An independent technical review of your existing HACCP plan. Every element marked sound, weak or missing, with replacement wording for anything that would not survive an audit.
A HACCP plan review is an independent technical assessment of an existing HACCP plan, checking that the hazard analysis is complete and justified, that the critical control points are correctly identified, and that critical limits, monitoring, corrective action and verification would stand up to an audit. It is carried out against the seven Codex Alimentarius principles, against the requirements of the certification standard the business holds, and against the food law of the markets it sells into.
Most HACCP plans fail audits in the same small number of places, and almost all of them are visible on paper long before an auditor arrives. Hazard analysis without recorded justification, critical control points that should be prerequisite programmes, and critical limits lifted from guidance and never validated account for a large share of HACCP findings across BRCGS, IFS Food, FSSC 22000, ISO 22000 and SQF audits.
The review returns specific rewrites in place of general observations, so the plan can be corrected directly with no reinterpretation first. Plans are reviewed in any language, and the report is delivered in whichever language you need.
A HACCP plan review checks whether your existing plan would survive an audit, and tells you exactly which wording to change. It is delivered remotely from the documents you already hold, and is quoted on scope.
The review works through the seven Codex principles in order, then checks the plan against the additional requirements of the certification standard you hold.
| Codex principle | What is checked | Most common failure |
|---|---|---|
| 1. Conduct a hazard analysis | Every hazard identified at every step, across biological, chemical, physical, allergen and radiological categories, with the significance decision justified in writing. | Justification missing or asserted without evidence |
| 2. Determine the critical control points | Decision logic applied and recorded, with each control correctly classified as a CCP, an OPRP or a prerequisite programme. | Controls made CCPs that should be prerequisites |
| 3. Establish critical limits | Limits that are measurable, achievable in production, and supported by validation evidence that applies to your product and equipment. | Limits copied from guidance with no validation |
| 4. Establish monitoring procedures | Who monitors, how, how often, with what equipment, and where the result is recorded. | Frequency set with no stated rationale |
| 5. Establish corrective actions | What happens to affected product and to the process when a limit is breached, including who decides and who is informed. | Action covers the process but not the product |
| 6. Establish verification procedures | Activities confirming the plan works as intended, distinct from monitoring, with results reviewed by someone able to act on them. | Verification confused with monitoring |
| 7. Establish documentation and records | Records that prove each element operated, retained for the required period and retrievable on request. | Records exist but cannot be found quickly |
Misclassifying a control is one of the most common structural fault in a HACCP plan, and it goes wrong in both directions. This is the distinction the review applies.
| Type | What it is | Critical limit | Monitoring | Corrective action |
|---|---|---|---|---|
| Critical control point (CCP) | A step where control is essential to prevent, eliminate or reduce a significant hazard to an acceptable level. | Yes, measurable | Continuous or at defined frequency, recorded every time | Immediate, covering both process and affected product |
| Operational prerequisite (OPRP) | A control measure that manages a significant hazard where a measurable critical limit and immediate product decision are not practical. | Action criteria in place of a critical limit | Planned and recorded | Defined, though not necessarily immediate product disposition |
| Prerequisite programme (PRP) | A basic condition or activity maintaining a hygienic environment across the operation, not controlling one hazard at one step. | No | Scheduled verification in place of per batch monitoring | Corrective action on the programme, not on a specific batch |
A control designated a critical control point must be monitored and recorded to CCP standard every time. Designating a prerequisite programme as a CCP therefore creates a nonconformity the moment monitoring lapses, without adding any food safety benefit.
These eight account for a large share of HACCP findings raised at certification audits. Each is checked explicitly during the review.
The plan states that a hazard is or is not significant and stops there. Auditors test the reasoning and not the conclusion, so a plan with entirely correct conclusions still attracts a finding when the likelihood and severity assessment behind them was never written down.
Controls that are properly prerequisite programmes or operational prerequisites have been designated CCPs. This creates monitoring and record burden with no food safety benefit, and it attracts findings, because a CCP that is not monitored to CCP standard is a nonconformity.
A limit lifted from an industry guide or a textbook is not evidence that the limit works on your equipment with your product. Where the cited source used a different matrix, a different formulation or different parameters, the limit is unvalidated in practice.
Diagrams drawn at implementation and never revisited after a line change, a new step or a rework loop being added. A hazard analysis built on an inaccurate flow cannot be correct, because the steps being assessed are not the steps being run.
Rework reintroduces product into the process and carries allergen, microbiological and traceability implications. Plans routinely map the primary flow and omit it entirely.
Hazards arriving through ingredients, packaging, processing aids, water, compressed air and ice are among the most commonly missed. A hazard analysis starting at the first processing step is incomplete before it begins.
Monitoring confirms the control is operating right now. Verification confirms the plan as a whole is working. A plan that lists monitoring under both headings has no verification at all.
Standards expect the plan to be reassessed when a product, process, ingredient, supplier or piece of equipment changes, and periodically regardless. Plans frequently carry an annual review date and no change triggers.
Any food business operating a HACCP plan, whether certified to a GFSI recognised standard or working to the legal requirement alone. It suits manufacturers, processors, packers, food supplement producers and catering operations, and it is particularly useful where the plan was written by someone no longer with the business or has never been independently checked.
Your plan was written years ago and the process has moved on since.
An auditor has said your hazard analysis lacks justification.
You are not confident your CCPs are correct, or you suspect you have too many.
Your critical limits came from a guidance document instead of your own validation.
You are moving to a new standard and the plan must meet a different expectation.
A new product, line or process step has been added without the plan being reassessed.
The person who wrote the plan has left and nobody can defend it.
A customer or a regulator has asked to see evidence of independent review.
You send the current plan, flow diagrams, the supporting hazard analysis and any validation evidence you hold.
