HACCP requirements explained: the 12 steps and seven principles of Codex HACCP

Where the HACCP requirements come from

There is no ISO number for HACCP. The method is defined by the Codex Alimentarius Commission, the joint FAO and WHO body, in the General Principles of Food Hygiene, CXC 1-1969. The current version is the 2020 rewrite as revised in 2022. Certification bodies audit against it directly or against a national HACCP standard built on it; food hygiene law, such as EU Regulation (EC) No 852/2004, builds on the same principles.

The document has two chapters. Chapter One sets out good hygiene practices; Chapter Two describes the HACCP system and how to apply it. Chapter Two states the seven principles, then turns them into twelve successive steps, shown as a logic sequence in Annex II. That sequence is what most people mean when they ask about the HACCP 12 steps:

The step names are plain-language summaries of the Codex sequence; your documents need not copy its wording, as long as each step can be traced.

Steps 1 to 5: the preliminary steps

The first five steps produce no CCPs, yet the hazard analysis is only as good as the process description they create.

Step 1: the HACCP team

The team needs people who know the product, the process, the equipment, hygiene and the relevant hazards. The Codex text itself acknowledges that small businesses do not always have that expertise on site, which is where external support usually comes in. The team also fixes which products and lines the plan covers.

Steps 2 and 3: product and intended use

The product description records what affects safety: ingredients, properties such as pH or water activity, treatments, packaging, shelf life, storage and distribution. Intended use states whether the food is eaten as sold or cooked first, and whether infants, elderly people or other vulnerable groups are among the consumers.

Steps 4 and 5: the flow diagram and its confirmation

The flow diagram shows every step in sequence, with raw materials and packaging entering, rework loops, by-products and waste leaving. The team then checks it against the real operation. Auditors frequently open with this step: a diagram that misses a holding stage or a rework route means the hazard analysis never considered it.

Steps 6 and 7: hazard analysis and critical control points

Principle 1 asks the team to "conduct a hazard analysis and identify control measures". At each step on the confirmed diagram, the team lists the biological, chemical and physical hazards that could arise there, including allergens. It then judges which hazards are significant, weighing how likely they are and how severe the effect would be, and names the measures that control them. Hazards that good hygiene practices already control should be recorded as such, not pushed into the plan.

Principle 2 asks the team to "determine the critical control points (CCPs)": the steps where control is essential to prevent or eliminate a significant hazard or reduce it to an acceptable level. The 2022 revision added Annex IV, which provides a decision tree and a CCP determination worksheet as tools for this decision.

The detail of scoring hazards and working the decision tree is the subject of its own guide.

Hazard analysis and the CCP decision tree: a worked example

Steps 8 to 10: critical limits, monitoring and corrective action

Principle 3 now reads "establish validated critical limits". A critical limit separates acceptable from unacceptable product at a CCP and has to be measurable during production: a core temperature held for a time, a pH value, a water activity, a detector sensitivity for a stated test piece. Validation means evidence that meeting the limit actually controls the hazard.

Principle 4 asks for "a system to monitor control of CCPs". The procedure states the measurement, the method, the frequency and the person responsible, and in practice it has to reveal a loss of control early enough to act before product is released.

Principle 5 asks for corrective actions to be established in advance for each CCP, to be applied "when monitoring indicates a deviation from a critical limit at a CCP has occurred". A sound procedure restores control, holds the affected product, has an authorised person decide its disposition, and records it all.

Steps 11 and 12: validation, verification and records

Principle 6 is to "validate the HACCP plan and then establish procedures for verification to confirm that the HACCP system is working as intended". The two activities answer different questions. Validation asks, before the plan is relied on, whether the control measures and limits are capable of controlling the hazards. Verification asks, once the plan runs, whether it is being followed and is still effective: review of monitoring and deviation records, calibration, sampling and testing, internal audit, and review of the plan after a change of product, supplier, equipment or process.

Principle 7 asks for documentation of all procedures and records appropriate to the principles and their application. In practice that means the plan and the studies behind it, plus monitoring, deviation, verification and change records.

HACCP internal audit and verification: what to check

What the 2020 and 2022 revisions changed

Plans written to the 1997 text keep the same twelve steps, but two principles were reworded:

The current text also calls a positive food safety culture fundamental to any food hygiene system, recognising the importance of human behaviour, and it treats prerequisite programmes, including good hygiene practices, as the foundation for an effective HACCP system.

Prerequisite programmes and good hygiene practices

HACCP requirements: questions buyers ask