The 7 Principles of HACCP, in Order, With Examples

The 7 principles of HACCP are: (1) conduct a hazard analysis, (2) identify critical control points, (3) set critical limits, (4) establish monitoring, (5) establish corrective actions, (6) establish verification, and (7) keep records. They come from Codex Alimentarius and the US NACMCF, and every HACCP plan, and every GFSI scheme such as SQF or BRCGS, is built on them.

Last updated: November 12, 2026

The 7 HACCP principles at a glance

To put principles 1 and 2 (hazard analysis and critical control points) on paper, use our free HACCP plan template (also as an Excel file).

The 7 HACCP principles are used across restaurants, catering operations, food manufacturing plants, meat and poultry facilities, seafood processors, juice producers, bakeries, dairy plants and ready-to-eat food sites. The setting changes, but the logic stays the same. A small kitchen may use HACCP to control cooking, cooling, reheating and allergen risks. A food manufacturer may use it to manage validated cook steps, metal detection, pasteurization, pH control, supplier hazards, sanitation controls and audit records.

This guide explains what each principle means, what should be documented, what auditors commonly check, and how the principles apply in food manufacturing. For teams that need to turn the principles into a structured plan, a dedicated HACCP builder can help organize hazards, CCPs, monitoring records and supporting documents in one workflow.

HACCP principles vs the 12 steps

People often use “HACCP principles” and “HACCP steps” as if they mean the same thing. In formal HACCP guidance there is a difference.

The 7 HACCP principles are the core requirements of the system. They explain what a HACCP plan must cover: hazards, CCPs, limits, monitoring, corrective actions, verification and records.

The 12 HACCP steps describe the process used to build a HACCP plan: 5 preliminary steps, then the 7 principles.

This structure is reflected in the FDA HACCP principles and application guidelines, which present the preliminary tasks before applying the seven principles. When people search for “7 steps of HACCP” they usually mean the seven principles.

The preliminary steps are why a plan copied from a template fails audits: without a verified flow diagram and a real product description, the hazard analysis describes someone else's process. For the full build sequence, see how to create a HACCP plan.

Principle 1: Conduct A Hazard Analysis

The first principle of HACCP is to identify the food safety hazards that could occur at each step of the process. It comes first because every later decision (which steps are CCPs, what limits to set) depends on it. If the hazard analysis is incomplete, the rest of the plan will be weak, even if the forms look organized.

A hazard analysis usually looks at biological, chemical, physical and allergen hazards. Biological hazards include pathogens such as Salmonella, Listeria monocytogenes, E. coli, Campylobacter, viruses, parasites, mold growth and toxin formation. Chemical hazards include cleaning chemical residues, pesticide residues, incorrect additive levels, lubricant contamination and undeclared allergens. Physical hazards include metal, glass, hard plastic, wood, stones and packaging fragments. Allergen hazards include cross-contact, wrong labels, undeclared ingredients, rework with allergens and supplier formula changes.

A hazard analysis should not list every possible theoretical hazard and stop there. The HACCP team must decide which hazards are significant for the actual product and process, looking at how likely the hazard is to occur and how severe the impact would be. The FDA HACCP guidance explains that hazard analysis should consider hazards that are reasonably likely to occur and the measures that can control them.

Example

A facility makes refrigerated ready-to-eat chicken salad. At receiving, the team identifies raw chicken as a possible source of Salmonella or Campylobacter. Since the product is ready-to-eat after processing, pathogen survival matters, and the later cooking step becomes a key control. At mixing, the team identifies allergen risk because mayonnaise contains egg; if the site also makes products without egg, cross-contact and label control need to be considered. At packaging, a chicken salad containing egg packed with a label that does not declare egg could be unsafe for allergic consumers. At slicing or mixing, metal fragments may be a hazard if equipment wear could introduce them.

What To Document

A hazard analysis should show the process step, the potential hazard, the hazard type, whether the hazard is significant, the reason for that decision, and the control measure. It should also explain when a hazard is not significant: “N/A” is not enough, and a short reason is usually needed.

