The 7 HACCP Principles Explained (With Real Examples)

In 2015, Blue Bell Creameries recalled its entire product line after Listeria monocytogenes in its ice cream was linked to ten illnesses and three deaths. The pathogen had been turning up in the company's own environmental swabs since 2013 - found, logged, and never acted on, which is precisely the failure the seven HACCP principles exist to prevent.

Hazard Analysis and Critical Control Points is a preventive system, and its seven principles are the operating instructions that make it work on a production line or a cook line. This article covers all seven in order: what each one actually means, how it looks in a real processing plant and a real commercial kitchen, and the mistake that most often breaks it. 

If you need the wider picture first who is legally required to have a plan, what goes in one, and how to implement it, start with our complete guide to HACCP.

What Are the 7 HACCP Principles?

The seven HACCP principles are the framework of a food safety management system built on prevention rather than inspection. 

Instead of testing finished product and hoping problems surface, HACCP requires you to identify where biological, chemical, and physical hazards can enter a process, pinpoint the steps where those hazards must be controlled, set a measurable limit at each one, and prove through monitoring and records that control held on every batch.

The system dates to the 1960s, when Pillsbury developed it alongside NASA and the U.S. Army Natick Laboratories to produce food safe enough for spaceflight, an astronaut with foodborne illness in orbit had nowhere to go. 

The National Advisory Committee on Microbiological Criteria for Foods codified the modern seven-principle form in 1997, and it was adopted internationally through the Codex Alimentarius general principles of food hygiene.

Each principle depends on the one before it. A critical limit is meaningless without a CCP to attach it to, and monitoring is meaningless without a limit to measure against; which is why the order matters and why plans usually fail at the seams between principles rather than inside them.

Before the Principles: The 5 Preliminary Steps

You cannot analyze hazards in a process you haven't described. Before Principle 1 begins, FDA's application guidelines call for five preliminary tasks that most plans rush and most auditors probe first.

1. Assemble the HACCP team. Bring together people who know different parts of the operation - production, sanitation, quality, maintenance, and someone with food microbiology knowledge. A single quality manager writing the plan alone will miss what the maintenance lead knows about the equipment. These cross-functional team roles are what keep the analysis honest.

2. Describe the product and its distribution. Composition, pH, water activity, packaging, shelf life, and whether it ships frozen, refrigerated, or ambient. A product formulated to pH 4.2 has a fundamentally different hazard profile than the same recipe at pH 5.0.

3. Identify the intended use and consumers. Product headed for a hospital, nursing home, or school feeds an immunocompromised or high-risk population, which raises the severity of every pathogen you're about to evaluate.

4. Construct a flow diagram. Map every step from receiving to shipping, including rework loops and holding steps, the places hazards hide.

5. Verify the diagram on the floor. Walk the line during production and confirm the diagram matches reality, across all shifts.

This is why sources disagree on the count. Codex frames HACCP as 12 steps: these five, plus the seven principles.

The 3 Hazard Categories HACCP Controls

Every hazard your team identifies in Principle 1 falls into one of three classic categories.

Biological hazards are pathogenic bacteria, viruses, and parasites - Salmonella, Listeria monocytogenes, E. coli O157:H7, norovirus. They cause the majority of foodborne illness and are usually controlled by a validated kill step or by strict time and temperature control. Understanding biological hazards is the foundation of any credible hazard analysis.

Chemical hazards include cleaning compounds, sanitizer residue, pesticide carryover, veterinary drug residues, and naturally occurring toxins like histamine in scombroid fish or mycotoxins in grain. Control is typically supplier verification plus controlled chemical storage away from production.

Physical hazards are foreign material capable of causing injury: metal fragments, glass, hard plastic, stones, bone. Control comes through equipment inspection, screens and sieves, and detection at packaging.

One important addition. Under FSMA's preventive controls rule, FDA treats food allergens as their own hazard class and also recognizes radiological hazards. This matters more than its coverage suggests, undeclared allergens are the leading cause of FDA food recalls, and allergen control is a labeling and segregation problem, not a kill-step problem.

The 7 HACCP Principles Explained

Each principle below follows the same structure: what it means, how it's done, a real example from both manufacturing and foodservice, and the mistake that most often breaks it.

Principle 1 — Conduct a Hazard Analysis

Hazard analysis is the foundation the other six principles stand on. It asks a deceptively simple question at every step of your flow diagram: what can go wrong here, and does it matter enough to control?

