HACCP plan explained: the 12 steps, a worked hazard analysis, and where CCPs end and OPRPs begin

Most HACCP plans that fail an audit do not fail on microbiology. They fail on paperwork logic: a flow diagram that does not match what happens on the floor, a hazard analysis with no column explaining why anything was rated the way it was, a critical limit nobody can point to evidence for, and a plan in which either everything is a critical control point or nothing is.

That is good news, because paperwork logic is fixable. This article walks the whole method in plain English — the twelve steps, the seven principles inside them, a worked hazard analysis you can copy the habits from, the decision-tree questions that determine a CCP, and the split between a CCP and an OPRP that ISO 22000 adds and Codex does not. The free template at the end covers the first five steps, which is where more studies go wrong than anywhere else.

A note on scope. This is Qlause's own explanation of the HACCP method, written in our own words; it reproduces no Codex, ISO or scheme text, and the worked example is illustrative rather than a model plan you can adopt. Work from your licensed standards, your national food legislation and your scheme requirements, and validate every limit on your own product and process.

The twelve steps, and the seven principles inside them

HACCP is usually described as seven principles. In practice it is run as twelve steps, because the first five happen before any hazard is analysed and the seven principles are steps six to twelve.

Assemble the HACCP team. Names, functions and the competence that qualifies each person. Bought-in expertise is allowed, and for a difficult hazard it is often necessary — record who and what.
Describe the product. Composition, allergens, water activity and pH, packaging, shelf life and the evidence behind it, storage and distribution.
Identify the intended use. How the consumer will actually use it, who the consumer is, and what foreseeable misuse looks like.
Draw the flow diagram. Every step in product order.
Confirm the flow diagram on site. Walk the line and correct the diagram where it is wrong.
Conduct the hazard analysis. (Principle 1)
Determine the critical control points. (Principle 2)
Establish validated critical limits. (Principle 3)
Establish a monitoring system. (Principle 4)
Establish corrective actions. (Principle 5)
Establish verification procedures. (Principle 6)
Establish documentation and record keeping. (Principle 7)

The sequence matters more than it looks. Nearly every weak plan we see has skipped or rushed steps two to five, and then spent enormous effort on steps six onwards that the foundation could not support.

Steps 2 and 3: the two sentences that decide half your plan

Two fields on the product description do more work than all the others combined: how the consumer will use it, and who the consumer is.

Take a cooked, sliced chicken breast, vacuum packed and sold chilled. If it is eaten cold, straight from the pack, there is no consumer step that would destroy a pathogen — so anything that survives your process or recontaminates the product afterwards reaches someone's plate exactly as it left your line. And if the intended consumers are the general retail population, that includes the elderly, pregnant women, infants and the immunocompromised, because nothing on the label excludes them.

Those two sentences are why Listeria monocytogenes gets the highest severity rating available in that study, and why the whole plan is built around post-cook hygiene rather than around the cook. Change either sentence — say the product is sold frozen for cooking, or supplied only to a customer who will heat it — and the severity ratings, the controls and the monitoring burden all move with it.

So write those fields honestly, and write them first. Assume the consumer does the easiest thing rather than the correct thing: eats it a day past the use-by date, keeps it in a fridge running at 7 degrees, leaves the opened pack for a week. Foreseeable misuse belongs in the analysis, not in a footnote.

The physical and chemical characteristics do the other half of the work. Water activity, pH, salt on the water phase and any preservative system decide which pathogens can grow at all. A plan that does not record them has no basis for saying a hazard is unlikely, which means it has no basis for its likelihood ratings either.

Steps 4 and 5: the flow diagram, and the walk nobody does

A flow diagram should show every step the product actually takes, and most show only the operations. The steps that get left out are the ones where hazards live:

Receiving, despatch and the storage between every operation. Growth happens while product waits, not while it is being processed.
Transport between buildings, and any step where product sits in a queue.
Rework and waste loops, with the written rule for where rework re-enters. Undrawn rework is the single most common gap found when a diagram is finally walked.
What is added at each step — ingredients, water, air, packaging, processing aids. Every input is a route in, and every one of them is somebody's supplier.
The parameters that decide safety at each step: time, temperature, pH, water activity, speed.
The hygiene zone of each step, and every point where product, people or equipment cross a zone boundary. For a cooked ready-to-eat product, the zone crossings are where the hardest hazard in the study lives.

