HACCP: The 12 Steps, the 7 Principles, and Where Most Plans Quietly Fail

A field-tested implementation guide for food technologists, QA officers, regulatory inspectors, and food science students.

The Scene Every Auditor Knows

You arrive at a plant. The HACCP manual is on the conference room table — laminated, indexed, signed by the team. The flow diagram is current. The critical limits are documented. The monitoring forms are filled in for the past six months without a single missing entry.

And then you walk the line.

Five minutes in, you see it. The thermometer at the cook step has been reading the same value for three weeks. The "monitoring" is a signature, not a measurement. The corrective action procedure exists in the manual, but it has never been triggered — because deviations are not being detected. They are being absorbed.

The HACCP plan on the table is excellent. The HACCP system in the plant does not exist.

[Your story here — an audit, an inspection, or an internal review where the gap between the document and the practice became unignorable. One or two specific details — a piece of equipment, a record book, a moment of recognition — anchor the whole post. Example: "Years ago, during a routine inspection at a mid-size processor, I picked up the temperature log for a thermal step and saw forty-two consecutive entries written in the same handwriting, all within 0.2°C of each other. The operator who had supposedly recorded them had been on leave for two of those weeks..."]

This post is for the QA officer, food safety manager, regulatory inspector, or food technology student who has read the Codex Alimentarius General Principles of Food Hygiene, knows what the letters HACCP stand for, and wants to understand why the plan on paper so often diverges from the plan in production.

The 12-Step Implementation Pathway, at a Glance

Codex Alimentarius defines HACCP through twelve steps: five preliminary steps that build the foundation, and seven principles that constitute the system itself. Most plans that fail are not failing at the principles. They are failing at the preliminaries.

What HACCP Actually Is — and What It Is Not

The single largest source of confusion in food safety is the relationship between HACCP and the systems around it. Get this wrong and you will spend years auditing the wrong things.

Prerequisite Programmes (PRPs) are the foundation. Cleaning and sanitation, personal hygiene, pest control, waste management, supplier control, infrastructure, equipment maintenance. PRPs control the routine, ever-present conditions in a food operation. They are not optional. HACCP cannot work on a foundation of poor hygiene.

HACCP sits on top of PRPs and controls the specific, identifiable hazards that the PRPs alone cannot eliminate. HACCP is preventive, focused, and limited to food safety hazards — biological, chemical, physical, and allergenic. Quality issues, customer preferences, and regulatory labelling are outside its scope.

Food Safety Management Systems (FSMS) — ISO 22000, FSSC 22000, BRCGS — are the management wrapper. They contain HACCP, PRPs, leadership commitment, document control, internal audits, management review, and continual improvement. HACCP is a tool inside an FSMS, not a replacement for one.

Risk assessment is the underlying science that determines which hazards are significant enough to control through HACCP. (For the full treatment, see the risk assessment post in this series.)

PRPs catch the routine. HACCP catches the critical. An FSMS catches the drift. Risk assessment tells you which catch belongs to whom.

The 12 Steps, Explained for Practitioners

Step 1: Assemble the HACCP Team

A HACCP team needs people who together understand the product, the process, the equipment, the hazards, and the regulatory environment. In practice, that means production, QA, engineering, microbiology, and someone with hands-on operator experience. The competence of each member should be documented.

The most common failure is the one-person HACCP team — usually the QA manager, working alone, producing a plan that has never been challenged by the people who actually run the line.

Step 2: Describe the Product

A full description includes composition, allergens, packaging type, storage conditions, distribution chain, shelf life, intended preparation, and any pH, water activity, or formulation parameters relevant to safety. If you sell three variants under one product name, you write three descriptions.

The most common failure is a generic description that papers over product variants. The plan that covers the standard product fails the day a reformulation goes through change control without a HACCP review.

Step 3: Identify Intended Use

Who eats this, how often, and under what conditions? If the product can reasonably reach infants, pregnant women, elderly consumers, or immunocompromised patients, the hazard analysis must account for them. Intended use is not the same as advertised use; consumers do what consumers do.

The most common failure is defaulting to "general public" without thinking about who actually buys this product, or about the realistic ways it gets stored, prepared, and consumed.

Step 4: Construct the Process Flow Diagram

Every step from raw material receipt to dispatch. Include rework loops, idle product holding, manual additions, sampling points, packaging changes, and any step where product is open to the environment. The flow diagram is the spine of the HACCP plan; if a step is missing here, every downstream analysis is incomplete.

The most common failure is missing the informal steps — the manual scoop of additive, the rework that goes back two stages, the overnight holding tank that wasn't in the original design. Operators know these steps. HACCP plans often don't.

