HACCP is the legal foundation of food safety and the core of every certification standard. We build, review and validate HACCP plans that reflect your real process.
HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic, preventive approach to food safety that identifies, evaluates and controls hazards before they reach the consumer, instead of relying on testing the finished product.
HACCP was developed in the 1960s for the US space programme by Pillsbury, NASA and the US Army, in response to the need for a near-zero failure rate in food produced for astronauts. It was later adopted by the Codex Alimentarius Commission, the joint food standards body of the FAO and WHO, and has since become the global foundation of food safety regulation.
HACCP is built around 7 principles, implemented through a 12-step methodology. The 12 steps include 5 preliminary steps that establish the scope and process understanding, followed by the 7 principles that form the technical core of the plan: hazard analysis, CCP determination, critical limits, monitoring, corrective action, verification and documentation.
HACCP underpins every major food safety standard. ISO 22000, BRCGS, FSSC 22000, SQF and IFS Food all require a HACCP plan as their technical core, built on top of prerequisite programmes. A weak or generic HACCP plan is one of the most common root cause of certification audit failures across every standard.
The Codex Alimentarius defines 12 steps for developing a HACCP plan: 5 preliminary steps that establish the foundation, followed by the 7 principles that form the technical core.
A multidisciplinary team with the combined knowledge and expertise to develop an effective plan, covering production, quality, engineering and hygiene.
A full description of the product including composition, physical and chemical structure, processing, packaging, storage conditions and shelf life.
The intended use of the product by the end user or consumer, including any vulnerable groups who may be affected by a food safety failure.
A diagram covering all steps in the operation, from raw material receipt through to despatch, including all inputs and outputs at each stage.
The HACCP team verifies the flow diagram against actual operations during all stages and hours of operation, correcting it where it does not match reality.
List all potential biological, chemical and physical hazards at each step. Assess the likelihood and severity of each hazard and identify control measures.
Use a decision tree to determine which steps are CCPs, where control is essential and where loss of control results in an unacceptable food safety risk.
Set measurable criteria, such as temperature, time, pH or moisture level, that separate acceptable from unacceptable at each CCP.
Define how, when and by whom each CCP will be monitored to ensure it remains within its critical limits during operation.
Define the actions to be taken when monitoring shows a CCP is not within its critical limit, including how affected product is handled.
Define activities, beyond monitoring, that confirm the HACCP system is working as intended, such as calibration checks, internal audits and product testing.
Maintain documentation covering the hazard analysis, CCP determination and all supporting procedures, plus records of monitoring, corrective actions and verification.
Every food business is legally required to operate a food safety management system based on HACCP principles. The complexity of the plan should match the complexity of the operation.
Restaurants, cafes, takeaways and catering operations need a HACCP-based system covering receipt, storage, preparation, cooking, cooling and service. Often a simplified, template-based approach is appropriate for smaller operations.
Manufacturers require a full, formally documented HACCP plan with validated CCPs, critical limits and monitoring records for every product and process. This is the foundation for ISO 22000, BRCGS, FSSC 22000 and other certification standards.
Supermarkets and retailers with in-store bakeries, delis, hot food counters or food-to-go preparation need a HACCP plan covering those activities specifically, separate from any plan covering pre-packed goods.
Institutional catering serving vulnerable groups requires particular attention to the intended use step of HACCP, since the consequences of a food safety failure are more severe for these populations.
Farms and primary producers need a HACCP-based or good agricultural practice approach appropriate to their level of processing, scaling from minimal handling through to on-farm packing and processing.
Businesses handling food without processing it still need a food safety plan covering storage, temperature control, traceability and handling, in line with the BRCGS Issue 9 traded goods requirements and equivalent provisions in other standards.
We build HACCP plans that reflect your actual process, not a generic template. Every service is available remotely or on-site.
Full development of a HACCP plan following the Codex Alimentarius 12-step methodology. Includes hazard analysis workshops, process flow mapping, CCP and OPRP determination, critical limit setting, monitoring system design and documentation.
