What Should a HACCP Plan Include, and How Does It Differ From Prerequisite Programs?

A HACCP plan must document the seven HACCP principles applied to a specific product and process: hazard analysis, critical control points (CCPs), critical limits, monitoring, corrective actions, verification, and recordkeeping. Prerequisite programs (PRPs) are the foundational, facility-wide conditions—sanitation, pest control, supplier approval, employee hygiene, maintenance, and traceability—that create a clean, controlled environment before HACCP is applied. In short: PRPs manage general risks across the plant; HACCP manages specific, significant hazards at defined steps in a process. You need both, and a HACCP plan that ignores PRPs usually fails because it tries to control too much at CCPs while basic conditions remain uncontrolled.

The seven HACCP principles and the order to apply them

The widely used sequence (aligned with Codex Alimentarius and reflected in FDA and USDA guidance) is:

1. Conduct a hazard analysis — identify biological, chemical, and physical hazards reasonably likely to occur.
2. Determine CCPs — decide where control is essential to prevent, eliminate, or reduce a significant hazard to an acceptable level.
3. Establish critical limits — set measurable boundaries (time, temperature, pH, water activity, moisture, etc.) for each CCP.
4. Establish monitoring — define what, how, when, and by whom each CCP is checked.
5. Establish corrective actions — specify what happens when monitoring shows a deviation.
6. Establish verification — confirm the plan is working and being followed.
7. Establish recordkeeping — document the plan and its execution.

A common mistake is jumping to CCPs before the hazard analysis is complete. The hazard analysis drives everything else; if it is thin, the rest of the plan is built on sand.

Step 1 in practice: the hazard analysis

For each process step, list hazards in three categories:

• Biological: pathogens (e.g., Salmonella, Listeria monocytogenes, E. coli O157:H7), spoilage organisms, toxins, parasites, viruses.
• Chemical: allergens, cleaning chemical residues, mycotoxins, antibiotic residues, unapproved additives, lubricants.
• Physical: metal, glass, hard plastic, bone, stones, wood.

For each hazard, record:

• Whether it is reasonably likely to occur (consider history, literature, and process data).
• The basis for that decision (scientific reference, plant data, regulatory guidance).
• The preventive measure that addresses it—and whether that measure belongs in a PRP or a CCP.

This is where the PRP/HACCP boundary gets decided. If sanitation controls Listeria in the environment, that is a PRP. If a cook step must reduce Salmonella to a defined level, that is a CCP.

Where prerequisite programs sit relative to HACCP

PRPs are not part of the HACCP plan itself, but the plan depends on them. Typical PRPs include:

A useful rule: if a hazard can be controlled facility-wide through good practices, it usually belongs in a PRP. If it must be controlled at a specific step to make the product safe, it belongs in the HACCP plan as a CCP.

Critical limits, monitoring, corrective actions, verification, recordkeeping

Critical limits must be measurable and based on a validated scientific or regulatory basis. "Cook to 165°F" is not a critical limit; "internal temperature ≥165°F for at least 15 seconds" is. Avoid vague limits like "clean" or "properly cooked."

Monitoring should answer: what is measured, how, at what frequency, and by whom. Continuous monitoring (e.g., a chart recorder) is stronger than periodic checks, but both need a documented frequency and responsible role.

Corrective actions must address three things:

• What happens to the affected product (hold, rework, reject, destroy).
• What happens to the process (adjust, stop, re-clean).
• How the root cause is investigated and prevented from recurring.

Verification includes activities beyond routine monitoring: calibration, record review, CCP reassessment, environmental sampling where applicable, and internal audits. Verification confirms the plan is scientifically valid and consistently followed.

Recordkeeping should make the plan auditable. Keep the hazard analysis, CCP determination rationale, critical limit basis, monitoring logs, corrective action records, verification records, and training records. Records must be legible, dated, signed where required, and retained per applicable regulation.

Common documentation gaps that cause audit failures

• Hazard analysis lacks a basis. Decisions are asserted without scientific or historical support.
• CCPs are either missing or excessive. Too few leaves hazards uncontrolled; too many dilutes focus and burdens the team.
• Critical limits are not measurable. Auditors look for objective, verifiable values.
• Monitoring frequencies are unrealistic. A frequency the team cannot sustain is a finding waiting to happen.
• Corrective actions are generic. "Retrain employee" without product disposition and root cause is incomplete.
• Verification is confused with monitoring. Reviewing a log is not the same as verifying the plan.
• PRPs are undocumented. If sanitation or supplier approval is assumed but not written, the HACCP plan has no foundation.
• Records are incomplete or unsigned. Missing dates, initials, or corrective action follow-up are frequent findings.

Regulatory and standards references

HACCP requirements appear across several frameworks. FDA's seafood HACCP regulation (21 CFR 123) and juice HACCP regulation (21 CFR 120) are mandatory for those industries; USDA FSIS requires HACCP for meat and poultry establishments (9 CFR 417). Codex Alimentarius provides international HACCP principles and guidelines. FDA's Food Safety Modernization Act (FSMA) preventive controls rule (21 CFR 117) uses a preventive controls framework that overlaps with HACCP but is not identical. GFSI-benchmarked schemes (e.g., BRCGS, SQF, FSSC 22000) require both PRPs and HACCP-based plans. Always confirm current rule text and applicability with the relevant authority, as requirements and interpretations can change.

A practical way to build or review a plan

1. Assemble the team: quality, production, sanitation, maintenance, and a person with HACCP training.
2. Describe the product, its intended use, and the process flow.
3. Verify the flow diagram on the floor.
4. Conduct the hazard analysis and document the basis for each decision.
5. Determine CCPs using a structured decision approach.
6. Set critical limits with a validated basis.
7. Define monitoring, corrective actions, verification, and records.
8. Confirm PRPs are documented and effective.
9. Reassess whenever the product, process, equipment, or regulation changes.

If you are reviewing an existing plan, start with the hazard analysis and the PRP documentation. Those two areas reveal most weaknesses before you reach the CCPs.