HACCP: what it is, what it requires and how to train
The system that controls the safety of a food product. It is the base of ISO 22000, of FSSC 22000 and of Mexico's NOM-251, and it is where most plans fall apart: by mistaking a good hygiene practice for a critical control point.
HACCP (Hazard Analysis and Critical Control Points) is a preventive system that identifies the biological, chemical, physical and allergen hazards of a food process and establishes controls at the points where they are decisive for the safety of the product. Its international reference is the General Principles of Food Hygiene of the Codex Alimentarius (CXC 1-1969) and its HACCP annex, revised in 2020 and amended in 2022. HACCP is not certifiable on its own the way an ISO standard is, but it is a requirement within ISO 22000, FSSC 22000 and the food regulations of most countries.
In short
- Reference
- Codex Alimentarius CXC 1-1969
- Latest revision
- 2020, amended in 2022
- Principles
- 7
- Application steps
- 12
- Mandatory base
- Prerequisite programmes (GMP/PRP)
- Required within
- ISO 22000, FSSC 22000, NOM-251
This guide is written for whoever has to learn or teach HACCP. If what you need is for us to implement the system at your company, that work is done by Beira Consultores.
See consulting at beira.com.mxThe 7 HACCP principles
The seven Codex principles are the core of the system, and the order matters: each one rests on the previous. Skipping the hazard analysis to get to the CCP table sooner is the shortcut that produces plans that cannot survive an audit.
- 1. Conduct a hazard analysis and identify the control measures.
- 2. Determine the critical control points (CCPs).
- 3. Establish validated critical limits for each CCP.
- 4. Establish a monitoring system for each CCP.
- 5. Establish the corrective actions to take when monitoring indicates a deviation.
- 6. Establish verification procedures for the system.
- 7. Establish appropriate documentation and records.
The 12 steps: what comes before the principles
The Codex describes twelve application steps, and the first five are preparatory and usually the worst executed: assembling a HACCP team with multidisciplinary competence, describing the product, identifying its intended use and its consumers (vulnerable populations included), drawing the flow diagram and confirming it on the floor.
Confirming the flow diagram against the real process, not in the meeting room, is the step that prevents the most nonconformities. A plan built on a flow that does not match the operation controls stages that do not exist and leaves uncontrolled the ones that do.
CCP versus good practices: the distinction the auditor checks
The 2020 revision of the Codex reinforced the distinction between good hygiene practices (GHP) and critical control points, and that is where the findings concentrate. A CCP is a step where a control essential to prevent, eliminate or reduce a hazard to an acceptable level is applied, with a measurable and validated critical limit. Everything else (cleaning, pest control, personnel hygiene, maintenance) belongs to the prerequisite programmes, and they are the base the plan rests on.
The two symmetrical mistakes cost the same. Declaring fifteen CCPs on one line creates a monitoring system nobody can sustain and that ends up being filled in from memory. Declaring zero CCPs because "GMPs control everything" leaves hazards that do need control without any. The Codex decision tree exists to settle that question with judgment rather than habit.
How to train in HACCP
HACCP training splits between whoever builds the plan and whoever operates it. The HACCP team needs to master hazard analysis, validation of critical limits and verification: that is technical training, with cases and with audit judgment. Plant personnel need to understand their control, their record and their corrective action, which is a far narrower scope.
A HACCP plan stands or falls on the competence of the team that maintains it. That is why certification audits review the training evidence of the HACCP team as part of the system, and not just the existence of the document.
Who needs training in HACCP
HACCP team leader or coordinator
Build the plan, stand behind the hazard analysis and defend it with technical judgment in the audit.
Production supervisor
Operate the CCP controls, record the monitoring and apply the correction when a critical limit is lost.
Food safety analyst or technician
Verify, validate and keep the plan current when the product, the process or a supplier changes.
Plant personnel
Understand why each control exists and what to do when a record falls out of limit.
Frequently asked questions about HACCP
What are the 7 HACCP principles?
The seven HACCP principles according to the Codex Alimentarius are: conduct the hazard analysis, determine the critical control points, establish critical limits, establish monitoring for each CCP, establish corrective actions, establish verification procedures, and establish documentation and records. They are applied within a sequence of twelve steps that includes five preparatory ones.
What is the difference between a CCP and a good hygiene practice?
A critical control point (CCP) is a step where a control essential to prevent, eliminate or reduce a hazard to an acceptable level is applied, and it has a measurable, validated critical limit. A good hygiene practice is a prerequisite programme that creates the basic conditions for safety (cleaning, pest control, personnel hygiene) but does not control a specific hazard at a specific step. Confusing them is the most common finding in food safety audits.
Is HACCP certifiable?
HACCP is not a certifiable standard on its own the way ISO 22000 is: it is a reference system from the Codex Alimentarius. Private certification schemes based on HACCP do exist, and its principles are a mandatory requirement within ISO 22000, FSSC 22000 and food regulations such as NOM-251 in Mexico. What is certified is the competence of people, through training certificates.
How often should the HACCP plan be reviewed?
The HACCP plan is reviewed at least once a year and whenever something changes that could affect the hazard analysis: a new product or formulation, a change of process or equipment, a change of supplier for a critical ingredient, new scientific evidence about a hazard, or a recurring deviation detected in monitoring. The annual verification does not excuse reviewing it at every change.
Who should be on the HACCP team?
The HACCP team must be multidisciplinary and bring together knowledge of the product, the process and the hazards: typically production, quality and food safety, maintenance and, depending on the case, purchasing or product development. The Codex requires demonstrable competence from the team, not a minimum size; in a small company it can be a team of three supported by external advice.