Review of an existing HACCP plan to confirm it remains accurate following changes to products, processes, suppliers or equipment. Includes validation of control measures using current scientific or technical evidence.
Facilitated workshops with your HACCP team to conduct or refresh the hazard analysis, ensuring biological, chemical, physical and where relevant allergen and radiological hazards are fully considered for each product and process.
Application of decision tree methodology to correctly classify control measures as CCPs or operational prerequisite programmes, with documented rationale that withstands audit scrutiny.
Review and development of prerequisite programmes that support the HACCP plan, including cleaning and disinfection, pest control, supplier approval, allergen management and personal hygiene.
A review of your current HACCP system against the 12-step Codex methodology and against the requirements of any certification scheme you hold or are pursuing. Produces a written action plan.
Internal audits of your HACCP system to confirm monitoring, corrective action and verification records are complete and that documented procedures match actual practice.
Training for HACCP teams, food safety managers and operational staff covering the 7 principles and 12 steps, tailored to your specific products and processes and not generic theory.
For businesses operating multiple sites, we develop a standardised HACCP framework that can be adapted to site-specific processes while maintaining consistency for group-level audits and management review.
Our HACCP training courses build internal competency for your food safety team. We also offer food hygiene training at all levels and internal auditor training aligned to HACCP-based management systems.
Building a HACCP plan follows a defined sequence. Our part of the process typically takes a few weeks, depending on the number of products and processes involved.
| Stage | What happens | Our role | Duration |
|---|---|---|---|
| 1. Gap assessment | Your current HACCP system, if any, is reviewed against the 12-step methodology and any relevant certification requirements. | We conduct the assessment and deliver a written action plan. | 2 to 3 days |
| 2. Team and scope | The HACCP team is assembled or confirmed. Product descriptions, intended use and scope are documented for every product and process line. | We facilitate the team setup and document product descriptions and scope. | 2 to 3 days |
| 3. Process flow mapping | Process flow diagrams are constructed for each product and confirmed against the actual production environment. | We construct the diagrams and conduct the on-site confirmation walkthrough. | 2 to 3 days |
| 4. Hazard analysis workshop | A facilitated workshop identifies and assesses all biological, chemical, physical and allergen hazards at each process step. | We facilitate the workshop and document the hazard analysis. | 2 to 3 days |
| 5. CCP determination and limits | CCPs and OPRPs are determined using decision tree methodology. Critical limits, monitoring, corrective actions and verification are established for each. | We lead the CCP determination and document all critical limits, monitoring and verification procedures. | 3 to 5 days |
| 6. Documentation | The full HACCP plan is documented, including all supporting procedures and record templates for monitoring and verification. | We write the complete HACCP plan documentation in collaboration with your team. | 1 to 2 weeks |
| 7. Staff briefing and implementation | Staff are briefed on new or revised monitoring and recording procedures. The plan is implemented and runs for an evidence period. | We provide implementation support and review early records for compliance. | 1 to 2 weeks |
| 8. Validation and review | Control measures are validated against scientific or technical evidence. The plan is signed off by the HACCP team. | We conduct the validation review and prepare the sign-off documentation. | 2 to 3 days |
If you already have a HACCP plan, the right starting point is a gap assessment, not a rebuild. Most existing plans need targeted correction, not replacement.
Our HACCP gap assessment reviews your existing plan against the full 12-step Codex Alimentarius methodology, checking that every step has been completed, documented and kept current. We also check alignment against any certification scheme requirements relevant to your business, such as ISO 22000, BRCGS or FSSC 22000.
The most common finding is not a missing step, but a step that was completed once and never updated. Process changes, new products, new equipment and new suppliers all require the HACCP plan to be reviewed, and this review is the step most often skipped.
We review your existing HACCP documentation against all 12 steps, checking completeness and currency of each.
We walk the production line and compare the documented process flow, CCPs and critical limits against what is happening in practice.
We review monitoring, corrective action and verification records to confirm the plan is being followed in practice and reflects what is written down.
We produce a written gap assessment with a prioritised action plan for any corrections, updates or improvements identified.