Then there is step 5, which is a requirement in its own right and the one most sites treat as a formality: walk the line during production — all shifts, and including a changeover — and confirm the diagram is what actually happens.

It is worth doing properly because it almost always finds something. In the worked example that runs through the Qlause HACCP toolkit, the walk found two errors: a zone transfer drawn as a doorway when it is actually a hatch, and slicing waste that was quietly going back into the marinade batch on night shift — a rework loop that took cooked product back to the raw side and that nobody had drawn, because nobody on days knew it happened. That is a normal outcome, not an unusual one.

An unconfirmed flow diagram is a proposal. And an auditor will often test it the fastest way available, by walking the line with your diagram in their hand.

Principle 1: the hazard analysis

Now the analysis. One row per hazard per step, working down the flow and taking each step through all four hazard types:

Biological — pathogens and their toxins. Ask three separate questions at every step: can it get in here, can it survive here, can it grow here?
Chemical — substances that make the food unsafe, whether they arrive with the material, are added in error, or come off the plant. Cleaning chemical residue, veterinary residues, mycotoxins, non-food-grade lubricant, migration from packaging.
Physical — foreign matter that can injure. Judge it by injury potential, not by how ugly it looks in a photograph.
Allergen — treated separately because the food is safe for almost everyone and dangerous for a few, and because the control is usually segregation, cleaning and correct labelling rather than a process step.

Each hazard gets a likelihood and a severity. Likelihood is how likely the hazard is to be present at an unacceptable level at this step, given the prerequisite programmes you already have in place — rated on what actually happens on your site, using your own complaint, testing and deviation history, not the worst case in the literature. Severity is how bad the consequence is for the person who eats it, and it belongs to the consequence: no control ever lowers it.

Multiply them, apply a documented rule, and you get significant or not significant. Any defensible rule works, but two things about it matter far more than the numbers. It has to be written into your HACCP procedure, and it has to be applied the same way every time. Consistency is what an auditor tests; the exact thresholds rarely are.

One refinement worth building in: treat the highest severity band as significant at any likelihood. The reason a life-threatening hazard is rare on your site is usually that a prerequisite programme is holding it down — which is a control decision worth recording, not an argument for dropping the line.

A worked hazard analysis, in six lines

From the cooked ready-to-eat chicken example, six of sixteen lines. Note that half of them are not significant, and that each of those still carries a sentence explaining why:

Receiving raw fillet — biological. Salmonella and Campylobacter present on incoming raw poultry. Likelihood 5, severity 4. Significant, because raw poultry is assumed contaminated and the product is eaten without further cooking — but nothing at receiving eliminates it, so the control belongs to the cook further down the line.
Receiving raw fillet — chemical. Veterinary medicine residues above the legal maximum. Likelihood 1, severity 4. Not significant: no site process can reduce a residue, so control sits with the supplier — an approved supply base with a residue monitoring plan, results per batch and no positive in eight years of records. Held by the supplier approval prerequisite programme.
Receiving raw fillet — physical. Bone fragments in a boneless fillet. Likelihood 2, severity 3. Not significant: purchased to a boneless specification with the supplier's own bone-check step verified at audit, plus incoming sampling; two complaints in six years, both traced and closed. Worth noting the metal detector downstream does not see bone, so the control really is the specification and the incoming check.
Cooking — biological. Survival of vegetative pathogens through an under-processed cook. Likelihood 3, severity 5. Significant — the only lethality step in the process, and failure reaches the consumer directly.
High care, slicing — biological. Recontamination with Listeria monocytogenes from surfaces, equipment, air or people. Likelihood 3, severity 5. Significant — no step follows that would destroy it, the product supports growth at chill temperature, and vulnerable consumers are not excluded.
Labelling — allergen. The wrong label applied, so the allergen declaration does not match the product in the pack. Likelihood 3, severity 5. Significant — the single most common cause of allergen recalls, on a line that changes over daily.

The justification is the part that does the work. An auditor reads that column first, because it is where the study either shows its reasoning or does not. A hazard analysis that records only the exciting lines and leaves the rest blank is the one that collects a finding: a blank field reads as an omission, and a short sentence reads as a decision.

