Seven steps to food safety – how to implement an HACCP system in practice?

Implementing an HACCP system is a legal obligation for every food business operator in the EU. In practice, however, there is often a huge gap between being aware of this obligation and actually having a functioning system in place. Many companies have HACCP documentation – but not necessarily a system that actually protects consumers and the business from food safety incidents. Below, we explain how to set up an HACCP system that works.

Where to start – preliminary stages prior to the hazard analysis

Before the HACCP team begins the hazard analysis, it must carry out a series of preliminary tasks which form the foundation of the entire system. Omitting or rushing through these stages results in a hazard analysis based on incorrect assumptions – and a system that looks correct on paper but, in reality, fails to ensure product safety.

Establishing the HACCP team. The Codex Alimentarius standards and the requirements of ISO 22000 stipulate that the HACCP team must be multidisciplinary – comprising individuals with knowledge of the product, the production process, microbiological and chemical hazards, and legal requirements. In small businesses, a single employee may combine several roles, but must have documented competence in all the necessary areas.

Product description and its intended use. A documented description must be drawn up for each product manufactured, covering its composition, physicochemical parameters (pH, water activity, salt content), method of packaging and storage, shelf life and distribution conditions, as well as the intended consumers – including particularly vulnerable groups (children, the elderly, pregnant women, and immunocompromised individuals). The intended use of the product determines the level of acceptable risk and the scope of HACCP requirements.

Process flow diagram and its verification on the production site. The diagram must reflect the actual course of the process – every stage, every branching point, every potential point where raw materials and finished products may cross. A key requirement is the verification of the diagram on the production site by physically tracing the process and confirming that the diagram corresponds to reality. A flowchart drawn up at a desk without verification at the site is one of the most common non-compliances identified by regulatory authorities.

Prerequisite programmes (GHP/GMP). A hazard analysis should be carried out in an environment where basic hygiene requirements are already met. Prerequisite programmes – covering the hygiene of premises and personnel, pest control, waste management, process water control and allergen management – must be documented and in place before the hazard analysis is undertaken.

The most common mistakes when setting up an HACCP system and how to avoid them

• A hazard analysis copied from a template. Ready-made hazard analysis templates available online can be a useful starting point, but they can never replace an analysis tailored to the specific characteristics of a particular facility, raw materials and technology. Regulatory authorities and certification auditors verify whether the analysis reflects actual processes – any discrepancy is one of the most serious non-conformities.
• Too many CCPs or too few. An excessive number of critical control points indicates a flawed analysis – not every hazard needs to be managed by a CCP. Many hazards can be effectively controlled through pre-treatment programmes or operational pre-treatment programmes (OPRPs). Conversely, too few CCPs may mean that actual hazards have been overlooked. Proper use of the Codex decision tree is key to correct classification.
• Critical limits that are unmeasurable or unverifiable. A critical limit must be expressed in a measurable way – temperature in degrees Celsius, time in minutes, concentration as a percentage. Descriptive limits (‘appropriate temperature’, ‘sufficient time’) do not meet the requirements. Each critical limit should be based on scientific data or legal requirements and documented.
• Monitoring on paper only. The CCP monitoring system must be effectively implemented by designated staff at appropriate intervals. Monitoring records must be complete and reliable – gaps, unsigned corrections or records filled in retrospectively are a red flag for any auditor.
• Lack of system verification. The HACCP system must be regularly verified – through internal audits, microbiological testing of products and the environment, and system reviews following any significant change to a process, raw material or product. A system that has not been verified for a year or more requires immediate updating.
• Documentation unavailable or out of date. All HACCP documentation – plans, procedures, records – must be up to date, approved by authorised persons and available where it is needed. Archival documentation must be retained for the period required by regulations or customer requirements.