How to Write a HACCP Plan: The 12 Steps and 7 Principles with a Worked Example
A step-by-step guide to building a HACCP plan using the Codex 12-step sequence, with a worked example for a hot-filled tomato sauce, a CCP table and the documentation auditors expect.
HACCP (Hazard Analysis and Critical Control Point) is the basis of food safety law and certification worldwide. The internationally recognised reference is the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969), revised in 2020. This guide follows that structure.
Before you start: prerequisite programmes
HACCP controls significant hazards at specific points. It assumes that the basics are already in place: cleaning and sanitation, pest control, personal hygiene, supplier approval, maintenance, water quality, waste management, allergen management and training. These are prerequisite programmes (PRPs), also called Good Hygiene Practices (GHPs). If they are weak, your hazard analysis will find hazards everywhere, and you will end up with too many CCPs.
The 12 steps
Step 1: Assemble the team and define the scope
Include people who know the product, process, equipment, cleaning and microbiology: typically QA, production, engineering and hygiene. If you lack expertise (for example in thermal processing), bring it in. Define the scope: which products, which lines, from which step (goods receipt) to which step (dispatch), and which hazard types.
Step 2: Describe the product
Record composition, pH, water activity, preservatives, processing (heat treatment, packaging), shelf life, storage and distribution conditions, and labelling. For a hot-filled tomato sauce: tomato paste, sugar, vinegar, salt, spices, modified starch; pH 3.7–3.9; hot filled into glass jars; ambient shelf life 12 months unopened; refrigerate after opening.
Step 3: Identify intended use and consumers
Who eats it and how? Is it ready to eat? Are vulnerable groups (infants, elderly, immunocompromised) likely consumers? Could it be misused, for example eaten without the cooking the label instructs?
Step 4: Construct the flow diagram
Show every step in order: receipt, storage, weighing, mixing, cooking, filling, capping, inversion, cooling, labelling, coding, packing, storage, dispatch. Include rework loops, water, steam and packaging inputs.
Step 5: Confirm the flow diagram on site
Walk the line during production, on every shift if processes differ, and correct the diagram. Auditors will check that what is on paper matches the floor.
Step 6 (Principle 1): Conduct a hazard analysis
For each step, list potential biological, chemical (including allergens) and physical hazards. Then evaluate each by likelihood and severity to decide which are significant, and identify control measures. Record your reasoning, not just the result.
Step 7 (Principle 2): Determine critical control points
A CCP is a step where control is applied and is essential to prevent, eliminate or reduce a significant hazard to an acceptable level. Many teams use a decision tree; the 2020 Codex revision includes one as an example, not a requirement. Not every significant hazard needs a CCP: some are better controlled by a PRP that needs greater attention.
Step 8 (Principle 3): Establish validated critical limits
A critical limit separates acceptable from unacceptable. It must be measurable (temperature, time, pH, aw, metal detector sensitivity) and validated, meaning there is scientific evidence that staying within it controls the hazard.
Step 9 (Principle 4): Establish monitoring
Define what is measured, how, how often and by whom. Continuous monitoring (a temperature recorder) is preferred where possible.
Step 10 (Principle 5): Establish corrective actions
State in advance what happens when monitoring shows a deviation: how the process is brought back under control, what happens to affected product (hold, assess, rework or destroy), and who decides.
Step 11 (Principle 6): Validate and verify
Validation asks: "Will this plan control the hazards?" (before implementation and after changes). Verification asks: "Are we following it, and is it working?" (record reviews, calibration, internal audits, product testing).
Step 12 (Principle 7): Documentation and records
Keep the hazard analysis, CCP determinations, critical limits and their validation, monitoring records, corrective action records and verification records. Records must be signed, dated and reviewed.
Worked example: CCPs for a hot-filled tomato sauce
The values below illustrate the format. Your own limits must come from your own validation and process authority, not from this table.
| CCP | Hazard | Critical limit (example) | Monitoring | Corrective action | Records |
|---|---|---|---|---|---|
| CCP 1: Acidification (batch release) | C. botulinum growth if pH is too high | Finished batch pH ≤ 4.2 (validated margin below 4.6) | pH of each batch before filling, per pH method | Hold batch; adjust acid and retest, or reject | Batch pH log |
| CCP 2: Hot fill | Survival of vegetative pathogens and spoilage organisms; recontamination of container and closure | Fill temperature ≥ validated minimum (e.g. 85 °C); container inverted for validated time | Continuous temperature recorder at filler; hourly manual check | Divert or hold product filled below limit; evaluate | Recorder chart; check sheet |
| CCP 3: Metal detection | Metal fragments from equipment | Detects and rejects test pieces of validated sizes (e.g. Fe 2.0 mm, non-Fe 2.5 mm, SS 3.0 mm) | Test pieces at start, every hour, end of run | Hold product since last good test; repair; re-inspect | Metal detector log |
Allergen control (mustard in some recipes), glass breakage and label control would typically be managed as PRPs or operational PRPs rather than CCPs in this example, depending on your hazard analysis.
Where the law requires HACCP
- EU and UK: Article 5 of Regulation (EC) No 852/2004 requires food business operators to put in place procedures based on HACCP principles.
- United States: HACCP is mandatory for juice (21 CFR 120), seafood (21 CFR 123) and meat and poultry (USDA FSIS, 9 CFR 417). Most other facilities must comply with the Preventive Controls for Human Food rule (21 CFR 117), which builds on HACCP but adds other preventive controls.
- Canada: the Safe Food for Canadians Regulations require preventive control plans for many licence holders.
- Australia: HACCP-based food safety programs are required for certain higher-risk sectors under the Food Standards Code.
Common audit findings
- Hazard analysis lists hazards but not the reasoning for significance
- Critical limits with no validation evidence
- Monitoring records filled in at the end of the shift ("pencil whipping")
- Corrective actions that fix the process but don't address the affected product
- No review after a recipe or equipment change
Sources
- Codex Alimentarius Commission. General Principles of Food Hygiene (CXC 1-1969), revised 2020. FAO/WHO.
- European Union. Regulation (EC) No 852/2004 on the hygiene of foodstuffs, Article 5.
- U.S. Food and Drug Administration. 21 CFR Part 117, 21 CFR Part 120 and 21 CFR Part 123.
- USDA Food Safety and Inspection Service. 9 CFR Part 417, Hazard Analysis and Critical Control Point (HACCP) Systems.
- Canadian Food Inspection Agency. Safe Food for Canadians Regulations: preventive control plan guidance.
This guide is educational. Safety-critical limits (thermal processes, pH limits, allergen claims) must be confirmed with your process authority, certification body or regulator for your product and market. Spotted an error? Tell the editors.