Our HACCP Standard help & advice will help you understand what’s required & direct you to the area you’re interested in…

BRC Food Safety eDocs
BRC Storage and Distribution eDocs
BRC Agents and Brokers eDocs
BRC Packaging eDocs

place 1 

What is HACCP?

HACCP stands for “Hazard Analysis of Critical Control Point”.

The purpose of HACCP is to ensure that the product produced is safe for consumption.

The system risk assesses the process in which a product is made and highlights the food safety hazards at each step that need to be controlled.
Back to top of page…


Where did HACCP come from?

HACCP was originally designed in the 1960’s when NASA asked their supplier – Pillsbury, to develop a system to ensure that all the food produced for the first space flights would not cause harm to their astronauts.  Astronauts with food poisoning wouldn’t have been a pretty sight!
Back to top of page…


Do I have to have HACCP?

In the UK all businesses who provide food for sale, with the exception of primary producers (farms) are required by law to have a HACCP.

The law also states that these food businesses must implement HACCP based on the 7 codex principles, which are:

  1. Identify the food safety hazards within the process
  2. Identify which steps of the process are critical to food safety (CCPs)
  3. Establish the food safety limits for each of these CCPs
  4. Establish how the CCPs need to be monitored to make sure they stay in control
  5. Establish what corrective action would need to be put in place if the CCPs were found to be out of control
  6. Put procedures in place which ensure that the monitoring and corrective action is complied with
  7. Ensure that records are kept to show that the monitoring and corrective action has been complied with.

The Codex Alimentarius standard can be downloaded here.

As the law states that these 7 principles must be followed it is extremely important for food businesses to understand each one so they can apply them, each one of them is explained below.
Back to top of page…


Who can put a HACCP together?

The law says you need to be suitably trained to be able to carry out and manage the implementation and day to day running of the HACCP system.  The law does not say that you have to have formal qualifications, you just need to be able to show that you know enough about HACCP to be able to put a plan together and adhere to it.
Back to top of page…


Principle 1.  Identify the food safety hazards within the process.

In order to be able to establish all the hazards at each point of the process – it is important to understand what a hazard is.

A hazard is something that may cause harm.  In HACCP it is really important to remember that only food safety hazards are to be considered.  It is a common mistake to include hazards that do not cause harm.  Do not include hazards which would be classed as something that would ‘upset’ someone or cause a quality complaint.  Finding a small piece of soft paper in your food may cause you upset, or may cause you to complain – but it would not because you harm.  So, it is important when considering hazards to ask – is this a food safety hazard that may cause harm, or is it a quality hazard?

All food safety hazards can be classified into one of the following groups – chemical, microbiological, physical, radiological and allergenic.

Sometimes allergenic hazards are classified under the umbrella of chemical hazards, due to their nature.  This is totally acceptable and just comes down to personal preference, as long as it is explained in the food businesses documentation that this is the case.

The next step is to identify all the steps in the process.  This is where another common mistake is made – where food businesses end up with lots of sets of HACCP plans, because they think of each step as a piece of equipment.  So, if they have 3 manufacturing lines all making exactly the same product, each with different pieces of equipment (due to a brand name or slight differences) they create 3 different HACCPs.  This is not necessary and makes it more complicated than it needs to be.  Each process step is what happens to the product at that step, this is explained in an example below:

Once all the steps in the process have been identified, this should be drawn into a process flow.  It’s a good idea to label each step in the process, so when documenting your hazards you can clearly show which step the hazard belongs to.

Then for each step, assess the food safety hazards – go through each group (chemical, micro, physical, radiological and allergenic) and document each one that is relevant.

There are two important details that are often forgotten at this point:

  1. The type of chemical, micro, physical or allergen you are talking about. So, for physical do not just document ‘physical hazard’ but you must write what type of physical hazard it is – e.g. metal, glass, hard plastic etc.  This is important because you will need to define the severity of harm that the hazard will cause later, if you’ve just put ‘physical hazard’ it makes it difficult to assign the correct severity – the severity from soft plastic for example would not be the same as the severity from chewing glass.
  2. Where the hazard has come from. This is key, because if you cannot explain how it got into the food (the event that caused the contamination), then it’s probably not a true hazard.  Also, when you get to risk assessing the hazard, you need to be able to risk assess how likely it is for the event to happen.   So, physical contamination of glass due to overhead lights breaking.

