Is HACCP a certification?

No. HACCP is a method set out by the Codex Alimentarius Commission and no organisation certifies against it as an author. Certificates described as HACCP certificates are issued by certification bodies or training providers against their own criteria. A certificate that a retailer will accept is normally a GFSI-recognised scheme certificate, and every one of those requires a HACCP-based plan inside it.

Is HACCP required by law in the United States?

For some foods. The FDA requires HACCP for juice under 21 CFR part 120 and for fish and fishery products under 21 CFR part 123. USDA FSIS requires it for meat and poultry under 9 CFR part 417. For most other FDA-regulated food, 21 CFR part 117 requires a food safety plan with a hazard analysis and preventive controls, which is built on the same logic without using the term critical control point for every control.

What is the difference between a CCP and a prerequisite programme?

A critical control point is a step where control is essential and a measurable critical limit can be set and monitored, such as a cook step with a time and temperature. A prerequisite programme is a condition that must be in place for the plan to work at all, such as cleaning, pest control and personnel hygiene. Prerequisite programmes are auditable and necessary; they are not critical control points because no single measurable limit at a single step controls the hazard.

Early access How it works

HACCP: Hazard Analysis and Critical Control Points

HACCP is a system for identifying the hazards in a food process and controlling them at the points where control matters, and it is a method rather than a certification: no organisation owns HACCP and there is no such thing as a HACCP certificate issued by its author.

What it is: Framework
Published by: Codex Alimentarius Commission (FAO and WHO)
GFSI recognised: Not applicable
When it started: Codex guidelines, 1993
Where it is used: Required by name in United States, European Union and most export-market law

What HACCP is

HACCP stands for Hazard Analysis and Critical Control Points. It was set out by the Codex Alimentarius Commission, the joint food standards body of the Food and Agriculture Organization and the World Health Organization, as an annex to its General Principles of Food Hygiene. Every certification scheme in this list is built on it, and several national regulations require it by name.

The seven HACCP principles are: conduct a hazard analysis; determine the critical control points; establish validated critical limits; establish a system to monitor each critical control point; establish the corrective action to take when monitoring shows a deviation; validate the plan and establish verification procedures; and establish documentation and records.

The distinction that causes the most confusion is between a critical control point and a prerequisite programme. A critical control point is a step where control is essential to prevent or eliminate a hazard or reduce it to an acceptable level, and where a measurable limit can be set and monitored: a cook step with a time and a temperature, a metal detector with a rejection threshold. Cleaning, pest control and personnel hygiene are prerequisite programmes. They are necessary, they are auditable, and they are not critical control points because no single measurable limit at a single step controls the hazard.

Because HACCP is a method and not a scheme, a HACCP certificate is issued by a training provider or a certification body against their own criteria rather than by Codex. Many customers ask for one anyway. A site that needs a certificate a retailer will accept usually needs a GFSI-recognised scheme instead, and every one of those requires a HACCP plan inside it.

In United States regulation the FDA requires HACCP by name for two categories: juice processing under 21 CFR part 120 and fish and fishery products under 21 CFR part 123. For most other FDA-regulated food, the FSMA preventive controls rule at 21 CFR part 117 requires a food safety plan built on the same logic, with a hazard analysis and preventive controls in place of critical control points. USDA FSIS requires HACCP for meat and poultry under 9 CFR part 417, which is a different title and a different agency.

Where HACCP came from

HACCP was not written by a regulator. It came out of the Pillsbury Company in the 1960s, working with NASA and the United States Army Natick laboratories on food for spaceflight, where the requirement was close to absolute assurance that a meal would not make a crew ill in orbit. The team concluded that the assurance could not be obtained by testing finished product, because finished-product testing at any sampling rate a factory can afford tells you about the samples and not about the batch. The only way to get there was to control the process at the points where the hazard is actually introduced or removed.

Pillsbury presented the approach publicly at a United States national conference on food protection in 1971. The Food and Drug Administration adopted it first for low-acid canned food, an area where the failure mode is botulism and the cost of being wrong is fatal. The Codex Alimentarius Commission published its HACCP guidelines in 1993 and annexed them to the General Principles of Food Hygiene, which is where the seven principles most people quote actually live.

That history explains the shape of the method. HACCP is built for a process with identifiable steps and measurable limits, and it is weakest where a hazard is diffuse, which is why allergen cross-contact and environmental Listeria are handled by prerequisite and preventive-control programmes rather than by a critical control point in most plants.

