What Are the 7 Principles of HACCP and the 12-Step Codex Architecture
The 7 principles of HACCP (Hazard Analysis and Critical Control Points) form an engineering methodology for controlling biological, chemical, physical, radiological, and allergen hazards directly inside a food production process. Relying on end-product laboratory testing alone doesn't work at industrial scale: testing a 0.1% statistical sample from a finished batch leaves a massive mathematical probability of missing localized Salmonella or metal contamination. A properly engineered HACCP system builds measurable barriers right on the processing line. Pillsbury, the U.S. Army Laboratories, and NASA originally developed this framework in the 1960s to manufacture pathogen-free rations for astronauts in orbit.
The international baseline for the methodology is the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969), revised in 2022/2023. That code establishes a strict 12-step implementation sequence: the first 5 steps are preliminary engineering tasks, while Steps 6 through 12 execute the 7 principles of HACCP.
In Ukraine, Articles 20 and 21 of the Law of Ukraine No. 771/97-VR "On Basic Principles and Requirements for Food Safety and Quality" legally require all food business operators (beyond primary agriculture) to develop, validate, and maintain permanent HACCP-based procedures. The specific technical rules for Ukrainian facilities are detailed in Order of the Ministry of Agrarian Policy and Food of Ukraine No. 590 of 01.10.2012, while state inspectors from the State Service of Ukraine on Food Safety and Consumer Protection (SSUFSCP / Держпродспоживслужба) audit compliance under Law of Ukraine No. 2042-VIII.
Before you map out critical control points in the food industry, you have to separate Prerequisite Programs (PRPs) from the HACCP plan itself. PRPs establish hygienic environmental conditions across the entire site: potable water treatment, pest control, hygienic zoning with positive air pressure in high-care rooms, staff hygiene, preventive maintenance, and Clean-in-Place (CIP) sanitation. Your HACCP plan sits on top of those functioning PRPs to target specific process hazards. For a broader overview of the legal framework and project stages, see our complete guide to HACCP certification.
The 5 Preliminary Steps (Steps 1-5) Before Applying the 7 HACCP Principles
You can't jump straight to Principle 1 without completing the 5 preliminary steps mandated by Codex CXC 1-1969 and Section III of Order No. 590. Auditors check these five steps first because they define the physical, chemical, and operational boundaries of your hazard analysis.
Step 1. Assemble a Multidisciplinary HACCP Team
One quality manager sitting in an office can't write a realistic HACCP plan alone. Codex requires a multidisciplinary team appointed by formal management order, bringing together 4 to 6 specialists who understand the actual equipment and microbiology on the floor:
- HACCP Team Leader (Food Safety Team Leader): typically the Quality Director or Chief Technologist, holding documented training in HACCP principles and ISO 22000;
- Production Technologist: understands thermal kinetics, cooling rates, fermentation curves, and recipe tolerances;
- Chief Maintenance and Instrumentation Engineer, managing preventive maintenance schedules, NSF H1 food-grade lubricants, PT100 temperature sensors, and flow diversion valves;
- Microbiologist or Laboratory Head, interpreting microbial criteria, environmental swabbing data, and physicochemical test results;
- Warehouse and Procurement Manager, controlling raw material intake, cold-chain docking temperatures, packaging specs, and lot traceability.
If a smaller plant doesn't employ a full-time microbiologist or thermal process authority, Order No. 590 permits bringing in external specialists (such as Ekontrol food safety engineers) to design and validate the plan, while internal staff run day-to-day monitoring.
Step 2. Describe the Product and Raw Materials in Engineering Detail
Every product (or product family sharing identical processing steps and hazard profiles) needs a technical food safety specification. Copying a commercial marketing sheet won't pass an audit. You need the intrinsic microbial growth parameters:
- Water activity ($a_w$): for instance, $a_w > 0.98$ in chilled raw meat or fluid milk (supporting rapid bacterial growth), $a_w \le 0.85$ in dry-cured sausages or sweetened condensed milk (inhibiting most vegetative bacterial pathogens), and $a_w < 0.60$ in flour or milk powder;
- Acidity ($\text{pH}$): the $\text{pH} = 4.6$ threshold is the biological cutoff below which Clostridium botulinum spores cannot germinate and produce neurotoxin;
- Complete ingredient composition, preservatives (sodium nitrite E250, sorbates, benzoates), and presence of the 14 statutory allergens regulated under Law of Ukraine No. 2639-VIII and EU Regulation 1169/2011;
- Packaging atmosphere and barrier properties: Modified Atmosphere Packaging (MAP, such as 70% $\text{N}_2$ / 30% $\text{CO}_2$), vacuum packaging (which creates anaerobic conditions requiring strict control of non-proteolytic C. botulinum and Listeria monocytogenes), or aseptic filling;
- Storage temperature limits (e.g., $+2,^\circ\text{C}$ to $+6,^\circ\text{C}$), distribution conditions, and scientifically validated shelf life.
Step 3. Identify Intended Use and Vulnerable Consumer Groups
Your team must state clearly whether the product is Ready-to-Eat (RTE) or requires thorough cooking by the consumer before consumption. You also have to account for foreseeable consumer misuse, such as a buyer microwaving a frozen raw poultry product for 45 seconds instead of baking it to an internal temperature of $+75,^\circ\text{C}$. Equally important: document whether the product reaches general consumers or vulnerable population groups (infants, pregnant women, elderly patients, immunocompromised individuals, or people with severe food allergies). If you supply schools, hospitals, or baby food lines, your risk matrix thresholds must be significantly stricter.
Step 4. Construct the Process Flow Diagram and Facility Layout
The HACCP team maps every single operational step under the facility's control, from receiving raw materials, primary packaging, and process water right through to final dispatch. A complete engineering flow diagram includes:
- chronological sequence and interaction of all equipment and holding tanks with target process parameters ($T, t, P$, flow rate);
- entry points for raw ingredients, potable water, culinary steam, compressed air, and packaging gases;
- rework loops, intermediate buffer storage, and product hold points;
- exit points for waste, animal by-products, rejects, and sewage. Alongside the block diagram, prepare a plant zoning schematic mapping the physical movement of raw materials, finished products, personnel, waste bins, and air pressure gradients to eliminate cross-contamination between dirty (raw) and high-care (post-lethality) zones.
Step 5. On-Site Verification of the Flow Diagram Across All Shifts
Paper diagrams almost always miss something happening on the shop floor. The entire HACCP team must walk the production line step by step to verify the flow diagram against physical piping and operator routines. Don't just walk the line at 10:00 AM on Tuesday. Verify it during the night shift, during product changeovers, and during CIP wash cycles. During night-shift walkthroughs, Ekontrol auditors frequently uncover temporary flexible bypass hoses, unrecorded rework tubs sitting at ambient temperature, or sifter screens removed to speed up viscous pumping. Every discrepancy must either be physically removed or added to the diagram and evaluated in Principle 1.
Principle 1 (Step 6): Conduct a Hazard Analysis and Risk Assessment Matrix
HACCP Principle 1 (Step 6 of Codex) requires the team to list all reasonably foreseeable hazards at each step of the verified flow diagram, evaluate their risk, and specify control measures. If your team misses a real hazard here, such as enterotoxin formation by Staphylococcus aureus during warm batter holding or undeclared sesame cross-contact on a shared conveyor, the rest of your HACCP plan won't catch it.
Five Hazard Categories in Modern Food Safety Engineering
At every process step from Step 1 (Raw Material Intake) to final dispatch, evaluate five distinct hazard classes and state the exact biological agent, chemical compound, or physical object plus the mechanism (initial presence, cross-contamination, growth/toxin production, or survival):
- Biological Hazards (B): vegetative bacterial pathogens (Salmonella enterica, Listeria monocytogenes, shiga-toxin-producing Escherichia coli O157:H7, Campylobacter jejuni, Staphylococcus aureus, Yersinia enterocolitica), spore-forming bacteria (Clostridium botulinum, Clostridium perfringens, Bacillus cereus), enteric viruses (Norovirus, Hepatitis A), and parasites (Trichinella spiralis, Anisakis simplex, Cryptosporidium).
- Chemical Hazards (C): mycotoxins (aflatoxins $B_1/M_1$, ochratoxin A, deoxynivalenol DON, zearalenone, patulin in apple concentrate), pesticide residues, heavy metals (lead, cadmium, mercury, arsenic), veterinary drug and antibiotic residues in milk and meat, CIP chemical residues (caustic soda $\text{NaOH}$, nitric acid $\text{HNO}_3$, peracetic acid, quaternary ammonium compounds), non-food-grade machinery lubricants lacking NSF H1 registration, packaging monomer migration, histamine in scombroid fish, acrylamide, and preservative overdosing (e.g., sodium nitrite E250).
- Physical Hazards (P): hard or sharp foreign bodies capable of causing choking, dental fracture, or gastrointestinal laceration: glass fragments, metal shavings from worn mixer blades, sifters, or grinders (ferrous, non-ferrous, stainless steel), brittle hard plastic from totes, stones, bone splinters, and wood splinters from pallets.