Now that the hazards at each step have been identified you can move on to the next principle.
Back to top of page…


Principe 2.  Identify which steps of the process are critical to food safety (CCPs)

In order to be able to identify which steps in the process are critical to food safety (CCP – Critical Control Point), each of the hazards at each process step need to be risk assessed.

To do this it is important to understand what the severity of harm would be caused by each hazard and also the likelihood of the hazard occurring (the event happening).

The risk from the severity and the likelihood is normally defined as high, medium or low risk.  Other scales can be used, this is just preference – for example 1, 2 and 3.  However, if you apply a different scale it is important that you define which way round the scale is (High risk = 3 or High risk = 1).

It is a really good idea to put together a definition for each part of the scale for severity and likelihood.  This will make it easier for you to explain when you have an audit and also will help you make the risk assessment decisions more consistently throughout your HACCP plan.

For example you may say for severity:

Scale (Rating)








Note, the example above does not include quality complaint, or upset – as these will not cause harm. In the same way, put together a definition for your likelihood scale. You can now go ahead and assign a severity rating to each of your hazards.

To be able to assign a likelihood rating to each hazard, the controls and pre-requisites in place must be taken into account.  So, we need to understand what a control and a prerequisite is.
Back to top of page…



These are the basic operational practises that must be in place.  Without these, your HACCP will not work – as the product being produced will probably not be safe anyway.  Examples of prerequisites would be Personal Hygiene or Pest Control.

They are the building blocks that underpin good practises of food production; if hand washing (which is part of the personal hygiene prerequisite) was not in place, the food would probably not be safe to eat.  If mice were running around inside the factory, again the food would probably not be safe to eat.

The prerequisites are there to control the majority of food safety issues in the production of the food.  However they are different from those that control true food safety hazards because of one main rule – they are generic, they do not apply to just one point in the process.  So, personal hygiene is necessary at each step in the process, so is pest control.  Ensuring that temperature control is achieved at the step of cooking however is specific to that process step – it is not generic and therefore would probably not be defined as a prerequisite.

Therefore, it is important at this stage to list your prerequisites.  It is also useful to list which controls are managed by each prerequisite, for example like we said before hand washing is a control managed by the prerequisite of Personal Hygiene.
Back to top of page…



A control is something that prevents hazard from occurring or reduces it to an acceptable level.  Here is another common mistake – many food businesses will define the control as something like “glass checks”.  A check is a monitor (we’ll come on to monitoring later) – it is not a control.  It is not a control because checking a piece of glass equipment to see if it is broken will not stop the hazard from occurring or reduce it to an acceptable level, it is just checking to see if the hazard has occurred.  Make sure your list of controls are just controls and do not include any checks.

Now go ahead and assign a likelihood rating for each of the hazards at each step, taking into account the controls in place.  Ensure for each hazard the controls and the prerequisite (if applicable) is documented.
Back to top of page…


Hazard Significance

Only significant hazards must be then taken forward to be assessed as CCPs.  If all hazards were taken forward then there would be far too many CCPs and they would not be focused on the ones that are truly critical to food safety.  If you have too many untrue CCPs there is a risk that you may end up not being able to manage them all, which may risk the true CCPs not being managed effectively and unsafe food being produced.

To establish which of the hazards are significant, the severity and likelihood ratings are used.  The following is a typical method of doing this, however there are many ways of doing this.  A combination of scores for each rating can be used and multiplied up – with only the scores above a set amount being significant.







Detail for each hazard if it is significant or not.  Take the ones that are significant forward through to the CCP decision tree, which is shown below.
Back to top of page…


CCP Decision Tree


If you have good prerequisites in place, you will find that most of the hazards are knocked out at question 1.  Take each hazard through the questions and document which ones are managed by the prerequisites and which are CCPs.
Back to top of page…


Principle 3.  Establish the food safety limits for each of these CCPs

The food safety limits are the measurements that you’ll use when monitoring the CCP to see if has been effective.  These measurements may be temperature, pH, Aw etc.

The aim is to set limits which will ensure that if you work within these limits the food will be safe.

Therefore it is essential to understand the hazard that you are trying to control.  If your hazard is the microbiological hazard of Salmonella in eggs, it is important to know at what temperature the bacteria is killed at and what temperatures it cannot grow at.  These are the temperature limits you would consider for the CCP.

