HACCP hazard analysis and the CCP decision tree: a worked example

What does HACCP hazard analysis involve?

Hazard analysis is the sixth of the twelve Codex steps and the first of the seven principles. It starts only once the team is assembled, the product and its intended use are described, and the flow diagram has been walked on the floor and corrected; those preliminary steps are covered in HACCP requirements explained: the twelve steps.

The work has three parts, and each leaves a trace on the worksheet:

• List the hazards that could reasonably be introduced, increased or left uncontrolled at every step, as biological, chemical and physical.
• Analyse which of them are significant, recording why each was kept or set aside.
• Control each significant hazard by naming the measure that deals with it, at that step or another.

Hazards that the good hygiene practices keep in check still appear on the worksheet, with the practice named as the control; those practices are explained in Prerequisite programmes and good hygiene practices.

How is a hazard judged significant?

The judgement that matters is which hazards need a dedicated control, explained so an auditor can follow it. In our projects we ask the team to answer three things for each hazard at each step:

• How likely is it at this step, given the raw material, the equipment and the site's own history?
• How serious would the harm be, bearing in mind the intended consumers in the product description?
• Is it already held at a safe level by a hygiene practice that is working, or does it need more?

A hazard that is unlikely and minor is set aside with its reason; one that is likely, severe or both moves on to the decision tree. A column of ticks does not work: "not significant" with no reason looks exactly like a hazard nobody considered.

How does the CCP decision tree work?

Principle 2 asks the team to determine the steps where control is essential to prevent, eliminate or reduce a significant hazard to an acceptable level. Annex IV, added in 2022, supplies a decision tree and matching worksheet so that every hazard is taken through the same questions and the answer is written beside it.

The questions below are Sterling's working version, written to follow the Principle 2 definition; your own worksheet should use the wording of Annex IV itself. Ask them for one significant hazard at one step at a time.

1. Is the hazard significant here? If not, it stays under the hygiene practices, with the reason recorded.
2. Is there a control measure for it at this step? If not, and safety depends on control here, the process has to change before the plan goes further.
3. Would the hazard reach an unacceptable level if this step failed, with no later step to remove or reduce it? If a later step does that job, examine that step instead.
4. Can control here be set against a limit and checked in time to act on the product? If yes, the step is a CCP; if not, the control needs redesign.

Write each answer on the worksheet, so that when the process changes you can see which decisions to reopen.

Worked example: a hot-filled tomato sauce in glass jars

This example is illustrative, not a model plan for any real product. Fresh tomatoes and vegetables are cooked, filled hot into glass jars, capped, pasteurised in the jar, cooled, labelled and stored at ambient temperature. The same line also runs a pesto containing nuts.

The labelling row is a judgement call: a team with more products sharing the line could reasonably make the label check a CCP. Either answer stands if the reasoning is recorded.

From CCP to critical limit, monitoring and corrective action

Principles 3 to 5 then ask for a validated critical limit at each CCP, a way of monitoring it and the action to take on a deviation. Every figure in this table is an example value showing the shape of an entry, not a regulatory limit.

A real plan sets each limit from a validation study, a regulatory value or a recognised reference that applies to this product and equipment, and keeps that evidence with the limit. The current Codex text requires validated critical limits and a validated plan before verification is set up; a figure lifted from a template meets neither. Checking the finished plan is covered in HACCP internal audit and verification: what to check.

What records should the hazard analysis leave behind?

An auditor reads the analysis as a chain, from flow diagram to monitoring record, and a break anywhere becomes a finding. The set we build with clients holds:

• the confirmed flow diagram, dated and signed after the walk-through;
• a worksheet row for every hazard at every step, with its reason;
• the decision-tree answers for each significant hazard, on the Annex IV worksheet or an equivalent;
• the validation evidence behind each critical limit;
• a review log showing when the analysis was reopened and why.

Common mistakes in hazard analysis and CCP decisions

• A CCP at every step. Monitoring spreads so thin that the steps that matter get no more attention than the rest.
• Weak hygiene practices. Hazards that cleaning, pest control or supplier control should hold are pushed on to CCPs never designed to carry them.
• A borrowed worksheet. It describes another plant's equipment and materials, and operators cannot explain it.
• Answers without reasons. A bare "no" in the tree cannot be reviewed when the process changes.
• A frozen analysis. The recipe, supplier or line changed and the worksheet did not.

HACCP hazard analysis and the CCP decision tree: questions buyers ask