The most costly approach in food safety is to take a sample after producing the product and wait for the analysis result. Analysis only tells you the condition of that one sample, and by the time the result arrives, the batch has already been shipped. HACCP reverses this logic: instead of looking for the hazard after the product has been made, it identifies in advance at which point in production it can be controlled, and monitors that point continuously. Below, we look at how the system is built — from hazard analysis to identifying critical control points, from the monitoring and verification chain to implementation steps on site — and where it is commonly built incorrectly.
Process control instead of final inspection: why HACCP exists
HACCP stands for Hazard Analysis and Critical Control Points. The core idea is simple: to identify, in advance, the hazards within a food business that could make consumers ill, to determine the points at which these hazards can be prevented, eliminated or reduced to an acceptable level, and to keep those points under continuous control using measurable limits.
It is easy to see why this is necessary with an example. You produce a batch of a thousand jars and send five of them for analysis. If these five samples come back clean, what do you actually know about the remaining nine hundred and ninety-five? Statistically, very little. However, if you have continuously recorded that the heat treatment process producing that batch reached the target temperature at the product's core and held it there for the required time, you can speak for the whole batch. HACCP shifts the evidence from the product to the process.
The system is built on the seven principles defined by the Codex Alimentarius: carrying out a hazard analysis, determining the critical control points, establishing critical limits, setting up a monitoring system, defining corrective actions, establishing verification procedures, and setting up a record-keeping system. These seven principles are preceded by five preliminary steps: assembling the team, describing the product, identifying its intended use, drawing up the flow diagram, and confirming the flow diagram on site.
HACCP is not a document in itself but the day-to-day way a business operates. Food safety management system standards such as ISO 22000 and FSSC 22000 incorporate HACCP and add management system requirements around it, namely policy, objectives, internal audit and management review. In Turkey, the obligation for food businesses to establish a food safety management system is set out in legislation; for businesses that export or supply chain retailers, certification is, in practice, a market requirement.
The spirit of the system is summed up in one sentence: write what you do, do what you write, prove what you did. When an auditor comes, the question they ask is almost always the same: how do you control this hazard, and what record can you show me to prove it?
Prerequisite programmes: the foundation of the system
The most common mistake in HACCP is starting to look for critical control points directly, without first establishing the prerequisite programmes. Prerequisite programmes provide the basic hygiene conditions of the production environment and form the foundation on which the HACCP plan is built. Without this foundation, the HACCP plan stays on paper: every hazard starts to look like a critical control point, and the system becomes unmanageable.
Cleaning and disinfection: It must be documented which surface is cleaned how often, with which product, at what concentration, for what contact time and by whom. The effectiveness of cleaning is verified not by visual inspection but by surface swab samples or rapid hygiene tests. Storing cleaning chemicals outside the production area, locked and labelled, is also part of this programme.
Personnel hygiene: Handwashing points, the clothing-change flow, the ban on jewellery and watches, the wound-dressing rule, the illness reporting obligation and health certificate monitoring. Staff flow must be designed to prevent return from a clean zone to a dirty zone.
Maintenance and calibration: Planned maintenance of equipment, suitability of food-contact surfaces, the use of food-grade lubricants in maintenance, the glass and hard plastic inventory and the breakage procedure. Calibration of measuring equipment is a separate heading: a record from a thermometer whose calibration is not documented carries no evidential value at audit.
Pest control: Bait and trap layout plan, regular inspection records, door and window sealing, and cleanliness of the exterior façade. This programme is usually carried out by an external contractor, but responsibility remains with the business; reports must be read and the root cause of recurring findings must be addressed.
Water and ice: The mains or well water must be of drinking-water quality, subject to periodic analysis, with clean storage tanks and lines, disinfection where necessary and free chlorine monitoring. Where ice comes into contact with food, the water used to produce it is subject to the same requirement.
Other programmes: Supplier approval and incoming goods acceptance, allergen management, waste management, foreign matter control, traceability and recall, transport and storage conditions, and training. For the field application of these programmes, see our article on food safety and hygiene in production.
Hazard analysis: what, where, how serious
Hazard analysis is the most labour-intensive and most frequently skipped step of HACCP. Without a properly conducted hazard analysis, the critical control points identified are arbitrary. The analysis is carried out separately for each step in the production flow chart: raw material acceptance, storage, pre-processing, heat treatment, cooling, packaging and dispatch.
