What is a HACCP plan?

01The definition

What does HACCP actually mean?

HACCP stands for Hazard Analysis and Critical Control Points. Try saying that out loud — it sounds like government writing because it is. The plain version: HACCP is a way of thinking about your food process where you find the places things can go wrong, decide which of those places are the most dangerous, and build a written rule for how you'll keep each of those places under control.

A "HACCP plan" is the document you write that captures all of that thinking. A "HACCP system" is the daily practice of actually following the plan. People use the words interchangeably, but inspectors will sometimes catch the difference. The plan is the paperwork. The system is what's happening on the floor.

02The origin story

A NASA problem that became your problem.

HACCP wasn't designed by regulators. It was designed by a Pillsbury microbiologist named Howard Bauman in 1959, working under a contract from NASA. The problem he was solving was simple and grim: if an astronaut got food poisoning in orbit, they couldn't exactly call in sick. The food had to be safe — not "tested and probably safe," but engineered to be safe with near-zero defect rate.

Bauman realized that testing finished food for contamination is too late. By the time you know the food is bad, it's already been eaten. The fix was to identify the points in the process where contamination COULD happen and build controls at each of those points so it doesn't. That's the original insight, and it's still the whole game.

For thirty years HACCP stayed mostly inside Pillsbury and the canning industry. Then in 1993, an E. coli O157:H7 outbreak at a Jack in the Box restaurant chain sickened 732 people and killed four children. The undercooked beef came from a meat plant that wasn't using HACCP. In response, the USDA published the "Mega-Reg" in 1996 — the first federal rule requiring HACCP for an entire industry sector. Seafood and juice followed within five years. In 2011, the Food Safety Modernization Act expanded the concept to almost every facility that makes human food.

03The framework

The 12 steps, in order.

The international standard for HACCP is the 12-step framework written by Codex. The first five are preliminary tasks — getting ready. The last seven are the principles that go into the written plan itself. You will see both numbers ("the 7 principles" and "the 12 steps") used to describe HACCP, and both are correct. The 7 are inside the 12.

1. 01

   Assemble the HACCP team

   Pick the people who will write the plan. At a small operation, this might be just you and one other person. Whoever is on the team has to know the process.

2. 02

   Describe the product

   Write down what you make, what's in it, what's the shelf life, who eats it, and how it gets stored once it leaves you.

3. 03

   Identify the intended use

   Who eats this? Adults? Children? People with weakened immune systems? The answer changes which hazards matter most.

4. 04

   Draw the process flow diagram

   Every step from receiving raw ingredients to shipping finished product. Cooking. Cooling. Packaging. Storage. All of it.

5. 05

   Verify the flow diagram on the floor

   Walk the actual production area with the diagram in your hand. Fix everything you got wrong. Usually a lot.

6. 06

   Conduct the hazard analysis (Principle 1)

   At each step, list the things that could go wrong — biological (bacteria), chemical (cleaner residue, allergens), and physical (broken glass, metal shavings). Rate each one for how likely and how severe.

7. 07

   Identify the Critical Control Points (Principle 2)

   A Critical Control Point (CCP) is a step in your process where you can apply a control that will stop a hazard from reaching the customer. Cooking chicken to 165°F is a CCP. Wiping the prep table is not. Use the Codex CCP decision tree to be sure.

8. 08

   Set critical limits at each CCP (Principle 3)

   The exact number or condition that separates “safe” from “not safe.” For chicken: 165°F internal for at least 15 seconds. For a metal detector: rejects everything above 2.0mm. The limit has to be measurable.

9. 09

   Build a monitoring procedure (Principle 4)

   How will you check that the limit is being met? Who checks? How often? What do they write down? Every CCP needs a procedure.

10. 10

    Decide corrective actions (Principle 5)

    What happens when the limit is missed? Who decides what to do with the food? Who decides whether to keep running? Write the procedure before you need it.

11. 11

    Build verification procedures (Principle 6)

    How will you know the plan is still working? This is your internal audit — somebody (often the same team) reviews records, calibrates equipment, and confirms the plan still matches reality.

12. 12

    Establish record-keeping (Principle 7)

    What gets written down? Where does it live? Who can pull it up during an inspection? The records are the only proof your plan worked.

That's the entire framework. Every HACCP plan ever written — for a single-product cottage operation, a multi-plant manufacturer, or a NASA-bound meal — is some version of these twelve steps.

04Scope

Do you actually need a HACCP plan?

The honest answer depends on what you make and where you sell it. There are seven situations where the answer is yes:

1. 01

   You make meat or poultry products in a USDA-inspected facility

   USDA-FSIS has required HACCP at every meat, poultry, and processed-egg plant since the 1996 Mega-Reg. 9 CFR Part 417

2. 02

   You process seafood in the U.S.