If your business is also pursuing or maintaining a certification standard, we align the HACCP gap assessment with that standard's specific requirements so the work counts towards both.
A weak HACCP plan is one of the most common root cause of certification audit non-conformances across every standard. The same issues appear repeatedly.
HACCP plans copied from a template, a previous employer or a similar business without being adapted to the specific products, equipment and layout of the site. Auditors compare every CCP and critical limit against what they observe on the production line, and any mismatch is an immediate finding.
New products, new suppliers, new equipment or process changes that were not reflected back into the HACCP plan. This is one of the most common single finding in audits across every standard, and is entirely preventable with a structured change review process.
Control measures classified as CCPs when they should be OPRPs, or vice versa, without a documented decision tree rationale. Auditors test the logic behind each classification and a weak rationale undermines confidence in the entire hazard analysis.
Monitoring records completed in batches at the end of a shift and not at the time of monitoring, missing entries, or records that do not match production schedules. Auditors check timestamps and cross-reference monitoring records against production records.
A deviation from a critical limit is recorded, but there is no documented corrective action, no record of what happened to the affected product, and no evidence the root cause was addressed. This is a direct food safety risk and a frequent critical or major finding.
Critical limits set without scientific or technical justification, such as a cooking temperature and time combination not validated against a recognised reference or challenge study. Validation is required by Codex and is a specific area of focus in BRCGS Issue 9.
The HACCP plan assumes a level of control that the prerequisite programmes do not deliver, for example assuming effective allergen segregation when the cleaning programme has not been validated for allergen removal. The hazard analysis must reflect what the PRPs genuinely achieve.
HACCP, prerequisite programmes and certification standards are often confused. Here is how they relate to each other.
| HACCP | Prerequisite programmes (PRPs) | Certification standard | |
|---|---|---|---|
| What it is | A methodology for identifying and controlling specific food safety hazards | Foundational hygiene and operational practices that create the conditions for HACCP to work | A certifiable scheme that requires both HACCP and PRPs, plus management system requirements |
| Examples | Cooking temperature CCP, metal detection CCP | Cleaning, pest control, staff hygiene, supplier approval | ISO 22000, BRCGS, FSSC 22000, SQF |
| Legal status | Mandatory in most jurisdictions | Mandatory as part of HACCP-based systems | Voluntary, but often required by buyers |
| Defined by | Codex Alimentarius | Codex Alimentarius and ISO 22002 series | ISO, BRCGS, FSSC, SQF and other scheme owners |
| Our consulting | HACCP consulting | Prerequisite programmes | All certification standards |
What drives the timeline and cost of HACCP consulting. We provide a written proposal with a fixed fee after the initial consultation.
Timeline
How long our consulting work takes
Cost factors
What drives the consulting fee
No existing HACCP plan. Full development including hazard analysis workshops and documentation. Our consulting work typically takes 2 to 4 weeks depending on the number of products and processes.
A single product line requires a smaller hazard analysis than a multi-product manufacturing site with several distinct process flows. Each additional process line adds to the scope.
An existing plan needs targeted correction following process changes or a gap assessment. Our consulting work typically takes 3 to 7 days.
High-risk production, allergen-handling sites, or operations with multiple shifts and varied product ranges require more time during the hazard analysis and validation stages.
Building or reviewing the HACCP plan as part of a wider ISO 22000, BRCGS or FSSC 22000 project. This work is typically scoped within the broader certification consulting engagement.
A gap assessment only, a full plan development, or ongoing review and validation support each carry different fees. Every scope is defined in writing before work begins.
Developing a standardised HACCP framework across multiple sites requires additional coordination but reduces the per-site cost compared to independent plans for each location.
HACCP team training is often combined with plan development. Training fees are scoped separately and depend on the number of staff and delivery format.
Answers to the questions we hear most often from businesses building or reviewing their HACCP plan.
HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic, preventive approach to food safety that identifies, evaluates and controls hazards that could cause food to be unsafe. HACCP was developed in the 1960s for the US space programme and has since been adopted globally as the foundation of food safety management. It is built around 7 principles and implemented through a 12-step methodology defined by the Codex Alimentarius Commission. HACCP is a legal requirement for food businesses in the EU, UK, US and most other jurisdictions, and forms the core of every major food safety certification standard including ISO 22000, BRCGS and FSSC 22000.