The work splits into two stages. 

First, hazard identification — list the biological, chemical, physical, and allergen hazards reasonably likely to occur at each process step, drawing on outbreak data, scientific literature, supplier information, and your own history. 

Second, hazard evaluation — assess each candidate to determine whether it is significant. Applying structured hazard identification methods keeps this from becoming a brainstorm, and evaluating hazards means you weigh severity against likelihood rather than treating every possibility as equally urgent. Only significant hazards carry forward to Principle 2.

In a plant: A ready-to-eat deli meat producer identifies Listeria monocytogenes recontamination at post-lethality slicing. The cook step already destroys it, but the product is exposed to the environment afterward and supports growth during refrigerated shelf life. Severity is high, likelihood is real; significant.

In a kitchen: A restaurant identifies Salmonella cross-contact during raw poultry prep, where the same board and knife move to salad greens that will never be cooked. Significant.

Where teams get it wrong: Cataloguing every conceivable hazard without evaluating significance. The result is a plan so bloated that staff can't execute it and a hazard analysis that lists forty items usually means nobody separated the real risks from the theoretical ones.

Principle 2 — Determine Critical Control Points

A critical control point is a step where control can be applied and is essential to prevent, eliminate, or reduce a significant hazard to an acceptable level. The emphasis belongs on essential: if losing control at this step doesn't put consumers at risk, it isn't a CCP.

The Codex Alimentarius decision tree exists to make this judgment consistent. Run each significant hazard, at each step, through four questions in order.

The tree matters because it forces the question "is control here essential, or merely helpful?", and how you answer depends on how control measures are selected across the process as a whole.

In a plant: On a ready-meal line, the thermal cook step is a CCP because it's the only step that destroys vegetative pathogens. Metal detection at final packaging is a second CCP, the last opportunity to remove foreign material before the product ships.

In a kitchen: Final cook temperature is a CCP. So is the cooling step after batch cooking, where product passes slowly through the range that lets spore-forming pathogens like Clostridium perfringens multiply.

Where teams get it wrong: Naming ten or twelve CCPs. Most operations have three to six. When receiving, storage, handwashing, and sanitation all get labeled critical, monitoring resources spread thin across steps that prerequisite programs already handle and the genuinely critical ones stop getting the attention they need.

Principle 3 — Establish Critical Limits

A critical limit is the maximum or minimum value that separates safe from unsafe at a CCP. It has to be a number someone can measure in real time - temperature, time, pH, water activity, chlorine concentration, detector sensitivity. "Cooked thoroughly" is not a critical limit.

Critical limits must be grounded in science, not preference. Draw them from regulation, from validated process authority studies, or from published thermal death time data. Where a regulation sets the value, the regulation wins.

There's a distinction page-one guides consistently skip: the critical limit versus the operating limit. The critical limit is the safety boundary. The operating limit is the tighter target you actually run to, deliberately set with a buffer so normal process variation never breaches the critical limit. 

If your critical limit is 165°F and you also target 165°F, half your batches will trip a deviation and you'll be writing corrective action reports all shift. Target 170°F instead, and the buffer absorbs the variation.

Where teams get it wrong: Subjective limits that can't be measured, and unvalidated numbers copied from another facility's plan. A limit borrowed from a different product mass, packaging format, or oven design isn't validated for yours.

Principle 4 — Establish Monitoring Procedures

Monitoring is the planned sequence of observations or measurements that shows a CCP is under control and produces the record that proves it later. Without it, a critical limit is an intention rather than a control.

Every monitoring procedure has to answer five questions: what is measured, how it's measured and with what instrument, when and how often, who is responsible, and where the result gets recorded. 

Assign monitoring to someone with direct access to the CCP, train them on the limit, and give them clear instruction to act the moment a reading falls outside it.

Frequency depends on the method. 

Continuous monitoring — a chart recorder logging oven temperature without interruption is preferred, because it captures every deviation. 

Intermittent monitoring is acceptable when continuous isn't feasible, but the interval must have a defensible rationale tied to lot isolation: if you check every 30 minutes, you must be able to identify and hold everything produced since the last confirmed good check.

In a plant: A continuous thermal recorder tracks the oven, and the shift supervisor reviews and signs the chart at the end of every run.

