What is a HACCP plan, and which text is it based on?
A HACCP plan sets out, for a given product and process, the significant hazards, the steps where they are controlled, the limits to respect, monitoring, corrective actions and verification. It applies the HACCP method (Hazard Analysis and Critical Control Point) described by the Codex Alimentarius, the joint FAO and WHO food standards commission.
The reference text is the General Principles of Food Hygiene, CXC 1-1969, last revised in 2022, listed among the Codex texts. It has two chapters. The first covers good hygiene practices (GHPs): premises and equipment, cleaning and disinfection, pest control, personal hygiene, control of operations, transport and training. The second covers the HACCP system and its application. The substantive revision dates from 2020, and the text was revised again in 2022; it can be read in the Codex codes of practice list. The principles and steps below are summarised in our own words: only the Codex text is authoritative.
GHPs come first. A HACCP plan built on poorly cleaned premises or uncontrolled water does not hold: it ends up classifying basic hygiene as CCPs. For a buyer, this is the first thing to read in a supplier’s file.
Element | What it is | Where we cover it |
|---|---|---|
Good hygiene practices (prerequisite programmes) | Basic conditions: premises, water, cleaning, pests, personnel | This page; food safety programmes |
HACCP plan | Significant hazards, CCPs, critical limits, monitoring, corrective actions, verification | This page |
ISO 22000:2018 | Food safety management system standard that includes HACCP and distinguishes CCPs and OPRPs | |
FSSC 22000, BRCGS, IFS | GFSI-recognised certification programmes, all built on a HACCP plan | |
ONSSA approval or authorisation | The plant’s legal obligation in Morocco under Law 28-07 | Further down this page |
What are the 7 Codex HACCP principles?
Conduct a hazard analysis, determine the CCPs, set validated critical limits, monitor, take corrective action, validate then verify, and document. The table shows what an inspector, a buyer or an auditor will ask you to show for each.
Principle | What it requires | What you will be asked to show |
|---|---|---|
1. Hazard analysis | Identify hazards at each step, retain the significant ones, define control measures | A justified hazard analysis and its sources: site history, complaints, scientific data, destination-country regulations |
2. Critical Control Points (CCPs) | Determine the steps where a measure is essential to control a significant hazard | The written reasoning behind each classification |
3. Validated critical limits | Set for each CCP a criterion that separates acceptable from unacceptable, and prove it works | The validation file: studies, trials, literature, regulatory limits |
4. Monitoring | Measure or observe each CCP often enough to react in time | Records completed at the time of the check and signed |
5. Corrective actions | Plan what happens when a limit is missed: restore control, isolate and assess the product | Deviation records and the fate of each affected batch |
6. Validation and verification | Validate the plan before applying it, then verify it works as intended | The verification programme: record review, calibration, testing, internal audits |
7. Documentation | Keep documents and records proportionate to the size of the business | The list of current documents and record retention times |
Two points make the difference in an audit. Validation: a critical limit borrowed from another plant, with no evidence that it controls your hazard in your product, is not validated. Management commitment: the auditor reads it in the resources given to the HACCP team and in the decisions taken after a deviation.
How do you work through the 12 Codex steps?
The first five steps prepare the study; the last seven apply the seven principles one by one. Skipping the preliminary steps is the costliest mistake: a hazard analysis built on a wrong flow diagram is wrong. The step names below follow the sequence in the FAO good hygiene practices and HACCP toolbox.
Step | What it produces | Common gap we find |
|---|---|---|
1. Assemble the HACCP team and define the scope | A multidisciplinary team, a written scope | The team is the quality manager alone |
2. Describe the product | Composition, safety-relevant characteristics, packaging, shelf life, storage and distribution | A sales sheet instead of a safety description |
3. Identify intended use and users | Target consumers, vulnerable groups, foreseeable misuse | Use in the destination market is not considered |
4. Construct the flow diagram | All steps, inputs of materials, water and packaging, rework, outsourcing | Water and rework are missing |
5. Confirm the flow diagram on site | A diagram checked during production, dated and signed | A diagram drawn in the office |
6. Conduct the hazard analysis (principle 1) | Significant hazards and their control measures | A generic list, identical for every product |
7. Determine CCPs (principle 2) | The classification of each measure | Everything is a CCP, or nothing is |
8. Establish validated critical limits (principle 3) | One limit per CCP with its validation evidence | Limits copied from a template |
9. Monitor each CCP (principle 4) | Method, frequency, responsibility, record | A frequency that cannot trace the affected product |
10. Establish corrective actions (principle 5) | What happens to the process and the product after a deviation | “Inform the supervisor” as the only action |
11. Validate the plan and set verification (principle 6) | A validated plan and a verification programme | Verification reduced to signing records |
12. Documentation and record keeping (principle 7) | The system’s documents and records | Documents with no version or date |
How these steps map to the clauses of ISO 22000:2018 is covered on our ISO 22000 certification page.