Common Audit Finding

A common audit finding is an incomplete hazard analysis. Allergen hazards are marked “N/A” even though the site handles milk, soy, wheat, egg, tree nuts, sesame or other regulated allergens. Another common issue is that the hazard analysis was not updated after a new ingredient, supplier, package format or processing step was introduced. Auditors often start here because the hazard analysis shows whether the site understands its real risks.

Connection To SQF, BRCGS, And FSMA

SQF, BRCGS and FSMA all expect the food safety system to begin with hazard analysis. Under FSMA Preventive Controls, the food safety plan must identify known or reasonably foreseeable hazards and determine which require preventive controls. The FSMA Preventive Controls for Human Food rule includes process controls, allergen controls, sanitation controls, supply-chain controls and other controls where needed.

Principle 2: Identify Critical Control Points

The second HACCP principle is to identify the process steps where control is necessary to prevent, eliminate or reduce a significant hazard to an acceptable level.

A Critical Control Point, or CCP, is not just an important step. It is a step where losing control could result in unsafe food, and where the control is specific enough to be measured, monitored and documented. For a four-question decision tree and worked examples, see our guide to critical control points (CCPs).

Examples Of CCPs

A cooking step may be a CCP when it is used to reduce pathogens in poultry, meat, seafood or ready-to-eat products. Pasteurization may be a CCP when time and temperature control pathogens in milk, juice or other liquids. Metal detection may be a CCP when it is used to detect and reject product contaminated with metal fragments. For acidified foods, pH control may be a CCP if equilibrium pH prevents pathogen growth or toxin formation. For cooked chilled products, cooling time and temperature may be a CCP if slow cooling could allow pathogen growth. In a cooked ready-to-eat poultry product, if the cooking step is where pathogens are reduced to a safe level, that step may be a CCP, and the plan then needs a critical limit, monitoring method, corrective actions, verification and records for it.

HACCP Decision Tree

Many HACCP teams use a decision tree to decide whether a step is a CCP. It asks whether there is a significant hazard at the step, whether there is a control measure, whether the step is designed to eliminate or reduce the hazard, whether the hazard could increase later, and whether a later step will control it. The decision tree does not replace judgment; it helps the team document why a step is or is not a CCP. The FDA HACCP application guidelines note that CCP decisions still depend on the actual product and process.

CCP Vs Prerequisite Program

A CCP controls a specific significant hazard at a specific point in the process. A prerequisite program (PRP) controls general conditions across the facility, such as sanitation, pest control, employee hygiene, supplier approval, preventive maintenance, glass and brittle plastic control and allergen zoning. Both matter. The mistake is treating every important program as a CCP: sanitation is important, but it is usually a prerequisite program, while a validated cook step may be a CCP because it controls a specific biological hazard at a defined step.

Common Audit Finding

Two opposite problems appear often. Some sites have too many CCPs because they try to control everything through the HACCP plan, which makes the system hard to manage. Others miss real CCPs because they assume a general GMP or sanitation program is enough, even when the hazard needs a measurable process control. Auditors want to see that the site can explain its decision, and the answer should come from the hazard analysis, not from habit or a copied template.

Principle 3: Establish Critical Limits

The third principle is to establish critical limits for each CCP. A critical limit is a measurable minimum or maximum value that separates control from loss of control. It may be based on temperature, time, pH, water activity, detector sensitivity, concentration, belt speed, pressure or another measurable parameter. The FDA HACCP guidance defines it as a maximum or minimum value that must be controlled at a CCP to prevent, eliminate or reduce a food safety hazard to an acceptable level.

Critical limits should not be chosen because “we have always done it this way.” They need support from reliable sources, such as regulation, FDA Food Code requirements, scientific literature, validated process data, process authority recommendations, customer or certification requirements, challenge studies or thermal process validation.

Critical limit examples

Other examples: certain non-intact meat products are cooked to 155 °F for 17 seconds and intact meat or fish to 145 °F for 15 seconds under the Food Code, depending on product and conditions. For low-moisture products, a limit of finished-product water activity of 0.85 or below can be used when water activity is the safety control; FDA explains the role of water activity in its guidance on water activity in foods. These numbers are examples, not universal limits: a manufacturer must use the correct requirement for the specific product, process and market.