In a kitchen: A calibrated probe thermometer checks the thickest portion of the first and last item in every batch, logged on the cook line as it happens.

Where teams get it wrong: "Pencil-whipping" - filling in logs at the end of shift from memory. Auditors test for this first, and it's easy to catch: the handwriting is uniform, the values are implausibly consistent, and nobody can explain what the reading was at 10:15.

Principle 5 — Establish Corrective Actions

A corrective action is the predetermined response when monitoring shows a critical limit has been breached. Predetermined is the operative word — it's decided while writing the plan, not improvised on the line at 2 a.m.

Federal HACCP regulation for meat and poultry specifies four components, and they're the right template for any operation. Bring the process back under control. Determine the disposition of every unit produced during the deviation. Identify and eliminate the root cause so it doesn't recur. Document all of it.

It's worth separating a correction from a corrective action. Reworking a batch is a correction — it deals with the product in front of you. Finding out why the sealer drifted and fixing the maintenance schedule is the corrective action. 

Confusing the two is why the same deviation shows up month after month. The distinction mirrors the difference between a deviation and a reportable incident in any control system: one is a symptom, the other is what you actually fix.

In a plant: The metal detector fails its hourly test-piece check. Everything produced since the last verified pass is held and rescreened, non-conforming product is destroyed, and maintenance investigates sensor drift before the line restarts.

In a kitchen: Chicken probes at 158°F, return it to heat and continue cooking to the critical limit. But if cooked rice sat at room temperature past the cooling window, there's no corrective action that makes it safe. It's discarded.

Where teams get it wrong: Fixing the batch and stopping there. If the root cause is never identified, the plan is generating paperwork rather than preventing recurrence.

Principle 6 — Establish Verification Procedures

Verification asks whether the HACCP system is working as designed — separate from monitoring, which asks whether a single CCP is in control right now.

First, a distinction almost every guide blurs. 

Validation asks will this plan work? It's the scientific evidence gathered up front proving your critical limits actually control the hazard - thermal death time studies, challenge testing, process authority letters. 

Verification asks is the plan being followed, and is it still working? It's ongoing. You validate once and revalidate on change; you verify continuously.

Verification activities include instrument calibration, review of monitoring and corrective action records, direct observation of the person doing the monitoring, targeted finished-product or environmental testing, and internal audit. 

Add to that a reassessment trigger: reassess the plan at minimum annually, and immediately on any change to product formulation, process, equipment, packaging, supplier, or intended consumer.

In a plant: Thermometer calibration is logged weekly, environmental swabbing for Listeria runs quarterly on a zoned schedule, and the plan is reassessed annually and after any line modification.

In a kitchen: A supervisor reviews cook and cooling logs weekly and signs off; thermometers are calibrated monthly in an ice-point slurry.

Where teams get it wrong: Treating monitoring records as verification. They're the input to verification, not the act of it — and the person verifying must be someone other than the person who did the monitoring. Self-review isn't verification.

Principle 7 — Establish Record-Keeping and Documentation

The final principle is the evidence layer. In an audit, an inspection, or a recall investigation, an undocumented control is indistinguishable from no control at all.

Four classes of record belong in a HACCP system: the plan itself and its supporting documentation (hazard analysis, CCP determinations, validation studies, the flow diagram); CCP monitoring records; corrective action records; and verification records. Keeping these coherent is a matter of documentation and record control version management, defined retention, and clear ownership; not just filing.

Retention periods vary by regulation. Under federal meat and poultry rules, records for slaughter and refrigerated product are generally held one year, and frozen, preserved, or shelf-stable product two years. 

Confirm the requirement that applies to your product category, and check whether customers or GFSI-scheme audits demand longer.

Where teams get it wrong: Records missing one of four essentials — the signature or initials of the person who took the reading, the date and time, the actual observed value rather than a checkbox, and evidence of reviewer sign-off. A log that reads "✓" tells an auditor nothing. A log that reads "168°F, 10:47, JM" tells them everything.

CCP vs. PRP: The Distinction That Fails Audits

More HACCP plans fail on this one distinction than on any other. It's also the distinction page-one guides skip almost entirely.

Prerequisite programs create the conditions that make safe food possible. Good manufacturing practices, sanitation, pest control, personal hygiene, water potability, supplier approval, allergen segregation, preventive maintenance, and training all sit here. 

