ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
HACCP records are the proof that a food safety plan works. A plan can be scientifically perfect, but if the monitoring logs are missing, incomplete or filled in later from memory, an auditor or inspector has no way to know that hazards were controlled on the day the food was made. Record keeping is the seventh of the seven HACCP principles for that reason.
This guide explains which HACCP records to keep, how to complete and review them, how long to retain them and what commonly goes wrong.
Free gap assessment
Would your HACCP plan survive an inspection?
Score the whole of the Codex text, free - the good hygiene practices as well as the seven principles, with the US and EU overlays on top.
Run the free HACCP gap assessment → or View premium report sample
The Codex Alimentarius General Principles of Food Hygiene, which include the HACCP system, list establishing documentation and record keeping as the seventh principle, and note that it should be appropriate to the nature and size of the operation. You can find the Codex texts on the Codex Alimentarius site. Records serve four purposes: they show that the process was in control, they support decisions on whether product can be released, they enable investigation when something goes wrong and they give evidence to customers and regulators.
Our overview of the seven HACCP principles shows how record keeping fits with the rest of the system.
Records fall into two groups: those that document the plan itself, and those that show it operating.
| Group | Record | Example |
|---|---|---|
| Plan documents | HACCP team and scope | Team list, product description, intended use |
| Plan documents | Hazard analysis and CCP decisions | Analysis worksheet, decision tree results |
| Plan documents | Critical limits and their basis | Cook temperature and scientific reference |
| Operating records | Monitoring | Temperature log, metal detector check |
| Operating records | Corrective actions | Deviation report, product disposition |
| Operating records | Verification and validation | Calibration, record reviews, testing, audits |
| Supporting records | Prerequisite programmes and training | Cleaning logs, pest control, training sign-off |
The plan itself is described in our guide to the HACCP plan, and the way the hazard analysis is done is in the guide to HACCP hazard analysis.
Monitoring records are the daily evidence. A good monitoring record identifies the product, date, time, CCP, critical limit, the measurement or observation, the equipment used and the person who performed the check. It should have space to record deviations and the action taken. The person monitoring should sign or initial each entry at the time of the check, not at the end of the shift.
Design the form so that the critical limit is printed on it, allowing the operator to compare the reading straight away. See our guides to monitoring procedures and critical limits for how to set the checks the records support.
When a critical limit is exceeded, the record should show what was found, what happened to the affected product, how the process was brought back into control, what caused the deviation and what was done to prevent it recurring. It should also show who authorised the disposition of the product. Our HACCP corrective action guide explains the steps. Incomplete corrective action records are one of the most frequent findings, because operators fix the problem but do not write it down.
Verification records show that the system is being followed and is working: calibration of thermometers, review of monitoring and corrective action records, direct observation, product testing and internal audits. Validation records show that the plan is capable of controlling the hazards, through scientific references, studies and challenge tests. The distinction is covered in our comparison of HACCP validation vs verification. Keep both, and keep them separate.
Good record practice is simple, and auditors will check it.
For electronic records, apply the same principles: user identification, time stamps, protection from alteration and an audit trail of changes.
Most poor records come from staff who do not understand why the entry matters. Explain it in plain terms: this reading is what lets the company release the product, and what protects the customer and the operator if something goes wrong. Show operators examples of good and poor entries, let them practise on a blank form, and observe them completing one in the first weeks. Refresh the training when forms or limits change, and keep attendance sheets as evidence.
Put forms at the point of use, on a clipboard or a wipe-clean board that is protected from moisture and heat. Provide working pens and calibrated instruments, and reduce the number of fields to what is needed. A form that takes two minutes at a busy time will be filled in later, so keep it fast. Where possible, connect probes or scales to an electronic system that captures the value automatically and prompts for action when a limit is exceeded.
Records must be reviewed by someone other than the person who made them, typically a supervisor or quality technician, within a defined time. Some regulations set specific rules for signing and review timing, for example the US rules for seafood and for meat and poultry HACCP; check the rule that applies to your product and market. Reviewers should look for missing entries, readings close to limits, unexplained changes, deviations without corrective action and patterns that suggest a problem developing. A signature without review is a weak control.
Retention periods depend on the product, shelf life and the law and customer requirements you follow. A common approach is to keep records for the shelf life of the product plus a margin, and for a fixed period such as one to two years for refrigerated or fresh products, and longer for shelf-stable products, but confirm requirements for your own situation. Store records so they can be retrieved quickly by product, date or batch, and protect paper records from damage and electronic records with backup. Our guide to the traceability system explains how records connect to batches during a recall.
The following is a hypothetical example invented for illustration. A small producer of cooked chicken strips has a CCP at the oven: the core temperature must reach a stated minimum. The operator records the temperature of a sample from each batch on a sheet showing the limit, signs and records the time. One afternoon a reading falls below the limit. The operator holds the batch, records the deviation, informs the supervisor and the batch is reheated and rechecked. The supervisor investigates, finds a faulty oven setting after maintenance and records the fix.
Later that week, a customer asks for evidence for a delivery. The quality manager retrieves the monitoring sheet, the deviation record and the reviewed sign-off in minutes, showing exactly what happened and that no under-cooked product was shipped. Without the records, the company could only have said it believed the process was fine.
Typical findings include missing or blank entries, records filled in before or after the event, identical readings that suggest copying, no signature or review, critical limits not printed on the form, corrective actions not recorded, uncalibrated instruments, records that cannot be found, retention periods not defined, and forms that differ from the current plan. Another is over-recording, where staff complete so many checks and forms that important ones are not done properly. Keep forms simple and focused.
Well-designed templates help operators complete records correctly. The HACCP Toolkit provides plan documents and record templates that you can adapt to your own products and limits. Whatever forms you use, ensure they match the current plan and are controlled documents, so operators are not using old versions.
Principle 7, documentation and record keeping. It requires records appropriate to the nature and size of the operation, to show the system is working.
Someone other than the person who made the entries, such as a supervisor or quality technician, within a period defined by your procedure and the regulations that apply to you.
It depends on shelf life, law and customer requirements. Many organisations keep them for the shelf life plus a margin, or one to two years or more, so check your own obligations.
Yes, if they identify who made each entry, carry time stamps, are protected from unauthorised change and can be retrieved. The same principles apply as for paper.
Auditors generally treat the check as not done. Investigate, assess the product, record the gap and fix the cause, such as the form or training.
September 30, 2026
