HACCP is built on 7 principles, but implementation requires 12 steps. The first 5 are preparatory tasks that must be completed before any of the 7 principles can be applied, and skipping them is one of the most common reasons HACCP plans fail to reflect how a business actually operates.
Most explanations of HACCP focus on the 7 principles because they are the technical core of the system. The 5 preliminary steps receive less attention despite being the foundation that determines whether the principles produce an accurate, workable plan or a document that exists on paper but does not match production reality. This guide explains all 12 steps in sequence, covering what each one requires and why it matters in practice.
What Are the 12 Steps of HACCP?
The 12 steps of HACCP are a structured sequence for developing and implementing a HACCP plan. They are drawn from Codex Alimentarius guidelines and form the basis for most national and international food safety systems that build on HACCP principles.
The first 5 steps are preliminary tasks: assembling the HACCP team, describing the product, identifying the intended use, constructing a flow diagram, and confirming the flow diagram on site. The remaining 7 steps correspond directly to the 7 HACCP principles: conducting a hazard analysis, identifying critical control points, establishing critical limits, establishing monitoring procedures, establishing corrective actions, establishing verification procedures, and establishing documentation and record-keeping.
Step 1: Assemble the HACCP Team
The first step of HACCP implementation is forming a multidisciplinary team with direct knowledge of the product, process, and facility being assessed. The team should include people with operational experience, technical food safety knowledge, and where relevant, expertise in microbiology, engineering, and quality management.
The HACCP team is responsible for all subsequent steps. A team that lacks genuine knowledge of how a process operates will produce a HACCP plan that describes an idealized version of the process rather than what actually happens. This is why team composition is a substantive step and not a formality.
Step 2: Describe the Product
The HACCP team produces a full description of the product being assessed, including its composition, physical and chemical properties, processing method, packaging, storage conditions, shelf life, and any relevant distribution information. Allergen content should be captured at this stage.
Product description matters because hazards and control measures are product-specific. A HACCP plan developed for one product cannot be assumed to apply to another without a separate description and analysis.
Step 3: Identify the Intended Use
The team identifies who will consume the product and how it will be prepared or used before consumption. This includes whether the product is intended for vulnerable populations such as infants, elderly people, or immunocompromised individuals, who may face higher risk from hazards that a healthy adult population tolerates more easily.
Intended use affects the risk level assigned to certain hazards and therefore the controls required to manage them.
Step 4: Construct a Flow Diagram
The team maps every step in the production or preparation process from raw material receipt through to distribution or service. The flow diagram covers all inputs, processing steps, storage conditions, and any points where product is held, transferred, or treated.
The flow diagram becomes the framework against which the hazard analysis is conducted. Every step on the diagram is examined for potential hazards in the analysis stage.
Step 5: Confirm the Flow Diagram On Site
The flow diagram is verified by walking through the actual process during normal operating hours and confirming that what was mapped on paper matches what happens in practice. Discrepancies between the documented flow and actual operations are corrected before the analysis proceeds.
This step is often skipped in practice, particularly when a HACCP plan is developed by an external consultant who produces the diagram remotely without visiting the site. A flow diagram that has not been confirmed on site frequently contains inaccuracies that undermine the entire analysis that follows.
Step 6: Conduct a Hazard Analysis (Principle 1)
The first HACCP principle is hazard analysis. For each step in the confirmed flow diagram, the team identifies all potential biological, chemical, and physical hazards that could occur. Biological hazards include pathogens such as Salmonella, Listeria, and E. coli. Chemical hazards include cleaning agents, pesticide residues, and allergens. Physical hazards include glass, metal, bone, and other foreign bodies.
Each identified hazard is assessed for its likelihood of occurring and the severity of its potential impact. Hazards that are significant for food safety are carried forward to the next step.
Step 7: Identify Critical Control Points (Principle 2)
A Critical Control Point is a step in the process at which a control measure can be applied to prevent, eliminate, or reduce a significant food safety hazard to an acceptable level. Not every process step is a CCP. HACCP teams use a decision tree to determine which steps qualify, asking whether the hazard at this step requires control, whether control exists here, and whether this is the last opportunity to control the hazard.
