How Ready Are You for Certification?

Have you assembled a HACCP team with multi-disciplinary expertise (production, QA, maintenance, procurement) and documented their roles and qualifications?

Have you completed a full product description — composition, pH/water activity, packaging, shelf life, storage and distribution temperature requirements?

Do you have a verified process flow diagram covering every step, confirmed on-site by the HACCP team to match actual operations?

Have you identified the intended use, intended consumers, and any vulnerable consumer groups (children, elderly, immunocompromised) for each product?

Have you conducted a hazard analysis at every process step — identifying biological, chemical and physical hazards and rating each by severity × likelihood against a defined risk matrix?

For every high-risk hazard, do you apply a documented decision tree (does control exist? is the step designed to eliminate the hazard? is there a later kill step?) to classify it correctly as a CCP or an OPRP?

Have you established and documented prerequisite programmes (PRPs) — sanitation, pest control, personnel hygiene, supplier approval, maintenance, allergen management — for low/medium-risk hazards?

Is the justification for each CCP/OPRP classification (why a subsequent step does or doesn't eliminate the hazard) documented and defensible to an auditor?

Does every CCP have a measurable, scientifically validated critical limit (e.g. core temperature and hold time) that must never be exceeded?

Does every OPRP have a measurable or observable action criterion, and do you operate with a tighter target value as a safety margin above the critical limit/action criterion?

Does each CCP and OPRP have a documented monitoring procedure specifying the method, device, frequency and the person responsible for checking it?

Is all monitoring and measuring equipment (thermometers, metal detectors, scales, data loggers) calibrated or verified at a defined frequency, with calibration records retained?

Are monitoring results for every CCP and OPRP check actually recorded in real time (not reconstructed later), with the operator and any deviation noted?

When a critical limit or action criterion is not met, do you immediately correct it (e.g. re-cook, re-test) and hold the affected product until its disposition is determined?

Do you conduct a root cause investigation (e.g. 5-Whys or fishbone) for each deviation, document it, and implement corrective action to prevent recurrence — with effectiveness verified afterward?

Do you have a documented withdrawal/recall procedure with named, authorized competent person(s), tested periodically through mock recalls?

Do you have a verification schedule covering record reviews, equipment calibration checks, microbiological/environmental testing, and internal HACCP audits — each with a defined frequency and responsible person?

Before implementing a control measure (and whenever it changes), do you validate with objective evidence (heat penetration study, challenge study, literature review, equipment capability test) that it actually achieves the intended control?

Do you ensure verification activities are never carried out by the same person responsible for the routine monitoring of that same CCP/OPRP?

Are verification and validation results analyzed for trends and reported as input to management review and continual improvement?

Is your HACCP plan formally document-controlled — with a defined scope, revision history, and sign-off by both the preparer and an approver?

Do you maintain a change/update log that records every modification to the HACCP plan (new CCP, new supplier, changed critical limit) with its trigger, approval and verification of implementation?

Do you track food safety KPIs (CCP deviations, corrective action closure rate, customer complaints, recalls, audit nonconformities) and review them at a defined frequency?

Does top management formally review the HACCP plan and its performance at planned intervals — considering audit results, corrective actions, supplier performance, and update activities — with documented outputs?