The 7 HACCP principles explained with practical examples

HACCP (Hazard Analysis and Critical Control Points) is not a document to keep in a drawer for the inspection. It is a method to identify where a food can become dangerous and to keep that risk under control every day, not just on the day of the inspection. The method is based on 7 principles, defined by the Codex Alimentarius and taken up by EC Reg. 852/2004. Let us go through them one by one, with a practical example for each.

1. Hazard analysis

The first step is to list, for each stage of the process — from receiving raw materials to sale — the biological, chemical and physical hazards that might appear: a bacterium that multiplies if the temperature rises, a residue of detergent that was not rinsed off, a glass fragment from a broken container.

Example: in the cooling stage of a pastry cream, the biological hazard is the growth of Bacillus cereus if the product stays too long in the so-called "danger zone" — roughly between 8°C and 60°C, the range in which bacterial growth is fastest (references vary slightly from source to source). It is a real hazard, not a theoretical one: it must be written down, not taken for granted.

2. Identifying the critical control points (CCPs)

Not all stages carry the same weight. A CCP is a stage where, if you do not intervene, the hazard identified in point 1 is no longer eliminated or reduced to an acceptable level at any later stage. It is identified with a decision tree: is there a control measure? Does this stage eliminate or reduce the hazard? If you do not do it here, will another stage do it later?

Example: baking a dough made with eggs is typically a CCP, because it is the only stage that reduces the initial microbial load — afterwards, the product is not heat-treated again.

3. Setting critical limits

Every CCP needs a measurable critical limit: a temperature, a time, a pH, not a generic phrase like "bake well". The limit must be verifiable with an instrument, otherwise it is not a limit, it is an opinion.

Example: "core temperature of the product ≥ 75°C for at least 2 minutes" is a critical limit that can be verified with a probe thermometer. "Bake until golden" is not.

4. Monitoring system

Once the limit is defined, you need a way to check it regularly: who measures, how, when, and where it is recorded. Monitoring must be continuous or frequent enough to catch a deviation before the product leaves the workshop.

Example: every batch of baked product is measured with a probe thermometer at the end of baking, and the value is entered on the production sheet — not "from memory" at the end of the day.

5. Corrective actions

When monitoring shows that the critical limit has not been met, you need a corrective action defined in advance: what is done with the product (discard it, bake it again, downgrade it) and what is done to the process so that it does not happen again. Improvising on the spot is a sign that the system is not really ready.

Example: if the baking temperature turns out to be below the limit, the batch is not released for sale and goes through a second baking cycle, with the new value checked and recorded.

6. Verification of the system

Verification is different from monitoring: its purpose is to check that the HACCP system as a whole really works, not just that a single CCP is respected at a given moment. It includes instrument calibration, internal audits, sample laboratory analyses and periodic review of the plan.

Example: a six-monthly calibration of the thermometers used at the CCPs, and an annual microbiological analysis on a high-risk product, to confirm that the control measures work in practice and not only on paper.

7. Documentation and records

Everything above must be documented: the hazard analysis, the CCPs identified, the critical limits, the monitoring records, the corrective actions when needed, the verifications. Not for bureaucracy, but because it is the only way to show — to yourself first, before the inspector — that the control was really carried out, and to trace back if one day you need to.

Example: in case of a product recall, it is the baking records and the batch traceability that make it possible to isolate exactly which packs are involved, instead of having to withdraw everything.

The most common mistake: the 7 principles as an exercise, not a process

The problem I have seen most often is not understanding the principles — they are fairly intuitive once explained with real examples. The problem is when HACCP is written once, when the workshop opens or for an audit, and then never updated: a recipe changes, a supplier changes, a piece of equipment changes, and the HACCP plan stays the one from two years ago. At that point principle 1 (hazard analysis) and principle 7 (documentation) stop matching the reality of the workshop — and that is exactly where an inspection finds the gap.

How the 7 principles become functions, not just theory

The safest way I have found to keep the HACCP plan aligned with real production is to let the 7 principles live inside the same system that manages recipes, suppliers and stock, not in a separate Word document. In KoreLab each principle corresponds to a concrete function, linked to the workshop's real records:

• Hazard analysis (principle 1) — flow diagram, biological/chemical/physical hazards, allergens and fraud with a 5×5 Probability × Severity matrix, and a Codex decision tree that automatically classifies CCP, oPRP or PRP.
• CCPs and critical limits (principles 2-3) — critical points with limits taken from a reusable, versioned library; an out-of-limit value opens a Non-Conformity on its own — the verdict is calculated from the data, not stated in words.
• Monitoring (principle 4) — almost 30 append-only register templates (temperatures, calibration, goods acceptance…) built on the ALCOA+ principles: every entry is attributable, legible and dated, and a correction is a traced reversal, never an overwrite.
• Corrective actions (principle 5) — the Non-Conformities opened by monitoring become CAPAs with the full cycle cause → correction → action → verification → closure, so none is forgotten.
• Verification (principle 6) — gap analysis by standard (met / partial / not met) with a coverage dashboard, plus scheduled internal audits with a checklist built on the real requirements.
• Documentation (principle 7) — a manual with a section life cycle (draft → approved → obsolete) and printing of the complete file, ready to hand to the auditor.

You can start for free on your first products, without a credit card: create a free account.

In short

The 7 HACCP principles are: hazard analysis, identification of CCPs, critical limits, monitoring, corrective actions, verification and documentation. Taken one by one they are simple to understand; the real difficulty is keeping them aligned with real production over time, not just on the day the plan is written.