Hazard analysis works step by step and hazard by hazard, estimating the likelihood of occurrence without control and the severity of the effects. Four families are reviewed: biological (pathogens and their toxins, viruses, parasites, and substances such as histamine formed in some fish), chemical (residues, contaminants, cleaning chemicals, migration from packaging), allergens (in the recipe or from cross-contact) and physical (metal, glass, hard plastic, wood, bone). A hazard is significant when it is reasonably likely to occur at an unacceptable level without control, given the intended use. Food fraud and food defence are assessed separately, as the GFSI standards require: see our food safety programmes.
CCP, OPRP or good hygiene practice: how do you classify a control measure?
By the significance of the hazard and the role of the measure. Ordinary GHPs maintain basic conditions, an enhanced measure controls a significant hazard without a critical limit, and a CCP is the step where an essential measure is applied with a validated critical limit. The Codex and ISO 22000 describe the same ladder with different words.
Level of control | Codex term (CXC 1-1969) | ISO 22000 and FSSC 22000 term | When the measure fails |
|---|---|---|---|
Basic conditions | Good hygiene practices | Prerequisite programmes (PRPs) | Correction, no significant hazard targeted |
Enhanced measure | GHPs that need greater attention | Operational prerequisite programme (OPRP), with a measurable or observable action criterion | Correction and assessment of the effect on the product |
Critical point | CCP, with a validated critical limit, measurable or observable | CCP, with a measurable critical limit | Product treated as potentially unsafe: isolated, assessed, then released, reprocessed or destroyed |
BRCGS Food Safety and IFS Food work with Codex CCPs and prerequisite programmes; check the vocabulary of your own standard. A decision tree helps, but it is a tool, not a requirement, and its answer must stay consistent with the hazard analysis. The errors we see most often are a plan where every step is a CCP, “monitoring” that arrives after dispatch (that is verification), critical limits with no validation, OPRPs with no action criterion, and corrective actions that fix the machine but forget the product made since the last good check.
What does a HACCP plan look like for a fish cannery?
Short on CCPs and precise on their evidence. The example below is generic: it illustrates the method for a Moroccan sardine, mackerel or tuna cannery, with no figures. Your limits, frequencies and classifications must come from your own hazard analysis and validation.
The typical flow runs from receipt of fresh or frozen fish through chilled or iced storage, thawing, heading and gutting, brining, pre-cooking, filling, oil or sauce addition, seaming, can washing, sterilisation, cooling, labelling, storage and dispatch, including the water and empty-can circuits.
Step | Main hazard | Control measure | Typical classification, to be justified | Monitoring | If a deviation occurs |
|---|---|---|---|---|---|
Fish receipt | Histamine formed during a cold-chain break upstream, in the species concerned | Assessed suppliers and vessels, temperature at receipt, sensory check, testing to a sampling plan | CCP or OPRP depending on the site’s analysis | Temperature of each delivery, results per lot | Lot rejected or isolated, then assessed |
Chilled or iced storage | Bacterial growth, histamine formation | Control of temperature and storage time | OPRP, or GHP needing greater attention | Temperature record | Exposed lots assessed |
Seaming | Seal failure, then recontamination after sterilisation | Seamer set-up, regular visual checks, seam teardown | CCP or OPRP depending on the site’s analysis | Checks per seamer and per head at a set frequency | Output held back to the last good check, seamer reset, product assessed |
Sterilisation | Survival of Clostridium botulinum and other spore-formers | Scheduled process validated per can format and recipe, retort loading and operation | CCP | Record of each cycle, reviewed before release | Off-schedule cycle: batch isolated and assessed by a competent thermal process person |
Cooling | Recontamination by water through a seam defect | Treated cooling water, residual chlorine checked | OPRP, or GHP needing greater attention | Residual chlorine at a set frequency | Water corrected, batches cooled during the deviation assessed |
Labelling | Undeclared allergen in a sauce, wrong lot or date | Label check at start-up and at each changeover | OPRP, or GHP needing greater attention | Documented check | Labels removed, product reworked |
The scheduled process is never copied: a person or body competent in thermal processing establishes and validates it for each format and recipe, and any change of format, fill or retort calls it into question. Seaming and cooling water protect what sterilisation achieved. Fish is itself a declarable allergen, and sauces may add others. The Codex sector codes of practice on fish and fishery products and on low-acid canned foods support this analysis; they are in the Codex list of codes of practice, where their latest revision should be checked before citing them in a plan.
