HACCPHazard Analysis and Critical Control Points

Hazard Analysis and Critical Control Points (HACCP) is a preventive, systematic approach to food safety that focuses controls at the specific points in a process where a biological, chemical, physical or — increasingly — radiological hazard can be eliminated, prevented or reduced to an acceptable level. It was developed in the 1960s for the Apollo programme to keep astronaut food safe, codified by the FDA's National Advisory Committee on Microbiological Criteria for Foods (NACMCF) and then by Codex Alimentarius (CXC 1-1969 Annex), and is now the foundation of every major food-safety regulation worldwide.

HACCP is not a paper plan and a binder. It is a working system — a plan that is implemented every shift, monitored in real time at the CCPs, verified by management and auditors, and revised whenever the process, the product or the hazard picture changes.

In the United States, HACCP is mandatory by regulation for three food categories: seafood (21 CFR 123, since 1997), juice (21 CFR 120, since 2001), and meat and poultry (9 CFR 417, enforced by USDA-FSIS, since 1996–2000). For other human-food categories, FSMA replaced 'classical' HACCP with HARPC — Hazard Analysis and Risk-Based Preventive Controls — under 21 CFR Part 117. HARPC is HACCP-derived and HACCP-compatible but broader: it recognises supplier and sanitation controls as 'preventive controls' even when they are not strictly CCPs.

In the European Union, Article 5 of Regulation 852/2004 requires every food business operator (except primary producers) to 'put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles'. Member-state competent authorities enforce this through routine inspection.

Beyond regulation, every GFSI-recognised certification scheme — SQF, BRCGS, FSSC 22000, IFS Food, Global G.A.P. — requires a fully implemented HACCP (or HACCP-equivalent, like FSSC's ISO 22000 hazard plan) as a non-negotiable foundation. Retailer customer audits (Walmart, Tesco, Costco, Kroger) demand it. In practice, no commercial food manufacturer operates without one.

HACCP works only when general food-hygiene controls are already in place. These foundational programmes are called Prerequisite Programs (PRPs) or Good Manufacturing Practices (GMPs). They cover the things HACCP assumes — the building, the equipment, the people, the cleaning — so that the HACCP plan can focus on the process-specific control points.

• Sanitation Standard Operating Procedures (SSOPs) — daily cleaning and sanitising of food-contact surfaces, with verification.
• Pest control — contracted programme, bait-station map, monthly inspection records.
• Allergen control — segregation, validated cleaning between allergen-bearing and allergen-free runs, label control.
• Supplier approval — qualified suppliers, incoming CoAs, periodic audits.
• Personal hygiene — handwashing, gowning, illness exclusion, training.
• Maintenance — preventive maintenance programme, calibration of measurement instruments used at CCPs.
• Recall and traceability — one-up / one-down at minimum; FSMA 204 high-risk-food trace where applicable.
• Training — every operator working at or near a CCP trained on the CCP, the limit, the monitoring procedure and the corrective action.

Auditors test PRPs first. A weak SSOP programme means the HACCP plan rests on quicksand: cross-contamination on equipment that should have been clean undermines every downstream CCP.

HACCP is built on seven principles — they have been the same since NACMCF 1997 and Codex 1997. Every regulatory and certification scheme references them.

1. Conduct a hazard analysis. List every potential biological, chemical, physical (and where applicable radiological or allergen) hazard for each step of the process. For each, assess likelihood and severity. Identify which hazards are 'significant' — reasonably likely to occur and severe enough to warrant a control.
2. Determine the Critical Control Points (CCPs). A CCP is a step at which control can be applied and is essential to prevent or eliminate a significant food-safety hazard or reduce it to an acceptable level. A CCP decision tree (the Codex decision tree, or the modified NACMCF version) is the standard tool.
3. Establish critical limits. For each CCP, set a measurable parameter and a value beyond which the product is unsafe (e.g. internal temperature ≥ 71.1 °C for 15 seconds; pH ≤ 4.6; metal detector aperture ≤ 2.5 mm Fe).
4. Establish a monitoring system. Define what is measured, how, by whom, how often, and where the result is recorded. Continuous monitoring (a chart recorder on a cook step) is preferred where possible.
5. Establish corrective actions. Pre-define exactly what to do when a CCP goes out of limit — segregate product, hold pending evaluation, investigate root cause, prevent recurrence. Improvising at the moment is not acceptable.
6. Establish verification procedures. Define how the plan as a whole is checked for effectiveness — calibration of monitoring instruments, environmental swabs, finished-product testing, internal HACCP audits, management review.
7. Establish documentation and record-keeping. The plan itself, the monitoring records, the corrective-action records, the verification records — all retained for at least the shelf life of the product plus one year (typical regulatory minimum; longer for some categories).

Over-identifying CCPs is the most common HACCP failure. A plan with 12 CCPs is almost always a plan with 8 CCPs and 4 strong PRPs misclassified. CCPs demand continuous monitoring, immediate corrective action, calibrated instruments and dedicated records. Loading the system with non-CCP controls labelled as CCPs dilutes attention from the steps that genuinely matter.