Principle 2: determining the critical control points

Every significant hazard now goes through a determination. The classic sequence is four questions; here they are in plain English, with a fifth that separates a CCP from an OPRP.

Is there a control measure for this hazard, at this step or anywhere later? If not, the hazard is uncontrolled — and if control is necessary for safety, the answer is not a rating. Change the step, the process or the product, then analyse again.
Is this step specifically designed to eliminate the hazard, or reduce it to an acceptable level? "Designed to" is the test: a cook, a metal detector, a pasteuriser, an acidification step. Storage and handling steps are almost never designed to.
Could contamination occur, or could the hazard increase, to an unacceptable level at this step? If no, this step is not where the hazard is decided.
Will a later step eliminate the hazard, or reduce it to an acceptable level? If yes, the control belongs to that step. Be strict here: the later step must actually deal with this hazard, and heat does not destroy everything — heat-stable toxins and chemical hazards survive the cook.
Can the control measure be monitored against a measurable limit, quickly enough to identify and hold the exact product affected? This is the CCP or OPRP split, and it is where a lot of plans go quietly wrong.

CCP, OPRP or PRP

Three answers, and the test is not how important the control feels — it is what kind of control it is.

A prerequisite programme keeps the whole site fit to make food. Cleaning and sanitation, pest control, maintenance, personal hygiene, supplier approval, glass and brittle plastic control. It is not aimed at one hazard at one step, and it is not chosen by the hazard analysis: it is what the hazard analysis assumes is already there.
A critical control point is applied at a specific step, has a measurable and validated critical limit, and is monitored fast enough that a breach lets you identify and hold the exact product affected before it leaves your control.
An operational prerequisite programme sits between them. It controls a significant hazard at an identified step, but through action criteria and observation rather than a limit you can read in real time. Loss of control is usually found by verification after the fact, so the response has to include deciding what to do with product already made.

The honest test is a single question: if this control failed right now, would I know before the product left, and could I say exactly which product was affected? Yes to both, against a measured limit, is a CCP. Otherwise it is an OPRP — and an OPRP is not a weaker answer, it is the accurate one.

In the worked example, that logic produces three CCPs and three OPRPs. The cook is a CCP: core temperature and hold time are measured on every batch against a validated limit, and a failure identifies one batch that is still in the cook room. Metal detection is a CCP: certified test pieces, a verifiable sensitivity, and a failed check that holds everything back to the last good one. High-care hygiene against Listeria is an OPRP, because there is no measurement on the product that would tell you in time — control is zoning, validated sanitation and environmental monitoring, verified by trend. Label verification at changeover is an OPRP too: real control, but the interval between checks defines the quantity at risk, and product packed between two checks has already been labelled.

The two ways this goes wrong

Everything becomes a CCP. A plan with twenty critical control points is a plan nobody can monitor. The monitoring collapses into paperwork that gets signed rather than done, and the records stop meaning anything — which is worse than having fewer, real CCPs supported by strong prerequisite programmes.

Nothing is a CCP. The mirror-image failure, usually in a process that has an obvious kill step. If you cook, pasteurise, acidify or detect metal, and your plan has no critical control points at all, that is a finding waiting to happen.

Lines will move between the two plans as a study matures. A control you wrote as an OPRP turns out to have a genuine measurable limit and real-time monitoring, so it becomes a CCP; or a "CCP" turns out to be checked twice a shift by observation, so it moves the other way. That movement is the study getting more honest, not a mistake being corrected.

Principle 3: critical limits, and the word "validated"

A critical limit is a measurable value separating acceptable from unacceptable. Three properties make it a limit rather than an opinion: it is measurable in real time, it is set with enough margin that reaching it does not mean unsafe product has already gone, and it is validated.

Validation is the one that gets skipped. It means evidence, gathered before you rely on the control, that the control is capable of doing what you claim — a thermal validation study behind a cook temperature and hold time, a chilling trial at maximum load, a sanitation validation on the equipment as it is actually used, an equipment qualification behind a metal detector's sensitivity.

The finding auditors write most often on a HACCP plan is a critical limit with no validation basis. "Because we have always used it" and "because it is in the industry guide" are not the same thing as evidence on your product, at your loading pattern, in your equipment. Where you do rely on published guidance, cite it and show it applies to your product.

