HACCP Plan Template: How to Create a Hazard Analysis Critical Control Point Process
Understanding the basics of HACCP can help you get started, but implementing your own HACCP plan can be overwhelming. Luckily there are resources and plan templates to make it easier.
Why Does HACCP Exist?
By the time NASA (with help from Pillsbury and U.S. Army Laboratories) invented Hazard Analysis Critical Control Point (HACCP) for food safety, inspection-based food safety systems and food recall existed. But these are both reactive systems – they only catch potential food safety problems after the job is done.
Shortly after their collaboration with NASA, Pillsbury began applying Hazard Analysis Critical Control Point to their earth-bound food production after a recall due to glass found in cereal. Their program was a success, which led to the 1974 adoption of principles by FDA canned goods inspectors. The protocols gained wider traction in the 1990s after a series of E coli outbreaks in meat.
In August 1997, modern HACCP principles were born. An advisory group known as The National Advisory Committee on Microbiological Criteria for Food established seven principles within Hazard Analysis Critical Control Point to ensure food safety from harvest through and including consumption.
Regulatory adoption of the programs spread after that because the process provided a robust, preventative framework for food safety. Under 9 CFR 417 (for the USDA) and 21 CFR 120 (for the FDA, programs are required for riskier food products, including meat, juice, and seafood.
With the passing of the Food Safety Modernization Act of 2011, nearly all facilities that manufacture, process, pack, distribute, receive, hold, or import food must conduct Hazard Analysis and Risk-Based Preventative Control (HARPC), an approach that borrows heavily from the concepts.
Steps to Create an HACCP Plan
The seven principles of HACCP include:
- Conducting a Hazard Analysis
- Determining Critical Control Points
- Establishing Critical Limits
- Establishing Monitoring Procedures
- Establishing Corrective Actions
- Establishing Recordkeeping and Documentation Procedures
- Establishing Verification Procedures
These principles can also be viewed as different steps in the process since it makes sense to work through them in order.
So, what is the first step?
Principle 1: Conduct A Hazard Analysis
The first step in preventing any food safety hazard is to identify where and how a hazard might crop up. The analysis is most effective when it's conducted by someone with extensive experience.
For a thorough hazard analysis, you need to start by documenting all the processes, equipment, and ingredients that go into your operation. That will help you determine all the ways that food could become contaminated.
Hazards include any agent that can cause injury or illness to the consumer. They can be biological (like bacteria), physical (like broken glass), or chemical (like heavy metals).
Next, you assess the potential severity and likelihood of each hazard and document your team's reasoning in detail. Any significant hazards will need a control plan.
You can't just base your hazard analysis on how things are "supposed to work." You need to confirm that your understanding of all the steps matches what actually happens on the ground.
Principle 2: Determine Critical Control Points (CCP)
Next, you'll identify potential control measures and the most effective time to apply them.
A critical control point (CCP) is a point in your process where you can apply a safety measure to prevent, eliminate, or reduce the hazard to an acceptable level. Often, a decision tree is used to pinpoint the best CCPs.
Some operational stages commonly serve as critical control points. For example, choosing reputable suppliers and certifying deliveries can reduce the likelihood of many different hazards. Any point in food processing that involves a change in temperature is critical for biological hazards.
The control measure you'll apply at a particular CCP varies based on the hazard you're targeting. For example, time and temperature control, pasteurization, and acid rinses are useful for biological contaminants. For chemical contaminants, you might test ingredients for residue and store cleaning products separately from food. Testing, metal detection, pest control, and enforcing employee hygiene on the production floor can prevent or eliminate physical contaminants.
The number of critical control points any single operation needs will vary. In some cases, a single CCP may control multiple hazards. In other cases, a single hazard may need multiple CCPs.
Principle 3: Establish Critical Limits
For each CCP, you need to set at least one critical limit (CL) – a reliably measurable minimum or maximum value to which some parameter is controlled.
This could be the temperature above or below which food is held or the maximum amount of a contaminant that will be safe to the consumer.
The chosen value needs to be one that leads to the prevention, elimination, or reduction of the hazard to an acceptable level. It may be determined by regulatory guidelines, expert opinions, or in-house research.
Principle 4: Establish Monitoring Procedures
Critical control points and critical limits mean nothing if you don't monitor values regularly and ensure they remain within safe limits. Devising a system for measuring and recording values is essential to the success of an HACCP program.
If at all possible, you want a continuous method of measurement. When continuous monitoring isn't feasible, you need to check critical limits often enough to ensure control. Ideally, monitoring will allow corrective action to happen before critical limits are violated to prevent waste.
Monitoring procedures need to include:
- What instruments to use
- How to take the measurement
- How often to measure during production
- Who will be responsible for the measurement
- What value should trigger corrective action
- How monitoring will be documented
- Who will supervise monitoring to ensure compliance
If the measurements and monitoring are conducted through automation, you also need to decide how often a manual measurement or calibration should be performed to ensure the sensors are working correctly.
Principle 5: Establish Corrective Actions
For each CCP, you need predetermined, written plans for how to deal with any deviation from critical limits. This is known as a corrective action plan.