Common examples of CCPs include cooking steps where a minimum temperature eliminates pathogen risk, metal detection steps where foreign body contamination is identified before product leaves the facility, and chilling steps where temperature control prevents pathogen growth.
Step 8: Establish Critical Limits (Principle 3)
Each CCP must have a measurable critical limit, the boundary that separates acceptable from unacceptable. Critical limits must be science-based, which means derived from regulatory standards, published research, or validated operational data. A cooking CCP might have a critical limit of 75°C at the core of the product. A chilled storage CCP might have a critical limit of 5°C maximum.
Critical limits must be measurable so that monitoring can confirm whether a CCP is under control. A limit that cannot be measured cannot be monitored.
Step 9: Establish Monitoring Procedures (Principle 4)
Monitoring procedures define who checks each CCP, how it is checked, how often, and how the result is recorded. The monitoring system must be capable of detecting a loss of control at a CCP in time to take corrective action before an unsafe product reaches the consumer.
Continuous monitoring, where temperature sensors log readings automatically rather than relying on manual checks at intervals, provides stronger assurance than periodic manual monitoring. Equipment suppliers such as Adria Food Tech provide monitoring systems that generate automated, time-stamped records across cooking, chilling, and cold storage CCPs, which reduces both the burden of manual recording and the risk of monitoring gaps.
Step 10: Establish Corrective Actions (Principle 5)
A corrective action is the procedure followed when monitoring shows that a CCP is out of control, meaning a critical limit has been breached. Corrective actions must address two things: restoring control at the CCP, and deciding what to do with any product that was affected while the CCP was out of control.
Corrective actions must be pre-planned and documented. A team discovering a cooking temperature breach should not be deciding in real time what to do with the product. The response should already be defined in the HACCP plan.
Step 11: Establish Verification Procedures (Principle 6)
Verification is the activity of confirming that the HACCP system is working as intended. It is separate from monitoring. Monitoring checks whether a specific CCP is under control at a given moment. Verification checks whether the overall system is consistently effective.
Verification activities include reviewing monitoring records, calibrating monitoring equipment, auditing the HACCP plan against current operations, and periodically testing finished products to confirm that controls are producing safe outcomes.
Step 12: Establish Documentation and Record-Keeping (Principle 7)
The HACCP plan and all associated monitoring, corrective action, and verification records must be documented and maintained. Records provide the evidence that a HACCP system exists and is being followed. They are the primary evidence reviewed during food safety audits and regulatory inspections.
Records must be legible, dated, signed by the person making the entry, and retained for a period appropriate to the product’s shelf life and any applicable regulatory requirements.
Workforce training underpins the entire 12-step process. The HACCP team needs technical knowledge to conduct the analysis credibly, and the operational staff who perform monitoring and corrective actions need to understand what they are doing and why. Providers such as Confi Food deliver structured HACCP and food safety management training designed to build both the technical knowledge needed for plan development and the practical understanding required for day-to-day operation.
Common Gaps in HACCP Implementation
The most frequent implementation failures occur at the preliminary steps, particularly the failure to confirm the flow diagram on site, and at the monitoring stage, where records are incomplete, inconsistent, or produced retrospectively rather than in real time.
HACCP plans that were accurate when written but have not been updated following process changes are also a persistent issue. Any change to ingredients, suppliers, equipment, or process steps should trigger a review of the relevant sections of the HACCP plan.
Conclusion
The 12 steps of HACCP provide a structured path from initial preparation through to a documented, operational food safety management system. The 5 preliminary steps determine the accuracy of everything that follows, and the 7 principles provide the technical framework for controlling hazards once the groundwork is in place. Both halves of the sequence require the same discipline: accurate information, genuinely knowledgeable people, and consistent follow-through in daily operations.
Frequently Asked Questions
What are the 12 steps of HACCP?