Step 5: Confirm the Flow Diagram On Site

Walk the line. Compare the diagram to what is actually happening. Do this at different times of day and across different shifts. The on-site confirmation is not a formality — it is the single highest-yield activity in the preliminary steps.

The most common failure is signing off the diagram without walking the line, or walking it once during day shift and never again.

Step 6 (Principle 1): Conduct a Hazard Analysis

At every step, list the biological, chemical, physical, and allergen hazards that could be introduced, increased, or controlled. For each, determine whether the hazard is significant — that is, reasonably likely to occur and severe enough to warrant control. Significance is a risk-assessment judgement, and it must be documented.

The most common failure is generic hazard language. "Microbial contamination" is not a hazard analysis. Listeria monocytogenes in a ready-to-eat product at the post-cook handling stage is.

Step 7 (Principle 2): Determine the Critical Control Points

Now you decide which significant hazards require control at specific steps, and at which steps that control is critical. The Codex decision tree is the standard tool. Use it consistently, document the answers, and resist the urge to declare every step a CCP because it makes the plan "look thorough." Too many CCPs makes monitoring unmanageable, which guarantees that real CCPs will be neglected.

The most common failure is treating "CCP" as a status symbol. Plans inflate to fifteen CCPs in operations that genuinely have two or three, monitoring resources scatter across all of them, and the genuine critical points lose attention.

Step 8 (Principle 3): Establish Critical Limits

A critical limit is the boundary between safe and unsafe at a CCP. It must be measurable in real time, validated against the hazard it controls, and defensible against a regulator or court. Time–temperature combinations, pH, water activity, salt concentration, residual chlorine, metal detector sensitivity — these are critical limits. "Visually clean" is not.

The most common failure is copying critical limits from a textbook or a sister site without validating them against the specific product, equipment, and process. A pasteurisation time–temperature combination that is correct for one product matrix may be inadequate for another.

Step 9 (Principle 4): Establish Monitoring

Monitoring is the scheduled measurement that confirms a CCP is operating within its critical limits. The plan specifies what is measured, how, where, when, by whom, and how often. Continuous monitoring (such as inline temperature recording) is preferred where possible; intermittent monitoring requires a sampling frequency that matches the production rate and the hazard severity.

The most common failure is signature-based monitoring. The operator signs the form at the end of the shift instead of recording the actual measurement at the actual time. The records look perfect. The system is blind.

Step 10 (Principle 5): Establish Corrective Actions

A corrective action procedure says what happens when a critical limit is breached. It addresses both the immediate product (segregate, rework, reject, recall if dispatched) and the root cause (investigate, correct, prevent recurrence). The procedure must be defined in advance, not improvised at 2am when a deviation hits.

The most common failure is corrective action that addresses the product but never the cause. The deviation gets disposed of, the root cause analysis never happens, and the same deviation occurs again three weeks later.

Step 11 (Principle 6): Establish Verification

Verification confirms that the HACCP system itself is working — not just on the day of monitoring, but as a system. It includes calibration of monitoring equipment, review of records, internal audit of the plan, end-product testing on a defined schedule, and periodic reassessment of the entire HACCP plan when products, processes, or hazard profiles change.

Verification is performed by people independent of monitoring. The operator does not verify their own measurements.

The most common failure is conflating verification with monitoring. They are different activities, conducted by different people, on different schedules, against different criteria.

Step 12 (Principle 7): Establish Documentation and Record-Keeping

Records are evidence that the system operated as designed. They include the HACCP plan itself, hazard analysis worksheets, CCP decision records, monitoring records, deviation and corrective action records, verification activities, calibration records, and training records.

The most common failure is documentation as compliance theatre — records produced for the auditor rather than used by the operation. A record that has never been reviewed by anyone other than the person who filled it in is not a record. It is paper.

A Worked Example: Pasteurised Milk

[Your case here — substitute a real HACCP study from your career: a dairy, a spice mill, a bakery, a meat processor, an RTE facility. Walk through the process flow, the hazard you identified, the CCP determination, and one specific moment where the plan caught (or missed) something. The example below is illustrative.]

Consider a basic HTST pasteurised milk line. The process flow diagram looks like this:

Hazard analysis identifies vegetative pathogens — Salmonella spp., Listeria monocytogenes, pathogenic E. coli, Campylobacter — as the significant biological hazards. Applying the decision tree to the pasteurisation step: control measures exist (Q1: Yes), the step is specifically designed to reduce the hazard to an acceptable level (Q2: Yes). Pasteurisation is therefore a CCP.