- Allergen Hazards (A): unintended cross-contact or mislabeling of the 14 statutory allergens defined in Ukrainian Law No. 2639-VIII and EU Regulation 1169/2011 (cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk/lactose, tree nuts, celery, mustard, sesame seeds, sulfur dioxide and sulfites $> 10\text{ mg/kg}$, lupin, and molluscs). To see how regulators penalize labeling failures, read our analysis of the AMCU fine and food labeling compliance case.
- Radiological Hazards (R): elevated specific activity of radionuclides cesium-137 ($^{137}\text{Cs}$) and strontium-90 ($^{90}\text{Sr}$) in wild berries, forest mushrooms, grains, milk from northern regions, or local borehole water.
Semi-Quantitative $5 \times 5$ Risk Matrix ($R = L \times S$)
To separate Significant Hazards (which require a CCP or OPRP) from low-level hazards managed by baseline PRPs, multiply Likelihood of occurrence ($L$, scored 1 to 5) by Severity of health impact ($S$, scored 1 to 5): $R = L \times S$. Evaluate Likelihood assuming baseline PRPs are running, but before applying the specific step's CCP/OPRP control.
| Risk Level (R = L x S) | 5 x 5 Matrix Score | Engineering Criteria for Likelihood (L) and Severity (S) | Hazard Classification and Required Control Routing |
|---|---|---|---|
| Low (Negligible Risk) | 1 - 6 points (where S <= 3) | Minor temporary discomfort or remote probability (less than once in 5 years on the line) | Non-significant hazard. Managed entirely by baseline Prerequisite Programs (PRPs: sanitation, GMP, pest control). Does not enter the CCP Decision Tree. |
| Moderate (Medium Risk) | 8 - 10 points (where S <= 3) | Moderate reversible illness or minor injury without hospitalization; occasional industry occurrence | Transitional zone. Requires targeted inspection of PRP effectiveness, equipment redesign, or enhanced operator training. |
| High (Significant Hazard) | 12 - 16 points (or any hazard with S = 4 and L >= 3) | Acute foodborne infection, intoxication, or mechanical trauma requiring medical treatment | Significant food safety hazard. Must pass through the Step 7 (Principle 2) Decision Tree to assign an OPRP or Critical Control Point (CCP). |
| Critical (Unacceptable Risk) | 20 - 25 points (or any hazard with S = 5 regardless of L) | Life-threatening condition: anaphylactic shock, botulism, listeriosis in vulnerable groups, or fatality | Mandatory Significant Hazard. Even at L = 1 (rare), maximum severity S = 5 requires a validated CCP or high-reliability OPRP barrier. |

Principle 2 (Step 7): Determine Critical Control Points (CCPs) Using the Decision Tree
HACCP Principle 2 (Step 7) identifies the specific steps in your process where control is essential to prevent or eliminate a significant food safety hazard or reduce it to an acceptable level. Those steps become Critical Control Points (CCPs).
Walking Through the 4-Question Codex Decision Tree
Take every Significant Hazard identified in Principle 1 ($R \ge 12$ or $S = 5$) and run it sequentially through the four Codex Decision Tree questions ($Q_1 - Q_4$):
- Question $Q_1$: Do preventive control measures exist at this step or subsequent steps for the identified hazard? If Yes, move to $Q_2$. If No, ask whether control at this step is necessary for food safety. If it is necessary and no control exists, you must modify the process, equipment, or product formulation.
- Question $Q_2$: Is this step specifically designed to eliminate the hazard or reduce its likely occurrence to an acceptable level? (Examples: HTST pasteurizer, retorting autoclave, final metal detector, X-ray bone/glass inspection, sterilizing membrane filtration). If Yes, this step goes straight into the plan as a CCP without asking $Q_3$. If No, proceed to $Q_3$.
- Question $Q_3$: Could contamination with the identified hazard occur in excess of acceptable levels, or could it increase to unacceptable levels? If No, it's not a CCP. If Yes, proceed to $Q_4$.
- Question $Q_4$: Will a subsequent step eliminate the identified hazard or reduce its likely occurrence to an acceptable level? If Yes, the current step is not a CCP because a downstream barrier handles it (for example, vegetative pathogens in raw meat intake are killed during downstream smokehouse cooking at $+72,^\circ\text{C}$ core temperature). If No (no downstream step destroys the hazard, such as antibiotic residues in raw milk intake or glass splinters during jar filling), the current step is a CCP.
Differentiating PRPs, OPRPs, and CCPs Under ISO 22000 and FSSC 22000
While basic Codex HACCP splits controls into two buckets (PRPs and CCPs), international standards like ISO 22000 (Clause 8.5) and FSSC 22000 use a three-tier engineering hierarchy: PRPs (Prerequisite Programs), OPRPs (Operational Prerequisite Programs), and CCPs (Critical Control Points).
Here's how food safety engineers separate an OPRP from a CCP during an audit:
- CCP: controlled via measurable physical or chemical critical limits ($T, t, \text{pH}, a_w$, metal detector test sphere size in mm) monitored in real time or near-real time, where any breach means the batch is potentially unsafe and must be automatically diverted or quarantined;
- OPRP: controls a significant hazard using action criteria rather than absolute pass/fail critical limits, often relying on scheduled visual checks or sanitation verification. Typical OPRPs include shift-by-shift inspection of sifter mesh and neodymium magnetic traps ($\ge 10,000\text{ Gauss}$), validated allergen changeover cleaning verified by rapid protein swabs, or cold-store temperature control.
One mistake we fix constantly during consulting projects: plants designate 15 or 20 CCPs because they treat every hygiene check as a critical point. Operators get buried in paperwork, and real critical points get neglected. A well-engineered production line usually has 1 to 4 true CCPs and 2 to 5 OPRPs.
Principle 3 (Step 8): Establish Critical Limits and Operational Buffer Limits
HACCP Principle 3 (Step 8) requires you to establish and validate measurable Critical Limits for each CCP. A critical limit is the exact numerical value (minimum or maximum physical/chemical parameter) that separates a safe, acceptable product from an unsafe, unacceptable product.
Why Microbiological Counts Cannot Serve as CCP Critical Limits
If your HACCP plan lists "Salmonella absent in 25 g, E. coli absent in 1 g" as the Critical Limit for a cooking CCP, an auditor will raise a nonconformity immediately. Why? Because culturing a petri dish in a microbiology lab takes 24 to 120 hours, while your conveyor belt moves several tons of product per hour. A CCP critical limit must be measurable in real time (in-line or at-line) so you can stop the line before unsafe product leaves the room. That's why engineers convert microbial lethality into physical and chemical surrogates: temperature ($T$), holding time ($t$), flow rate ($Q$), differential pressure ($\Delta P$), acidity ($\text{pH}$), water activity ($a_w$), or metal detector test sphere diameter in millimeters.
Critical Limits vs. Operational Limits (Buffer Zones)
Waiting until your pasteurizer or oven drops all the way down to the legal critical limit is bad engineering. Every time you cross a critical limit, you have to quarantine the batch, stop production, and file a formal corrective action report. To prevent CCP breaches, process engineers establish Operational Limits: tighter internal action thresholds that give operators a safety buffer.
When a process parameter drifts past the operational limit (say, pasteurization temperature drops to $74.0,^\circ\text{C}$ while the critical limit is $72.0,^\circ\text{C}$), an alarm triggers and the PID steam valve opens wider, keeping the milk completely safe without triggering a CCP failure. The table below details validated critical and operational limits across major food processing operations.
