The Complete Guide to HACCP
The 7 HACCP principles, critical control points, Codex Alimentarius, and practical implementation - for food safety managers in production.
What is HACCP?
HACCP (Hazard Analysis and Critical Control Points) is a preventive, science-based system for identifying, evaluating, and controlling food safety hazards. Developed in the 1960s jointly by NASA, the US Army, and the Pillsbury Company, HACCP is today internationally standardized through the Codex Alimentarius guidelines (CAC/RCP 1-1969, Rev. 2020) and legally required in the EU under Regulation (EC) No. 852/2004 for all food business operators with limited exceptions.
HACCP is not a standard you certify against - it is a management system concept that serves as the foundation for food safety standards such as ISO 22000:2018 and FSSC 22000. ISO 22000 integrates HACCP into a broader food safety management system framework and harmonizes it with the High Level Structure of other ISO standards. The HACCP plan is the core document of the system - it must be based on a thorough, documented hazard analysis and kept continuously current.
Prerequisite Programs (PRPs) as an indispensable foundation
HACCP only works on a stable foundation of basic hygiene programs (Prerequisite Programs, PRPs). These include: cleaning and disinfection, pest control, personnel training and hygiene, traceability, supplier control, maintenance and calibration, allergen management, and recall procedures. PRPs prevent most hazards before the HACCP plan. Organizations that neglect PRPs and try to control everything through CCPs create an unmanageable system with too many critical control points.
Why a robust HACCP system is indispensable
HACCP is a legal requirement - but companies that treat it as a strategic quality instrument achieve far more than compliance.
Legal compliance and production authorization
Without a documented HACCP system, a food manufacturer in the EU may not produce. Authorities check HACCP documentation in every food inspection. Missing or incomplete HACCP plans lead to fines, plant closures, and forced recalls.
Preventive hazard control rather than reactive response
HACCP systematically identifies biological (Salmonella, Listeria monocytogenes, STEC), chemical (pesticides, allergens, cleaning agent residues), and physical hazards (glass, metal, bone) before production. Prevention is cheaper than recalls by a factor of 10-1000.
Targeted traceability in the event of an incident
A HACCP system with complete batch traceability enables targeted isolation of affected batches in a recall event rather than a full product withdrawal. CCP monitoring records are the foundation for drastically reducing the scope of a recall.
Access to retail and trade partners
Major retail chains require suppliers to hold certifications under IFS Food, BRCGS, or FSSC 22000 - all HACCP-based standards. Without a functioning HACCP system, access to these procurement channels is effectively blocked.
Liability reduction in the event of a claim
A documented, demonstrably practiced HACCP system is the most important evidence in product liability cases. The manufacturer must demonstrate the diligence of their manufacturing process. Incomplete HACCP documentation significantly increases liability risk in a crisis.
Efficiency through focus on what matters
HACCP forces prioritization: not every process step is a CCP. Concentrating resources on typically 2-6 CCPs per product is more efficient than undifferentiated quality control at every step. Everything else is covered through PRPs and operational PRPs (oPRPs).
The 7 HACCP principles in detail
Principle 1 - Hazard Analysis: systematically identify and evaluate all biological, chemical, and physical hazards at every process step. Evaluation criteria: likelihood of occurrence and severity of health impact. Result: list of significant hazards to be controlled in the HACCP plan. Principle 2 - CCP Identification: for each significant hazard, determine whether and at which process step it can be completely eliminated or reduced to an acceptable level. The decision tree approach per Codex Alimentarius is the standard tool. Principle 3 - Critical Limits: establish measurable, scientifically based limits for each CCP (e.g., core temperature 72 degrees C for 15 seconds during pasteurization, pH below 4.6 for acid preservation, water activity aw below 0.85). Limits must come from validated scientific sources or be validated independently.
Principle 4 - Monitoring System: establish a continuous or sampling-based measurement system for each CCP that monitors compliance with critical limits in real time. Requirements: who measures? What? How? How often? With which calibrated instrument? Principle 5 - Corrective Actions: pre-defined responses to CCP deviations - immediate action (what happens to the affected product?) and corrective action (what is changed to prevent recurrence?). Principle 6 - Verification: regular checks that the HACCP system as a whole is working: internal audits, microbiological product and environmental controls, calibration checks, countersigning of monitoring records. Principle 7 - Documentation: all HACCP activities must be recorded: hazard analysis, HACCP plan, monitoring records, CCP deviations and corrective actions, verification activities, and training records. These records are mandatory evidence for authorities and certifiers.
Creating a HACCP plan - step by step
An effective HACCP plan is not created at a desk. It requires multidisciplinary expertise, deep production knowledge, and scientifically sound hazard assessment.
