removal
Step 4: Verify the flow diagram on-site
Take the paper flow diagram onto the floor and walk the process in real time. You might find that the operator actually holds the product for 10 minutes longer than the written procedure states, or that a cleaning step happens at a different junction. Adjust the diagram to reflect actual practice, not intended practice.
Step 5: Identify potential hazards (Principle 1 — hazard analysis)
Examine each step in the flow diagram and ask: what could go wrong here?
- Biological: pathogens (Salmonella, Listeria), spoilage organisms, viruses
- Chemical: allergens (cross-contact), cleaning chemical residues, mycotoxins, pesticide residues
- Physical: metal fragments, stones, plastic, wood splinters
The goal is to determine significant hazards — those that are reasonably likely to occur and would cause serious harm if not controlled. Minor issues are handled by Prerequisite Programmes (GMPs/SSOPs), not the HACCP plan itself.
Part 2: Building the control system (the 7 core principles)
Once the groundwork is complete, you apply the seven principles to build the actual control mechanism of the plan.
Step 6: Determine Critical Control Points (Principle 2)
A CCP is the last step where you can apply control to prevent, eliminate, or reduce a significant hazard to an acceptable level. Not every step is a CCP. Use a decision tree to identify CCPs objectively.
- Thermal processing (kill step): ovens, fryers, pasteurisers designed to destroy pathogens
- Metal detection/X-ray: the final check for physical contaminants
- Filtration/screening: removing bone fragments or stones
- Allergen addition: the point where a known allergen is introduced to the batch
Step 7: Establish critical limits (Principle 3)
For every CCP, you need a measurable boundary that separates safe from unsafe. Limits must be quantifiable — numbers, not adjectives.
- Not acceptable: "Cook until hot"
- Acceptable: "Internal temperature ≥ 75°C for at least 30 seconds"
Base your limits on regulatory standards, Codex Alimentarius, or peer-reviewed scientific studies.
Step 8: Establish monitoring procedures (Principle 4)
How will you know the CCP is staying within its critical limit in real time? Define the four Ws:
- What: temperature, time, pressure, visual inspection
- How: calibrated thermometer, flow meter, metal detector test piece
- When (frequency): continuous (automated chart recorder) or intermittent (check every 30 minutes)
- Who: a designated trained employee
Step 9: Establish corrective actions (Principle 5)
You must have a written plan for what to do immediately when monitoring shows a deviation.
- Product disposition: hold and segregate affected product. Determine if it can be reworked, diverted to non-food use, or must be destroyed
- Process correction: fix the immediate cause and document the event to prevent recurrence
Step 10: Establish verification procedures (Principle 6)
This answers the question: is the HACCP plan actually working?
- Validation: scientific proof that the plan can control the hazard — completed before implementation
- Verification: ongoing activities to ensure the plan is being followed correctly, including calibration of monitoring equipment, review of monitoring records, and periodic product testing
Step 11: Establish record-keeping and documentation (Principle 7)
In food safety, if it is not written down, it did not happen. Records are your legal defence and proof of compliance.
- HACCP plan (signed and dated, with version control)
- CCP monitoring logs (temperature charts, metal check records)
- Corrective action reports describing the deviation and product disposition
- Validation studies (scientific justification for cook times and critical limits)
- Training logs
Step 12: Review and update the plan
A HACCP plan is a living document. Review it whenever there is a change in raw material or supplier, new processing equipment is installed, a product formulation changes, repeated deviations occur at a CCP, or at minimum once a year.
3 common pitfalls to avoid
Confusing SSOPs with CCPs
Not everything is a Critical Control Point. Basic sanitation is a Prerequisite Programme. If you make every step a CCP, the plan becomes bloated and unmanageable without making the operation any safer.
Vague language
Avoid words like "adequate," "sufficient," or "clean." Use specific, measurable terms — for example, "wash for 2 minutes with 200 ppm sanitiser solution." Auditors will push on anything that cannot be objectively verified.
Lack of scientific justification
Why is your cook time what it is? Do not guess. Cite a regulatory standard, Codex Alimentarius, or a thermal death time study. Auditors will check this, and "that is what we have always done" is not an acceptable answer.
By following these 12 steps, you create more than a manual — you build a system of proactive food safety that protects your consumers and your business. For a practical companion to this guide, see our HACCP checklist for new food businesses.