The 7 principles of HACCP, as defined by the Codex Alimentarius, are: conduct a hazard analysis to identify biological, chemical and physical hazards. Determine the critical control points where control is essential. Establish critical limits for each CCP. Establish monitoring procedures for each CCP. Establish corrective actions for when a critical limit is not met. Establish verification procedures to confirm the system is working. Establish documentation and record-keeping procedures. These 7 principles are implemented through a 12-step process that includes 5 preliminary steps before the principles are applied.
The 12 steps of HACCP combine 5 preliminary steps with the 7 principles. The preliminary steps are: assemble the HACCP team, describe the product, identify the intended use, construct a process flow diagram, and confirm the flow diagram on-site. The remaining 7 steps are the 7 principles: conduct a hazard analysis, determine the critical control points, establish critical limits, establish monitoring procedures, establish corrective actions, establish verification procedures, and establish documentation and record-keeping. All 12 steps must be completed and documented for a HACCP plan to be valid.
Yes. HACCP-based food safety management is a legal requirement for food businesses in the EU under Regulation 852/2004, in the UK under retained EU law and the Food Safety Act, and in the US under FDA and USDA regulations including FSMA. Most other jurisdictions worldwide have equivalent legal requirements. This applies regardless of whether a business pursues voluntary certification such as ISO 22000 or BRCGS, both of which require a HACCP plan as their foundation.
Every food business is legally required to have a food safety management system based on HACCP principles, regardless of size. This includes restaurants, catering operations, food manufacturers, retailers, distributors, and primary producers. The complexity of the HACCP plan scales with the complexity of the operation: a small catering business may have a simplified HACCP-based system, while a food manufacturer will require a full, formally documented HACCP plan with validated critical control points.
A Critical Control Point is a specific step in the process where control is essential to prevent or eliminate a food safety hazard, with a measurable critical limit and active monitoring. A Prerequisite Programme is a foundational hygiene and operational practice, such as cleaning, pest control or staff hygiene, that creates the conditions necessary for the HACCP plan to work. PRPs are not CCPs because they do not have the same level of specific, measurable control. A HACCP plan cannot function effectively without robust prerequisite programmes in place first.
A HACCP gap assessment reviews your current food safety system against the 12-step Codex Alimentarius methodology and against any certification scheme requirements relevant to your business. It checks whether all 12 steps have been completed and documented, whether the hazard analysis is current and product-specific, whether CCPs and critical limits are correctly determined and validated, and whether monitoring, corrective action and verification records are being maintained. It produces a written action plan identifying every gap.
A HACCP plan should be reviewed at least annually, and immediately whenever there is a change that could affect food safety. This includes changes to raw materials, suppliers, recipes, processing methods, equipment, packaging, or the intended use of the product. Certification audits routinely check that the HACCP plan reflects current operations, and a HACCP plan that has not been updated following a known change is one of the most common audit non-conformances.
Yes. Hazard analysis workshops, HACCP plan documentation, plan review and validation support are all available remotely. We work with clients in any country. On-site visits are available where a physical process review or production line walkthrough is needed to confirm the process flow diagram and validate control measures.
HACCP consulting fees depend on the number of products and processes covered, the complexity of the operation, and whether a HACCP plan already exists or needs to be built from scratch. A focused HACCP plan development project for a single process line is a smaller investment than a multi-product manufacturing site. We provide a detailed written proposal after an initial consultation.
You can commission any of these on their own, with an agreed scope and a written quote, without taking on ongoing consulting. See all food safety services.
Where no plan exists yet.
Read about HACCP plan development →Where a plan exists and attracts findings.
Read about A HACCP plan review →Where the findings concentrate in the analysis itself.
Read about A hazard analysis review →To establish whether your controls were ever proven capable.
Read about A verification and validation review →Tell us about your products and processes. We will tell you exactly what your HACCP plan needs and how long it will take.