The HACCP certification process, step by step

Who does what in HACCP certification

Four parties have a role, and confusing them causes most bad HACCP purchases. The food business owns the hazards, the plan and the records. A consultancy such as Sterling helps build the system and prepare for the audit, but cannot audit it for certification or issue anything. The certification body audits the system and decides whether a certificate is granted. Where the certificate is accredited, an accreditation body has assessed the certification body for that activity; recognition between accreditation bodies now runs through the Global ACI arrangement, which took over from the IAF MLA and the ILAC MRA in January 2026.

The method comes from the Codex General Principles of Food Hygiene, CXC 1-1969, but Codex publishes recommendations for governments; it runs no scheme and issues no certificate. That is why the first question in any HACCP project is not "when is the audit?" but "which document will the certificate name, and who will issue it?".

Steps 1 to 5: the work your team does

Step 1: fix the scope and the target document

List the products, lines, sites and shifts the certificate must cover, and write down who is asking for it. A buyer may name a particular scheme, accept only an accredited certificate, or want ISO 22000 or FSSC 22000 instead, a choice our comparison guide covers. Confirm the target with the customer in writing before any other work starts.

Step 2: gap analysis

Sterling's gap analysis walks the plant and reads the paperwork against the Codex text and the scheme the certificate will name: premises and zoning, cleaning and pest control, food handler training, supplier controls, any HACCP plan that already exists and the records behind it. The result is an agreed list of actions with owners and dates, and a realistic month for the certification audit.

Step 3: hygiene practices and the HACCP study

The good hygiene practices go in first, because a plan resting on weak cleaning or poor segregation ends up with too many CCPs. The HACCP team then works the Codex sequence from product description to records, validating each critical limit on the way; our twelve-steps guide and the worked hazard-analysis guide cover that detail.

Step 4: produce under the plan

An auditor judges the system by real production days: monitoring entries made at the time, deviations and the product decisions that followed, calibrated probes and detectors. Certification bodies commonly set a minimum period of operation before they will audit, so this step cannot be compressed by effort alone.

Step 5: verification and internal audit

Before the certification body arrives, the team should have verified the plan (record reviews, calibration checks, any testing the plan calls for) and run an internal audit covering both the HACCP plan and the hygiene practices, with findings closed. Our HACCP internal audit and verification guide covers what to check.

Step 6: choose the certification body and the document

HACCP certification is less uniform than ISO management system certification, so ask five questions. Which HACCP document will the certificate state, and in which edition? Is the certificate issued under accreditation, by which accreditation body, and does that body's own directory list the certification body for this activity? Will your customer accept that combination? How many audit days are planned, for which sites and HACCP studies, and is the certification audit one visit or two? What are the surveillance and recertification arrangements?

Apply while implementation is under way, since auditors are booked weeks ahead. A HACCP certificate on its own is not a GFSI-recognised certification; if the buyer's contract names a GFSI scheme, settle that before signing anything.

Steps 7 and 8: the certification body's assessment

The assessment normally opens with a readiness review of the documented system: the scope, the product descriptions and flow diagrams, the hazard analysis, the HACCP plan and the prerequisite programmes. It may be an on-site first visit or a remote document review.

The certification audit itself happens on the production floor. Expect the auditor to walk the flow diagram against the line, question operators at each CCP, pull records for sampled dates, check calibration and test the hygiene practices around the CCPs. Findings are presented at the closing meeting, graded under the certification body's own rules.

Steps 9 and 10: closing findings and the certification decision

For each finding, the business sends a correction, the cause and the corrective action, within the period the certification body sets. Serious findings at a CCP, such as a limit with no validation behind it or monitoring that did not happen, are usually verified before any decision, sometimes by a return visit.

The certification body then decides, using the audit report and the closure evidence. The certificate names the business, the sites, the products or processes covered, the HACCP document, the dates and, where it applies, the accreditation mark. Check the draft scope against what your customer needs before it is issued.

Steps 11 and 12: surveillance and recertification

The cycle certification bodies commonly run is three years: a surveillance audit in each of the first two years and a recertification audit before the certificate expires, although the scheme being certified against sets the exact terms. Surveillance samples the system and goes straight to change: new products, equipment, recipes or suppliers, complaints and recalls, and whether the plan was reassessed. Report changes to sites, products or the legal entity in advance.

A HACCP system decays quietly: records drift to the end of the shift and a new line runs under the old flow diagram. Keeping verification, internal audit and plan review on a calendar makes surveillance routine, and is the work Sterling's Sustain™ phase supports.

How long HACCP certification takes

Most food businesses complete steps 1 to 5 in 3 to 6 months: nearer three where hygiene practices already hold and the products share one process flow, nearer six where the premises need works or several HACCP studies are required. Add the certification body's lead time and a few weeks to close findings. The cost drivers behind each stage are set out in our HACCP cost guide. An offer of a HACCP certificate in a few days, with no visit to the production floor, is not describing a certification audit.

HACCP certification process: questions buyers ask