| Process Step (CCP) & Sector | Target Significant Hazard | Critical Limit (Safety Boundary) | Operational Limit (Operator Buffer) | Validation & Regulatory Basis |
|---|---|---|---|---|
| Milk HTST Pasteurization (Dairy Plant) | Biological: survival of vegetative pathogens (Mycobacterium, Salmonella, Listeria, Coxiella burnetii) | T >= 72.0 °C for holding time t >= 15 s; regeneration differential pressure P_past > P_raw by >= 0.5 bar | Target run T = 74.5 - 76.0 °C, t >= 18 s; automatic FDDV flow diversion set at 73.0 °C | Codex CXC 1-1969, Regulation (EC) 853/2004, holding tube hydraulic flow validation protocol |
| Smokehouse Cooking of Emulsified Sausages (Meat Plant) | Biological: survival of Salmonella spp. and Listeria monocytogenes in core | Core temperature of thickest chub T_core >= 72.0 °C for >= 2 min (achieving >= 6D reduction) | T_core >= 74.5 °C measured in the mapped cold spot of the smokehouse rack prior to shower cycle | Thermal D/z-value lethality tables for L. monocytogenes, 12-point chamber thermal mapping report |
| Acidification & Hot Fill of Pickled Vegetables / Sauces | Biological: spore germination and neurotoxin synthesis by Clostridium botulinum | Equilibrium pH <= 4.50 in every blended batch + hot-fill temperature T >= 85.0 °C | Operating recipe window pH = 4.10 - 4.30; filler manifold temperature T = 88.0 - 90.0 °C | Codex Alimentarius Code for Acidified Low-Acid Canned Foods (pH 4.6 barrier), recipe validation |
| Fermentation & Drying of Dry-Cured Salami / Meat Snacks | Biological: growth and heat-stable enterotoxin production by Staphylococcus aureus | Core water activity aw <= 0.85 and pH <= 5.2 prior to release from ripening chamber | Target release aw <= 0.83; chamber relative humidity RH controlled within 72 - 75% | Drying curve validation study and dew-point water activity meter verification |
| Final Package Metal Detection (Bakery & Confectionery) | Physical: sharp ferrous, non-ferrous, and stainless steel fragments from blades/sieves | 100% rejection of certified test spheres: Fe <= 1.5 mm, Non-Fe <= 2.0 mm, SS 316 <= 2.5 mm | Detector phase and sensitivity set with 15% margin above product effect signal threshold | Metal detector validation protocol passing test cards through geometric center of aperture |
| Raw Milk Tanker Antibiotic Screening Prior to Unloading | Chemical: beta-lactam, tetracycline, sulfonamide, and chloramphenicol veterinary residues | Negative rapid test strip result (residue concentration below statutory EU/UA MRL thresholds) | Optical reader line-intensity ratio > 1.10 (safety margin above 1.00 cutoff threshold) | Regulation (EU) 37/2010, Ukrainian statutory MRL standards, AOAC validation certificate |
Principle 4 (Step 9): Monitoring Procedures and ISO/IEC 17025 Metrological Calibration
HACCP Principle 4 (Step 9) defines the scheduled observations or measurements that prove each CCP operates within its critical limits. Every monitoring procedure in your HACCP plan must explicitly answer four engineering questions:
- What is measured: the exact physical or chemical parameter (e.g., product exit temperature at the pasteurizer holding tube and position of the Flow Diversion Device Valve);
- How it is measured: the specific instrument type, asset ID, accuracy class, and measurement method (e.g., Class A PT100 platinum resistance thermometer wired to a tamper-protected paperless chart recorder, or insertion of a calibrated needle probe into the geometric center of three units at the cold spot);
- How frequently measurements occur: the gold standard is continuous automated monitoring (100% of run time or 100% of packages). Where monitoring is periodic (such as passing certified test pieces through a metal detector every 60 minutes), the monitoring interval must be shorter than the timefinished pallets remain in your warehouse before dispatch, guaranteeing 100% batch recall inside your own walls if a test fails;
- Who performs and reviews the check: the specific job title of the line operator trained and authorized to halt the line, plus the QA supervisor who signs off the log every shift.
Metrological Calibration Under ISO/IEC 17025
CCP temperature and pH logs are worthless if your sensor has drifted by $3,^\circ\text{C}$. Under international food safety standards and ISO 22000, every measuring device governing a CCP or OPRP (PT100 sensors, core probe thermometers, differential pressure gauges, pH meters, water activity meters, nitrite dosing scales, and metal detector test spheres) must be calibrated at defined intervals by a metrology lab accredited to ISO/IEC 17025, traceable to national or international standards.
Between annual external calibrations, plants run internal routine verification checks comparing working probes against a certified reference thermometer at two points: crushed ice in distilled water ($0.0,^\circ\text{C}$) and a thermostated water bath at operating temperature ($72.0 - 80.0,^\circ\text{C}$), allowing a maximum deviation of $\pm 0.5,^\circ\text{C}$. If a working probe fails its internal check, you must treat all product manufactured since the last passing calibration check as potentially nonconforming.

Principle 5 (Step 10): Corrective Actions, Batch Quarantine, and Root Cause Analysis
HACCP Principle 5 (Step 10) dictates the exact pre-planned actions your team must take the moment monitoring shows a CCP has crossed its critical limit. In ISO 22000 (Clause 8.9), this response splits into two distinct phases: Correction (handling the immediate process and affected product) and Corrective Action (eliminating the root cause so the failure doesn't recur).
Phase 1. Immediate Correction and Quarantine of Affected Product
Suppose at 14:00 during the hourly metal detector check, the $2.5\text{ mm}$ stainless steel test sphere passes through the aperture without triggering the pneumatic reject arm, whereas the 13:00 check passed. The operator doesn't improvise; they execute the written CCP protocol:
- Stop the line and restore control: halt the conveyor immediately and call maintenance to adjust air pressure or coil phase sensitivity until all three test pieces ($\text{Fe, Non-Fe, SS}$) are rejected three consecutive times.
- Quarantine product back to the last good check: every single package produced between 13:00 (the last passed check) and 14:00 (the failed check) is classified as potentially unsafe product. Pallets are physically moved to a locked quarantine cage, tagged with red "CCP HOLD / QUARANTINE" labels, and blocked in the WMS/ERP system under status
HOLDso logistics cannot accidentally ship them. - Reprocess or re-inspect: pass 100% of the quarantined 13:00-14:00 batch units individually through the repaired and re-verified metal detector under QA supervision. For a thermal CCP deviation (e.g., sausage core temperature reached $69.5,^\circ\text{C}$ instead of $\ge 72.0,^\circ\text{C}$), immediately return the rack to the smokehouse to complete thermal lethality.
- Safe disposition or destruction: if reprocessing cannot guarantee safety (for example, raw milk contaminated with beta-lactam antibiotics or product where heat-stable Staphylococcus aureus enterotoxin may have formed), the batch must be condemned and disposed of as Category 2/3 waste under documented supervision.
Phase 2. Root Cause Analysis (5 Whys) and Systemic Corrective Action
Re-checking or re-cooking a batch only fixes the symptom. Auditors require a documented Root Cause Analysis using the 5 Whys method or an Ishikawa fishbone diagram. For example: Why did the reject arm fail at 14:00? Compressed air pressure dropped below 4.0 bar. Why did air pressure drop? A bagging machine on the adjacent line shares the same air manifold. Why didn't the conveyor stop when air pressure dropped? The metal detector lacked a low-pressure interlock switch. Systemic Corrective Action: install a pneumatic pressure switch interlocked with the belt drive motor (stopping the line automatically if pressure falls below 5.0 bar) plus a photoelectric reject-confirmation sensor and a locked reject bin.
Need Engineering Support to Build or Audit Your HACCP Plan?
Ekontrol food safety engineers design, validate, and audit practical HACCP, ISO 22000, and FSSC 22000 systems for Ukrainian manufacturers and exporters: from 5x5 risk matrices to SSUFSCP inspection defense.
Request an Ekontrol ConsultationPrinciple 6 (Step 11): Validation vs. Verification and Laboratory Testing
HACCP Principle 6 (Step 11) requires procedures to confirm that your HACCP plan is scientifically sound and working effectively day after day. Both Codex Alimentarius CXC 1-1969 and ISO 22000 (Clauses 8.5.3 and 8.8) draw a hard engineering boundary between Validation and Verification.
1. Scientific Validation of Control Measures ($F_0$, $D$-value, $z$-value)
Validation happens before a control measure goes live (and whenever you change equipment, recipes, or packaging) to prove scientifically that the chosen parameters can actually achieve the required hazard reduction. In thermal processing, validation relies on microbial inactivation kinetics ($D$-value and $z$-value) and cumulative lethality ($F_0$ or $P$-value):
- Decimal reduction time ($D_T$-value): the time in minutes at a specific temperature $T$ required to kill $90%$ ($1,\log_{10}$) of the target pathogen population. To achieve a standard $6D$ ($6,\log_{10}$) reduction of Listeria monocytogenes in cooked meat or dairy at $+70,^\circ\text{C}$ (where $D_{70} \approx 0.20 - 0.28\text{ min}$), the geometric center of the product must hold $+70,^\circ\text{C}$ for at least $1.7 - 2.0\text{ min}$ (or reach $+72.0,^\circ\text{C}$ for at least $15 - 30\text{ seconds}$).
- Thermal resistance constant ($z$-value): the temperature change in $,^\circ\text{C}$ needed to change the $D$-value by a factor of 10. For low-acid canned foods ($\text{pH} > 4.6$), validation targets proteolytic Clostridium botulinum spores ($T_{\text{ref}} = 121.1,^\circ\text{C}$, $D_{121.1} = 0.21\text{ min}$, $z = 10,^\circ\text{C}$), requiring a minimum $12D$ sterilizing value of $F_0 = \int 10^{(T(t) - 121.1)/10},dt \ge 3.0\text{ min}$ in the slowest-heating container.
To validate an autoclave or smokehouse, engineers place 9 to 12 wireless temperature data loggers across the load to map the Cold Spot and prove that even the coldest point exceeds the target $F_0$ or $P$-value.