How does ONSSA approval relate to the HACCP plan?
ONSSA sanitary approval (agrément) or authorisation (autorisation) is the plant’s legal obligation; the HACCP plan is the technical core of what it must be able to show; certification comes afterwards. According to ONSSA, food and animal feed businesses must be approved and/or authorised on sanitary grounds.
Text cited by ONSSA | Subject | What we check in a diagnostic |
|---|---|---|
Law 28-07 | Sanitary safety of food products | The plant holds its approval or authorisation number |
Decree 2-10-473 | Implementation of certain provisions of Law 28-07 | The regime matches the plant’s real activities |
Order 2768-12 of 1 August 2012 | Activity code and prefecture or province code | Declared activities cover the whole future certification scope |
Order 244-13 of 16 January 2013 | Sanitary authorisation and approval | The file still describes current buildings, lines and products |
Procedure code CP 05/DCPV/14 | Granting, suspension and withdrawal of approvals and authorisations | Nothing in day-to-day practice exposes the plant to suspension |
The application is filed with the ONSSA inspection service of the province where the plant is located, with an administrative part and a technical part, and separate files for approval and for authorisation. Issue leads to an approval or authorisation number, and ONSSA publishes lists of approved and authorised establishments. The split between the two regimes is set by Article 4 of Decree 2-10-473 (in French): activities in the categories of its annex require approval, such as meat and meat products, milk and dairy products, fishery products, chilled storage of products of animal origin, juices and nectars, or heat-treated canned vegetables; all others require authorisation. The process decides: olives in brine fall under authorisation, while the same olives sterilised in jars become a heat-treated canned product. If in doubt, have the ONSSA provincial service confirm the regime before filing.
The technical part of the file is set by Order 244-13 (in French):
- a location plan at 1:1,000 and a general layout at 1:100 to 1:300, showing work and storage areas, drinking water, waste water, staff facilities, equipment, product flow, staff movement and waste removal;
- a technical sheet with ten headings, from the nature of the activity to means of transport, including detailed production flow diagrams and capacities;
- for approval, a manual describing the HACCP-based own-check programme; for authorisation, a procedures manual based on the good sanitary practice guide for the activity.
For a site elsewhere in Africa or in the Middle East, the starting point is the national approval or registration that applies there. The full roadmap from ONSSA to the choice of standard is on our food safety consulting page.
How does the HACCP plan prepare ISO 22000, FSSC 22000, BRCGS or IFS?
All of them require a HACCP plan in line with the Codex; each adds its own requirements. A well-built plan is reused as it is, which avoids paying twice for the same work.
Standard | What it adds to the HACCP plan | Our page |
|---|---|---|
ISO 22000:2018 | A management system, justified PRPs, CCP or OPRP classification | |
FSSC 22000 Version 7 | ISO 22000, ISO 22002-x:2025 PRPs and additional requirements, GFSI-recognised | |
BRCGS Food Safety Issue 9 | Detailed requirements on the HACCP team, validation and review, in a graded audit | |
IFS Food Version 8 | HACCP requirements in a scored standard with KO requirements | |
All GFSI standards | Culture, food defence, fraud, allergens, traceability and recall, environmental monitoring |
Some bodies issue a “HACCP” certificate based on the Codex. It may reassure a local customer, but it is not among the programmes recognised by GFSI: ask your buyer in writing what they accept before choosing.
Would your HACCP plan pass an inspection or audit tomorrow?
The checklist we use at the start of a diagnostic, and that a buyer can use to screen a supplier.
If more than three boxes are empty, the plan needs rework before any certification project.
What ACG does for your HACCP plan
For buyers, we run second-party supplier audits in Morocco, Africa and worldwide. Our food safety training covers HACCP for operators, supervisors and HACCP teams, on site, in public sessions or online, in English, French or Arabic; funding through OFPPT special training contracts is explained on our CSF funding page, with no promised amount. To test your plan before a deadline, describe your project.