Critical Limit Vs Operating Limit

A critical limit is the safety boundary. If the process falls outside it, the CCP is not under control. An operating limit is an internal target that gives the team a buffer. For example, the critical limit for a cooked product may be 165°F while the operating limit is 168°F. The operating limit helps prevent deviations; the critical limit determines whether corrective action is required.

Common Audit Finding

A common audit finding is a critical limit with no support. A HACCP plan says “cook for 20 minutes,” but the site cannot explain the product size, internal temperature, oven load, lethality target or validation source. The auditor may then question whether the limit actually controls the hazard.

Principle 4: Establish Monitoring Procedures

The fourth principle is to define how each CCP will be monitored. Monitoring answers four practical questions: what will be measured, how, when, and who is responsible. The FDA HACCP principles and application guidelines describe monitoring as a planned sequence of observations or measurements used to assess whether a CCP is under control and to produce accurate records for later verification.

Example

For a poultry cooking CCP, the operator measures internal product temperature with a calibrated probe thermometer for the first batch, at defined intervals, and after a line stoppage. The result is recorded in a cooking temperature log with the product, lot, time, result and operator initials. The procedure should be clear enough that a trained employee can follow it without guessing.

What A Monitoring Record Should Include

A useful monitoring record shows the product or batch identification, date and time, actual result, instrument used, name or initials of the person monitoring, any deviation, and the action taken if a limit was missed. Under FSMA Preventive Controls, records must be accurate, created at the time the activity is performed, and include details such as date, time where appropriate, signature or initials, and product or lot identity where appropriate, as listed in 21 CFR Part 117, Subpart F.

Monitoring Frequency

Monitoring must be frequent enough to detect loss of control before unsafe product moves forward. Some CCPs are monitored continuously, such as a pasteurization system that records time and temperature. Others are monitored by batch or at set intervals. “Once per shift” may not be enough if many batches are made during the shift and a deviation could affect several lots before anyone notices.

Common Audit Finding

Auditors often question logs that look too perfect, such as the exact same temperature every hour for several weeks, which may suggest values were copied or entered later. Another common issue is a gap between the plan and real practice: the plan says checks are hourly, but operators complete them at the end of the shift.

Principle 5: Establish Corrective Actions

The fifth principle is to define what happens when monitoring shows a CCP is outside its critical limit. Corrective actions must do two things: control the affected product and fix the cause of the deviation. The FDA HACCP guidance explains that they should correct the cause of the deviation, determine what happens to affected product, and create records of what was done.

The 4 parts of a corrective action

1. Fix the cause. Identify and correct the problem that let the limit be missed.
2. Regain control. Bring the process back within the critical limit and take action to reduce the likelihood it recurs.
3. Decide on the affected product. Hold it, evaluate it for safety, and keep affected food from entering commerce unless it can be shown safe.
4. Record it. Write down the deviation, the product disposition, the cause and the action taken.

Parts 1 to 3 follow the corrective action requirements in 21 CFR 117.150(a)(2), which require appropriate action to identify and correct a problem, to reduce the likelihood that it will recur, and to evaluate all affected food for safety and prevent it from entering commerce if it cannot be shown to be safe.

Example

A ready-to-eat cooked chicken product has a critical limit of 165°F. During a routine CCP check, one batch records 158°F. The record should not stop at “operator retrained.” A complete record shows the affected batch was identified and held, QA reviewed its status, the batch was reprocessed or rejected under the site's validated procedure, and the cause of the low temperature was investigated. If the oven probe was faulty, it shows the repair, the calibration check and follow-up review of the next production runs.

Correction Vs Corrective Action

A correction fixes the immediate issue. A corrective action addresses the reason it happened and reduces the chance of recurrence. Removing the wrong label roll from the line is a correction; investigating why it was issued, updating the label control process and verifying the change is corrective action.

Common Audit Finding

The most common finding is a corrective action record that is too thin: “fixed,” “rechecked” or “operator retrained,” with no product disposition, root cause or verification of closure. Another serious finding is product released after a critical limit deviation without documented evaluation.

