Quality Gurus
- Food Safety
- Training
Every food safety scheme worth having — ISO 22000, FSSC 22000, BRCGS — has HACCP at its core, and yet most HACCP plans we review in the field share the same weaknesses: hazard analyses copied from templates, critical control points (CCPs) chosen by habit rather than analysis, and monitoring records that show suspiciously perfect compliance. A HACCP plan that would survive a certification audit is built through the Codex method, in order, with your own process data.
The Codex approach is twelve steps: five preliminary, then the seven principles. Here is each one, with the practical traps.
The five preliminary steps
1. Assemble the HACCP team. Multidisciplinary is the requirement that matters: production, quality, engineering, hygiene. A plan written by one quality officer alone is the single most reliable predictor of a weak hazard analysis, because no one person knows the whole process.
2. Describe the product. Composition, water activity, pH, packaging, storage conditions, shelf life, distribution. These parameters drive the hazard analysis — a low-water-activity spice blend and a chilled ready meal have entirely different hazard profiles.
3. Identify the intended use and consumers. Is the product ready-to-eat or cooked by the consumer? Could it reach vulnerable groups — infants, the elderly, the immunocompromised? A hazard acceptable in a product that will be boiled is not acceptable in one eaten from the pack.
4. Construct the flow diagram. Every step from raw material intake to dispatch, including rework loops, delays and by-passes — the places contamination actually happens.
5. Confirm the flow diagram on site. Walk the line, on all shifts. In our audit experience this is the step most often skipped, and it shows: the diagram describes the process as designed, while the night shift runs it differently.
The seven principles
Principle 1 — Conduct a hazard analysis. For each step, identify the biological, chemical (including allergens) and physical hazards that could occur, then assess each for likelihood and severity. This is the intellectual heart of the plan. The trap: copying a generic hazard list instead of analysing your process, your ingredients, your region's water and raw-material realities.
Principle 2 — Determine the CCPs. A CCP is a step where control is essential — where loss of control means an unacceptable hazard and no later step will catch it. Use the Codex decision tree, and be honest: a cook step, a metal detector, a pasteuriser are classic CCPs. Twenty CCPs in a simple process means the analysis confused CCPs with prerequisite programmes; the hygiene fundamentals (cleaning, pest control, personal hygiene) belong in PRPs, not the HACCP plan.
Principle 3 — Establish critical limits. Each CCP needs a measurable limit separating safe from unsafe — a minimum core temperature and time, a maximum metal test-piece size, a pH ceiling. Limits must be validated: based on regulation, recognised scientific literature, or your own validation study. "We've always used 72°C" is not validation unless you can point to why.
Principle 4 — Establish monitoring. Who measures what, how, how often — with frequency high enough that a loss of control is caught before unsafe product ships. Continuous monitoring (data-logged pasteurisation) beats periodic checks where feasible.
Principle 5 — Establish corrective actions. Decided in advance, not improvised: what happens to the product made since the last good check, who has authority to hold and release, how the process is restored. Auditors read corrective-action records against monitoring records — gaps between the two are a major finding.
Principle 6 — Establish verification. Activities that confirm the plan works: calibration of CCP instruments, record review by someone other than the record-maker, micro testing trends, internal audits, and revalidation when anything changes. Keep validation and verification distinct in your documentation — validation asks would this control work? before you rely on it, verification asks is it working? afterwards. Auditors probe the difference, and conflating the two is one of the most common findings on otherwise sound plans.
Principle 7 — Establish documentation and record-keeping. The records that prove the plan ran: monitoring logs, deviations, corrective actions, verification. One field note: records showing years of perfect compliance with zero deviations do not reassure auditors — they suggest pencil-whipping. Real processes deviate occasionally; the system's value is proving you caught it.
The failure pattern to avoid
The plans that fail audits were written once — often by a consultant who left — and never revisited. HACCP is a living system: it must be reviewed when products, equipment, suppliers or regulations change, and revalidated on a defined cycle. If your plan's last revision date is three years old and your process has changed since, your plan no longer describes your risk.
Practical steps
Walk your own flow diagram this week, on the least-supervised shift. Check your critical limits have documented validation. Count your CCPs and challenge each one against the decision tree. If you would rather build it right the first time, we train HACCP teams and build certifiable food safety systems across Egypt and the region — see also our guide to choosing between HACCP, ISO 22000 and FSSC 22000.