Writing a HACCP plan that passes audit: CCPs, critical limits & verification

Your HACCP plan is the document an auditor will spend the most time on — and the one most likely to land you a non-conformance. Not because the hazards are exotic, but because the plan was copied from a template, never tested, or quietly out of date. Here's how to build one that holds up.

What HACCP actually asks of you

HACCP (Hazard Analysis and Critical Control Points) is a systematic way of answering one question: where in my process could something make the product unsafe, and how do I control it? It rests on seven principles, sitting on top of your prerequisite programmes (PRPs) — the everyday hygiene, cleaning and pest controls that have to be in place first.

The seven principles, in plain terms: analyse your hazards, find the points you must control, set a measurable limit at each, monitor it, decide what to do when it slips, prove the whole thing works, and keep records of all of it.

Step by step

1. Describe the product and draw the process

Before any analysis, you need an accurate flow diagram — every step from goods-in to despatch — and a description of the product and its intended use. Auditors verify the flow diagram against the actual factory floor, so a tidy-but-wrong diagram is worse than none.

2. Analyse the hazards

At each step, identify the realistic hazards across four families: biological (pathogens, spoilage), chemical (cleaning residues, mycotoxins), physical (metal, glass, plastic) and allergen (cross-contact). Score each by likelihood and severity so you can tell a genuine risk from a theoretical one.

3. Determine your CCPs

A Critical Control Point is a step where control is essential to prevent or eliminate a hazard — and where, if you lose control, there's no later step to catch it. Use a decision tree to separate true CCPs from things better handled as prerequisites or operational PRPs. For many producers the classic CCPs are a metal-detection step or a cook/kill step. Having fewer, well-justified CCPs beats a long list you can't defend.

4. Set critical limits you can measure

Every CCP needs a critical limit that's objective and measurable — a temperature, a time, a metal-detector sensitivity, a ppm. "Cooked thoroughly" is not a critical limit; "core temperature ≥ 75°C for 30 seconds" is. If you can't measure it, you can't monitor it.

5. Monitor — and write it down

Define who checks each CCP, how, and how often, and make sure every check leaves a record. This is the evidence the auditor follows: pick a day, find the monitoring record, confirm it was within limits. Gaps in the record read as gaps in control.

6. Decide the corrective action in advance

For each CCP, write down what happens when the limit is breached: who's told, what you do with the affected product, and how you stop it recurring. Deciding this calmly in advance is far safer than improvising mid-incident.

7. Verify and validate

Verification is the proof your system works in practice — checking records, calibrating equipment, reviewing the plan. Validation is the evidence your controls are capable of working at all. At minimum, review the whole plan annually and whenever a recipe, process or piece of equipment changes.

The bottom line

A strong HACCP plan isn't a thick document — it's an honest, measurable, current one. Match the hazards to your real process, keep your CCPs few and defensible, record every check, and review whenever something changes. Do that and the audit becomes a walk-through of a system that already works, not an exam you cram for.