A HACCP plan is a written food safety strategy that identifies where hazards can enter a food product during production and sets up controls to prevent them. HACCP stands for Hazard Analysis and Critical Control Points, and it’s the most widely adopted food safety framework in the world. Rather than relying on end-product testing alone, it builds safety into every stage of production, from raw ingredients to the finished item on a store shelf or restaurant plate.
The concept was first developed in the 1960s when NASA partnered with the Pillsbury Company to create pathogen-free food for astronauts. Testing every single item wasn’t practical, so they designed a system that controlled hazards at specific points during production. That approach eventually became the standard for the entire food industry.
How a HACCP Plan Works
At its core, a HACCP plan maps out every step in a food production process, flags the steps where something dangerous could happen, and puts safeguards in place at those exact points. The “something dangerous” falls into three categories: biological hazards (bacteria like Salmonella or Listeria), chemical hazards (cleaning agents, allergens, pesticides), and physical hazards (metal fragments, glass, bone).
The steps where these hazards are controlled are called critical control points, or CCPs. A CCP is any stage where you can apply a control that’s essential to preventing a hazard or reducing it to a safe level. Cooking is the most intuitive example. If you’re producing chicken, the cooking step is a CCP because hitting the right internal temperature kills harmful bacteria. Cooling, holding, and reheating are other common CCPs, since bacteria can grow rapidly when food sits in the temperature danger zone between roughly 40°F and 140°F.
Each CCP has a critical limit, which is the specific, measurable boundary that separates safe from unsafe. These aren’t vague guidelines. They’re precise numbers. For poultry, the critical limit for cooking might be an internal temperature of 165°F. For chilled storage, it might be holding at 41°F or below. Research from the University of Wisconsin-Madison has mapped out exactly how long different raw products can safely remain at various temperatures before pathogens begin to grow. Beef at 70°F, for instance, has a safe window of about 3 hours and 30 minutes, while poultry at the same temperature has roughly 4 hours and 45 minutes. These kinds of data points are what critical limits are built on.
The Seven Principles
The FDA outlines seven principles that form the backbone of every HACCP plan:
- Conduct a hazard analysis. Identify every biological, chemical, and physical hazard that could reasonably occur at each step of production.
- Determine the critical control points. Pinpoint which steps in the process are essential for controlling those hazards.
- Establish critical limits. Set the measurable boundaries (temperature, time, pH, moisture level) that must be met at each CCP.
- Establish monitoring procedures. Define how and how often each CCP will be checked to ensure the critical limits are being met.
- Establish corrective actions. Spell out exactly what happens when monitoring shows a critical limit has been exceeded.
- Establish verification procedures. Confirm that the entire system is working as designed through activities like calibration, sampling, record review, and direct observation.
- Establish record-keeping and documentation procedures. Maintain written records that prove the plan is being followed and that corrective actions are taken when needed.
Five Preliminary Steps
Before applying those seven principles, the FDA requires five preliminary tasks. First, you assemble a HACCP team with people who understand the product, the process, and food safety science. Then the team formally describes the food product and how it will be distributed, including whether it will be frozen, refrigerated, or shelf-stable. Third, they define the intended consumer. A product aimed at elderly or immunocompromised populations, for example, demands tighter controls than one sold to healthy adults.
The fourth step is developing a flow diagram that maps every stage of production, from receiving raw materials through packaging and shipping. Finally, the team physically walks through the facility to verify that the flow diagram matches what actually happens on the production floor. These five steps plus the seven principles make up the complete 12-step HACCP implementation process.
Validation vs. Verification
Two terms that often cause confusion are validation and verification. Validation happens up front: it demonstrates that the HACCP system, as designed, can adequately control hazards and produce a safe product. Think of it as proving the plan works before you rely on it.
Verification is the ongoing work of confirming the plan is actually being followed day to day. It includes activities like calibrating thermometers, reviewing monitoring records, directly observing employees as they take samples or check temperatures, and periodically reviewing test results. Validation asks “Can this plan work?” Verification asks “Is it working right now?”
Who Is Required to Have One
In the United States, HACCP plans are federally mandated for three categories of food production. The FDA requires them for seafood and juice processors. The USDA’s Food Safety and Inspection Service requires them for meat, poultry, and egg product establishments, where the goal is reducing pathogenic microorganisms and lowering the incidence of foodborne illness from those products.
For most other food facilities, the Food Safety Modernization Act (FSMA), which took effect in 2015, introduced a related but distinct requirement called HARPC (Hazard Analysis and Risk-Based Preventive Controls). HARPC is built on HACCP principles but expands the scope. While HACCP focuses controls at critical control points, HARPC food safety plans can include preventive controls at additional steps beyond traditional CCPs. HARPC plans also explicitly cover food allergen controls, sanitation controls, supply chain controls, and recall plans. Another key difference: HARPC plans must be formally reanalyzed at least every three years.
HACCP on the International Stage
Outside the U.S., the Codex Alimentarius Commission, a joint body of the United Nations’ food and agriculture and health organizations, provides the international framework for HACCP. The Codex General Principles of Food Hygiene, originally established in 1969 and most recently revised in 2022, serves as the reference document that most countries build their own food safety regulations around. Codex guidelines are actively being updated to align related food safety texts with that 2022 revision, incorporating the latest scientific risk assessments for specific pathogens like Listeria in ready-to-eat foods.
Many countries treat the Codex HACCP guidelines as the baseline for trade. If you’re exporting food products internationally, having a HACCP plan that aligns with Codex standards is often a prerequisite for market access.
What a HACCP Plan Looks Like in Practice
A finished HACCP plan is a written document, sometimes a binder, sometimes a digital file, that a food safety inspector or auditor can review at any time. It contains the flow diagram, the hazard analysis for each step, a list of CCPs with their critical limits, the monitoring schedule, corrective action procedures, and all associated records. Those records are the proof. If your CCP is a cooking step with a critical limit of 165°F, the plan will include logs showing that someone measured the temperature at the required frequency and that every reading met the limit, or that a corrective action was taken when it didn’t.
The plan is not a static document. Any time you change a product, a supplier, a piece of equipment, or a process step, the HACCP team needs to reassess whether the existing hazard analysis and CCPs still apply. A plan that doesn’t evolve with the operation it covers will eventually fail to catch a hazard that wasn’t there when the plan was written.