The HACCP plan for that CCP looks like this:

HACCP Element	CCP-1: Pasteurisation
Hazard	Survival of vegetative pathogens (Salmonella, Listeria, E. coli, Campylobacter)
Critical limit	≥ 72°C for ≥ 15 seconds (HTST); validated against the most heat-resistant target
Monitoring	Continuous inline temperature recording; flow diversion valve interlocked to set point; chart recorder or digital log on every batch
Frequency	Continuous during production; manual review at end of each batch
Responsibility	Pasteurisation operator (monitoring); QA officer (record review)
Corrective action	Automatic flow diversion on deviation; segregate and re-pasteurise affected product; investigate root cause; document and review
Verification	Daily review of charts by QA; weekly calibration of temperature probes; alkaline phosphatase test on finished product; quarterly internal audit
Records	Continuous temperature charts; deviation log; corrective action records; calibration records; phosphatase test results

Notice what the plan does not do. It does not declare receiving a CCP just because raw milk has hazards (Q4: yes, pasteurisation downstream will eliminate them — so receiving is controlled by PRPs, not as a CCP). It does not declare cold storage a CCP for finished product (the hazard cannot increase to unacceptable level at ≤ 4°C within shelf life — Q3: no, manage via PRP). One CCP. Tight. Monitorable. Defensible.

Where HACCP Plans Quietly Fail

Across audits, regulatory inspections, and post-incident reviews, the failures cluster around the same patterns:

The plan was written by one person. A HACCP plan produced without operators, engineers, and microbiology is a plan that has never been challenged by the people who will execute it.

The flow diagram is wrong. Rework loops, idle holding, manual additions, and product diversion paths missing from the diagram. Every hazard living in those missing steps is unaddressed.

The hazard analysis is generic. "Microbiological contamination" instead of named pathogens in named matrices. "Foreign material" instead of specific physical hazards from specific sources. The plan looks complete and controls nothing specifically.

CCPs are inflated. Twelve, fifteen, twenty CCPs in operations that have two or three. Monitoring spreads thin, real CCPs are neglected, and the plan becomes unmanageable.

Critical limits are unvalidated. Time–temperature combinations copied from a textbook. pH targets that do not reflect the actual product matrix. Metal detector sensitivities never validated against the actual contaminant population.

Monitoring is signature-based, not measurement-based. The form is filled in. The measurement is not actually taken at the actual time by the actual person.

Deviations are absorbed, not recorded. An operator catches a near-miss and adjusts. Nothing reaches the deviation log. The pattern is invisible to management. The third occurrence becomes a recall.

Corrective actions stop at the product. The affected batch is rejected or reworked. Root cause analysis never happens. The deviation recurs.

Verification and monitoring are conflated. The same person who took the measurement also reviews it. Independence is lost. The system cannot detect its own drift.

The plan is never reassessed. A new product is introduced, a piece of equipment is replaced, a supplier changes, the consumer demographic shifts. The HACCP plan is dated three years ago and has never been opened since.

HACCP, HARPC, ISO 22000, FSSC 22000: What Goes Where

Food safety standards proliferate, and the names blur. A practitioner should be able to place each one cleanly.

HACCP (Codex Alimentarius) is the foundational methodology. Twelve steps, seven principles. It is the language every other system speaks.

HARPC (Hazard Analysis and Risk-Based Preventive Controls) is the US FSMA equivalent, applied to facilities registered with the FDA. It expands the hazard scope to include economically motivated adulteration and radiological hazards, and replaces "CCPs" with the broader concept of "preventive controls." The mental model is HACCP, but the regulatory machinery and terminology differ.

ISO 22000 is a food safety management system standard. It contains HACCP as one component and wraps it in management-system requirements: leadership, planning, support, operation, performance evaluation, improvement. Certifiable, but on its own not always accepted by GFSI-aligned buyers.

FSSC 22000 is ISO 22000 plus sector-specific PRP requirements (ISO/TS 22002-x series) plus additional FSSC requirements. It is GFSI-recognised, audited by accredited certification bodies, and the version 6 update brought food fraud and food defence into the certification scope.

A food technologist should know which of these applies to their plant, what each one requires beyond HACCP, and where the boundaries lie.

A Portable Mental Model

If you remember nothing else from this post, remember this:

PRPs catch the routine. HACCP catches the critical. Verification catches the drift. Documentation proves all three actually happened.

That sentence is the entire system. Every component of a food safety operation should map cleanly to one of those four roles. Anything that does not is either misplaced or unnecessary.

What This Means for Food Technology Students

If you are studying food technology and planning a career in QA, regulatory inspection, product development, or laboratory analysis, learn HACCP as something you can actually do, not as a list to memorise.

Be able to do the following on demand:

Walk through the 12 steps in order, naming each, and explain what the output of each step is.
Apply the CCP decision tree to a specific hazard at a specific process step, and justify your answer to each question.
Write a critical limit that is measurable, validated, and defensible — and explain how it was validated.
Distinguish monitoring from verification clearly, with examples of each.
Identify three common ways HACCP plans fail in practice, with one mitigation for each.

