The 7 Principles of HACCP, Explained

Hazard Analysis and Critical Control Point, or HACCP, is the globally recognised backbone of food safety management. At its core are seven principles: a sequence of steps that together give you a structured, preventive way of controlling food safety hazards.

In Ireland and the UK this is not optional. Regulation (EC) 852/2004 requires every food business operator to put in place, implement and maintain a permanent procedure based on HACCP principles, and has done since January 2006. It applies whether you run a single café or a multi site production facility. It is enforced by the FSAI through the Environmental Health Service in Ireland, and by local authority Environmental Health Officers in the UK.

The scale of what you document varies with the size and nature of your business. The obligation does not. Here is why each principle matters.

Principle 1: Hazard analysis

A thorough hazard analysis is the vital first step that sets the foundation for the entire plan. It involves:

• Identifying potential biological, chemical, physical and allergenic hazards at each process step
• Evaluating the likelihood of each hazard occurring, and its severity
• Determining a preventive control measure for each hazard identified

Without a comprehensive hazard analysis, critical hazards get overlooked and never make it into the plan. A failure to recognise the hazard of metal fragments from degraded equipment, for instance, leads directly to foreign body contamination nobody was watching for.

Allergens deserve particular attention in Ireland and the UK, because undeclared allergens sit behind a large share of food withdrawals, and they are almost always a records failure rather than a hygiene one.

Principle 2: Critical control points

Once hazards are recognised, the next step is identifying the critical control points, meaning the steps in a process where a hazard must be controlled to assure food safety.

Determining a CCP comes down to two questions:

• Can control be applied at this step to eliminate the hazard or reduce it to an acceptable level?
• Will a lack of control here fail to prevent, eliminate or reduce the hazard?

Correct identification focuses your control measures where they are genuinely vital, which avoids wasting resources controlling hazards at steps where it is not essential.

Critical control points are where most HACCP plans succeed or fail, and telling a CCP from a prerequisite programme is the distinction auditors test hardest. Read the full guide to identifying and monitoring CCPs.

Principle 3: Critical limits

Critical limits are the defined parameters that indicate whether a CCP is under control. They are measurable, observable criteria that separate safe from unsafe.

Each CCP will have one or more critical limits set for factors such as temperature, time, moisture level, pH or water activity.

In practice, most Irish and UK food businesses work to limits like these:

Equivalent time and temperature combinations are acceptable for cooking where you can demonstrate the same lethality, such as 70°C for two minutes. Keep the validation with the plan.

Setting limits too loosely means hazards are not adequately controlled. Setting them too tightly wastes product and provokes alarm fatigue. Validation against your own process, rather than a template default, is what makes a limit defensible.

Principle 4: Monitoring procedures

Once critical limits are set, monitoring procedures establish whether CCPs are staying within those limits during production. Monitoring enables rapid detection of deviations, so corrective action can be taken before unsafe product results.

A monitoring procedure specifies:

• What is measured, such as time, temperature or moisture level
• How often, at a frequency that will catch a loss of control quickly
• Who does it, named and trained rather than left to whoever is on shift
• What equipment and records are used

Temperature is the control point most often failed, because manual checks at open and close say nothing about the hours between them. See how continuous monitoring closes that gap.

Principle 5: Corrective actions

When monitoring shows that a CCP has deviated from its critical limit, pre planned corrective actions must restore control. HACCP requires documenting corrective actions that include:

• Identifying and isolating affected product
• Bringing the CCP back within its critical limit, by adjusting cooking time or temperature for example
• Disposing of contaminated product and ingredients
• Increasing monitoring frequency after the deviation
• Recording the incident and the actions taken

A corrective action recorded hours later is the half auditors ask about. See how the app prompts it at the point of breach.

Principle 6: Verification

Verification provides the evidence that the HACCP system is working as intended. If you are certified against a scheme, this is also where the external audit sits. See what BRCGS Issue 9 requires. Methods include:

• Plan review, meaning periodic in depth review of hazard analysis, CCPs, critical limits and procedures
• Third party audits by consultants, customers or certification bodies
• Calibration of measuring and monitoring equipment
• Product testing for microbiological, chemical and physical hazards
• Record review, checking completeness, accuracy and frequency

Without verification, even a well designed system fails over time. Verification is what turns a plan on a shelf into a system that works.

Principle 7: Record keeping

Comprehensive record keeping provides documented proof that HACCP procedures were performed as required. Records include:

• The hazard analysis
• CCP determinations and the reasoning behind them
• Critical limit validation
• Equipment calibration and maintenance
• Monitoring data and deviations
• Corrective action records
• Verification reports and audits
• Plan revision history

Records must be accurate, dated and attributable to a named person. There is no requirement for them to be on paper. See how digital check sheets meet those tests.

The whole is greater than the sum of its parts

Each principle has an important individual purpose, but it is the integration of all seven, in sequence, that produces robust control.

The hazard analysis provides the foundational knowledge. CCPs, critical limits and monitoring build layers of preventive control on top of it. Corrective actions, verification and record keeping reinforce a culture of food safety and prove that the system ran.

Frequently asked questions