What is HACCP according to the Codex Alimentarius?
HACCP (Hazard Analysis and Critical Control Point) is a method for identifying, assessing and controlling hazards that are significant for food safety. Its worldwide reference is the Codex Alimentarius text General Principles of Food Hygiene, CXC 1-1969.
The text was adopted in 1969 and revised in 1997, 2003, 2020 and 2022. The 2020 revision was the biggest: it clarified the link between good hygiene practices (GHPs) and HACCP, drew a clear line between validation and verification, and introduced GHPs requiring greater attention. The text is free to download from the Codex Alimentarius website.
Three ideas run through the Codex text:
- GHPs first: cleaning, pest control, personal hygiene, water, maintenance. Without them, no HACCP plan holds;
- HACCP next, for the hazards that GHPs alone cannot control;
- proportionality: a simple, accurate plan beats an exhaustive binder that nobody uses.
In Morocco, food safety is governed by Law 28-07 and supervised by ONSSA. Article 9 of Law 28-07 requires operators to run an own-check programme, or to follow an approved guide to good hygiene practice, and Article 41 of Decree No. 2-10-473 requires that programme to be based on HACCP principles, in line with Moroccan standard NM 08.0.002 or any standard replacing it, or an equivalent system. Exporting plants also have to meet the rules of the destination market. For how the ONSSA file connects with an export certification, see From ONSSA approval to GFSI certification.
What are the five preliminary steps?
The first five steps prepare the hazard analysis: they describe what you control and how the product is made. A mistake here distorts the whole plan.
- Assemble the HACCP team and identify the scope. Production, quality, maintenance and purchasing: people who know the line. The scope lists the products, lines and steps covered, from intake to dispatch.
- Describe the product. Composition, physical and chemical properties (pH, water activity, salt), heat treatment, packaging, storage conditions, shelf life, labelling.
- Identify the intended use and users. Ready to eat or cooked before eating, any vulnerable consumers, reasonably foreseeable use.
- Construct the flow diagram. Every step, including rework, recycling, holding times and waste flows.
- Confirm the flow diagram on site. The team walks the line during production, on every shift, and corrects the diagram.
Step 5 is the one most often rushed. In an audit, following one pallet of fish from intake to cold store is usually enough to find a holding point or a detour that is not on paper.
Step 2 deserves more care than it usually gets in canneries. Canned sardines in oil or tomato sauce are low-acid, shelf-stable products sealed in an airtight container: that description alone explains why the plan centres on spore-forming bacteria, seam integrity and the heat process. Write the product description with the real recipe, can sizes and covering liquids, and update it each time a buyer asks for a new format or a private-label variant. A description that stops at "canned fish" cannot support a serious hazard analysis, and an auditor will start there.
What are the seven HACCP principles?
The seven principles are steps 6 to 12 of the Codex sequence. Together they form the HACCP plan itself.
Step | Principle | What you must produce |
|---|---|---|
6 | 1 — Conduct a hazard analysis and identify control measures | Biological, chemical and physical hazards per step; likelihood and severity; significant hazards retained |
7 | 2 — Determine the critical control points (CCPs) | Steps where a control measure is essential to prevent, eliminate or reduce a significant hazard to an acceptable level |
8 | 3 — Establish validated critical limits for each CCP | Measurable values (temperature, time, dimension…) and evidence of their validation |
9 | 4 — Establish a system to monitor each CCP | Who measures what, how, how often, and where it is recorded |
10 | 5 — Establish corrective actions | What happens to the product and the process when a limit is exceeded |
11 | 6 — Validate the plan, then establish verification procedures | Evidence that the plan controls the hazards; audits, testing, record review |
12 | 7 — Establish documentation and record keeping | Procedures and records proportionate to the size of the business |
Two points from the 2020 text change day-to-day practice:
- Validation and verification are different. Validation proves beforehand that a measure can control the hazard (heat-penetration study, trials, scientific data). Verification checks during operation that the plan is applied and works (audits, testing, record review).
- Critical limits must be validated. They cannot be copied from another site or an online template: they depend on your product, your equipment and your process.
Codex offers a decision tree to help identify CCPs. It is a tool, not an obligation: the team must be able to justify each decision.
What does the hazard analysis of a canned sardine line look like?
In a sardine cannery, three hazards dominate: histamine formation before cooking, survival of Clostridium botulinum spores if sterilisation is insufficient, and recontamination of the can through a faulty seam. Foreign bodies complete the picture.
A typical line in Agadir or Safi runs as follows: intake of fresh or frozen fish, storage on ice or in a cold room, thawing if needed, heading and gutting, brining, filling, pre-cooking, draining, adding the covering liquid (oil, tomato sauce), seaming, can washing, retort sterilisation, cooling, drying, quarantine and incubation of samples, labelling, storage and dispatch. Tuna canneries elsewhere in Africa follow a similar logic with their own steps.