Principle 6: Establish Verification Procedures

The sixth principle is to confirm that the HACCP system works as intended. Monitoring checks whether a CCP is under control during production; verification checks whether the system itself is designed properly, followed correctly and still effective. The FDA HACCP application guidelines define verification as activities other than monitoring that determine whether the HACCP plan is valid and whether the system is operating according to the plan.

Monitoring Vs Verification

Verification is not monitoring. Monitoring happens during production and is usually done by operators: recording the internal cooking temperature of each batch. Verification happens through review, audit, calibration, validation or other scheduled checks, usually by QA or independent reviewers: reviewing cooking logs, checking calibration records, observing monitoring and confirming deviations were handled correctly.

Validation is a related idea: it proves the critical limits work in the first place. For example, a cook-step validation shows that reaching 165°F at the coldest point of your product achieves the pathogen reduction the plan relies on. Verification then confirms day to day that the plan is followed.

Examples Of Verification Activities

Verification may include calibration of thermometers, pH meters, scales or metal detectors; review of CCP monitoring and corrective action records; internal audits; direct observation of monitoring; finished product testing or environmental monitoring where appropriate; validation of critical limits; annual HACCP reassessment; and review after product, process, equipment, supplier or ingredient changes. The FSMA Preventive Controls rule also treats verification as a way to confirm that controls are consistently implemented and effective.

Common Audit Finding

A common finding is verification that has become a signature exercise: a supervisor signs a stack of CCP records every Friday with no evidence that missing entries, out-of-range values, calibration status or corrective action closure were reviewed. Another is overdue calibration; if the thermometer used for a cooking CCP is out of calibration, the site may have trouble defending its monitoring records.

Principle 7: Establish Record-Keeping And Documentation

The seventh principle is to keep the documents and records that prove the HACCP system exists and is being followed. The seventh principle requires the HACCP plan to be backed by records showing each CCP was monitored and every deviation was handled. Software that keeps these records versioned and time-stamped is compared in our guide to HACCP compliance software.

HACCP is evidence-based: a site may have good practices on the floor, but if the records are missing, incomplete or disconnected, an auditor cannot verify that the system worked. The FDA HACCP principles and application guidelines list HACCP records such as the hazard analysis summary, HACCP plan, team responsibilities, product description, verified flow diagram, CCP summary, validation records and operational records.

What Should Be Documented

A HACCP documentation system usually includes the HACCP plan, product description and intended use, verified process flow diagram, hazard analysis, CCP determination, critical limits and supporting validation, monitoring procedures and logs, corrective action records, verification activities, calibration records, training records, supplier documents where supplier controls support the plan, reassessment records and document version history.

The Practical Rule

From an auditor's perspective, if there is no record, it did not happen. That does not mean every task needs a complex form: the record must show what was done, when, by whom, what result was obtained, and what happened if something was wrong.

Record Retention

Record retention depends on the applicable regulation and product category. For many FDA-regulated facilities under FSMA Preventive Controls, records required by Part 117 must generally be retained for at least two years after the date they were prepared (21 CFR Part 117, Subpart F). For FDA seafood HACCP, records must be retained for at least one year for refrigerated products and at least two years for frozen, preserved or shelf-stable products (21 CFR 123.9). For FDA juice HACCP, records must be retained for at least one year for perishable or refrigerated juices, and for frozen, preserved or shelf-stable juices for two years or the shelf life of the product, whichever is greater (21 CFR 120.12).

Common Audit Finding

A common finding is that records exist, but they are not connected: a CCP deviation appears in the cooking log with no corrective action record, or a corrective action exists with no evidence that affected product was held, or a root cause was found with no verification that the action was closed. Disconnected records make the HACCP system look weaker than it may be.

For Food Manufacturers: How The 7 Principles Connect To SQF, BRCGS, And FSMA

The 7 HACCP principles are not limited to one standard. SQF, BRCGS and FSMA use different language and clause structures, but the same logic appears across all three.