Assemble the HACCP team
The HACCP team must be multidisciplinary: food technology, microbiology or food chemistry, quality management, procurement (for raw material risks), and where needed, external expertise for specific hazards. The HACCP team leader must be demonstrably trained. A HACCP plan created by one person alone is rarely valid - assessors and inspectors recognize the missing multidisciplinarity.
Define product description and intended use
Create a complete product description: composition, pH, water activity (aw), preservation method, packaging format, storage temperature, and best-before date. Document the intended use and target group - especially critical for products for vulnerable groups (infants, elderly, immunocompromised), as this significantly affects the hazard assessment.
Create process flow diagram and verify on-site
Document every process step from raw material receipt to dispatch, including temperatures, times, environmental conditions, and contact materials. Critical: the flow diagram must be verified on-site in the production facility. Deviations between document and reality are immediately detected in audits and are a direct finding.
Conduct hazard analysis
For every process step and every raw material, identify all potential biological, chemical, and physical hazards and assess them by likelihood and severity. Hazards with a significant risk product are controlled in the HACCP plan. Sources for hazard identification: scientific literature, EU RASFF database, FDA Outbreak database, historical complaint data, and industry guidelines.
Determine CCPs, set critical limits, and define monitoring
Apply the Codex Alimentarius decision tree for each significant hazard. For identified CCPs: derive critical limits from scientific literature or own validation studies. For each CCP, fully define: critical limit, monitoring procedure, frequency, instrument, owner, corrective actions, and recording format.
Validation, implementation, and continuous verification
Before implementation: validate the HACCP plan (are the control measures scientifically appropriate to control the hazards?). After implementation: regular verification. The HACCP plan must be reviewed promptly - and updated if needed - when products change, processes change, new raw materials are introduced, or after deviation events.
Typical HACCP weaknesses - and how to fix them
Food inspections and certification audits regularly reveal the same systemic weaknesses. Most are not knowledge problems - they are implementation and documentation problems.
Too many CCPs make the system unmanageable
A common mistake: every risk-relevant step is classified as a CCP. The result is a system that cannot be managed in practice. CCPs are exclusively points where a significant hazard can be completely eliminated or reduced to an acceptable level, and where no later control is possible. All other critical steps are Operational Prerequisite Programs (oPRPs) per ISO 22000.
HACCP plan is not updated after product or process changes
A change management process for HACCP-relevant changes is mandatory: every change to formulation, raw materials, suppliers, equipment, or process parameters triggers a HACCP review. Anchor this process in the QMS and document the review obligation. HACCP plans that are not updated after demonstrable changes are a classic Major finding in IFS Food, BRCGS, and FSSC audits.
CCP monitoring records are incomplete or filled in retrospectively
CCP monitoring records must be ALCOA-compliant: timely (not at shift end or the next day), with an actual measured value (not just 'OK'), identification of the person measuring, and batch reference. Digital monitoring systems with mandatory timestamps and automatic deviation escalation reliably prevent the most frequent finding category in food inspections.
Corrective actions are not pre-defined and are improvised
Corrective actions must be in the HACCP plan before a CCP deviation occurs. For each CCP, it must be clearly defined: what happens to the product produced during the deviation? What happens to the process? Who decides? Only with pre-defined responses can production employees act correctly in the event of a deviation.
Implementing HACCP digitally with Mobile2b
Paper-based HACCP documentation is the most common criticism in food inspections. Mobile2b digitizes CCP monitoring, deviation management, and verification in an integrated system.
Real-time CCP monitoring
Digital monitoring forms for each CCP with required fields, critical limit validation, and automatic deviation escalation. Measured value outside the critical limit? Immediate notification to the responsible person, automatic product hold as the next step. No monitoring result is lost, no field left empty.
HACCP verification and internal audits
Structured verification checklists for all 7 HACCP principles and all PRPs. Internal HACCP audits are fully documented, findings directly linked to corrective actions. The complete verification history is exportable for authorities and certifiers at any time.
CCP deviation and CAPA management
Every CCP deviation is structured as an incident: affected batch, measured value, immediate action and product disposition, root cause analysis, corrective action with owner and due date. The complete deviation history shows trends and enables proactive system improvements.
Traceability and complete audit trail
All HACCP activities - monitoring, deviations, actions, verifications, training - are stored with batch reference, timestamp, and user. In a recall event, the affected batch can be isolated in minutes based on CCP records.
Frequently asked questions about HACCP
Ready for complete HACCP documentation?
Mobile2b digitizes your CCP monitoring, deviation management, and verification program - inspection-ready, fully traceable, without paper.
Book a Demo