| |
| Process Notes |
Issue #002 · Weekly |
|
| Food Safety |
|
HACCP |
|
Audit-Ready |
|
|
HACCP Demystified
How to Build a Food Safety Plan That Actually Works — Without Drowning in Paperwork
|
| |
|
Every food safety article on the internet tells you the same thing: “HACCP has 7 principles. Here they are. Good luck.”
That’s not a guide. That’s a Wikipedia summary with a logo on it.
I’ve written HACCP plans for production lines that run 20 hours a day. I’ve sat through audits where the auditor flipped to page 3, found a gap, and the conversation got very uncomfortable, very fast. And I’ve inherited “HACCP plans” that were really just a hazard analysis table copy-pasted from a textbook with the company name swapped in.
This issue is the guide I wish someone had handed me the first time I was told: “You’re in charge of the HACCP plan now.”
|
|
The Real Problem
Most HACCP Plans Fail for the Same Boring Reason
It’s not the science. The 7 principles aren’t hard to understand. Conduct a hazard analysis. Identify your CCPs. Set critical limits. Monitor them. Fix deviations. Verify the system. Keep records. You can learn those in an afternoon.
The reason most plans fail — and I mean actually fail, as in: they exist on a shelf, they technically tick a box, but they would collapse under the weight of a real audit or a real incident — is that nobody connects the plan to the production floor.
The plan says one thing. The line operator does another. The monitoring log has gaps from last Thursday that nobody noticed until the QA manager scrambled to fill them in on Monday morning. Sound familiar?
|
|
⚡ The 3 Ways HACCP Plans Actually Fail
1. The Copy-Paste Plan — Lifted from a textbook or a previous employer. Looks professional. Doesn’t match your actual process flow, ingredients, or equipment.
2. The Paper Tiger — Written by an external consultant, signed off by management, then filed away. The production team has never read it. It passes a desktop review but fails the floor walk.
3. The Everything Plan — 40+ CCPs because nobody was brave enough to say “that’s actually a prerequisite programme, not a CCP.” Impossible to monitor. Guaranteed to generate incomplete records.
|
|
|
The Framework
The 7 Principles, the Way I’d Explain Them to a New Colleague
Forget the textbook definitions for a moment. Here’s what each principle actually means when you’re standing on a production floor, responsible for making sure nothing goes wrong:
|
|
|
Hazard Analysis — “What can actually go wrong here?”
Walk every single step of your process — receiving, storage, prep, processing, packaging, dispatch — and for each one, ask: what biological, chemical, or physical hazard could realistically show up? Not theoretically. Realistically, given your ingredients, equipment, and environment. This is where 90% of HACCP plans either succeed or quietly fall apart.
|
|
|
|
Identify CCPs — “Where’s the last line of defence?”
A CCP is the point in your process where, if you lose control, no downstream step will fix it. Cooking is the classic example — if your thermal kill step fails, packaging won’t save you. Most facilities have 2–5 true CCPs. If you’ve got 15, you’re confusing CCPs with prerequisite programmes (PRPs) and operational PRPs (OPRPs). That distinction matters enormously during audits.
|
|
|
|
Critical Limits — “What’s the number that separates safe from unsafe?”
A critical limit must be measurable. Not “hot enough” — 74°C internal temperature for 15 seconds. Not “metal-free” — no ferrous particles >1.5mm detected by in-line metal detector. Vague limits are the single fastest way to get flagged in an audit. Every CCP needs a number, a unit, and a science-based justification on file.
|
|
|
|
Monitoring — “Who checks, how often, and what do they write down?”
This is where the plan meets reality. If your line operator doesn’t know they’re supposed to log a temperature every 30 minutes — or doesn’t have the right thermometer — your plan is fiction. Monitoring must answer four questions: what is measured, how, how often, and by whom. Frequency should be based on risk, not convenience.
|
|
|
|
Corrective Actions — “The oven dropped below 74°C. Now what?”
Deviations will happen. The question is whether you have a pre-planned, documented response or whether your shift supervisor is calling the QA manager in a panic at 2am. Corrective actions must cover three things: what happens to the affected product (hold, rework, destroy), how the CCP is brought back under control, and what investigation follows to prevent recurrence.
|
|
|
|
Verification — “Is this system actually doing what we think it’s doing?”
Monitoring tells you the CCP was in control today. Verification asks the bigger question: is the entire HACCP system still valid? This means calibrating equipment, reviewing monitoring records for trends, running internal audits, and — critically — revalidating the plan whenever you change an ingredient, a process step, or a piece of equipment. Under FDA’s FSMA framework, reanalysis is required at minimum every 3 years.
|
|
|
|
Record-Keeping — “If it isn’t written down, it didn’t happen.”