The Codex decision tree asks four questions per step: (Q1) Are there control measures? (Q2) Is the step specifically designed to eliminate or reduce the hazard to an acceptable level? (Q3) Could contamination occur or increase to unacceptable levels? (Q4) Will a subsequent step eliminate the hazard? A 'yes' to Q2 makes the step a CCP. A 'yes' to Q3 followed by a 'no' to Q4 also makes it a CCP.

Common true-CCPs: thermal kill steps (pasteurisation, cook, retort), pH control on acidified foods, metal detection after the last possible metal-introduction point, allergen-segregated final pack on a shared line. Common false-CCPs: hand washing (PRP), receiving inspection (PRP), storage temperature (often PRP unless storage is the kill step), labelling (PRP for label content, CCP only when allergen declaration is the control for an allergen hazard).

Monitoring is the heartbeat of HACCP. For each CCP the plan must say what is measured (cook-zone-3 product-temperature probe T3-A), how (4-channel thermocouple with annual calibration certificate), by whom (cook-line operator, on-shift QC), how often (continuous, with a chart inspection every 30 minutes), and where the result is recorded (chart paper + signed log book + electronic record).

When an inspector audits a HACCP-regulated facility, the records they want are the ones for the CCPs. USDA-FSIS auditors pull the cook-temperature charts and the corrective-action log first. FDA seafood-HACCP auditors pull the histamine sampling records and the receiving temperature logs. A monitoring record that is illegible, untimed, unsigned or recreated after the fact is treated as no record at all.

Records are also the basis for trend analysis. A CCP that drifts toward its limit over weeks is a verification-process input — even if it never actually exceeds the limit, the trend should trigger investigation. Most modern HACCP systems implement SPC-style charts on continuous-monitoring CCPs for this reason.

Principle 5 corrective actions must be defined before the deviation occurs. The plan must say, for each CCP, exactly: what to do with the product made during the deviation (segregate, hold, evaluate); how to bring the process back into control; how to identify the root cause; how to prevent recurrence; and how to document the whole event in a corrective-action record.

Principle 6 verification has three layers. (1) Validation — the initial scientific demonstration that the chosen critical limit is adequate (e.g. a thermal study showing the cook step achieves 7-log Salmonella reduction). (2) On-going verification — calibration of thermometers, swab testing of post-cook environment, finished-product testing on a sampling plan. (3) Reassessment — at least annually, and whenever there is a change in raw materials, process, equipment or hazard picture.

FSIS 9 CFR 417.4 codifies this for meat and poultry: reassessment of the HACCP plan whenever changes occur that could affect the hazard analysis, and at least annually regardless. FDA 21 CFR 117.170 requires reanalysis of the food-safety plan at least every three years. EU 852/2004 Article 5 requires review whenever any modification is made.

In practice, a US food manufacturer that ships to a major retailer is running HARPC (regulatory) and one of SQF/BRCGS/FSSC (commercial) simultaneously, with one underlying HACCP plan that satisfies both.

1. Flow diagram does not match the actual line. Step added or moved during a retrofit; the plan was not updated.
2. Hazards listed without severity or likelihood scoring, so the 'significance' decision is unjustified.
3. Too many CCPs. A plan with PRPs misclassified as CCPs creates monitoring burden the team cannot sustain.
4. Critical limits set to a target value rather than a safety limit. 'Cook to 75 °C' is a target; the safety limit might be 71.1 °C — confusing the two means deviations get recorded that should not be, and real deviations get missed.
5. Monitoring records signed at end of shift rather than at the time of the measurement. Defensible only with a contemporaneous timestamp.
6. Corrective actions defined as 'investigate and decide'. Pre-defined actions are required; ad-hoc decisions at the deviation are not acceptable.
7. Verification activities documented as having been done, with no evidence (e.g. no calibration certificate behind a calibration log entry).
8. Reassessment overdue. Annual at minimum, plus on every relevant change. The most-cited reason a HACCP audit downgrades.

V5's food-industry profile treats the HACCP plan as a versioned, two-person-approved master document — the same way the pharma profile treats the MMR. Every CCP defined in the plan binds to a process step in the work-order template, with the critical limit, the monitoring method, the corrective action and the verification rule encoded as data, not narrative.

• Approved HACCP plan is immutable; revisions create a new version requiring two-person approval and a documented change rationale.
• When a work order is released, the HACCP plan version is snapshotted onto the WO. The kiosk reads from the snapshot for the life of the batch.
• At each CCP step, the kiosk gates progress on a monitoring measurement — either a manual entry, a connected device reading (cook probe, pH meter, metal-detector reject log) or a continuous stream. Out-of-limit values block the next step and open the pre-defined corrective-action workflow.
• Corrective actions are first-class records. They link the product hold, the root-cause investigation, the disposition (release, rework, destroy) and the verification of effectiveness.
• Verification activities (calibration due dates, environmental swab schedule, finished-product sampling plan) live on the device and lot records; the audit view shows compliance status without ad-hoc spreadsheets.
• Annual reassessment is a scheduled task with a workflow that pulls every CCP, every deviation in the period, every change record, and every verification result into a single review.