HACCP & Preventive Controls
HACCP — Hazard Analysis and Critical Control Points — is the internationally recognised system for building food safety into a process rather than inspecting it in at the end. It identifies where biological, chemical, and physical hazards can enter, fixes the points where control is essential, and then monitors and documents those points so a loss of control is caught and corrected before unsafe product ships. It is the backbone of modern food-safety regulation worldwide.
The seven principles
The Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969) codifies HACCP as seven principles: (1) conduct a hazard analysis; (2) determine the critical control points (CCPs); (3) establish validated critical limits for each CCP; (4) establish a system to monitor each CCP; (5) establish the corrective action when monitoring shows a CCP is out of control; (6) establish verification procedures to confirm the system works; and (7) establish documentation and record-keeping.
The principles are applied through a 12-step sequence — five preliminary steps (assemble the team, describe the product, identify intended use, construct and on-site-verify the flow diagram) followed by the seven principles. The discipline is in the order: you cannot sensibly pick CCPs before you have analysed the hazards, and you cannot set a critical limit you have not validated.
Prerequisite programmes and the hazard analysis
HACCP does not stand alone. It sits on prerequisite programmes (PRPs) — sanitation, pest control, personal hygiene, maintenance, supplier control — that manage the general conditions of hygiene. When PRPs are strong, the CCPs can stay few and genuinely critical; when they are weak, teams over-designate CCPs to compensate and the system becomes unmanageable.
The hazard analysis is the intellectual core: for each step, what biological, chemical (including allergens and mycotoxins), or physical hazard is reasonably likely, how severe is it, and is a control essential here to prevent or reduce it to an acceptable level? A CCP is a step where that answer is yes and where loss of control means the hazard is not caught later. Everything downstream depends on getting this analysis honest.
ISO 22000 and the management-system layer
ISO 22000 wraps HACCP inside a full food-safety management system, aligning it with the ISO high-level structure (leadership, planning, support, operation, evaluation, improvement) and formalising the interplay of PRPs, operational PRPs, and CCPs. It lets a food business integrate food safety with its other management systems and is the basis for several GFSI-recognised certification schemes.
The relationship is layered, not competing: HACCP is the hazard-control method; ISO 22000 is the management system that plans, resources, verifies, and improves it. A certified FSMS without a rigorous underlying hazard analysis is hollow; a good HACCP plan without a management system around it does not survive staff turnover.
FSMA preventive controls — HACCP, extended
In the US, FSMA replaced classic HACCP (retained for juice and seafood) with Hazard Analysis and Risk-Based Preventive Controls under 21 CFR Part 117 for human food and 21 CFR Part 507 for animal food. HARPC keeps the hazard-analysis core but broadens the control set beyond process CCPs to include allergen controls, sanitation controls, and supply-chain controls, and requires a preventive-controls-qualified individual to prepare and oversee the plan.
The practical shift is scope: a Part 117 food-safety plan must reckon with hazards a narrow CCP model might miss — undeclared allergens (the leading cause of US food recalls), environmental pathogens in ready-to-eat facilities, and hazards introduced by suppliers. The Codex seven principles remain the intellectual foundation; the preventive-controls framework is how modern regulation operationalises them.
Derived from the 4 standards that anchor this topic.
What are the seven principles of HACCP?
Conduct a hazard analysis; determine critical control points (CCPs); establish critical limits; establish monitoring; establish corrective actions; establish verification; and establish documentation and record-keeping. They are codified in Codex CXC 1-1969 and applied through a 12-step sequence.
What is a critical control point (CCP)?
A CCP is a step in the process where control is essential to prevent, eliminate, or reduce a food-safety hazard to an acceptable level, and where loss of control would not be caught later. Each CCP has a validated critical limit, monitoring, and a defined corrective action.
How does HACCP relate to ISO 22000?
HACCP is the hazard-control method; ISO 22000 is a food-safety management system that plans, resources, verifies, and continually improves HACCP alongside prerequisite programmes, using the ISO high-level structure. ISO 22000 underpins several GFSI-recognised certification schemes.
What is the difference between HACCP and FSMA preventive controls?
FSMA’s preventive-controls rules (21 CFR Part 117 for human food, Part 507 for animal food) keep the HACCP hazard-analysis core but broaden controls beyond process CCPs to include allergen, sanitation, and supply-chain controls, overseen by a preventive-controls-qualified individual.
Get the Weekly GxP Briefing
Curated regulatory intelligence — enforcement, recalls, guidance, and quality signals — in one practitioner-grade email each week. Free.