Any corrective action plan should include both immediate corrective actions and preventative corrective actions.
An immediate corrective action fixes the problem and prevents potentially hazardous food from entering the supply chain. For example, you might need to turn away a delivery if the temperature is in question. You might need to throw out food if a refrigeration unit is down for four hours or more.
Sometimes fixing the problem and diverting unsafe food are separate steps. If a faulty piece of equipment causes a batch of unsafe food, you may need to dispose of the existing product and fix the equipment before production resumes. Both corrective actions would be "immediate."
Preventative corrective actions focus on identifying the root cause of the deviation and taking steps to keep it from happening again. Sometimes this might mean revising HACCP procedures altogether.
Principle 6: Establish Recordkeeping and Documentation Procedures
As a wise man once said, "It isn't science unless you write it down." The same is true of regulatory compliance.
Keeping comprehensive records allows you to:
- Ensure and verify employee compliance with protocols
- Prove how a food product was produced safely to a regulatory body
- analyze which CCPs cause problems and improve your system
There are three main categories of documentation you should maintain under HACCP protocol.
First, you've got high-level prescriptive HACCP documents. This includes any of the documents we mentioned above: the hazard analysis, CCP and CL justifications, monitoring procedures, and corrective action plans. This big-picture category will also include things like HACCP team procedures and profiles, product descriptions, flow diagrams, and more.
These should be comprehensive living documents that are updated as adjustments to HACCP protocol are made.
Next, you've got day-to-day documentation of how protocols are executed. Any kind of operational record that guides employee compliance and/or logs a specific compliance event is included here: job-specific sign-off sheets, CL logs, training records, reports on corrective action events, and more.
These should be designed to discourage shortcuts in compliance, something made much easier by technology. For example, you can use systems that record the real-time and location of various sign-offs to ensure they're not retroactively filled in at once.
Regulatory agencies often require you to keep daily records for a specific period of time.
Finally, you need documentation about your documentation. This includes procedures for documenting events, like the required pieces of information, who is responsible for creating each type of record, and how promptly documentation must be done. You also need record-keeping procedures, like how long each type of record should be kept, where and how, who has access to records, and who is responsible for maintenance.
Principle 7: Establish Verification Procedures
Finally, once protocols are in use, you need to validate their effectiveness to make sure they're being followed, preventing the identified hazards, and being updated and maintained. Naturally, verification procedures and events should also be documented.
You should consider three different types or timelines for verification:
- Initial validation, to ensure your HACCP plan does what it's intended to do
- Ongoing or regular verification, to ensure the plan is being executed as intended
- Periodic reassessment, to determine if any changes are needed to make the plan more effective
Written verification procedures should specify how and when each type of verification should occur.
The verification protocol will depend on what you're validating at any given time. Verifying the effectiveness of Hazard Analysis Critical Control Point protocol might involve testing the final product to ensure it's within critical limits. Checking that everyone complies with the plan might require a series of different auditing and inspection techniques, from top to bottom. Reassessment might involve reviewing corrective action reports and operational records for certain patterns, as well as soliciting employee feedback.
How Do You Develop Your Own HACCP Plan?
Your Own Plan is the documentation of everything related to the Hazard Analysis Critical Control Point's system you're developing. As you go through the development process, you'll document the how or why of your decisions, as well as the guidelines themselves.
You can find plenty of templates out there to help you write your own plan. You may get templates for free from government agencies or non-governmental organizations (NGOs), but you can also purchase them from a vendor for your convenience.
You can find worksheet-like templates that separate each product, hazard, critical control point, or monitoring process, and these can be helpful for developing your plan and documenting your decision-making process. They can also act as instructions for implementation.
Other templates look more like master lists – for example, tables with every hazard you'll control and how. These can serve as convenient overviews and summaries once all the work is done.
It can be helpful to dig up examples for your type of business. That way, you can see what the finished product can look like and work from there.
Complete Your Prerequisite Programs
Before you can create a Hazard Analysis Critical Control Point system, you need existing procedures in place that address food safety. The FDA calls these "prerequisite programs," and they provide blanket protection in your facility to control bacterial growth, food contamination, and equipment maintenance.
HACCP Plan example prerequisite programs include:
- Vendor certification programs
- Worker training programs
- Cross-contamination prevention
- Food handling hygiene
- Allergen management
- Time-temperature Control for Safety (TCS)
- First-In-First-Out (FIFO) procedures
- Pest control
- Preventative equipment maintenance
- Waste disposal
These are just a few of the Standard Operating Procedures (SOPs) that count as prerequisites.
Gather Your Team
Your HACCP Team is responsible for developing, implementing, and maintaining your system.
The size and composition of your team will depend on the nature and size of your operation. A small business may only need a single Hazard Analysis Critical Control Point point person. In multi-department establishments, like large grocery stores, you'll need a whole team.
The team as a whole needs to have a comprehensive familiarity with your products, processes, and existing food safety programs. When building your team, you'll need as many individuals as necessary to cover all those bases. Additionally, you may need to bring in outside expertise.
Document the team's names and roles in your Plan and keep the list up to date as participants change.