The twelve steps, not only the seven principles

Codex sets out twelve steps, of which the seven principles are the last seven. The first five are preliminary and are the ones that get skipped: assemble a multidisciplinary team, describe the product and its distribution, identify the intended use and the consumer, construct a flow diagram, and confirm that flow diagram on the floor.

The fifth step is the one auditors find broken most often. A flow diagram drawn in an office and never walked is a diagram of the process somebody believes exists, and a hazard analysis built on it inherits the error everywhere. Confirming it on site means following the product, including rework loops, returns, and the paths people and waste take, which are usually the ones missing from the drawing.

A plan can therefore be non-conforming on the preliminary steps while every critical control point is monitored correctly, because the plan controls the wrong process. That is the practical reason to quote twelve rather than seven.

What HACCP is regularly confused with

A HACCP plan is not a food safety plan under the FSMA preventive controls rule, although one can be built from the other. The FSMA plan requires a hazard analysis and preventive controls, where a preventive control is a broader category than a critical control point: process controls, food allergen controls, sanitation controls and supply-chain controls all qualify, and only some of them have a critical limit at a single step. A site converting a HACCP plan to a food safety plan usually finds that most of what it called prerequisite programmes has become a preventive control with monitoring, corrective action and verification records attached.

HARPC is not a term the FDA uses in the regulation. It circulates in the industry as shorthand for Hazard Analysis and Risk-Based Preventive Controls, which is the title of the rule, but the regulation itself asks for a food safety plan and nothing in 21 CFR part 117 is called a HARPC plan.

A HACCP certificate is issued against a certification body or training provider criteria, not against Codex, which certifies nobody. Where a customer will accept it, it is a useful document. Where a customer means a GFSI-recognised scheme, it is not a substitute, and the difference is worth establishing before an audit is booked.

Certification, and why it may not apply

There is no certification against HACCP itself, because Codex is a standards body rather than a certification programme owner. A HACCP certificate is issued against a certification body's or a training provider's own criteria.

A site whose customers ask for proof of HACCP usually satisfies them with a GFSI-recognised certification, all of which require a HACCP-based plan, or with a regulatory inspection record where HACCP is mandated by rule.

GFSI recognition

HACCP is not a GFSI-recognised certification programme and cannot be, because it is a method rather than a programme. Every GFSI-recognised scheme requires a HACCP-based plan.

GFSI does not certify anybody and there is no GFSI certificate. What GFSI recognition actually means.

Where this meets United States regulation

A site selling into the United States is held to 21 CFR whether or not it holds a certification. These are the parts that bear on HACCP, reproduced in full on this site because title 21 is United States public domain.

What goes wrong in practice

Certification is a statement about a system on the day it was audited. FDA recall records are what happened afterwards, across the whole industry, and these are the hazards that appear most often in the records a plan built to HACCP is meant to control.

What Krolda does with HACCP

Krolda maps documents to HACCP plan elements by clause identifier, the same way it maps a scheme clause. The Codex text is published openly by FAO and WHO.

Questions

What are the seven principles of HACCP?: The seven HACCP principles are: conduct a hazard analysis; determine the critical control points; establish validated critical limits; establish a system to monitor each critical control point; establish the corrective action to take when monitoring shows a deviation; validate the plan and establish verification procedures; and establish documentation and records.
Is HACCP a certification?: No. HACCP is a method set out by the Codex Alimentarius Commission and no organisation certifies against it as an author. Certificates described as HACCP certificates are issued by certification bodies or training providers against their own criteria. A certificate that a retailer will accept is normally a GFSI-recognised scheme certificate, and every one of those requires a HACCP-based plan inside it.
Is HACCP required by law in the United States?: For some foods. The FDA requires HACCP for juice under 21 CFR part 120 and for fish and fishery products under 21 CFR part 123. USDA FSIS requires it for meat and poultry under 9 CFR part 417. For most other FDA-regulated food, 21 CFR part 117 requires a food safety plan with a hazard analysis and preventive controls, which is built on the same logic without using the term critical control point for every control.
What is the difference between a CCP and a prerequisite programme?: A critical control point is a step where control is essential and a measurable critical limit can be set and monitored, such as a cook step with a time and temperature. A prerequisite programme is a condition that must be in place for the plan to work at all, such as cleaning, pest control and personnel hygiene. Prerequisite programmes are auditable and necessary; they are not critical control points because no single measurable limit at a single step controls the hazard.

The other standards

Whatever a site is held to, the audit asks for the evidence behind each clause, and finding it is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.