Hazards fall into four categories. Biological hazards are pathogenic bacteria, viruses and parasites; they are the group most often responsible for serious outcomes in food safety. Chemical hazards are cleaning chemical residues, pesticide residues, heavy metals, mycotoxins and substances migrating from materials not suitable for food contact. Physical hazards are fragments of metal, glass, hard plastic, stone and bone. Allergens are treated as a separate heading, because their control method differs from the others — they cannot be destroyed by heat treatment and can only be managed through segregation and labelling.
Two questions are asked for every hazard: what is the likelihood of occurrence, and how severe is the consequence if it does occur? The intersection of these two axes determines whether the hazard is deemed significant. A hazard with a low likelihood but a severe consequence may take priority over one with a high likelihood but a mild consequence. The assessment must always be recorded together with its rationale; the sentence explaining why a hazard was deemed insignificant is the thing most often questioned during an audit.
The most common mistake made in the analysis is describing the hazard too generically. The term "contamination" is not a hazard definition. Which hazard, from which source, at which step, through which mechanism? For example, at the vegetable washing step, pathogen contamination from wash water and contamination from staff hands require different control measures; if you merge the two into a single line, your control measure becomes blurred as well.
A control measure is defined for every significant hazard. The control measure may form part of a prerequisite programme (staff hygiene, cleaning) or be a process step (heat treatment, metal detector, cooling). This distinction forms the basis of the next step: determining which points are critical control points.
How is a critical control point determined?
A critical control point (CCP) is a step at which control can be applied and is essential to prevent, eliminate or reduce a hazard to an acceptable level. Two words here are decisive: applicable and essential. Where the control can be carried out at another step, that step is not a CCP; likewise, if the loss of control does not directly affect consumer health, it is not a CCP either.
The Codex decision tree is used to make this determination. Four questions are asked in sequence for every significant hazard and every process step. First question: is there a control measure for the hazard at this step? If not, and control is required at this step, the process must be redesigned. Second question: is this step specifically designed to eliminate the hazard or reduce it to an acceptable level? If the answer is yes, the step is a CCP. Third question: could the hazard reach an unacceptable level, or increase, at this step? Fourth question: will a subsequent step eliminate this hazard or reduce it to an acceptable level? If a subsequent step does so, the current step is not a CCP.
In practice, the typical CCPs are well known. Heat treatment — that is, pasteurisation, cooking or sterilisation — is almost always a CCP, as it is specifically designed to reduce pathogens. The metal detector or screening step is the final control point for physical hazards. Cooling after heat treatment is defined as a CCP because it limits the time spent passing through the temperature range in which spore-forming bacteria can multiply. Acidification and pH adjustment are CCPs because they underpin safety in acidic products. Allergen labelling is also treated as a CCP in many businesses.
The two most common mistakes are the exact opposite of each other. The first is defining too many CCPs: a plan with twenty CCPs cannot be followed, records cannot be completed, and within a few months the system survives only on paper. Turning matters that could be managed through prerequisite programmes into CCPs is the main cause of this bloat. The second is defining no CCPs at all, or skipping a genuine control point; this simplifies the system on paper but leaves the hazard unaddressed.
Some standards use the concept of an operational prerequisite programme for steps that are not as critical as a CCP but need to be monitored more closely than a standard prerequisite programme. This intermediate category helps keep the plan realistic: only the small number of points that are genuinely critical remain CCPs, while the rest are monitored under a defined but more flexible arrangement.
Critical limit, monitoring and corrective action
A critical limit is set for each CCP. The critical limit is the boundary between what is acceptable and what is not, and it must always be measurable. Temperature, time, pH, water activity, salt concentration and metal detector sensitivity are measurable; expressions such as "well cooked" or "cold enough" are not critical limits. The limit is based on legislation, scientific literature or the company's own validation study, and this evidence is kept on file.
Monitoring is the planned measurement and observation that shows whether the critical limit is being maintained. The monitoring plan answers five questions: what will be monitored, how it will be monitored, at what frequency, who will monitor it, and where the record will be kept. The decision on frequency matters: continuous monitoring, such as the uninterrupted recording of heat treatment temperature, is the strongest option, as it removes any question over product made between two measurements. With intermittent monitoring, once a deviation is found, all product made since the last satisfactory measurement becomes suspect; frequency is set with this cost in mind.
The person carrying out the monitoring must be trained and must know what to do on seeing a deviation. An operator who fills in the record in bulk at the end of the shift makes the system work on paper but not on the shop floor. Records are kept at the moment of measurement, signed by the person taking the measurement; if a correction is needed afterwards, the original entry is struck through with a single line and the new value, date and signature are added.
