A HACCP plan is the backbone of every food safety management system. Whether your organisation is certified to ISO 22000, FSSC 22000 Version 7, BRCGS Food Safety, or SQF Edition 10 — a properly written HACCP plan is the document auditors check most carefully, and the one that most food businesses get wrong.
A HACCP plan that passes a food safety audit is not just a completed template. It is a genuine, site-specific, science-based document that demonstrates your organisation has systematically identified every food safety hazard in your process — and has effective, validated controls in place to prevent them.
This guide covers every element of a powerful HACCP plan — from the 5 preliminary steps through all 7 HACCP principles — with the specific detail auditors expect to see.
💡 Important: A HACCP plan does not work in isolation. Before applying the 7 HACCP principles, your site must have functioning prerequisite programmes (PRPs) covering hygiene, pest control, cleaning, maintenance, and allergen management. PRPs handle general food safety hazards. Your HACCP plan handles hazards specific to your product and process.
WHAT IS A HACCP PLAN AND WHY IS IT REQUIRED?
HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic, science-based approach to identifying and controlling food safety hazards in food production and handling.
A HACCP plan is a written document that records the outcome of the hazard analysis, identifies the Critical Control Points (CCPs) in your process, sets critical limits for each CCP, and establishes monitoring, corrective action, and verification procedures.
HACCP plans are required by:
✅ ISO 22000:2018 and the upcoming revision — core requirement of the food safety management system
✅ FSSC 22000 Version 7 — HACCP plan mandatory as part of the FSMS
✅ BRCGS Food Safety Issue 9 — detailed HACCP requirements in Section 2
✅ SQF Edition 10 — HACCP-based food safety plans required for all modules
✅ Codex Alimentarius — the international HACCP guidelines underpinning all GFSI schemes
✅ Regulatory requirements in the EU, US, UK, GCC, and most markets globally
THE 5 PRELIMINARY STEPS — BEFORE YOU WRITE YOUR HACCP PLAN
Most HACCP plans fail because organisations skip these preliminary steps and jump straight to hazard analysis. Auditors check these steps first — and gaps here undermine everything that follows.
PRELIMINARY STEP 1 — Assemble the HACCP Team
Your HACCP plan must be developed by a multidisciplinary team — not by one person at a desk. The team must include people with knowledge of the product, the process, and food safety hazards. Document the team members, their roles, and their expertise.
PRELIMINARY STEP 2 — Describe the Product
A complete product description must be documented — covering ingredients, physical and chemical characteristics (pH, water activity, salt content), packaging, storage conditions, shelf life, and intended use. Allergen status must be declared.
PRELIMINARY STEP 3 — Identify the Intended Use
Who will eat your product? Are there vulnerable consumer groups to consider — the elderly, infants, immunocompromised individuals, or allergen-sensitive consumers? The intended use determines how the hazard analysis must be conducted.
PRELIMINARY STEP 4 — Construct the Process Flow Diagram
A step-by-step flow diagram of your entire process — from incoming raw materials to dispatch. Every input, step, and decision point must be included. Then — and this is what auditors check — the flow diagram must be verified on-site. Someone walks the production line and confirms the diagram matches what actually happens.
PRELIMINARY STEP 5 — Verify the Flow Diagram On-Site
This is the most commonly skipped step. A HACCP plan flow diagram that has never been verified against actual operations is a non-conformance. The verification must be documented — who verified it, when, and what was confirmed.
YOUR HACCP PLAN — ALL 7 PRINCIPLES EXPLAINED
HACCP PLAN PRINCIPLE 1 — CONDUCT A HAZARD ANALYSIS
The hazard analysis is the most critical part of your HACCP plan. For every step in your process flow diagram, identify all potential food safety hazards — biological, chemical, physical, and allergen.
Biological hazards: pathogens such as Salmonella, Listeria, E. coli, Campylobacter, and Clostridium botulinum. Consider growth conditions, heat resistance, and contamination routes.
Chemical hazards: cleaning chemical residues, pesticide residues, allergen cross-contact, mycotoxins, heavy metals, and veterinary drug residues.
Physical hazards: foreign body contamination — metal, glass, hard plastic, wood, bones, stones, and pest-related contamination.
Allergen hazards: cross-contact of products with the 14 major allergens — peanuts, tree nuts, milk, eggs, wheat, soya, fish, shellfish, sesame, lupin, celery, mustard, sulphites, and molluscs.
For each hazard, assess the likelihood of occurrence and the severity of the potential harm. Use a risk matrix to determine whether the hazard is significant — and therefore requires a CCP or OPRP.
HACCP PLAN PRINCIPLE 2 — DETERMINE CRITICAL CONTROL POINTS (CCPs)
A Critical Control Point is a step in your process where a control measure can be applied to prevent, eliminate, or reduce a significant food safety hazard to an acceptable level.