If you can do those five things in an interview or an audit, you will be ahead of most graduates and many working professionals. The reason food safety failures keep happening in operations that "have HACCP" is that HACCP is treated as a binder rather than a habit. The professionals who stand out are the ones who treat it as a habit.

Conclusion: HACCP Is a System, Not a Document

A HACCP plan in a binder is necessary. It is not sufficient.

The plants that handle food safety well are the ones where the 12 steps are alive in daily decisions: where the flow diagram is updated when the process changes, where the hazard analysis is revisited when a new pathogen emerges, where the critical limits are validated against the actual product, where monitoring is a measurement and not a signature, where deviations are recorded and investigated, where verification is independent, and where the plan is reassessed when anything meaningful shifts.

Codex gave the world twelve steps and seven principles more than thirty years ago. The science has not changed. The framework has not changed. What separates the food safety teams that work from the ones that fail is whether they treat HACCP as the discipline it was designed to be — or as a document for the auditor.

Make it the discipline. Run the loop. Walk the line. The plan will follow.

Author Note

Written by Mahtab Khan, Food Technology professional with experience in food safety, regulatory compliance, food testing, quality control, inspection, and food sector operations. This article is prepared for food technology students, QA officers, laboratory analysts, food safety inspectors, auditors, procurement teams, regulatory officers, and food industry professionals.

You may also read:

Food Fraud Detection: Complete Guide from Risk Assessment to Laboratory Verification
Food Product Recall System: Complete Food Safety Recall Guide
Supplier Approval in the Food Industry: Risk Based Supplier Evaluation
Raw Material Inspection and Acceptance in Food Industry

FAQ

What does HACCP stand for?

Hazard Analysis and Critical Control Point. It is a preventive food safety system codified by Codex Alimentarius, built around twelve implementation steps and seven core principles.

What is the difference between HACCP and a Food Safety Management System (FSMS)?

HACCP is a methodology for identifying and controlling food safety hazards. An FSMS — such as ISO 22000 or FSSC 22000 — is a management system that contains HACCP along with PRPs, leadership, document control, internal audits, and continual improvement. HACCP is a tool inside an FSMS, not a replacement for one.

What is the difference between a CCP and a PRP?

A PRP controls routine, ever-present conditions (hygiene, sanitation, pest control) that apply across the operation. A CCP controls a specific significant hazard at a specific step where loss of control would result in unacceptable risk. PRPs are the foundation; CCPs are the targeted protections built on top.

How many CCPs should a HACCP plan have?

As many as the hazard analysis and the decision tree justify — typically a small number. Inflated CCP counts dilute monitoring effort and weaken the plan. Two to four CCPs is common in well-designed plans for many product categories.

What is the difference between monitoring and verification?

Monitoring is the scheduled measurement that confirms a CCP is operating within its critical limits in real time. Verification confirms that the HACCP system itself is working — including review of monitoring records, calibration, internal audit, and end-product testing — and is conducted by people independent of the monitoring activity.

What is a critical limit and how is it set?

A critical limit is the measurable boundary between safe and unsafe at a CCP. It must be validated against the hazard it controls — using scientific literature, regulatory standards, or process challenge studies — and it must be measurable in real time during production.

What happens when a critical limit is breached?

The corrective action procedure activates. Affected product is segregated, reworked, rejected, or recalled. The root cause is investigated, addressed, and documented. The deviation is recorded for trending and verification review.

How often should a HACCP plan be reviewed?

Whenever a meaningful input changes — new product, new equipment, new supplier, new regulatory limit, new hazard intelligence. At minimum, review annually. A HACCP plan that has not been opened in three years is not a plan; it is an artefact.

Is HACCP mandatory?

HACCP-based food safety systems are mandatory in most regulated food industries worldwide, though the specific legal framework varies by jurisdiction. Check your national authority's requirements for binding rules in your market.

References

Codex Alimentarius Commission, General Principles of Food Hygiene (CXC 1-1969), including the HACCP annex.
Codex Alimentarius Commission, Working Principles for Risk Analysis for Food Safety.
FAO and WHO, HACCP Principles and Application Guidelines.
ISO 22000, Food Safety Management Systems — Requirements for any organisation in the food chain.
FSSC 22000 Version 6, Scheme Requirements.
GFSI Benchmarking Requirements.
US FDA, Hazard Analysis and Risk-Based Preventive Controls for Human Food (HARPC), 21 CFR Part 117.
BRCGS Global Standard for Food Safety.
ISO/TS 22002 series, Prerequisite Programmes on Food Safety.
Peer-reviewed literature on HACCP validation, verification, and implementation.