Principles 6–7: Verification, Documentation, and Keeping the Plan Alive

Principle 6: Validate the HACCP plan and then establish procedures for verification. Codex puts two different jobs into one principle, and mixing them up is one of the most common audit findings. Get the distinction clear:

  • Validation proves the plan will work. It happens before implementation and after any change: the evidence that your critical limits control the hazards, that your cooking schedule delivers the required lethality, that your metal detector catches the specified test piece in your product at line speed. Scientific studies, challenge tests, in-plant trials — this is the evidence the plan is sound.
  • Verification proves the system is working. It runs continuously after implementation: calibration of monitoring instruments, review of monitoring and corrective action records, internal audits of the HACCP system, targeted product or environmental testing, and review of complaints and deviations for patterns.
Side-by-side comparison of HACCP validation versus verification: what each answers and when each happens

Monitoring asks “is this CCP under control right now.” Verification asks “is the whole system working as intended.” A line can pass every monitoring check while the system quietly fails — uncalibrated thermometers reading two degrees high will do exactly that. Verification is what catches it.

Put verification on a schedule. What stands up in audits: daily review of CCP monitoring records by the QA supervisor, signed and dated — never by the person who took the readings; calibration checks on a defined frequency against traceable standards; quarterly internal audits that walk the plan against the floor; re-validation of critical limits when equipment, suppliers, or formulations change; trend review of deviations and complaints. Each activity has a frequency, a responsible person, and a record.

Principle 7: Documentation and record-keeping

Principle 7 covers two things: the HACCP plan itself — the documented system — and the records the system generates. The plan document carries the team, product description, intended use, verified flow diagram, hazard analysis, CCP determinations, critical limits with their validation basis, monitoring procedures, corrective actions, and verification procedures. The records prove the plan ran: monitoring logs, corrective action reports, calibration records, verification records, training records.

Records must be legible, made at the time, signed, and retrievable. An auditor will ask for a specific date’s CCP records and time you. Retention should cover at least the product’s shelf life plus a margin — a year beyond shelf life is the working rule in most industries, longer where regulations or customers demand it. Electronic records are fine if the system controls who can enter, change, and delete — an editable spreadsheet on a shared drive is not a record system.

Keep the plan current

A HACCP plan has to stay current. Review it at least annually, and re-validate whenever anything changes: new ingredients or suppliers, new equipment or line speeds, new products, new packaging, changes in regulations, or after any incident, deviation trend, or complaint pattern. A plan that describes last year’s process is just paperwork. The review itself is a record: date, participants, what was checked, what changed, and re-signing of the plan.

Beyond HACCP: TACCP and VACCP

Modern audits — and all GFSI-benchmarked standards — expect two assessments alongside HACCP. TACCP (Threat Assessment Critical Control Points) applies the same thinking to deliberate contamination: who could intentionally adulterate the product, where the vulnerable points are, and what controls — access control, visitor procedures, material security — reduce the threat. VACCP (Vulnerability Assessment Critical Control Points) targets food fraud: economically motivated adulteration such as diluted, substituted, or mislabelled ingredients. The method is familiar — assess vulnerability by ingredient and supplier, prioritise, and put controls in place: supplier approval, authenticity testing, mass balance checks.

HACCP deals with accidents; TACCP and VACCP deal with people acting deliberately. The controls look different, but the discipline is the same: assess, control, monitor, verify, document. Plants that treat food defence and food fraud as a paperwork exercise find out the hard way during a real incident. Build them with the same rigour as the HACCP plan and they fit into the same management review.

PreviousNext