2. Ongoing System Verification Procedures
Once validated parameters are running, Verification checks periodically that the HACCP plan is being followed and remains effective:
- Scheduled microbiological, chemical, and radiological testing of raw materials, process water, and finished products at an accredited testing laboratory;
- Environmental Monitoring Program (EMP): routine microbiological swabbing across Zone 1 (direct food-contact surfaces), Zone 2 (adjacent equipment frames), and Zone 3 (floors, drains, wheels) for Listeria spp., Salmonella, and Enterobacteriaceae, combined with post-CIP ATP bioluminescence checks;
- Internal HACCP audits, monthly trend analysis of CCP logs and corrective actions, mock recall exercises (completing forward and backward mass-balance traceability within 4 hours), and independent pre-certification diagnostic audits.
How Auditors Distinguish Validation, Monitoring, and Verification
Validation proves in advance (via math, literature, and thermal mapping) that your control measure works in principle. Monitoring measures the parameter in real time on every batch during production. Verification checks periodically (via lab tests, environmental swabs, calibration, and internal audits) that your team actually followed the plan over time.
Principle 7 (Step 12): Documentation, Record-Keeping, and SSUFSCP Inspection Checklists
HACCP Principle 7 (Step 12) establishes the documentation and record-keeping architecture that proves your food safety system works. For both state inspectors and certification auditors, the rule is uncompromising: if an action isn't recorded, it never happened.
System Documentation vs. Operational Records
A compliant HACCP documentation package under Order No. 590 and Law No. 771/97-VR consists of two tiers:
- Static System Documentation: HACCP team appointment order and training certificates, food safety policy, documented Prerequisite Programs (PRPs), raw material and finished product specifications, verified flow diagrams and plant zoning maps, hazard analysis worksheets ($5 \times 5$ risk matrix), CCP decision tree tables, the master HACCP Plan (and OPRP control plan), and operator work instructions.
- Dynamic Operational Records: incoming material inspection and vehicle temperature logs, continuous SCADA charts or paper CCP monitoring sheets, hourly metal detector challenge logs, nonconformity and batch quarantine reports, ISO/IEC 17025 calibration certificates, test reports from accredited laboratories, mock recall minutes, and annual management review records. Retain records for at least the product shelf life plus 12 months (or 2 to 3 years under retail standards).
What SSUFSCP Inspectors Check and Statutory Fines Under Law No. 2042-VIII
Inspectors from the State Service of Ukraine on Food Safety and Consumer Protection (SSUFSCP) audit food businesses using the standardized HACCP State Control Inspection Act. Instead of reading binders in a conference room, inspectors head straight onto the production floor:
- they compare your signed flow diagram against actual piping, tanks, rework bins, and staff traffic routes;
- they interview line operators at each CCP (pasteurizer, smokehouse, metal detector) to check whether operators know the exact critical limit and what to do when an alarm sounds;
- they scrutinize CCP monitoring logs for blank hours, pre-filled afternoon entries written in the morning, or white-out correction fluid;
- they run a live traceability test under Article 22 of Law No. 771/97-VR, picking a finished lot in the warehouse and timing how fast your team produces raw material intake records, CCP temperature charts, and customer dispatch manifests.
Under Article 65 of the Law of Ukraine No. 2042-VIII, failing to implement and maintain permanent HACCP-based procedures carries a statutory fine of 30 minimum wages for legal entities and 15 minimum wages for individual entrepreneurs (FOP). If inspectors find violations that pose an immediate threat to human health, the Chief State Veterinary Inspector has the authority to suspend facility operations for up to 10 working days.
ALCOA+ Record Integrity: Never Use Correction Fluid on HACCP Logs
Using correction fluid (white-out), erasers, or pencil on CCP monitoring sheets is an immediate audit red flag. If an operator makes a mistake, they must draw a single thin line through the incorrect figure so it remains legible, write the correct reading beside it, and add the date, time, and their initials. Every HACCP certification auditor checks record integrity on day one.
Scaling From Basic HACCP to ISO 22000, FSSC 22000, BRCGS, and IFS
Implementing basic HACCP under Codex Alimentarius and Order No. 590 satisfies domestic regulatory compliance in Ukraine. However, if you supply national supermarket chains or export food products to the European Union, the UK, North America, or the Middle East, retail buyers and industrial clients will require certification under ISO 22000 or a Global Food Safety Initiative (GFSI) benchmarked scheme: FSSC 22000, BRCGS Food Safety, or IFS Food.
All of those international standards use the exact same 12 steps and 7 principles of HACCP as their technical engine. The comparison table below shows how basic HACCP scales up into ISO and GFSI certification schemes.
| Comparison Criterion | Basic HACCP (Codex CXC 1-1969 / Order No. 590) | ISO 22000:2018 | FSSC 22000 (Version 6) | BRCGS Food Safety (Issue 9) / IFS Food (v8) |
|---|---|---|---|---|
| Core Structural Architecture | 12 steps and 7 principles of Codex Alimentarius + baseline Prerequisite Programs (PRPs) | Annex SL High-Level Structure (Clauses 4-10) + 12 HACCP steps + dual PDCA cycles | ISO 22000:2018 + sector-specific PRP standard ISO/TS 22002-x + FSSC Additional Requirements | Prescriptive retail audit protocol + Codex HACCP plan + Senior Management Food Safety Culture |
| Control Measure Hierarchy | Two-tier model: Prerequisite Programs (PRPs) and Critical Control Points (CCPs) | Three-tier model: PRPs, Operational PRPs (OPRPs), and CCPs under Clause 8.5.4 | Three-tier model (PRPs, OPRPs, CCPs) with strict hygienic equipment design and validation rules | Strict Codex decision tree CCP justification + mandatory Fundamental / Knock-Out (KO) clauses |
| Food Fraud (VACCP) & Food Defense (TACCP) Requirements | Not explicitly mandated (covered only by basic raw material intake and traceability) | Addressed broadly within organizational context and risk planning (Clauses 4.1 and 6.1) | Mandatory documented Food Fraud vulnerability assessment and Food Defense threat plan | Detailed mandatory VACCP vulnerability matrices, TACCP site security plans, and product authenticity testing |
| GFSI Benchmarking & Export Retail Acceptance | Statutory legal baseline (EU Reg 852/2004 & UA Law 771), not a GFSI-benchmarked certificate | Recognized globally for B2B ingredients and food service, not directly GFSI-benchmarked | Full GFSI recognition (preferred by food processors, ingredient plants, and packaging manufacturers) | Full GFSI recognition (mandatory for Private Label suppliers to European and UK retail chains) |
| Audit Format & Unannounced Inspections | State inspections by SSUFSCP under Law No. 2042-VIII or voluntary national certification | Two-stage initial certification audit (Stage 1 + Stage 2) plus annual surveillance audits | 3-year cycle including at least one mandatory unannounced surveillance audit every 3 years | Graded scoring system (AA+, A, B or % KO score in IFS) with mandatory unannounced audit options |
How Ekontrol Engineers Build Practical, Audit-Ready HACCP Systems
At Ekontrol, we don't hand you a generic 400-page binder copied from another factory. Our food safety engineers walk your production lines across shifts, map real piping and air flows, validate thermal and metal detection CCPs, simplify operator logs onto single-page checklists, and train your floor staff so you pass both SSUFSCP inspections and GFSI audits without stress.
Actionable Roadmap for Implementing the 7 HACCP Principles and Passing Certification
To turn the 7 principles of HACCP into a reliable operational shield on your production floor, follow this four-step engineering sequence:
- Start with an on-site technical gap analysis. Before drafting hazard tables, inspect your facility's hygienic zoning, drainage, air handling, CIP sanitation, and sensor calibration. Booking an independent HACCP diagnostic audit gives you a clear, prioritized action plan measured against Order No. 590, ISO 22000, or GFSI requirements.
- Fix Prerequisite Programs (PRPs) first so you keep CCPs lean. Solid sanitation, pest control, glass/brittle plastic control, and allergen management absorb 85% of routine floor risks. That lets your team focus CCP monitoring on the 1 to 4 points where real-time physical limits protect the consumer.
- Execute hands-on implementation and operator training. Involve your shift technologists, maintenance engineers, and line operators when verifying flow diagrams and testing corrective actions. When you need turnkey engineering documentation, thermal validation, and floor coaching, explore our food safety system implementation service.
- Secure expert support during state inspections and certification audits. Whether you're preparing for an SSUFSCP inspection or certifying to ISO 22000, FSSC 22000, BRCGS, or IFS, professional audit support ensures your risk matrix, CCP validations, and traceability records stand up to auditor scrutiny.

Need a certification consultation?
