ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A HACCP plan is the output of a twelve-step method, not a template you fill in. Codex Alimentarius sets out those twelve steps in the General Principles of Food Hygiene, CXC 1-1969 — five preliminary steps that establish what you are analyzing, then the seven HACCP principles applied to it.
Skipping the preliminary five is the most common reason a HACCP plan fails an audit while looking complete: the hazard analysis is only as good as the product description and flow diagram it was built on.
Step 1 — Assemble the HACCP team and identify the scope. The 2020 revision added the scope to this step, and it matters: the plan has to state which products and which parts of the food chain it covers. The team needs product and process knowledge; where that is not available in-house, external expertise is legitimate, but the team owns the result.
Step 2 — Describe the product. Composition, structure, processing, packaging, storage and distribution conditions, shelf life, and any instructions for use. This is where the intrinsic controls live — water activity, pH, preservatives — and each one is a control measure the hazard analysis will lean on.
Step 3 — Identify the intended use and users. Ordinary consumer, or a vulnerable group? The same product has different acceptable levels depending on who eats it, and a plan that ignores this under-controls hazards for the population that matters most.
Step 4 — Construct a flow diagram. Every step in the process, in sequence, including rework, recycling loops, waste streams and where materials enter and leave. A diagram that stops at the process boundary misses the steps where recontamination happens.
Step 5 — On-site confirmation of the flow diagram. Walk the line, at operating hours, across shifts. This step is skipped more often than any other and it is the one that reliably finds the undocumented bypass, the temporary hose and the night-shift practice nobody wrote down.
| Step | Principle | What the HACCP plan records |
|---|---|---|
| 6 | Hazard analysis and control measures | Hazards per step, their significance, and the control measures for each |
| 7 | Determine the critical control points | Which steps are CCPs, and the reasoning |
| 8 | Establish validated critical limits | The measurable limit at each CCP, and the validation behind it |
| 9 | Establish a monitoring system | What is measured, how, how often, and by whom |
| 10 | Establish corrective actions | What happens to the process and to the affected product when a limit is breached |
| 11 | Validate the plan, then establish verification | Evidence the controls can work, plus the ongoing checks that they do |
| 12 | Documentation and record keeping | The plan itself and the records that prove it ran |
Two of these are routinely conflated. Validation asks whether the control measure is capable of achieving the intended level of control — the science behind a 72°C for 15 seconds limit. Verification asks whether the plan is being followed and is working in practice — record review, calibration, sampling, internal audit. The 2020 revision made validation explicit in step 11 for exactly this reason.
CXC 1-1969 is in two parts, and the HACCP annex is the second. The first sets out good hygiene practices — the conditions and activities that keep the environment hygienic across the supply chain. GHPs are the foundation the plan sits on, and the 2020 revision sharpened the relationship between them: some GHPs need greater attention because of the hazard they control, and the hazard analysis should say so.
Practically, that means a HACCP plan carrying a dozen CCPs is usually a sign that GHPs are doing too little work rather than a sign of rigour. Cleaning, personal hygiene, maintenance, pest control and supplier control belong in the prerequisite layer. Everything that survives into the plan should be a step where loss of control leads to unacceptable risk and where a measurable limit can actually be monitored.
The 2020 revision also brought allergen management, food safety culture, and product identification and traceability to the front — all three are now expectations a certification auditor will test alongside the plan.
What is the difference between the 7 principles and the 12 steps?
The twelve steps are the full application method: five preliminary steps that define what you are analyzing, then the seven principles as steps 6 to 12. Our guide to the 7 HACCP principles covers the principles themselves in detail.
How many CCPs should a HACCP plan have?
As few as the process genuinely requires. A long list usually means prerequisite programmes are being carried in the plan instead of underneath it.
Is a HACCP plan a legal requirement?
HACCP-based procedures are mandatory for most food businesses in the EU and UK, and required in various forms elsewhere. The Codex method is the reference point that regulators and certification schemes build on.
Do we need a separate plan per product?
Not necessarily. Products with the same hazards, process steps and controls can share a plan, provided the product description covers the group honestly.
Who has to be on the HACCP team?
People with knowledge of the product and the process — production, engineering, quality, hygiene. External expertise is allowed where in-house knowledge is missing, but the team remains accountable for the plan.
Work the twelve steps in order and the HACCP plan writes itself; start at the hazard analysis and you will be analyzing a process you have not described. Confirm the flow diagram on the floor rather than in a meeting room, keep the prerequisite layer strong so the plan stays short, separate validation from verification in your records, and reassess whenever the process, product or supplier changes.
Plan templates, hazard analysis worksheets and monitoring records are in the HACCP Toolkit, or start with the free ISO templates.
September 2, 2026
September 2, 2026
September 2, 2026
September 2, 2026
September 2, 2026