How to Write a HACCP Plan for a Bread Bakery | GIFSQ

How to Write a HACCP Plan for a Bread Bakery

Bread bakeries get treated as low-risk, and half of that reputation is earned — the oven is a genuine, validated kill step running above temperatures that destroy vegetative pathogens. The other half is complacency. Because here’s what the oven doesn’t do: it doesn’t remove allergens. It doesn’t destroy mycotoxins. It doesn’t catch the metal fragment from the slicer blade, and it doesn’t fix the wrong label on the bag. Bakery recalls are dominated by undeclared allergens and foreign material — the hazards everyone mentally filed under “the oven handles it.”

This guide walks the Codex 12 steps for a bread bakery — loaves, rolls, buns: mixing through proofing, baking, cooling, slicing, packing. The hazard analysis goes where bakery risk actually lives.

Step 1: Get the baker in the room

QA, head baker or production lead, maintenance, sanitation, procurement. The baker knows the recipes, the real allergen changeover sequence, and which equipment sheds what. That knowledge is the hazard analysis. One member with formal HACCP training. Document the team.

Step 2: Describe products — in families, honestly

For each product family: ingredients (flour types, yeast, seeds, dairy, egg, soy — every allergen flagged), formulation, baking profile, packaging, shelf life (ambient, typically 3–7 days), storage and distribution. Group similar products to keep the plan manageable — but group by genuine similarity. A seeded loaf and a plain white loaf have different allergen and foreign-material profiles. We’ve seen 40-SKU “bread” hazard analyses that said nothing about anything. Don’t.

Step 3: Who eats it?

General population, no further heating. Note children’s products (allergen accuracy matters enormously) and any free-from claims — a “gluten-free” claim is a promise your controls have to keep.

Step 4: Diagram and walk

Receiving → dry storage → scaling/mixing → dividing/rounding → proofing → baking → depanning → cooling → slicing → packaging → dispatch. Add rework (dough and baked — both), allergen changeovers, packaging handling. Walk it. The cooling area, the slicer, the rework bins — confirm they’re on the diagram. Sign, date.

Step 5: Hazard analysis — past the oven

• Biological: Salmonella in raw flour and egg ingredients — controlled by baking, if baking is validated. Post-bake contamination is limited by low water activity but not impossible; assess handling steps honestly.
• Chemical: allergens — the dominant chemical hazard in bakeries. Undeclared allergen from cross-contact or mislabeling. Mycotoxins in flour — not destroyed by baking, supplier-controlled. Cleaning chemical residues. Lubricants.
• Physical: metal (sifters, blades, slicer), plastic, wood, stones from flour, tray debris.

Write this sentence in your analysis: baking controls vegetative pathogens; it does not control allergens, mycotoxins, or post-bake foreign material. If the analysis doesn’t say that explicitly, it hasn’t understood bakery.

Step 6: CCPs

• Baking — validated time-temperature, the kill step.
• Metal detection — post-packaging or post-slicing.
• Allergen label verification — many bakeries make this a CCP, and given that undeclared allergens are among the most common bakery recalls, it earns the designation.
• Flour mycotoxins and supplier hazards: usually prerequisite-based with verification. Run the tree, document the call.

Step 7: Critical limits

• Baking: validated oven time-temperature achieving the required internal product temperature per product family (e.g., internal ≥90 °C or your validated equivalent). Validate per family and oven zone — a dense rye and a white roll don’t bake the same, and the oven has hot and cold spots. Find them.
• Metal detection: validated test-piece sizes.
• Label verification: the correct label for the product, verified per run — barcode scan tied to the schedule beats visual checks every time.

Step 8: Monitoring

Baking: continuous oven recording plus periodic internal product checks per family. Metal detection: every pack; test-piece challenges at defined frequencies. Label verification: at the start of every run and every product or label changeover, with documented sign-off. Named positions. The label check needs someone who understands that a wrong label is a recall, not a typo.

Step 9: Corrective actions

Under-baked product: hold, assess — extend the bake within validated parameters, rework, or destroy — investigate the oven cause. Metal reject: quarantine, find the source. Label error: stop the line, quarantine everything packed since the last correct check, 100% reconciliation or relabeling under QA supervision, root-cause investigation. Name who decides. Label errors feel minor in the moment; they’re recalls in hindsight.