Once you have defined the limits, document these for each CCP.
Back to top of page…


Principle 4.  Establish how the CCPs need to be monitored to make sure they stay in control

Monitoring is how the CCP will be checked to make sure that it is staying within the limits that you have set.  This can either be by manually checking the CCP or it can be automated.  If it is automated however it is still necessary for the automated system to be able to produce records, as these will be required as evidence (this is part of principle 7).

When setting out the monitoring think about how often it must be monitored.

If the product is being produced in batches – each batch may need to be checked, but how many samples in each batch and are there inconsistencies across the batch that need to be taken in to account?

For continuous production how often would the check need to be carried out?  If the process was to go out of control how long could it take for the CCP to go out of established food safety limits?  Also, consider how long it would take for the product to be out of your control – for example, if it could it go onto a delivery vehicle within an hour, perhaps the check should be every 30 minutes?

Document the monitoring that would be required – this will be used in principle 6.
Back to top of page…


Principle 5.  Establish what corrective action would need to be put in place if the CCPs were found to be out of control

The next steps it to work out what you would need to do if the monitoring showed that the CCP was outside of the established food safety limits.

The first rule is to always assess the risk to the product that has been produced, to ensure that you are not going to release for sale or consumption any food that is not safe.

In continuous production if you are checking at a set frequency you cannot guarantee the product produced since the last check is safe.  Therefore part of the corrective action must be to find the product produced since the last check and isolate so it can’t go out as good product.  You must also decide what you would do with this product to establish if it is safe.

Can it be retested?  For some such as temperature checks this may not be possible, as the temperature may have changed during that time – so how would you prove that it is safe?  You may decide to hold the product and not allow it to be consumed or go out for sale until micro tests can be carried out on it, to prove it is safe.  In some cases, with short shelf life products you may not be able to wait for this, so you may decide it has to be put to waste.

Can it be further processed to ensure it is safe? – this may be possible it you are cooking to achieve a certain temperature, you may be able to extend the cooking or baking process so the temperature is achieved.

The second rule is to ensure that the reason for the process going out of control is reviewed and the necessary action put in place to make sure that the likelihood of it happening again in the future is reduced.

Document what corrective action should be applied for each CCP if it were to go out of the food safety limits.
Back to top of page…


Principle 6.  Put procedures in place which ensure that the monitoring and corrective action is complied with

Now that you have your food safety limits and you know how you are going to monitor these, by the method and frequency you will apply, plus the corrective actions that need to applied in the event of a failure – this all now needs to be compiled onto a procedure that can be used to train your staff so they know what to do.  The procedure should also detail to your staff where they must record the information from the monitoring and corrective action that they would need to apply.

It is a good idea to also have the procedure handy where the CCP is to be monitored so that if they need to they can easily refer to it.

When training your staff to this procedure make sure you make a record of the training, so that you can prove that they were trained.  It is also a good idea to go back a couple of days after carrying out the training and check to make sure that they understood – you can do this by asking them to explain to you what they need to do and then getting them to show you how they would do it.
Back to top of page…


Principle 7.  Ensure that records are kept to show that the monitoring and corrective action has been complied with.

Now that the system is in place, it is key to ensure that you can prove that you have complied with the CCPs monitoring and corrective action.  To do this you must record the information from the monitoring and retain all the records.  We would recommend that the CCP records are checked routinely (daily) to make sure they are being completed and that any issues have been dealt with correctly, by applying the required corrective action.

If you do carry out a record check routinely, make sure you sign and date (and add the time if necessary) to the paperwork – to prove that you’ve checked it. And that’s it!
Back to top of page…

We hope our HACCP Guidance has helped you understand what is required for your HACCP plan.  Depending on what standard you are trying to achieve, the level of detail needed in your HACCP plan will vary.


We have HACCP Documentation Packs which adhere to the legislation standard (the law), SALSA and also BRC Food Safety, BRC Storage & Distribution, BRC Agents & Brokers and BRC Packaging & Packaging Materials.


To take a look at our HACCP Documentation Packs and how they can help you – pick the standard that you need to achieve below…

BRC Food Safety eDocs
BRC Storage and Distribution eDocs
BRC Agents and Brokers eDocs
BRC Packaging eDocs