How to Build a HACCP Plan Step by Step: Method and Checklist

How do you prepare the study: team, scope and product (steps 1 to 3)?

By appointing a team that knows the process, writing down what the study covers and describing each product from a safety point of view. These three steps produce no CCP, but everything else depends on them.

The team. Production, quality, maintenance and, depending on the case, purchasing, hygiene or product development. The team leader knows the Codex HACCP principles and can prove their training (BRCGS 2.1.1, IFS 2.3.1.2); in Morocco, Article 63 of Decree 2-10-473, which implements Law 28-07 on the safety of food products, requires appropriate training for the people responsible for the HACCP system. Expertise the site lacks, such as establishing a thermal process schedule, can come from outside; BRCGS allows this, provided day-to-day management of the food safety systems remains the company’s responsibility (1.2.4).

The scope. One page is enough: products or product groups, lines, premises and outsourced steps, from receipt of goods to dispatch (BRCGS 2.1.2, IFS 2.2.1.2).

The product description and intended use. A safety sheet, not a sales sheet.

Gather your sources from this step onwards: scientific literature, known hazards of the product, codes of practice, legislation, customer requirements, a map of the premises and a water distribution diagram (BRCGS 2.3.2). The auditor will ask what each conclusion is based on.

How do you draw and confirm the flow diagram (steps 4 and 5)?

By drawing every step, every input and every output, then verifying it on the line, during production, for each shift. A diagram drawn in the office is the leading cause of an incomplete hazard analysis.

The diagram covers the sequence and interaction of all process steps, inputs of raw materials, water and packaging, outsourced processes, potential process delays between two steps, rework and recycling, risk zones, and finished products, intermediate products, by-products and waste (BRCGS 2.5.1). IFS also requires it to identify every step and each control measure defined for CCPs and for other control measures, and to be dated (2.3.4.1).

On-site confirmation covers all operation stages and shifts (IFS 2.3.5.1), at least annually and whenever the process changes, taking daily and seasonal variations into account (BRCGS 2.6.1). Note the date, the participants and the corrections made: it is a record, not a formality.

How do you conduct the hazard analysis (step 6, principle 1)?

Step by step and hazard by hazard, estimating the likelihood of occurrence and the severity of the consequences, then concluding in writing: is the hazard significant, and which measure controls it?

Review biological, chemical (including radiological and allergens) and physical hazards, as well as those linked to materials in contact with food, packaging materials and the work environment (IFS 2.3.6.1). BRCGS adds fraud and malicious contamination to the list to be considered (2.7.1); they are handled through separate vulnerability and threat assessments, presented on our food safety programmes page. The assessment takes into account the vulnerability of those exposed, the survival and multiplication of micro-organisms, the presence or production of toxins and the contamination of materials (BRCGS 2.7.2), following the logic the FAO sets out for step 6.

A hazard analysis worksheet template, with one generic example row:

This row illustrates the form, not the content: your hazards, ratings and measures come from your own process. Consider using more than one control measure per hazard (BRCGS 2.7.3) and, where eliminating a hazard is not practical, justify the acceptable level in the finished product (BRCGS 2.7.2).

How do you determine CCPs and set validated limits (steps 7 and 8)?

By examining, for each significant hazard, which measures are essential, then giving each CCP a measurable or observable limit whose effectiveness has been proven. A decision tree helps, but what counts is consistency with the hazard analysis.

Three rules for classification:

• a measure essential to control a significant hazard, with a critical limit, makes the step a CCP;
• a measure that controls a significant hazard without a critical limit is one of the control measures requiring greater attention (an OPRP in ISO 22000 vocabulary): it has a measurable or observable criterion, and its capacity to control the hazard is validated (IFS 2.3.9.4, BRCGS 2.7.4);
• if a hazard requires control at a step where no control measure exists, the product or process must be modified at that step or at an earlier one (BRCGS 2.8.1).

The detailed correspondence between Codex and ISO 22000 vocabulary is on our HACCP plan page. If your site is aiming for ISO 22000 or FSSC 22000, building PRPs, OPRPs and CCPs to the standard is covered on our ISO 22000 certification page.

Critical limits. They apply to parameters such as temperature, time, moisture level, pH, aw or conveyor belt speed, as listed by the FAO for step 8. Where a limit is visual, photographs or examples make it explicit (BRCGS 2.9.1). Each limit is validated with existing studies from credible sources, the literature, models or trials; the validation file shows that the measure consistently controls the hazard to the specified acceptable level (BRCGS 2.9.2).

How do you organise monitoring, corrective actions and verification (steps 9 to 11)?

With one sheet per CCP, written with the people who apply it. It says what to measure, how, how often and by whom, what to do in case of deviation and who verifies.

Monitoring must detect loss of control in time for corrective action. Where measurement is discontinuous, the sample must be representative of the batch (BRCGS 2.10.1). Records show the date, time and result, are signed by the operator and verified by a competent person (BRCGS 2.10.2, IFS 2.3.9.2), and the staff who monitor have received specific training or instruction (IFS 2.3.9.3). Under IFS, monitoring of each CCP is a KO requirement (2.3.9.1).

Corrective action covers all product made while the process was out of control (BRCGS 2.11.1), including when results only show a trend towards loss of control, and it identifies the root cause (IFS 2.3.10.1).

Verification confirms that the plan works: internal audits, review of records where limits were exceeded, complaints, withdrawals and recalls (BRCGS 2.12.2), testing and sampling (IFS 2.3.11.2), at least once within a 12-month period. In Morocco, own-check testing is carried out in an in-house or contract laboratory that is officially recognised (Decree 2-10-473, Article 42). The plan itself is validated before it is implemented, as the FAO points out for step 11.

How do you document the plan and keep it alive (step 12)?

With dated, version-controlled documents, records that can be retrieved and a scheduled review. In Morocco, records are kept for at least 5 years (Law 28-07, Article 9), and the manual filed in the sanitary file held by ONSSA (Office National de Sécurité Sanitaire des Produits Alimentaires, the national food safety authority) must stay consistent with the plan actually applied.

Review the plan at least annually and before any change of raw material or supplier, recipe, process, cleaning, equipment, packaging or distribution, or consumer use, as well as after an incident, new scientific information or the recall of a similar product (BRCGS 2.12.3).

The mistakes we correct most often

• A HACCP team reduced to the quality department, and operators who discover the plan during the audit.
• Product descriptions without the legal requirements of the country of sale.
• A flow diagram without water, packaging or rework.
• The same hazard analysis for every product, with no rating or justification.
• Critical limits copied from a template or set to the machine setpoint, with no validation.
• A corrective action that repairs the machine but forgets the product.

HACCP plan checklist

• Team appointed and multidisciplinary, team leader trained, training evidence on file.
  
• Scope of the study written: products, lines, premises, outsourcing.
  
• Safety-oriented product description and intended use for each product or product group.
  
• Complete flow diagrams, confirmed on site for every shift, dated and signed.
  
• Hazard analysis rated, justified and sourced, step by step.
  
• Classification as CCP, measure requiring greater attention or GHP, with the reasoning written down.
  
• Critical limit and validation file for each CCP.
  
• Monitoring sheet for each CCP, operators trained, records signed and verified.
  
• Corrective actions covering process, product and root cause.
  
• Verification programme over 12 months, laboratories identified.
  
• Documents under version control, records kept for at least 5 years, annual review scheduled.
  

The legal framework of each step is set out in our HACCP plan Morocco guide, the time and resources to plan for in our article on HACCP plan cost, and a complete application in our sardine cannery case study.