This one sounds simple. It’s the principle most likely to sink you. Incomplete monitoring logs, unsigned corrective action forms, missing calibration certificates — these are the bread and butter of audit non-conformances. Your documentation system should be designed so that completing records correctly is easier than skipping them.
|
|
|
|
From the Audit Floor
5 Audit Landmines I’ve Seen Blow Up in Real Facilities
Every HACCP article lists “common mistakes.” These aren’t common mistakes — these are the specific findings I’ve seen derail audits and delay certifications in facilities I’ve worked with:
|
|
⚠ The process flow diagram doesn’t match the actual floor layout. The plan shows receiving → storage → prep → cook. But on the floor, there’s a rework loop after packaging that nobody documented. Auditors will walk the floor with your flow diagram in hand. Every mismatch is a finding.
|
|
⚠ Critical limits without scientific justification. You say the cooking CCP is 72°C for 2 minutes. Why? Where’s the reference? A challenge study? Published literature? Codex guidance? If you can’t produce the rationale, the limit is considered arbitrary. That’s a major non-conformance under BRC, SQF, and FSSC 22000.
|
|
⚠ Monitoring records with suspicious patterns. If every single temperature reading for 6 months is exactly 74.0°C, the auditor knows someone is writing down the target value instead of the actual reading. Real data has variation. Auditors look for it.
|
|
⚠ No evidence of HACCP team competency. Both the EU Commission Notice and FDA 21 CFR 117 require that your HACCP team includes at least one person with formal training. Not just “experience.” Documented, HACCP-specific training. Missing certificates = immediate non-conformance.
|
|
⚠ Corrective actions that stop at “product held and released after testing.” That’s product disposition, not a corrective action. Where’s the root cause analysis? The preventive action? The evidence that the same deviation didn’t happen again? Auditors want to see the full CAPA cycle — not just the firefighting.
|
|
|
🎁 Free Download
The HACCP Starter Checklist
Before you write a single page of your HACCP plan, you need to know if your foundation is solid. This one-page checklist covers the 12 prerequisites you should have in place before starting your hazard analysis — from supplier controls and sanitation SOPs to allergen management and training records.
It’s the scaled-down version of the full compliance checklist in the HACCP Template Pack (more on that below) — designed so you can print it, walk the floor, and know within 20 minutes whether you’re ready to build your plan or whether you’ve got gaps to close first.
|
|
|
The Structure
What a Real HACCP Plan Actually Looks Like
Forget 80-page documents that nobody reads. A HACCP plan that works in practice has a clear, layered structure that your production team can actually navigate. Here’s the anatomy of a plan that holds up under scrutiny:
|
| Section |
What It Contains |
| 1. Scope & Product Description |
What product, what process, what facility, who’s on the HACCP team, and who the intended consumer is. One page. |
| 2. Process Flow Diagram |
Visual map from raw material receiving to dispatch. Must be verified on the floor. Include rework loops, waste streams, and CCP locations marked. |
| 3. Hazard Analysis Table |
For each process step: identified hazard, type (B/C/P), likelihood × severity, control measure, and classification (CCP / OPRP / PRP). |
| 4. HACCP Control Chart |
The operational core: CCP number, hazard, critical limit, monitoring procedure, corrective action, verification method, and records reference. One row per CCP. |
| 5. Monitoring & CCP Logs |
Pre-designed log sheets for each CCP. Date, time, reading, operator initials, deviation (Y/N), corrective action taken. Designed so they take under 60 seconds to complete. |
| 6. Supporting Documents |
Validation evidence, corrective action reports, verification schedule, HACCP team training records, annual review minutes, and document control log. |
|
|
That’s it. Six sections. Every GFSI-benchmarked scheme (BRC, SQF, FSSC 22000, IFS) expects this structure — and so do EU and FDA inspectors. The difference between a plan that passes and one that doesn’t is almost always in the quality of sections 3 and 4.
|
|
|
★ The Process Notes HACCP Template Pack
Stop Building Your HACCP Plan from a Blank Page
I built this template pack from the HACCP plans I’ve written for real production environments — thermal processing, chilled ready meals, bakery, and beverage lines. It’s designed to give you a professional starting point you can adapt to your own facility, not a generic framework you’ll spend weeks trying to customise.
→ Complete Hazard Analysis Table (pre-populated with common food manufacturing hazards)
→ HACCP Control Chart template with worked examples
→ CCP Monitoring Log sheets (print-ready)
→ Corrective Action Report form with root cause analysis section
→ Full compliance checklist covering all 7 principles (EU & FDA dual-referenced)
→ Verification & Validation Schedule template
Works for EU (Commission Notice, Codex) and US (FSMA Preventive Controls, USDA-FSIS) regulatory frameworks. Editable in Excel and Word.
|
|
|
The Bottom Line
HACCP Isn’t Hard. Making It Work on the Floor Is.
The difference between a HACCP plan that passes audits and one that protects consumers isn’t complexity — it’s connection. Connection between the hazard analysis and what actually happens in your facility. Between the critical limits and the operator who checks them at 3am. Between the corrective action procedure and the shift supervisor who has to execute it under pressure.
Build your plan around your process, not around a template. Train your people on why, not just what. And design your records so that compliance is the path of least resistance, not a burden layered on top of an already demanding job.
|
|
|
📌 Coming up in Issue #003
How to Size a Heat Exchanger for Your Liquid Food
Plate or tubular? How do you calculate the heat transfer area you actually need? What happens when your product viscosity changes mid-run? Next week I’m walking through the engineering fundamentals of heat exchanger sizing for liquid food applications — from first principles to the spec sheet you hand to your equipment supplier.
|
|
|
One Quick Ask
Hit reply and tell me — have you ever inherited a HACCP plan that was completely disconnected from the actual process? What did you do?
I read every reply. Your answers shape what I cover next.
|
|
Thanks for being here. If this issue was useful, forward it to a colleague who’s building or revising a HACCP plan — it might save them a few painful audit findings.
See you next Tuesday.
Galvin Eyong
Food System Expert
Process Notes
processnotes.beehiiv.com
|
| |
|
Process Notes
Practical food engineering, delivered every Tuesday.
|
| |
