HACCP — Hazard Analysis and Critical Control Points — is a system that prevents food safety problems instead of trying to catch them in finished product testing. Testing has one basic weakness: you cannot test safety into a product. A lab sample covers only a fraction of a lot, pathogens are not spread evenly through it, and a negative result never proves the rest of the lot is clean. HACCP works the other way round: find where hazards can occur in your process, put controls at those points, and monitor the controls.

Here is the maths behind the testing problem. Take a lot where 1% of the units carry contamination — a realistic figure behind actual outbreaks — and pull 60 samples, which is a generous testing programme by most plants’ standards. The chance that all 60 come back clean, even though the lot is contaminated, is roughly 55%. More than half the time, the testing programme clears the lot and it ships. No practical sampling plan fixes this: to be confident about low, unevenly spread contamination, you would have to test so much of the lot that nothing would be left to sell.

End-product testing also comes too late. It tells you the product was wrong hours or days after the event — after the raw materials were bought, after the line ran, after the batch was finished. When a result comes back positive, everything made in that window is suspect. Testing is a verification tool. It was never meant to be the control itself.

What HACCP does differently

HACCP controls the process, not the product. For each food safety hazard that could realistically cause harm — pathogens, chemical contaminants, foreign bodies, allergens — you work out where in your process that hazard can be prevented, eliminated, or reduced to a safe level. Then you put a hard, measurable control at that point and check it every time the line runs. Safety is built in at the hazard point, instead of being guessed from a few samples.

The system was developed in the 1960s for NASA’s space programme — food for astronauts had to be safe with near-certainty, and end-product testing could not deliver that. The method proved itself and became the basis of food safety law around the world. Codex Alimentarius sets the global reference in CXC 1-1969, General Principles of Food Hygiene, revised in 2020. EU hygiene law requires HACCP-based procedures, FDA’s preventive controls under FSMA follow the same logic, and every GFSI-benchmarked standard — BRCGS, SQF, FSSC 22000 — audits it. Learn the Codex version and every auditor you meet will be working from the same page.

The foundation comes first

Codex is clear on one point: HACCP will not work without prerequisite programmes already in place. GMP, sanitation, pest control, maintenance, supplier approval, personnel hygiene — these cover the general conditions of the plant. HACCP deals with the specific hazards your PRPs cannot control. A plant with weak sanitation and a polished HACCP plan will not survive the first audit. Get the foundations running, verified, and routine first — then HACCP adds the precision.

The seven principles are: conduct a hazard analysis and identify control measures, determine the CCPs, establish validated critical limits, monitor control of CCPs, take corrective actions on deviation, validate the plan and verify the system, and document everything. Each lesson in this course takes them in order, the way you would work through them on the floor — with the decisions each step actually requires.