Keep three words apart, because they get confused constantly:

Validation happens before, and asks can this control work?
Monitoring happens during, and asks is it under control right now?
Verification happens after, and asks did it work, and is the plan being followed?

Principles 4 and 5: monitoring, correction and corrective action

Monitoring has to answer four questions on the plan — what, how, how often, and by whom — and it has to be fast enough to act on the affected product before it leaves your control. A daily check on a control that produces eight hours of product between checks is not monitoring that control; it is sampling it.

The response to a deviation splits into two things that plans routinely merge:

The correction deals with the product in front of you: hold under positive release, re-process within the documented rework rule, or destroy.
The corrective action deals with the cause: the loading pattern that made the oven under-cook, the changeover clearance that let old labels reach the line, the chiller that was never re-balanced after the last capacity increase.

Auditors look for both, and they look for the second one to have actually happened. A file of deviations that were all closed by holding product and nothing else says the same cause is still there.

Principles 6 and 7: verification and records

Verification is where a plan proves it is real: reviewing monitoring records before release, calibrating the devices your CCP decisions rest on, testing product and environment, auditing internally against the plan, and running a traceability exercise that tests whether you can actually retrieve product in the time your procedure claims.

Add reverification to the schedule as a separate line: the review that asks whether the study itself is still right. It is triggered by any change to product, process, equipment, packaging, legislation, consumer or new hazard information — and it runs at a defined interval anyway, because plenty of things change without anyone raising a change request.

For records, name the actual record. A plan that says "as per procedure" in the records column has not documented anything, and it is the first place an auditor will pull the thread.

Where ISO 22000 and FSSC 22000 differ from Codex

If you are certified rather than just compliant, the vocabulary shifts slightly.

Codex names one outcome from the determination: the critical control point. ISO 22000:2018 splits control measures into CCPs and OPRPs, and calls the two plans together the hazard control plan. That is why the OPRP plan is not an optional extra in a certified system: it is half the deliverable, and a plan that lists only CCPs has left the other half undocumented.

ISO 22000 also asks for the OPRP to be held to the same standard as the CCP — action criteria, monitoring, correction and corrective action, verification and records. The only real differences are that a critical limit becomes an action criterion, and that the justification for the criterion replaces the validation of the limit as the thing you have to be able to show.

FSSC 22000 builds directly on ISO 22000 and adds its own requirements on top, so a certified site needs both plans and needs them to line up with the prerequisite programmes underneath. If you are working towards the Version 7 upgrade audit, the FSSC 22000 Version 7 guide covers what changed and by when, and the free V7 masterclass walks it in about eighteen minutes.

Six findings auditors write most often

The flow diagram does not match the line. Usually rework, a zone crossing, or a step added since the last revision. Fixed by walking it and signing the confirmation.
No justification column, or an empty one. The ratings are there; the reasoning is not, so nobody can tell whether the study thought about the hazard or copied it.
A critical limit with no validation basis. The limit may well be right. There is just nothing on file that says why.
Correction and corrective action are the same sentence. Product was held every time and the cause was never removed.
Every significant hazard became a CCP. Monitoring that nobody can sustain, so the records are signed rather than done.
The study was never reverified after a change. New equipment, a new supplier, a recipe change, a new customer specification — and the plan still describes the old process.

None of these are microbiology problems. All six are fixable in an afternoon each, with the documents you already have.

Where to start

Start where most studies are weakest: the first five steps. Fill in the product description properly, and be honest about who eats the product and how. Draw the flow diagram including the storage, the transport, the rework and the zone crossings. Then walk the line, correct what you find, and sign it.

The free HACCP Flow Diagram and Product Description Template below covers exactly those steps — both documents with a note on every field explaining what belongs there and why it matters later, the same cooked ready-to-eat worked example used throughout this article, and a twelve-point health check with a live score for the documents you already have. Run the health check first; most sites lose their marks on the same four questions.

When you are ready for steps six to twelve, the HACCP Plan Toolkit picks up where the free file stops: the hazard analysis with significance calculated from likelihood and severity, the five determination questions with the CCP, OPRP or PRP outcome answered by formula, both plans, a validation and verification schedule with live overdue flags, and the full worked example carried all the way through to sixteen hazard lines, three CCPs and three OPRPs.