Step 10: Verification

Calibration of oven recorders and probes. Baking validation studies per product family. Metal detector validation. Label reconciliation audits. Supplier verification — flour mycotoxin COAs, allergen statements. Product and environmental testing per your plan. Independent review of CCP records. And read your consumer complaints: foreign material trends in complaints are verification data. Use them.

Step 11: Records

The plan, the hazard analysis, baking logs, detector check logs, label verification records (tied to specific production runs — “correct labels used today” isn’t traceable), deviation logs, calibration records, supplier COAs and allergen statements, training records. Label records are under increasing scrutiny — make them run-specific.

Step 12: Reassess — and gate new products

Annual minimum. Triggers: new recipe or allergen, new flour supplier, oven changes, new slicer or packer, complaint or deviation trends. Every new SKU gets a hazard analysis review before launch — build that gate into your new product development procedure, not as an afterthought when the auditor asks.

Things that actually work in bakeries

Schedule allergens deliberately. Allergen-free first, after a validated clean; then sequence low-to-high allergen. Document the scheduling logic — auditors ask how you determined it, and “that’s how we’ve always run it” isn’t an answer.

Validate the worst case. Your validation must cover the densest product, the fullest oven, the coldest zone. If the worst case passes, the rest follows. If you validated the easy product, you’ve validated nothing.

Control the cooling area. Open product, exposed, for an extended time. Manage traffic, overheads, air handling. It’s the most exposed product in the plant and often the least controlled area.

War stories

The brush-down changeover. Seeded loaf to plain white, “cleaned” with a dry brush in ten minutes because production was behind. The allergen validation — which didn’t exist — would have failed. The customer complaint with the sesame seed in the “plain” loaf didn’t. Allergen changeovers need defined, validated procedures. Ten minutes with a brush isn’t one.

Rework with no identity. Dough rework bins with no labeling — allergen status unknown, age unknown — going back into the mixer. When we asked what was in the bin, nobody could say. Rework needs identity, age limits, and defined re-entry. Or a ban. Both are valid; “unknown” isn’t.

The flour nobody tested. Mycotoxin COAs “on file” — from two years ago, from a different supplier. The current flour had never been tested. The kill step doesn’t touch mycotoxins, so the entire control was supplier verification that wasn’t happening. Test per risk, per supplier, per crop year.

Forty SKUs, one paragraph. The hazard analysis covered “bread” in a page and a half. Four allergens across the range, seeded and unseeded lines, fried and baked products — all “bread.” The auditor’s response was short and the nonconformance was major. Group honestly or don’t group.

Common mistakes

“Cleaning” an allergen changeover with a dry brush. Seeded loaf to plain white in ten minutes because production was behind — no validated procedure, and the customer found the sesame seed. Allergen changeovers need defined, validated procedures.

Running rework with no identity. Dough bins with no labeling — allergen status unknown, age unknown — going back into the mixer. Rework needs identity, age limits, and defined re-entry — or a ban. “Unknown” isn’t valid.

Relying on a two-year-old flour COA. Mycotoxin COAs “on file” — from two years ago, from a different supplier. The kill step doesn’t touch mycotoxins, so the entire control was supplier verification that wasn’t happening. Test per risk, per supplier, per crop year.

Writing one analysis for forty SKUs. Four allergens, seeded and unseeded lines, fried and baked products — all “bread” in a page and a half. Group honestly or don’t group.

Validating the easy product. Validation on the lightest loaf while the densest product and fullest oven run unvalidated. Cover the worst case — the densest product, the fullest oven, the coldest zone.

Leaving the cooling area uncontrolled. Open product, exposed, for an extended time — the most exposed product in the plant and often the least controlled area. Manage traffic, overheads, and air handling where it matters most.

Checklist — before you call this plan done

• [ ] Team includes the head baker and procurement; training documented
• [ ] Product families grouped by genuine similarity — allergens, process, risk
• [ ] Flow diagram includes rework (dough and baked) and changeovers; walked, signed, dated
• [ ] Hazard analysis explicitly states what baking does and doesn’t control
• [ ] CCPs: baking kill step (validated per family), metal detection, label verification
• [ ] Monitoring with named positions; label checks at every changeover, run-specific records
• [ ] Corrective actions: hold, investigate, disposition authority — label errors stop the line
• [ ] Verification: calibration, validation studies, supplier COAs, complaint trending, independent record review
• [ ] New-SKU hazard review gated in NPD; annual reassessment scheduled