Free Consultation
On This Page
- What Are the 7 Principles of HACCP and the 12-Step Codex Architecture
- The 5 Preliminary Steps (Steps 1-5) Before Applying the 7 HACCP Principles
- Principle 1 (Step 6): Conduct a Hazard Analysis and Risk Assessment Matrix
- Principle 2 (Step 7): Determine Critical Control Points (CCPs) Using the Decision Tree
- Principle 3 (Step 8): Establish Critical Limits and Operational Buffer Limits
- Principle 4 (Step 9): Monitoring Procedures and ISO/IEC 17025 Metrological Calibration
- Principle 5 (Step 10): Corrective Actions, Batch Quarantine, and Root Cause Analysis
- Principle 6 (Step 11): Validation vs. Verification and Laboratory Testing
- Principle 7 (Step 12): Documentation, Record-Keeping, and SSUFSCP Inspection Checklists
- Scaling From Basic HACCP to ISO 22000, FSSC 22000, BRCGS, and IFS
- Actionable Roadmap for Implementing the 7 HACCP Principles and Passing Certification
What Are the 7 Principles of HACCP and the 12-Step Codex Architecture
The 7 principles of HACCP (Hazard Analysis and Critical Control Points) form an engineering methodology for controlling biological, chemical, physical, radiological, and allergen hazards directly inside a food production process. Relying on end-product laboratory testing alone doesn't work at industrial scale: testing a 0.1% statistical sample from a finished batch leaves a massive mathematical probability of missing localized Salmonella or metal contamination. A properly engineered HACCP system builds measurable barriers right on the processing line. Pillsbury, the U.S. Army Laboratories, and NASA originally developed this framework in the 1960s to manufacture pathogen-free rations for astronauts in orbit.
The international baseline for the methodology is the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969), revised in 2022/2023. That code establishes a strict 12-step implementation sequence: the first 5 steps are preliminary engineering tasks, while Steps 6 through 12 execute the 7 principles of HACCP.
In Ukraine, Articles 20 and 21 of the Law of Ukraine No. 771/97-VR "On Basic Principles and Requirements for Food Safety and Quality" legally require all food business operators (beyond primary agriculture) to develop, validate, and maintain permanent HACCP-based procedures. The specific technical rules for Ukrainian facilities are detailed in Order of the Ministry of Agrarian Policy and Food of Ukraine No. 590 of 01.10.2012, while state inspectors from the State Service of Ukraine on Food Safety and Consumer Protection (SSUFSCP / Держпродспоживслужба) audit compliance under Law of Ukraine No. 2042-VIII.
Before you map out critical control points in the food industry, you have to separate Prerequisite Programs (PRPs) from the HACCP plan itself. PRPs establish hygienic environmental conditions across the entire site: potable water treatment, pest control, hygienic zoning with positive air pressure in high-care rooms, staff hygiene, preventive maintenance, and Clean-in-Place (CIP) sanitation. Your HACCP plan sits on top of those functioning PRPs to target specific process hazards. For a broader overview of the legal framework and project stages, see our complete guide to HACCP certification.
The 5 Preliminary Steps (Steps 1-5) Before Applying the 7 HACCP Principles
You can't jump straight to Principle 1 without completing the 5 preliminary steps mandated by Codex CXC 1-1969 and Section III of Order No. 590. Auditors check these five steps first because they define the physical, chemical, and operational boundaries of your hazard analysis.
Step 1. Assemble a Multidisciplinary HACCP Team
One quality manager sitting in an office can't write a realistic HACCP plan alone. Codex requires a multidisciplinary team appointed by formal management order, bringing together 4 to 6 specialists who understand the actual equipment and microbiology on the floor:
- HACCP Team Leader (Food Safety Team Leader): typically the Quality Director or Chief Technologist, holding documented training in HACCP principles and ISO 22000;
- Production Technologist: understands thermal kinetics, cooling rates, fermentation curves, and recipe tolerances;
- Chief Maintenance and Instrumentation Engineer, managing preventive maintenance schedules, NSF H1 food-grade lubricants, PT100 temperature sensors, and flow diversion valves;
- Microbiologist or Laboratory Head, interpreting microbial criteria, environmental swabbing data, and physicochemical test results;
- Warehouse and Procurement Manager, controlling raw material intake, cold-chain docking temperatures, packaging specs, and lot traceability.
If a smaller plant doesn't employ a full-time microbiologist or thermal process authority, Order No. 590 permits bringing in external specialists (such as Ekontrol food safety engineers) to design and validate the plan, while internal staff run day-to-day monitoring.
Step 2. Describe the Product and Raw Materials in Engineering Detail
Every product (or product family sharing identical processing steps and hazard profiles) needs a technical food safety specification. Copying a commercial marketing sheet won't pass an audit. You need the intrinsic microbial growth parameters:
- Water activity ($a_w$): for instance, $a_w > 0.98$ in chilled raw meat or fluid milk (supporting rapid bacterial growth), $a_w \le 0.85$ in dry-cured sausages or sweetened condensed milk (inhibiting most vegetative bacterial pathogens), and $a_w < 0.60$ in flour or milk powder;
- Acidity ($\text{pH}$): the $\text{pH} = 4.6$ threshold is the biological cutoff below which Clostridium botulinum spores cannot germinate and produce neurotoxin;
- Complete ingredient composition, preservatives (sodium nitrite E250, sorbates, benzoates), and presence of the 14 statutory allergens regulated under Law of Ukraine No. 2639-VIII and EU Regulation 1169/2011;
- Packaging atmosphere and barrier properties: Modified Atmosphere Packaging (MAP, such as 70% $\text{N}_2$ / 30% $\text{CO}_2$), vacuum packaging (which creates anaerobic conditions requiring strict control of non-proteolytic C. botulinum and Listeria monocytogenes), or aseptic filling;
- Storage temperature limits (e.g., $+2,^\circ\text{C}$ to $+6,^\circ\text{C}$), distribution conditions, and scientifically validated shelf life.
Step 3. Identify Intended Use and Vulnerable Consumer Groups
Your team must state clearly whether the product is Ready-to-Eat (RTE) or requires thorough cooking by the consumer before consumption. You also have to account for foreseeable consumer misuse, such as a buyer microwaving a frozen raw poultry product for 45 seconds instead of baking it to an internal temperature of $+75,^\circ\text{C}$. Equally important: document whether the product reaches general consumers or vulnerable population groups (infants, pregnant women, elderly patients, immunocompromised individuals, or people with severe food allergies). If you supply schools, hospitals, or baby food lines, your risk matrix thresholds must be significantly stricter.
Step 4. Construct the Process Flow Diagram and Facility Layout
The HACCP team maps every single operational step under the facility's control, from receiving raw materials, primary packaging, and process water right through to final dispatch. A complete engineering flow diagram includes:
- chronological sequence and interaction of all equipment and holding tanks with target process parameters ($T, t, P$, flow rate);
- entry points for raw ingredients, potable water, culinary steam, compressed air, and packaging gases;
- rework loops, intermediate buffer storage, and product hold points;
- exit points for waste, animal by-products, rejects, and sewage. Alongside the block diagram, prepare a plant zoning schematic mapping the physical movement of raw materials, finished products, personnel, waste bins, and air pressure gradients to eliminate cross-contamination between dirty (raw) and high-care (post-lethality) zones.
Step 5. On-Site Verification of the Flow Diagram Across All Shifts
Paper diagrams almost always miss something happening on the shop floor. The entire HACCP team must walk the production line step by step to verify the flow diagram against physical piping and operator routines. Don't just walk the line at 10:00 AM on Tuesday. Verify it during the night shift, during product changeovers, and during CIP wash cycles. During night-shift walkthroughs, Ekontrol auditors frequently uncover temporary flexible bypass hoses, unrecorded rework tubs sitting at ambient temperature, or sifter screens removed to speed up viscous pumping. Every discrepancy must either be physically removed or added to the diagram and evaluated in Principle 1.
Principle 1 (Step 6): Conduct a Hazard Analysis and Risk Assessment Matrix
HACCP Principle 1 (Step 6 of Codex) requires the team to list all reasonably foreseeable hazards at each step of the verified flow diagram, evaluate their risk, and specify control measures. If your team misses a real hazard here, such as enterotoxin formation by Staphylococcus aureus during warm batter holding or undeclared sesame cross-contact on a shared conveyor, the rest of your HACCP plan won't catch it.
Five Hazard Categories in Modern Food Safety Engineering
At every process step from Step 1 (Raw Material Intake) to final dispatch, evaluate five distinct hazard classes and state the exact biological agent, chemical compound, or physical object plus the mechanism (initial presence, cross-contamination, growth/toxin production, or survival):
- Biological Hazards (B): vegetative bacterial pathogens (Salmonella enterica, Listeria monocytogenes, shiga-toxin-producing Escherichia coli O157:H7, Campylobacter jejuni, Staphylococcus aureus, Yersinia enterocolitica), spore-forming bacteria (Clostridium botulinum, Clostridium perfringens, Bacillus cereus), enteric viruses (Norovirus, Hepatitis A), and parasites (Trichinella spiralis, Anisakis simplex, Cryptosporidium).
- Chemical Hazards (C): mycotoxins (aflatoxins $B_1/M_1$, ochratoxin A, deoxynivalenol DON, zearalenone, patulin in apple concentrate), pesticide residues, heavy metals (lead, cadmium, mercury, arsenic), veterinary drug and antibiotic residues in milk and meat, CIP chemical residues (caustic soda $\text{NaOH}$, nitric acid $\text{HNO}_3$, peracetic acid, quaternary ammonium compounds), non-food-grade machinery lubricants lacking NSF H1 registration, packaging monomer migration, histamine in scombroid fish, acrylamide, and preservative overdosing (e.g., sodium nitrite E250).