For Principle 1, the hazard analysis is the starting point. SQF expects the food safety plan to be based on identified hazards and controls, BRCGS expects the HACCP food safety plan to identify and assess hazards, and FSMA requires a written hazard analysis of known or reasonably foreseeable hazards. Auditors check whether it is specific to the product, process, ingredients, suppliers and facility.

For Principle 2, CCPs and other controls must be clearly justified. SQF and BRCGS follow traditional CCP logic; FSMA uses the broader term “preventive controls.” Auditors check the decision logic behind each CCP and whether the site can explain the difference between CCPs, preventive controls and prerequisite programs.

For Principle 3, critical limits must be measurable and supported. Auditors ask for the scientific basis, regulatory source, validation document or process authority support behind each limit.

For Principle 4, monitoring must match the written plan. Auditors check actual values, frequency, responsible personnel, signatures or initials, and whether records were completed at the time of the activity.

For Principle 5, corrective actions must address both the product and the process. Auditors check product hold records, disposition decisions, root cause, preventive action and evidence of closure.

For Principle 6, verification confirms whether the system works. Auditors look for evidence that verification is more than a signature and that someone actually reviewed the records.

For Principle 7, records prove implementation. Auditors check whether records are complete, accurate, traceable, signed, retained for the required period and connected to the relevant hazard, CCP, corrective action or verification activity.

SQF, BRCGS and FSMA do not always use identical terms. Traditional HACCP focuses heavily on CCPs, while FSMA Preventive Controls uses a broader structure of process, allergen, sanitation, supply-chain and other preventive controls. A cooking step may still look very much like a CCP, but allergen label control or sanitation controls for ready-to-eat exposure may be handled as preventive controls rather than traditional CCPs.

In IONI, you upload your existing HACCP documents or SOPs and the AI builds the HACCP plan, flags gaps against the principles, and runs the monitoring checks and deviations on the floor. See the HACCP plan builder or book a demo.

You can review the official program information for SQF food safety codes, the BRCGS Food Safety standard, and the FDA's overview of FSMA Preventive Controls for Human Food. For teams comparing HACCP with certification requirements, IONI also has a separate guide on HACCP vs SQF.

FAQ

What are the 7 principles of HACCP in order?

1. Conduct a hazard analysis.
2. Identify critical control points.
3. Establish critical limits.
4. Establish monitoring procedures.
5. Establish corrective actions.
6. Establish verification procedures.
7. Establish record-keeping and documentation.

What is the first principle of HACCP?

The first principle is to conduct a hazard analysis: identify biological, chemical, physical and allergen hazards at each process step, then decide which are significant enough to need control. It comes first because the CCPs, limits and monitoring all depend on it.

What does the seventh HACCP principle require?

It requires record-keeping and documentation: the HACCP plan, hazard analysis, CCP monitoring records, corrective action records and verification records, kept for the required retention period, so you can show the system is working.

What are critical limits in HACCP?

A critical limit is a measurable maximum or minimum value at a CCP that separates safe from unsafe, such as a core cooking temperature of at least 165 °F for poultry. It should be backed by regulation, scientific data or process validation.

How many HACCP principles are there, and how are they different from the 12 steps?

There are 7 principles. The 12 steps are the sequence used to build a plan: 5 preliminary steps (team, product description, intended use, flow diagram, on-site flow verification) followed by the 7 principles.

Who created the 7 HACCP principles?

They were developed by the US National Advisory Committee on Microbiological Criteria for Foods (NACMCF) and by Codex Alimentarius, and are adopted in US regulation for seafood and juice (FDA) and meat and poultry (USDA FSIS). For many other FDA-regulated manufacturers, FSMA Preventive Controls applies a HACCP-like logic under the term “preventive controls.”

Related Reading

• The Future of Food Safety: How AI Is Changing HACCP Compliance
• 9 Common Mistakes in HACCP Plans and How AI Prevents Them
• How Small Food Producers Can Save Time with AI-Generated HACCP Plans
• Manual vs. AI-Generated HACCP Plans: A Detailed Comparison
• Basic HACCP Plan Explained: A Step-by-Step Guide for Beginners
• HACCP Audit Checklist: Everything Your Business Needs to Be Ready