   FDA's Seafood HACCP rule has applied since 1997. Records must be kept for 1 year (refrigerated) or 2 years (frozen). 21 CFR Part 123

3. 03

   You make fruit or vegetable juice

   FDA Juice HACCP has been in effect since 2002. The rule requires a validated 5-log pathogen reduction step. 21 CFR Part 120

4. 04

   You make almost any other human food at an FDA-registered facility

   The Food Safety Modernization Act (FSMA) requires a “Food Safety Plan” at every covered facility. The plan is HACCP-shaped — the FDA calls the practitioner who writes it a PCQI (Preventive Controls Qualified Individual). 21 CFR §117.126

5. 05

   You run a restaurant doing a 'special process'

   Sous vide, smoking for preservation, fermenting, reduced-oxygen packaging, sprouting — your local health department will require a written HACCP plan under FDA Food Code §3-502.11 before they grant a variance.

6. 06

   Your buyer or auditor told you to

   If you sell to a grocery chain, foodservice distributor, or co-packer, they will probably require a GFSI-certified food safety system (SQF, BRCGS, FSSC 22000). All of those are HACCP-based.

7. 07

   You hold a CFIA Safe Food for Canadians licence

   SFCR §86 requires a written Preventive Control Plan (PCP) for most licence holders. The PCP is HACCP-shaped with extra sections specific to Canadian rules.

If none of the seven describes you, you might genuinely be exempt. But even then, the discipline of writing a HACCP plan is valuable. The plan forces you to admit, on paper, where you can't actually prove the food is safe — and lets you fix it before an outbreak does the proving for you.

05The plan itself

What an audit-ready HACCP plan contains.

A complete HACCP plan, of the kind an inspector will accept, has these sections:

1. 01

   Plan summary and scope

   What products this plan covers. What it doesn't. Who's responsible. Version and date.

2. 02

   Product descriptions

   One per product — ingredients, packaging, shelf life, distribution, intended use, intended consumer.

3. 03

   Process flow diagrams

   One per product or product family. Every step, in order.

4. 04

   Hazard analysis tables

   Step-by-step list of every biological, chemical, and physical hazard you considered, with severity and likelihood for each.

5. 05

   CCP determination

   Which steps you decided are Critical Control Points and your reasoning (using the Codex decision tree).

6. 06

   HACCP plan summary table

   The big rectangular table: CCP, hazard, critical limit, monitoring, corrective action, verification, records. One row per CCP.

7. 07

   Supporting programs

   Allergen control, sanitation, pest control, water/ice testing, supplier verification. Each is its own short document.

8. 08

   Training records

   Who's been trained on what, when, and by whom.

9. 09

   Monitoring records

   The actual filled-in logs from the production floor.

10. 10

    Calibration records

    Every probe, every scale, every metal detector — what was calibrated, when, against what reference, by whom.

11. 11

    Corrective action records

    Every time a critical limit was missed and what you did about it.

12. 12

    Verification records

    Internal audits, mock recalls, environmental monitoring results.

06HACCP vs everything else

HACCP, FSP, PCP — what's the difference?

The food-safety world has three nearly-identical frameworks with three different names depending on which regulator wrote them. The short version:

USDA-FSIS uses "HACCP" plainly because that's what the 1996 rule called it. FDA renamed it "Food Safety Plan" for FSMA because they wanted to add the supply-chain and recall sections without renaming HACCP itself. CFIA renamed it "Preventive Control Plan" because Canadian law uses different language than U.S. law. The underlying framework is the same.

07Cost and time

What does this actually cost?

There are five realistic price points depending on how you build it.

There are also training costs separate from the plan itself. PCQI training (FDA-side) runs $700 to $900. HACCP coordinator training (industry-side) is $300 to $800. If you're building your own Food Safety Plan, you need at least one PCQI on staff or contracted.

Time is the other cost. A simple single-product plan can be drafted in two weekends. A multi-product, multi-line operation takes three to six months. The biggest time sink is verifying the flow diagram against actual production and rewriting it until it matches. Plan for that step taking twice as long as you think.

08What to do this week

How to start this week.

You don't need a consultant to get started. The first three steps cost nothing and give you the foundation to decide what kind of help you need next.

1. 01

   Pick your team — even if it's just you

   Two people is better than one. Whoever knows the process best has to be on the team.

2. 02

   Write a one-page product description

   Ingredients, packaging, shelf life, distribution channel, intended consumer. That's it. One page per product.

3. 03

   Sketch a flow diagram from receiving to shipping

   Pencil and grid paper. Walk the floor with it. Fix what you got wrong. Repeat until it matches reality.

If those three steps tell you the process is straightforward and the hazards are obvious, you might genuinely be able to build the rest of the plan yourself. If they expose a process you don't fully understand, that's the signal to bring in help — either a consultant for one engagement, or a guided builder you can use yourself.

Footnotes

1.Codex Alimentarius Commission, General Principles of Food Hygiene, CAC/RCP 1-1969 Rev. 4-2003, HACCP Annex — fao.org

2.21 CFR Part 117 (Preventive Controls for Human Food) — ecfr.gov

3.9 CFR Part 417 (USDA-FSIS HACCP Systems) — law.cornell.edu

4.USDA-FSIS Final Rule, 61 FR 38806, “Pathogen Reduction; HACCP Systems,” July 25, 1996

5.CFIA Preventive Control Plans — inspection.canada.ca

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-03· 11 min read· Wikidata Q139112497