The 12 steps of HACCP are the complete implementation sequence defined by Codex Alimentarius. The first 5 are preliminary tasks: assembling the HACCP team, describing the product, identifying the intended use, constructing a flow diagram, and confirming the flow diagram on site. The remaining 7 steps correspond to the 7 HACCP principles: hazard analysis, CCP identification, establishing critical limits, monitoring, corrective actions, verification, and documentation.
What is the difference between the 7 HACCP principles and the 12 steps?
The 7 HACCP principles are the technical core of the system covering hazard analysis through record-keeping. The 12 steps include 5 preparatory tasks that must be completed before the principles can be applied. The 12-step framework provides the full implementation sequence.
Why are the 5 preliminary steps of HACCP important?
The 5 preliminary steps establish the accurate foundation the hazard analysis depends on. A HACCP plan built on an incomplete product description or an unverified flow diagram will contain inaccuracies that affect every subsequent step.
What is a Critical Control Point in HACCP?
A Critical Control Point is a step in the food process where a control measure can be applied to prevent, eliminate, or reduce a significant food safety hazard to an acceptable level. Cooking, chilling, and metal detection are common examples.
What is a critical limit in HACCP?
A critical limit is the measurable boundary at a CCP that separates acceptable from unacceptable control. Critical limits must be science-based and measurable, such as a minimum cooking temperature or a maximum storage temperature.
What is the difference between monitoring and verification in HACCP?
Monitoring checks whether a specific CCP is under control at a given moment. Verification checks whether the overall HACCP system is working as intended over time. Both are required but they serve different functions.
What records does a HACCP system require?
A HACCP system requires the HACCP plan itself and records of monitoring activities, corrective actions taken when critical limits were breached, and verification activities. Records must be legible, dated, and signed.
How often should a HACCP plan be reviewed?
A HACCP plan should be reviewed whenever there is a change to the process, product, ingredients, suppliers, or equipment. It should also be reviewed periodically as part of the verification schedule, even if no changes have occurred.
Who should be on a HACCP team?
The HACCP team should include people with direct operational knowledge of the process being assessed, plus individuals with technical food safety knowledge. For smaller businesses, external food safety consultants may contribute to the team where internal expertise is limited.
What happens if a CCP critical limit is breached?
A pre-defined corrective action should be applied immediately. This addresses both restoring control at the CCP and deciding the fate of any product affected while the CCP was out of control. Corrective actions and their outcomes must be documented.
Can a HACCP plan be developed by one person?
Codex Alimentarius guidelines recommend a multidisciplinary team for HACCP development. A plan developed by a single individual risks missing hazards or process details that a broader team would capture. External expertise should supplement internal knowledge where the team lacks specific technical areas.
What is the role of monitoring equipment in HACCP?
Monitoring equipment such as temperature sensors, ATP swab testers, and metal detectors generates the objective, time-stamped records that demonstrate a CCP is under control. Automated monitoring reduces the risk of gaps in manual records and provides continuous rather than periodic evidence of control.
How does HACCP relate to ISO 22000?
ISO 22000 is a food safety management system standard that incorporates HACCP principles alongside additional requirements covering communication, management systems, and continual improvement. HACCP provides the hazard control methodology that ISO 22000 builds upon.
How long does HACCP implementation take?
Implementation timelines vary significantly depending on the complexity of the operation, the size of the HACCP team, and whether staff have existing HACCP knowledge. A straightforward single-product process might complete implementation in weeks. A complex multi-product manufacturing environment may require several months.
Related from the Knowledge Center
What Is HACCP? A Beginner’s Guide to Food Safety and Risk Prevention
The foundational overview of what HACCP is, where it came from, and why it is the basis of most modern food safety management systems.
What Is a Food Safety Audit? Types, Process, and What to Expect
HACCP plans and monitoring records are the primary documentation reviewed in food safety audits. This article explains what auditors look for and how to prepare.
Why Food Safety Systems Fail: Common Causes and Practical Prevention
Many HACCP implementation failures follow recognizable patterns. This article explores the common causes of food safety system failure and how to prevent them.