Team members will need to complete an in-depth course on HACCP, if they haven't already, to arm them with the right tools.
Identify Products, Foods, and Processes to Cover
Next, you'll create a complete list of all products and processes that need to be covered under a Plan.
Some state or local food codes require a Hazard Analysis Critical Control Point under specific circumstances, especially for facilities that serve a Highly Susceptible Population. In other locations, it's just recommended.
Situations that may call for HACCP Plans in a retail food establishment include on-site processes to preserve TCS food (like smoking, curing, or fermenting) or preparation methods like reduced-oxygen packaging, sous vide, or cook-chill.
Create a List of Ingredients, Materials, Equipment, and Recipes/Formulas
For each product or process that needs a Hazard Analysis Critical Control Point Plan, you'll create a comprehensive list of everything you require: ingredients, materials, and equipment.
Stock forms can be very helpful for this step.
Develop a Process Flow Diagram
For every product that requires HACCP, you need to document all the steps in the production process, from receiving to sale or service. Make sure you include any routine variations and related side processes.
The FDA's website has a simple example of a process flow diagram. You can also find more complex example HACCP diagrams online.
Verify the Process Flow Diagram
This sounds scary, but it's not – verifying your diagram just means walking through the actual process and comparing it to the documented flow to find any missing steps or changes.
It's helpful to have someone who routinely performs the process help with verification. Better yet, make it someone who's not part of your Team.
Perform a Hazard Analysis
You'll base your hazard analysis on your process flow diagram(s). That's why accuracy is so important.
A hazard analysis generally has three stages: identification, evaluation, and finding preventative measures. First, you identify all food safety hazards that may be introduced or increased at each step in your flow diagram. Next, you evaluate how likely it is that each hazard on the list may occur.
For every hazard that is at least "reasonably likely to occur," you'll need to research the appropriate preventative measures to control that hazard.
The FDA provides a helpful list of example questions to ask during the hazard analysis. They also provide an HACCP Plan example for how to document this step.
Identify Critical Control Points
Next, you'll find a critical control point (CCP) at which you can prevent, eliminate, or reduce each hazard to an acceptable level. Some CCPs can be useful for multiple hazards.
The FDA provides examples of decision trees for identifying each Critical Control Point.
Set Critical Limits for Each CCP
Next, you'll set specific values that must be achieved at the CCP to mitigate the risk – these are called critical limits. Common plan examples for critical limits include bringing food to a specific temperature for a specific time to destroy bacteria or bringing food to a certain pH to limit microbial growth.
For each CCP, your Plan template should identify the process or product and the step that represents the CCP, then describe the specific critical limit and identify your source. You need to base all critical limits on reliable sources of information like regulatory requirements, scientific literature, or expert consultation.
Identify Monitoring Procedures for Each CCP
Someone needs to make sure your critical limits are met, and this step helps you plan how that will happen. For each CCP, you need to describe who, what, when, and how the limit will be monitored. "Who" is generally a role, rather than a name. The "what" is your critical limit and any acceptable variation. "When" describes whether the monitoring is continuous (ie, constant) or non-continuous (ie, periodic). If the monitoring is non-continuous, what's the frequency and the acceptable variation (for example, within 5 minutes of prescribed time)? Finally, the "how" covers the type of measuring tool and exactly how to take the measurement for consistency.
Your HACCP Plan template for each monitoring procedure will identify the process/product, the CCP, and the complete description of the monitoring procedure. Be specific.
Define Corrective Actions for Each CCP
Finally, you need to decide what to do when you fail to meet a critical limit – this is called corrective action.
Any deviation from a critical limit will require multiple actions to make things right, including:
- Finding and fixing the source of the deviation
- Demonstrating that the CCP is once again within critical limits
- Preventing the source of this deviation from reoccurring
- Making sure no hazardous food gets to consumers (via recall, discarding, holding for evaluation, or using another process to eliminate the hazard)
- Documenting the corrective actions
In addition to corrective action plans for anticipated deviations, you need a plan for hazards you don't expect, so that customers can be protected and Hazard Analysis Critical Control Point protocols can be created to address the problem.
The HACCP Plan template for corrective action should include the problem (which critical limit was exceeded), how the deviated product should be handled, all corrective action steps, compliance procedures that need to be followed, and who is responsible for performing the corrective actions.
Plan for Maintenance
The last two principles of the process involve establishing recordkeeping, documentation, and verification procedures. You need forms for logging critical limits, reports, and filing requirements for corrective actions, and a plan for validating and auditing your system once it's up and running.
Dive Deeper into Hazard Analysis Critical Control Point Plans
It's nearly impossible to get everything you need for building your own plan from a few online articles. That's why we offer a 16-hour Food Safety Hazard Analysis Critical Control Point For Retail Establishments course to help you get started. It's also online – and self-paced – so you can learn on your own schedule.
The course complies with the FDA Code and the USDA requirements for school district HACCP Plan Implementation. We'll cover hazard identification, risk assessment, and control measures in-depth. By the end of the course, you'll know how to write and implement a Food Safety Management Plan that provides an Appropriate Level of Protection for Consumers. Get started now!