The table below is an example of structure. Numerical critical limits are deliberately left out: each one is set by the site’s own validation study.
Step | Significant hazard | Control measure | Status | Type of critical limit | Monitoring |
|---|---|---|---|---|---|
Fish intake | Histamine (chemical) | Fish on ice, core temperature measured, histamine testing of lots, rejection of non-compliant lots | CCP 1 | Maximum fish temperature at intake and maximum histamine content, set by the site’s validation study | Temperature of every lot; testing per sampling plan |
Storage and holding before cooking | Histamine formation through temperature abuse | Cold room, icing, first in first out, limited holding time | OPRP or CCP, depending on the analysis | Maximum holding time and temperature, set by the site | Temperature logger, time-stamped lot sheet |
Filling and covering liquid | Foreign bodies (metal, hard plastic, glass) | Sieving or filtering liquids, visual inspection, glass and hard plastics policy | OPRP | Action criterion: integrity of sieves and filters | Check at every shift change |
Seaming | Post-process recontamination through a leaking seam | Seamer set-up, visual seam checks, seam teardown | CCP 2 | Seam dimensions (overlap, hooks, tightness) per the can maker’s specification | Visual checks at fixed intervals; teardowns per plan |
Retort sterilisation | Survival of Clostridium botulinum spores | Sterilisation schedule validated per can size and product | CCP 3 | Schedule time and temperature and lethality value, set by the validated heat-penetration study | Continuous recording of each cycle; process indicators; review before release |
Cooling | Recontamination from cooling water | Chlorinated water, controlled circuit | OPRP | Minimum residual chlorine, set by the site | Measurement at defined frequency |
Incubation and release | Verification of commercial sterility | Incubated samples before lot release | Verification (principle 6) | No swelling or defect | Sample reading, release decision |
Three auditor remarks on this example:
- Sterilisation does not destroy histamine. It is heat-stable: fish poorly chilled on board or at the quay will give a non-compliant can, however good the retort. Time and temperature are controlled upstream.
- EU law sets a criterion, not your critical limit. Regulation (EC) No 2073/2005 sets, for fishery products from species associated with high histidine (including the herring family to which sardines belong), a nine-sample plan with m = 100 mg/kg and M = 200 mg/kg. That criterion applies to lots placed on the EU market; your internal intake limit must be set and validated by your own team to guarantee it is met.
- The sterilisation schedule is a validation record, not a machine setting. It must exist for every combination of can size, product and retort, and be reviewed after any change.
The certifications each export market expects from this kind of plant are covered in Fish canneries in Morocco: which certifications to export to the EU, UK, US and Africa.
Which mistakes come up most often in audits?
The same mistakes appear from one site to the next, whatever the scheme. They rarely come from the method itself: they come from a plan written for the audit rather than for the line.
- A copied plan. Same hazards and limits as the original template, including steps the site does not perform.
- Critical limits without validation. "121 °C" written down with no heat-penetration study and no link to the can size.
- Too many CCPs. Every step becomes a CCP, monitoring becomes impossible and nothing is truly controlled.
- Vague corrective actions. "Inform the quality manager" instead of stating what happens to the product, how the process is corrected and how the decision is traced.
- Records filled in afterwards. Identical readings day after day, the same handwriting for every shift.
- A HACCP team on paper only. Retort and seamer operators cannot state the critical limit or the action to take.
- A plan never reviewed. New sauce, new can size, new oil supplier: nothing changed in the file.
Run your plan through this list before your next audit:
What do BRCGS, IFS and FSSC 22000 add?
All GFSI-recognised schemes require Codex-based HACCP, then go further on governance, prerequisite programmes and evidence. A sound HACCP plan is necessary but not sufficient to pass a certification audit.
Scheme | HACCP basis | What comes on top |
|---|---|---|
BRCGS Food Safety Issue 9 | Codex-based HACCP plan at the heart of the standard | Senior management commitment, food safety culture, detailed requirements on premises, hygiene, allergens, food fraud and site security |
IFS Food Version 8 | Codex-based HACCP plan | KO requirements, some of them directly on CCP control; strong focus on practices observed on the floor |
FSSC 22000 Version 7 | Hazard analysis and hazard control plan of ISO 22000:2018 | ISO 22002-100:2025 prerequisite programmes and sector part; FSSC additional requirements |
ISO 22000 brings its own vocabulary, distinguishing CCPs and OPRPs (operational prerequisite programmes). The choice between ISO 22000 alone and FSSC 22000 is explained in ISO 22000 vs FSSC 22000 v7: which certification to choose?.
A HACCP plan lives through the people who apply it. Training levels for each role (operators, supervisors, HACCP team) are set out in HACCP training in Morocco: which level for which role?.