Use the CCP decision tree — a structured series of questions — to determine which steps with significant hazards are CCPs.
Common CCPs in food manufacturing include: cooking (for pathogen kill), metal detection (for metal foreign body control), pasteurisation, pH adjustment, and chilling or freezing steps.
Important: do not identify too many CCPs. Not every control measure is a CCP. If a hazard is controlled by a PRP or OPRP — it should not be a CCP. Too many CCPs make HACCP plans unmanageable and are themselves a non-conformance finding.
HACCP PLAN PRINCIPLE 3 — ESTABLISH CRITICAL LIMITS
For every CCP, you must set a critical limit — a measurable value that separates safe from unsafe. Critical limits must be scientifically validated. You cannot set a cooking temperature critical limit based on experience alone — it must be backed by scientific evidence or regulatory guidance.
Examples of critical limits: cooking at minimum 75°C for 2 minutes for pathogen kill; metal detector rejection for ferrous particles above 1.5mm; chilled storage below 5°C; pH below 4.6 to prevent C. botulinum growth.
HACCP PLAN PRINCIPLE 4 — ESTABLISH MONITORING PROCEDURES
For every CCP, document how, when, and by whom the critical limit is monitored. Monitoring must occur in real time — not retrospectively. Records must be completed at the time of monitoring, not at the end of a shift.
A common audit finding: monitoring records show regular readings but at suspiciously regular intervals that suggest they were completed retrospectively. Auditors look for natural variation in readings — perfectly identical readings at perfectly timed intervals are a red flag.
HACCP PLAN PRINCIPLE 5 — ESTABLISH CORRECTIVE ACTIONS
For every CCP, document what actions must be taken when monitoring shows that the critical limit has been breached — or when the CCP is at risk of going out of control.
Corrective actions must address two things: the immediate disposition of affected product (quarantine, assess, reject, or reprocess) and the root cause of the deviation (fix the process that caused the breach).
Every corrective action must be documented. An audit finding specifically mentioned in multiple GFSI audit reports: monitoring records showing a deviation with no corresponding documented corrective action.
HACCP PLAN PRINCIPLE 6 — ESTABLISH VERIFICATION PROCEDURES
Verification confirms that your HACCP system is working as intended. It is different from monitoring.
Monitoring checks individual CCPs in real time. Verification evaluates whether the entire HACCP system is effective.
Verification activities include: reviewing CCP monitoring records, conducting internal audits of the HACCP system, calibrating monitoring equipment, conducting end-product testing, and reviewing customer complaints for food safety trends.
HACCP PLAN PRINCIPLE 7 — ESTABLISH RECORD KEEPING AND DOCUMENTATION
Your HACCP plan must be documented — and all monitoring, corrective action, and verification activities must be recorded.
Auditors review records as the primary evidence that your HACCP plan is genuinely implemented. A plan that exists on paper but has no supporting records is a major non-conformance.
Records that must be maintained:
→ CCP monitoring logs — completed in real time by trained operators
→ Corrective action records — every deviation and the action taken
→ Verification records — audit reports, calibration certificates, product testing results
→ HACCP team meeting minutes — showing the plan is regularly reviewed and updated
COMMON HACCP PLAN AUDIT FAILURES
❌ FAILURE 1 — Flow diagram never verified on-site
Fix: Walk the line with your HACCP plan and document the verification — name, date, signature
❌ FAILURE 2 — HACCP team is one person
Fix: Assemble a genuinely multidisciplinary team — include production, quality, technical, and management
❌ FAILURE 3 — Too many CCPs identified
Fix: Review each CCP using the decision tree — move appropriate controls to PRPs or OPRPs
❌ FAILURE 4 — Critical limits not validated
Fix: Every critical limit must have a documented scientific basis or reference to regulatory guidance
❌ FAILURE 5 — Monitoring records completed retrospectively
Fix: Train operators to complete records at the time of monitoring — and audit compliance
❌ FAILURE 6 — HACCP plan never reviewed after changes
Fix: Review and revalidate the HACCP plan after any change to ingredients, process, equipment, or site
THE BOTTOM LINE
A powerful HACCP plan that passes a food safety audit is built on genuine hazard analysis, validated critical limits, real-time monitoring records, and documented verification. It is site-specific — not a copied template. It is multidisciplinary — developed by a team with food safety expertise. And it is a living document — reviewed and updated whenever your product or process changes.
Start with your prerequisite programmes. Build your HACCP team. Verify your flow diagram on-site. That is where the audit-ready HACCP plan begins.
👉 Download your free HACCP plan template at standardsunlimited.com/free
#HACCPPlan #HACCP #FoodSafety #ISO22000 #FSSC22000 #BRCGS #SQF #GFSI #FoodSafetyAudit #CriticalControlPoints #FoodSafetyManagement #HazardAnalysis #AuditReady