- Physical Hazards (P): hard or sharp foreign bodies capable of causing choking, dental fracture, or gastrointestinal laceration: glass fragments, metal shavings from worn mixer blades, sifters, or grinders (ferrous, non-ferrous, stainless steel), brittle hard plastic from totes, stones, bone splinters, and wood splinters from pallets.
- Allergen Hazards (A): unintended cross-contact or mislabeling of the 14 statutory allergens defined in Ukrainian Law No. 2639-VIII and EU Regulation 1169/2011 (cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk/lactose, tree nuts, celery, mustard, sesame seeds, sulfur dioxide and sulfites $> 10\text{ mg/kg}$, lupin, and molluscs). To see how regulators penalize labeling failures, read our analysis of the AMCU fine and food labeling compliance case.
- Radiological Hazards (R): elevated specific activity of radionuclides cesium-137 ($^{137}\text{Cs}$) and strontium-90 ($^{90}\text{Sr}$) in wild berries, forest mushrooms, grains, milk from northern regions, or local borehole water.
Semi-Quantitative $5 \times 5$ Risk Matrix ($R = L \times S$)
To separate Significant Hazards (which require a CCP or OPRP) from low-level hazards managed by baseline PRPs, multiply Likelihood of occurrence ($L$, scored 1 to 5) by Severity of health impact ($S$, scored 1 to 5): $R = L \times S$. Evaluate Likelihood assuming baseline PRPs are running, but before applying the specific step's CCP/OPRP control.
| Risk Level (R = L x S) | 5 x 5 Matrix Score | Engineering Criteria for Likelihood (L) and Severity (S) | Hazard Classification and Required Control Routing |
|---|---|---|---|
| Low (Negligible Risk) | 1 - 6 points (where S <= 3) | Minor temporary discomfort or remote probability (less than once in 5 years on the line) | Non-significant hazard. Managed entirely by baseline Prerequisite Programs (PRPs: sanitation, GMP, pest control). Does not enter the CCP Decision Tree. |
| Moderate (Medium Risk) | 8 - 10 points (where S <= 3) | Moderate reversible illness or minor injury without hospitalization; occasional industry occurrence | Transitional zone. Requires targeted inspection of PRP effectiveness, equipment redesign, or enhanced operator training. |
| High (Significant Hazard) | 12 - 16 points (or any hazard with S = 4 and L >= 3) | Acute foodborne infection, intoxication, or mechanical trauma requiring medical treatment | Significant food safety hazard. Must pass through the Step 7 (Principle 2) Decision Tree to assign an OPRP or Critical Control Point (CCP). |
| Critical (Unacceptable Risk) | 20 - 25 points (or any hazard with S = 5 regardless of L) | Life-threatening condition: anaphylactic shock, botulism, listeriosis in vulnerable groups, or fatality | Mandatory Significant Hazard. Even at L = 1 (rare), maximum severity S = 5 requires a validated CCP or high-reliability OPRP barrier. |

Principle 2 (Step 7): Determine Critical Control Points (CCPs) Using the Decision Tree
HACCP Principle 2 (Step 7) identifies the specific steps in your process where control is essential to prevent or eliminate a significant food safety hazard or reduce it to an acceptable level. Those steps become Critical Control Points (CCPs).
Walking Through the 4-Question Codex Decision Tree
Take every Significant Hazard identified in Principle 1 ($R \ge 12$ or $S = 5$) and run it sequentially through the four Codex Decision Tree questions ($Q_1 - Q_4$):
- Question $Q_1$: Do preventive control measures exist at this step or subsequent steps for the identified hazard? If Yes, move to $Q_2$. If No, ask whether control at this step is necessary for food safety. If it is necessary and no control exists, you must modify the process, equipment, or product formulation.
- Question $Q_2$: Is this step specifically designed to eliminate the hazard or reduce its likely occurrence to an acceptable level? (Examples: HTST pasteurizer, retorting autoclave, final metal detector, X-ray bone/glass inspection, sterilizing membrane filtration). If Yes, this step goes straight into the plan as a CCP without asking $Q_3$. If No, proceed to $Q_3$.
- Question $Q_3$: Could contamination with the identified hazard occur in excess of acceptable levels, or could it increase to unacceptable levels? If No, it's not a CCP. If Yes, proceed to $Q_4$.
- Question $Q_4$: Will a subsequent step eliminate the identified hazard or reduce its likely occurrence to an acceptable level? If Yes, the current step is not a CCP because a downstream barrier handles it (for example, vegetative pathogens in raw meat intake are killed during downstream smokehouse cooking at $+72,^\circ\text{C}$ core temperature). If No (no downstream step destroys the hazard, such as antibiotic residues in raw milk intake or glass splinters during jar filling), the current step is a CCP.
Differentiating PRPs, OPRPs, and CCPs Under ISO 22000 and FSSC 22000
While basic Codex HACCP splits controls into two buckets (PRPs and CCPs), international standards like ISO 22000 (Clause 8.5) and FSSC 22000 use a three-tier engineering hierarchy: PRPs (Prerequisite Programs), OPRPs (Operational Prerequisite Programs), and CCPs (Critical Control Points).
Here's how food safety engineers separate an OPRP from a CCP during an audit:
- CCP: controlled via measurable physical or chemical critical limits ($T, t, \text{pH}, a_w$, metal detector test sphere size in mm) monitored in real time or near-real time, where any breach means the batch is potentially unsafe and must be automatically diverted or quarantined;
- OPRP: controls a significant hazard using action criteria rather than absolute pass/fail critical limits, often relying on scheduled visual checks or sanitation verification. Typical OPRPs include shift-by-shift inspection of sifter mesh and neodymium magnetic traps ($\ge 10,000\text{ Gauss}$), validated allergen changeover cleaning verified by rapid protein swabs, or cold-store temperature control.
One mistake we fix constantly during consulting projects: plants designate 15 or 20 CCPs because they treat every hygiene check as a critical point. Operators get buried in paperwork, and real critical points get neglected. A well-engineered production line usually has 1 to 4 true CCPs and 2 to 5 OPRPs.
Principle 3 (Step 8): Establish Critical Limits and Operational Buffer Limits
HACCP Principle 3 (Step 8) requires you to establish and validate measurable Critical Limits for each CCP. A critical limit is the exact numerical value (minimum or maximum physical/chemical parameter) that separates a safe, acceptable product from an unsafe, unacceptable product.
Why Microbiological Counts Cannot Serve as CCP Critical Limits
If your HACCP plan lists "Salmonella absent in 25 g, E. coli absent in 1 g" as the Critical Limit for a cooking CCP, an auditor will raise a nonconformity immediately. Why? Because culturing a petri dish in a microbiology lab takes 24 to 120 hours, while your conveyor belt moves several tons of product per hour. A CCP critical limit must be measurable in real time (in-line or at-line) so you can stop the line before unsafe product leaves the room. That's why engineers convert microbial lethality into physical and chemical surrogates: temperature ($T$), holding time ($t$), flow rate ($Q$), differential pressure ($\Delta P$), acidity ($\text{pH}$), water activity ($a_w$), or metal detector test sphere diameter in millimeters.
Critical Limits vs. Operational Limits (Buffer Zones)
Waiting until your pasteurizer or oven drops all the way down to the legal critical limit is bad engineering. Every time you cross a critical limit, you have to quarantine the batch, stop production, and file a formal corrective action report. To prevent CCP breaches, process engineers establish Operational Limits: tighter internal action thresholds that give operators a safety buffer.