The plan is checked against the Codex sequence and the documented requirements of your standard, so missing elements surface before content is assessed.
Hazard analysis and CCP determination are assessed on technical merit, hazard by hazard and step by step.
Critical limits and control measures are checked against the validation evidence you hold, and gaps in that evidence are recorded.
Every element is marked sound, weak or missing, with the reasoning stated in place of a general observation.
Specific wording is supplied for anything that would not survive an audit, so the plan can be corrected directly.
The review assesses and corrects an existing plan. Building a plan from nothing is HACCP plan development, quoted separately.
Laboratory validation of critical limits is also separate, though the review identifies precisely which limits require it and what study would satisfy the requirement.
Where a process needs a recognised process authority, such as low acid canned food thermal processing, the review states that plainly and does not assess it.
Quoted on scope, never sold at a list price, because plan length varies enormously between businesses with the same nominal scope. These factors determine the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
A HACCP plan review is an independent technical assessment of an existing HACCP plan. It checks that hazards have been identified at every process step, that significance decisions carry written justification, that critical control points are correctly determined, and that critical limits, monitoring, corrective action and verification are adequate. The output marks every element as sound, weak or missing, and supplies replacement wording for anything that would not survive an audit.
At least annually under most certification standards, and additionally whenever something changes that could affect the hazard analysis. That includes a new product or recipe, a formulation or supplier change, new or modified equipment, a change to a process parameter, a new hazard identified in the sector, a customer complaint or recall, and any change to the applicable legislation. An annual review date with no change triggers defined is itself a common finding.
Someone with HACCP training and technical knowledge of the process, who is independent of the people who wrote the plan. Independence is the difficulty for small teams, because the person qualified to review the plan is usually the person who wrote it. An external reviewer resolves that, and standards accept an external reviewer provided competence is documented.
Evidence, never assertion. Auditors test whether the hazard analysis covers every step and category, whether significance decisions are justified, whether CCP determination followed a recorded logic, whether critical limits are validated for your process, whether monitoring records exist and were completed at the time, and whether the plan has been reassessed after change. A plan that reads well but cannot produce the evidence behind it will still attract findings.
A review starts from a plan you already have and corrects it, returning findings and replacement wording. Development starts from your process and builds the plan from the beginning, including flow diagrams and the full hazard analysis. If your plan is broadly sound but unverified, a review is the right service. If it is a template with your company name typed into it, development usually costs less than repairing it.
There is no correct number, and comparing against other businesses is misleading because CCPs depend on the process and not on the sector. What matters is that each CCP is genuinely a step where control is essential and a measurable limit exists. In practice, over identification is far more common than under identification, and both are findings.
In most countries, yes. The Codex Alimentarius principles have been written into national food law across the great majority of jurisdictions, so a documented HACCP based system is a legal obligation for most food businesses wherever they operate. The wording differs by country. In the European Union it comes through Regulation (EC) 852/2004. In the United States most registered facilities fall under FSMA preventive controls in 21 CFR Part 117, with separate HACCP rules for seafood, juice, and meat and poultry. Other markets impose it through their own food safety acts and sector regulations. The review is carried out against the law of the markets you sell in, which is confirmed at scoping.
It checks whether the hazard analysis relies on prerequisite programmes and whether that reliance is stated. It does not assess the programmes themselves in depth, which is a prerequisite programme review. This matters because hazards are routinely dismissed on the grounds that a prerequisite controls them, and if that programme is weak the justification collapses.
Yes. We work in any language, and the review is delivered in whichever language you need it in. Where the plan and the report are in different languages, both are handled on our side, so you receive findings and replacement wording ready to drop into the plan as it stands. Language is confirmed at scoping so nothing is assumed.
A written report marking every element of the plan as sound, weak or missing, with the reasoning stated for each finding, and specific replacement wording for anything that needs correcting. The report is written so it can be used directly to amend the plan, and so it can be shown to an auditor as evidence that the plan was independently reviewed.
A single product family with a straightforward process is quick. Multiple product families, long process flows or plans covering several sites take longer. The largest variable is plan length, which differs enormously between businesses with the same nominal scope. Turnaround is confirmed with the quote once the plan has been seen.
Yes, and it is one of the main reasons businesses commission it. Each control measure is assessed against decision logic, and the review states whether it should be a CCP, an OPRP or a prerequisite programme, with the reasoning recorded so the classification can be defended at audit.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
A focused review of the hazard analysis itself, which is where most HACCP plans fail an audit.
Read about Hazard Analysis Review →A review of whether your controls have been validated as capable, and whether verification proves they keep working.
Read about Verification and Validation Review →A structured comparison of your current food safety system against the standard you need to meet, returning every gap with a priority and an owner.
Read about Food Safety Gap Assessment →A complete HACCP plan built from your process where repairing the existing one would cost more than starting again.
Read about HACCP Plan Development →Certificated course covering hazard analysis, CCP determination and plan maintenance.
View Certified HACCP Manager →Certificated course covering auditing a HACCP system against Codex and scheme requirements.
View Certified HACCP Internal Auditor →Expert HACCP consulting worldwide. HACCP plan development, hazard analysis, CCP determination, validation, internal audits and training for food businesses of all sizes.
See HACCP Consulting →Expert Canada food safety consulting worldwide. Safe Food for Canadians Regulations (SFCR), Preventive Control Plans, SFC licensing, traceability, and the new...
See Canada Food Safety Consulting →Expert EU food hygiene consulting worldwide. Regulation 852/2004 and 853/2004 compliance, HACCP-based procedures, establishment approval, official controls, and 2026...
See EU Hygiene Regulations Consulting →Send the plan and receive a written quote covering the scope, the timeline and the price.