Corrective action is the pre-written record of what is to be done when a critical limit is exceeded, and it has two strands. The first strand concerns the product: what happens to the product made during the deviation? It is quarantined, reworked, downgraded or destroyed; the person authorised to make this decision is identified by name. The second strand concerns the process: what caused the deviation, and what will be done to stop it happening again? A corrective action that only segregates the product without investigating the cause will simply reproduce the same deviation the following week.
Corrective action records are the system's most valuable data. How many deviations occur per year, which CCP they cluster around, and which causes recur reveal the business's real weak points. If these records are not reviewed at management review, the system is not learning.
Verification, validation and record-keeping
Verification must not be confused with monitoring. Monitoring shows that the process is currently under control; verification proves that the system as a whole is working, that monitoring is being carried out correctly, and that the plan is still valid. Monitoring is carried out by the operator on the line, while verification is usually carried out by the food safety team or an independent person.
Verification activities include: reviewing records, equipment calibration, product and surface microbiological analyses, internal audits, evaluation of consumer complaints, and independent checking of CCP monitoring records. The role of analysis here is notable: analysis is not carried out to prove that the product is safe, but to verify that the system is working. This distinction allows you to use both your sampling plan and your analysis budget wisely.
Validation is a different and more fundamental step than verification: it shows whether the control measure you have chosen actually controls the hazard. For example, you must demonstrate that the heat-treatment temperature-time pair you have set sufficiently reduces the target micro-organism, either on the basis of the literature or through temperature-distribution and core-temperature measurements carried out on your own product. Validation is carried out once, when the system is set up, and is repeated whenever the product, packaging, equipment or recipe changes.
Record-keeping is the system's memory. The length of time records are retained is determined with the product's shelf life in mind; the general approach is a period that clearly exceeds the shelf life. Where electronic records are used, immutability and backup must be ensured. With paper records, the most common problems are incompletely filled-in rows and blank signature fields; an empty cell is read, during an audit, as meaning the task was not carried out.
Traceability is a separate but connected chain of records: which raw material batch went into which production batch, and which production batch went to which customer? Without this chain in place, a recall cannot be carried out. Running a recall drill at least once a year is the most practical way of showing that the chain genuinely works; the drill measures how many minutes it takes to trace a batch's entire route.
Implementation steps on site and common mistakes
For a business setting up a system from scratch, the sequence is as follows. First comes top management commitment and the allocation of resources; without this, the system is reduced to the personal effort of the quality manager and collapses once that person leaves. The second step is setting up a multidisciplinary food safety team, with one representative each from production, quality, maintenance, warehousing and purchasing. The third step is drawing up the prerequisite programmes and beginning to implement them on site.
The fourth step is defining the product and writing its intended use: composition, packaging, shelf life, storage conditions, target consumer group, and whether the product will be cooked or consumed directly. If a vulnerable consumer group is targeted, the risk assessment is tightened accordingly. The fifth step is drawing the flow diagram and, most importantly, verifying it by walking the site; the diagram drawn at a desk and the reality of the line are almost always different.
From the sixth step onwards, the seven principles are applied: hazard analysis, determining CCPs, critical limits, monitoring, corrective action, verification and record-keeping. Staff training, trial implementation and the first internal audit follow. Running the system on real production data for at least a few months is the most useful thing to do before applying for certification.
Common mistakes can be gathered into a list:
- Using a ready-made file prepared by a consultant without adapting it to the business; going into an audit with another facility's flow diagram.
- Starting to determine CCPs before the prerequisite programmes are in place.
- Writing critical limits in terms that cannot be measured.
- Setting monitoring frequency unrealistically often and then filling in the records in bulk afterwards.
- In corrective action, only segregating the product without investigating the root cause.
- Neglecting equipment calibration and keeping records with uncalibrated devices.
- Failing to update the hazard analysis when the recipe, equipment or supplier changes.
- Treating allergen management as a labelling matter only, without accounting for line cleaning and production sequence.
- Only remembering the system during audit week.
One final point: HACCP does not end at the facility gate. Once the product enters storage and is loaded onto a vehicle, temperature, hygiene and traceability requirements continue. We covered the transport leg of the cold chain in our refrigerated transport guide, and the storage leg in the article explaining how a cold storage facility works.
At İTS Gıda & Lojistik, we are planning the food safety management system for our processing and storage facility currently under construction in Milas not as a file added afterwards, but as part of the line's design. Get in touch with us to work together on your processing, storage and distribution processes.
Bodrum Beton
Bodrum Boru
İTS Maden
İTS Denizcilik