When a process parameter drifts past the operational limit (say, pasteurization temperature drops to $74.0,^\circ\text{C}$ while the critical limit is $72.0,^\circ\text{C}$), an alarm triggers and the PID steam valve opens wider, keeping the milk completely safe without triggering a CCP failure. The table below details validated critical and operational limits across major food processing operations.
| Process Step (CCP) & Sector | Target Significant Hazard | Critical Limit (Safety Boundary) | Operational Limit (Operator Buffer) | Validation & Regulatory Basis |
|---|---|---|---|---|
| Milk HTST Pasteurization (Dairy Plant) | Biological: survival of vegetative pathogens (Mycobacterium, Salmonella, Listeria, Coxiella burnetii) | T >= 72.0 °C for holding time t >= 15 s; regeneration differential pressure P_past > P_raw by >= 0.5 bar | Target run T = 74.5 - 76.0 °C, t >= 18 s; automatic FDDV flow diversion set at 73.0 °C | Codex CXC 1-1969, Regulation (EC) 853/2004, holding tube hydraulic flow validation protocol |
| Smokehouse Cooking of Emulsified Sausages (Meat Plant) | Biological: survival of Salmonella spp. and Listeria monocytogenes in core | Core temperature of thickest chub T_core >= 72.0 °C for >= 2 min (achieving >= 6D reduction) | T_core >= 74.5 °C measured in the mapped cold spot of the smokehouse rack prior to shower cycle | Thermal D/z-value lethality tables for L. monocytogenes, 12-point chamber thermal mapping report |
| Acidification & Hot Fill of Pickled Vegetables / Sauces | Biological: spore germination and neurotoxin synthesis by Clostridium botulinum | Equilibrium pH <= 4.50 in every blended batch + hot-fill temperature T >= 85.0 °C | Operating recipe window pH = 4.10 - 4.30; filler manifold temperature T = 88.0 - 90.0 °C | Codex Alimentarius Code for Acidified Low-Acid Canned Foods (pH 4.6 barrier), recipe validation |
| Fermentation & Drying of Dry-Cured Salami / Meat Snacks | Biological: growth and heat-stable enterotoxin production by Staphylococcus aureus | Core water activity aw <= 0.85 and pH <= 5.2 prior to release from ripening chamber | Target release aw <= 0.83; chamber relative humidity RH controlled within 72 - 75% | Drying curve validation study and dew-point water activity meter verification |
| Final Package Metal Detection (Bakery & Confectionery) | Physical: sharp ferrous, non-ferrous, and stainless steel fragments from blades/sieves | 100% rejection of certified test spheres: Fe <= 1.5 mm, Non-Fe <= 2.0 mm, SS 316 <= 2.5 mm | Detector phase and sensitivity set with 15% margin above product effect signal threshold | Metal detector validation protocol passing test cards through geometric center of aperture |
| Raw Milk Tanker Antibiotic Screening Prior to Unloading | Chemical: beta-lactam, tetracycline, sulfonamide, and chloramphenicol veterinary residues | Negative rapid test strip result (residue concentration below statutory EU/UA MRL thresholds) | Optical reader line-intensity ratio > 1.10 (safety margin above 1.00 cutoff threshold) | Regulation (EU) 37/2010, Ukrainian statutory MRL standards, AOAC validation certificate |
Principle 4 (Step 9): Monitoring Procedures and ISO/IEC 17025 Metrological Calibration
HACCP Principle 4 (Step 9) defines the scheduled observations or measurements that prove each CCP operates within its critical limits. Every monitoring procedure in your HACCP plan must explicitly answer four engineering questions:
- What is measured: the exact physical or chemical parameter (e.g., product exit temperature at the pasteurizer holding tube and position of the Flow Diversion Device Valve);
- How it is measured: the specific instrument type, asset ID, accuracy class, and measurement method (e.g., Class A PT100 platinum resistance thermometer wired to a tamper-protected paperless chart recorder, or insertion of a calibrated needle probe into the geometric center of three units at the cold spot);
- How frequently measurements occur: the gold standard is continuous automated monitoring (100% of run time or 100% of packages). Where monitoring is periodic (such as passing certified test pieces through a metal detector every 60 minutes), the monitoring interval must be shorter than the timefinished pallets remain in your warehouse before dispatch, guaranteeing 100% batch recall inside your own walls if a test fails;
- Who performs and reviews the check: the specific job title of the line operator trained and authorized to halt the line, plus the QA supervisor who signs off the log every shift.
Metrological Calibration Under ISO/IEC 17025
CCP temperature and pH logs are worthless if your sensor has drifted by $3,^\circ\text{C}$. Under international food safety standards and ISO 22000, every measuring device governing a CCP or OPRP (PT100 sensors, core probe thermometers, differential pressure gauges, pH meters, water activity meters, nitrite dosing scales, and metal detector test spheres) must be calibrated at defined intervals by a metrology lab accredited to ISO/IEC 17025, traceable to national or international standards.
Between annual external calibrations, plants run internal routine verification checks comparing working probes against a certified reference thermometer at two points: crushed ice in distilled water ($0.0,^\circ\text{C}$) and a thermostated water bath at operating temperature ($72.0 - 80.0,^\circ\text{C}$), allowing a maximum deviation of $\pm 0.5,^\circ\text{C}$. If a working probe fails its internal check, you must treat all product manufactured since the last passing calibration check as potentially nonconforming.

Principle 5 (Step 10): Corrective Actions, Batch Quarantine, and Root Cause Analysis
HACCP Principle 5 (Step 10) dictates the exact pre-planned actions your team must take the moment monitoring shows a CCP has crossed its critical limit. In ISO 22000 (Clause 8.9), this response splits into two distinct phases: Correction (handling the immediate process and affected product) and Corrective Action (eliminating the root cause so the failure doesn't recur).
Phase 1. Immediate Correction and Quarantine of Affected Product
Suppose at 14:00 during the hourly metal detector check, the $2.5\text{ mm}$ stainless steel test sphere passes through the aperture without triggering the pneumatic reject arm, whereas the 13:00 check passed. The operator doesn't improvise; they execute the written CCP protocol:
- Stop the line and restore control: halt the conveyor immediately and call maintenance to adjust air pressure or coil phase sensitivity until all three test pieces ($\text{Fe, Non-Fe, SS}$) are rejected three consecutive times.
- Quarantine product back to the last good check: every single package produced between 13:00 (the last passed check) and 14:00 (the failed check) is classified as potentially unsafe product. Pallets are physically moved to a locked quarantine cage, tagged with red "CCP HOLD / QUARANTINE" labels, and blocked in the WMS/ERP system under status
HOLDso logistics cannot accidentally ship them. - Reprocess or re-inspect: pass 100% of the quarantined 13:00-14:00 batch units individually through the repaired and re-verified metal detector under QA supervision. For a thermal CCP deviation (e.g., sausage core temperature reached $69.5,^\circ\text{C}$ instead of $\ge 72.0,^\circ\text{C}$), immediately return the rack to the smokehouse to complete thermal lethality.
- Safe disposition or destruction: if reprocessing cannot guarantee safety (for example, raw milk contaminated with beta-lactam antibiotics or product where heat-stable Staphylococcus aureus enterotoxin may have formed), the batch must be condemned and disposed of as Category 2/3 waste under documented supervision.
Phase 2. Root Cause Analysis (5 Whys) and Systemic Corrective Action
Re-checking or re-cooking a batch only fixes the symptom. Auditors require a documented Root Cause Analysis using the 5 Whys method or an Ishikawa fishbone diagram. For example: Why did the reject arm fail at 14:00? Compressed air pressure dropped below 4.0 bar. Why did air pressure drop? A bagging machine on the adjacent line shares the same air manifold. Why didn't the conveyor stop when air pressure dropped? The metal detector lacked a low-pressure interlock switch. Systemic Corrective Action: install a pneumatic pressure switch interlocked with the belt drive motor (stopping the line automatically if pressure falls below 5.0 bar) plus a photoelectric reject-confirmation sensor and a locked reject bin.
Need Engineering Support to Build or Audit Your HACCP Plan?
Ekontrol food safety engineers design, validate, and audit practical HACCP, ISO 22000, and FSSC 22000 systems for Ukrainian manufacturers and exporters: from 5x5 risk matrices to SSUFSCP inspection defense.
Request an Ekontrol ConsultationPrinciple 6 (Step 11): Validation vs. Verification and Laboratory Testing
HACCP Principle 6 (Step 11) requires procedures to confirm that your HACCP plan is scientifically sound and working effectively day after day. Both Codex Alimentarius CXC 1-1969 and ISO 22000 (Clauses 8.5.3 and 8.8) draw a hard engineering boundary between Validation and Verification.
1. Scientific Validation of Control Measures ($F_0$, $D$-value, $z$-value)
Validation happens before a control measure goes live (and whenever you change equipment, recipes, or packaging) to prove scientifically that the chosen parameters can actually achieve the required hazard reduction. In thermal processing, validation relies on microbial inactivation kinetics ($D$-value and $z$-value) and cumulative lethality ($F_0$ or $P$-value):
- Decimal reduction time ($D_T$-value): the time in minutes at a specific temperature $T$ required to kill $90%$ ($1,\log_{10}$) of the target pathogen population. To achieve a standard $6D$ ($6,\log_{10}$) reduction of Listeria monocytogenes in cooked meat or dairy at $+70,^\circ\text{C}$ (where $D_{70} \approx 0.20 - 0.28\text{ min}$), the geometric center of the product must hold $+70,^\circ\text{C}$ for at least $1.7 - 2.0\text{ min}$ (or reach $+72.0,^\circ\text{C}$ for at least $15 - 30\text{ seconds}$).
- Thermal resistance constant ($z$-value): the temperature change in $,^\circ\text{C}$ needed to change the $D$-value by a factor of 10. For low-acid canned foods ($\text{pH} > 4.6$), validation targets proteolytic Clostridium botulinum spores ($T_{\text{ref}} = 121.1,^\circ\text{C}$, $D_{121.1} = 0.21\text{ min}$, $z = 10,^\circ\text{C}$), requiring a minimum $12D$ sterilizing value of $F_0 = \int 10^{(T(t) - 121.1)/10},dt \ge 3.0\text{ min}$ in the slowest-heating container.
To validate an autoclave or smokehouse, engineers place 9 to 12 wireless temperature data loggers across the load to map the Cold Spot and prove that even the coldest point exceeds the target $F_0$ or $P$-value.
2. Ongoing System Verification Procedures
Once validated parameters are running, Verification checks periodically that the HACCP plan is being followed and remains effective:
- Scheduled microbiological, chemical, and radiological testing of raw materials, process water, and finished products at an accredited testing laboratory;
- Environmental Monitoring Program (EMP): routine microbiological swabbing across Zone 1 (direct food-contact surfaces), Zone 2 (adjacent equipment frames), and Zone 3 (floors, drains, wheels) for Listeria spp., Salmonella, and Enterobacteriaceae, combined with post-CIP ATP bioluminescence checks;
- Internal HACCP audits, monthly trend analysis of CCP logs and corrective actions, mock recall exercises (completing forward and backward mass-balance traceability within 4 hours), and independent pre-certification diagnostic audits.
How Auditors Distinguish Validation, Monitoring, and Verification
Validation proves in advance (via math, literature, and thermal mapping) that your control measure works in principle. Monitoring measures the parameter in real time on every batch during production. Verification checks periodically (via lab tests, environmental swabs, calibration, and internal audits) that your team actually followed the plan over time.
Principle 7 (Step 12): Documentation, Record-Keeping, and SSUFSCP Inspection Checklists
HACCP Principle 7 (Step 12) establishes the documentation and record-keeping architecture that proves your food safety system works. For both state inspectors and certification auditors, the rule is uncompromising: if an action isn't recorded, it never happened.
System Documentation vs. Operational Records
A compliant HACCP documentation package under Order No. 590 and Law No. 771/97-VR consists of two tiers:
- Static System Documentation: HACCP team appointment order and training certificates, food safety policy, documented Prerequisite Programs (PRPs), raw material and finished product specifications, verified flow diagrams and plant zoning maps, hazard analysis worksheets ($5 \times 5$ risk matrix), CCP decision tree tables, the master HACCP Plan (and OPRP control plan), and operator work instructions.
- Dynamic Operational Records: incoming material inspection and vehicle temperature logs, continuous SCADA charts or paper CCP monitoring sheets, hourly metal detector challenge logs, nonconformity and batch quarantine reports, ISO/IEC 17025 calibration certificates, test reports from accredited laboratories, mock recall minutes, and annual management review records. Retain records for at least the product shelf life plus 12 months (or 2 to 3 years under retail standards).
What SSUFSCP Inspectors Check and Statutory Fines Under Law No. 2042-VIII
Inspectors from the State Service of Ukraine on Food Safety and Consumer Protection (SSUFSCP) audit food businesses using the standardized HACCP State Control Inspection Act. Instead of reading binders in a conference room, inspectors head straight onto the production floor:
- they compare your signed flow diagram against actual piping, tanks, rework bins, and staff traffic routes;
- they interview line operators at each CCP (pasteurizer, smokehouse, metal detector) to check whether operators know the exact critical limit and what to do when an alarm sounds;
- they scrutinize CCP monitoring logs for blank hours, pre-filled afternoon entries written in the morning, or white-out correction fluid;
- they run a live traceability test under Article 22 of Law No. 771/97-VR, picking a finished lot in the warehouse and timing how fast your team produces raw material intake records, CCP temperature charts, and customer dispatch manifests.
Under Article 65 of the Law of Ukraine No. 2042-VIII, failing to implement and maintain permanent HACCP-based procedures carries a statutory fine of 30 minimum wages for legal entities and 15 minimum wages for individual entrepreneurs (FOP). If inspectors find violations that pose an immediate threat to human health, the Chief State Veterinary Inspector has the authority to suspend facility operations for up to 10 working days.
ALCOA+ Record Integrity: Never Use Correction Fluid on HACCP Logs
Using correction fluid (white-out), erasers, or pencil on CCP monitoring sheets is an immediate audit red flag. If an operator makes a mistake, they must draw a single thin line through the incorrect figure so it remains legible, write the correct reading beside it, and add the date, time, and their initials. Every HACCP certification auditor checks record integrity on day one.
Scaling From Basic HACCP to ISO 22000, FSSC 22000, BRCGS, and IFS
Implementing basic HACCP under Codex Alimentarius and Order No. 590 satisfies domestic regulatory compliance in Ukraine. However, if you supply national supermarket chains or export food products to the European Union, the UK, North America, or the Middle East, retail buyers and industrial clients will require certification under ISO 22000 or a Global Food Safety Initiative (GFSI) benchmarked scheme: FSSC 22000, BRCGS Food Safety, or IFS Food.
All of those international standards use the exact same 12 steps and 7 principles of HACCP as their technical engine. The comparison table below shows how basic HACCP scales up into ISO and GFSI certification schemes.
| Comparison Criterion | Basic HACCP (Codex CXC 1-1969 / Order No. 590) | ISO 22000:2018 | FSSC 22000 (Version 6) | BRCGS Food Safety (Issue 9) / IFS Food (v8) |
|---|---|---|---|---|
| Core Structural Architecture | 12 steps and 7 principles of Codex Alimentarius + baseline Prerequisite Programs (PRPs) | Annex SL High-Level Structure (Clauses 4-10) + 12 HACCP steps + dual PDCA cycles | ISO 22000:2018 + sector-specific PRP standard ISO/TS 22002-x + FSSC Additional Requirements | Prescriptive retail audit protocol + Codex HACCP plan + Senior Management Food Safety Culture |
| Control Measure Hierarchy | Two-tier model: Prerequisite Programs (PRPs) and Critical Control Points (CCPs) | Three-tier model: PRPs, Operational PRPs (OPRPs), and CCPs under Clause 8.5.4 | Three-tier model (PRPs, OPRPs, CCPs) with strict hygienic equipment design and validation rules | Strict Codex decision tree CCP justification + mandatory Fundamental / Knock-Out (KO) clauses |
| Food Fraud (VACCP) & Food Defense (TACCP) Requirements | Not explicitly mandated (covered only by basic raw material intake and traceability) | Addressed broadly within organizational context and risk planning (Clauses 4.1 and 6.1) | Mandatory documented Food Fraud vulnerability assessment and Food Defense threat plan | Detailed mandatory VACCP vulnerability matrices, TACCP site security plans, and product authenticity testing |
| GFSI Benchmarking & Export Retail Acceptance | Statutory legal baseline (EU Reg 852/2004 & UA Law 771), not a GFSI-benchmarked certificate | Recognized globally for B2B ingredients and food service, not directly GFSI-benchmarked | Full GFSI recognition (preferred by food processors, ingredient plants, and packaging manufacturers) | Full GFSI recognition (mandatory for Private Label suppliers to European and UK retail chains) |
| Audit Format & Unannounced Inspections | State inspections by SSUFSCP under Law No. 2042-VIII or voluntary national certification | Two-stage initial certification audit (Stage 1 + Stage 2) plus annual surveillance audits | 3-year cycle including at least one mandatory unannounced surveillance audit every 3 years | Graded scoring system (AA+, A, B or % KO score in IFS) with mandatory unannounced audit options |
How Ekontrol Engineers Build Practical, Audit-Ready HACCP Systems
At Ekontrol, we don't hand you a generic 400-page binder copied from another factory. Our food safety engineers walk your production lines across shifts, map real piping and air flows, validate thermal and metal detection CCPs, simplify operator logs onto single-page checklists, and train your floor staff so you pass both SSUFSCP inspections and GFSI audits without stress.
Actionable Roadmap for Implementing the 7 HACCP Principles and Passing Certification
To turn the 7 principles of HACCP into a reliable operational shield on your production floor, follow this four-step engineering sequence:
- Start with an on-site technical gap analysis. Before drafting hazard tables, inspect your facility's hygienic zoning, drainage, air handling, CIP sanitation, and sensor calibration. Booking an independent HACCP diagnostic audit gives you a clear, prioritized action plan measured against Order No. 590, ISO 22000, or GFSI requirements.
- Fix Prerequisite Programs (PRPs) first so you keep CCPs lean. Solid sanitation, pest control, glass/brittle plastic control, and allergen management absorb 85% of routine floor risks. That lets your team focus CCP monitoring on the 1 to 4 points where real-time physical limits protect the consumer.
- Execute hands-on implementation and operator training. Involve your shift technologists, maintenance engineers, and line operators when verifying flow diagrams and testing corrective actions. When you need turnkey engineering documentation, thermal validation, and floor coaching, explore our food safety system implementation service.
- Secure expert support during state inspections and certification audits. Whether you're preparing for an SSUFSCP inspection or certifying to ISO 22000, FSSC 22000, BRCGS, or IFS, professional audit support ensures your risk matrix, CCP validations, and traceability records stand up to auditor scrutiny.