They operate across the whole facility rather than at one step, and they control the general environment rather than one identified hazard. FDA's application guidelines are explicit that HACCP is built on top of prerequisite programs, it doesn't replace them.

A CCP controls one specific significant hazard, at one specific step, against a measurable limit, with a corrective action waiting if that limit is breached. If you can't name the hazard, the step, and the number, you're describing a prerequisite program.

Readers working under GFSI schemes will also meet the operational prerequisite programme (oPRP), a middle category used in ISO 22000 and referenced in SQF and BRCGS audits. An oPRP controls a significant hazard but doesn't have a measurable critical limit that separates safe from unsafe — allergen changeover cleaning is the standard example. It's essential, it's monitored, but there's no temperature or pH that draws the line.

Two failure modes follow from getting this wrong.

Promoting PRPs to CCPs. Receiving, storage, handwashing, and sanitation all get designated critical, and suddenly the plan carries twelve CCPs and a monitoring burden nobody can sustain. Records get filled in retroactively, and the CCPs that genuinely matter drown in paperwork alongside the ones that don't.

Demoting a genuine CCP to a PRP. The rarer error, and the far more dangerous one. A step that is the only barrier to a significant hazard gets folded into a general sanitation program with no critical limit and no corrective action so when it fails, nothing triggers, no product is held, and no one finds out until the complaints arrive.

Worked Example: All 7 Principles on One Product

Principles read as seven separate ideas until you follow one product through all of them. Take a cooked, chilled ready-to-eat chicken salad - raw poultry, a kill step, a cooling step, and no further processing before the consumer eats it.

Principle 1 — Hazard analysis. Salmonella and Campylobacter arrive with the raw chicken. Clostridium perfringens spores survive cooking and germinate if cooling is too slow. Listeria monocytogenes can recontaminate during post-cook assembly, and the product supports its growth through refrigerated shelf life. Undeclared allergens enter through the mayonnaise base. All significant.

Principle 2 — CCPs. Two: the cook step (the only lethality treatment) and the cooling step (the only barrier to spore-former outgrowth). Post-cook handling is controlled through sanitation and hygiene prerequisite programs. Allergen control sits with label reconciliation, not a CCP.

Principle 3 — Critical limits. Cook: 165°F (74°C), instantaneous, at the thickest point. Cool: 135°F to 70°F within 2 hours, and to 41°F within 6 hours total. Operating targets are set tighter — pull at 170°F, aim to hit 70°F in 90 minutes — so ordinary variation never trips the limit.

Principle 4 — Monitoring. Cook: calibrated probe, thickest piece of every batch, logged at the time of measurement by the cook. Cool: temperature checked at the 2-hour and 6-hour marks and recorded on the cooling log, with the responsible person named.

Principle 5 — Corrective actions. Under-temperature at cook: return to heat, continue to limit, record. Cooling limit missed at 2 hours: rapid-chill immediately and reassess. Cooling limit missed at 6 hours: discard — there is no correction that makes it safe. In every case, investigate why: pan depth, batch size, walk-in load, or a failing blast chiller.

Principle 6 — Verification. Thermometers calibrated weekly in an ice-point slurry. A supervisor reviews all cook and cooling logs weekly and signs them. Finished-product Listeria testing on a defined schedule. Full plan reassessment annually, and immediately if the recipe, batch size, or chiller changes.

Principle 7 — Records. Cook logs, cooling logs, corrective action reports, calibration records, and verification sign-offs — each showing the actual measured value, the time, and who took it. Retained per the applicable regulatory requirement.

That's the system. Two CCPs, four numbers, and a record trail that lets you prove control on any batch you shipped.

HACCP vs. FSMA Preventive Controls

If you operate in the United States, there's a question worth settling early: are you running classic HACCP, or a Preventive Controls food safety plan? They share the same logic, but they're different regulatory systems with different vocabulary.

Classic HACCP still governs three product categories. Meat and poultry under 9 CFR 417, enforced by USDA FSIS. Seafood under 21 CFR 123. Juice under 21 CFR 120. If your product falls in one of these, the seven principles are the legal framework you work within.

Most other FDA-regulated food facilities now operate under 21 CFR 117, the Preventive Controls for Human Food rule created by FSMA. Three differences matter in practice.

First, preventive controls are broader than CCPs. Alongside process controls, the rule requires allergen controls, sanitation controls, supply-chain controls, and a recall plan; categories that classic HACCP handled through prerequisite programs.

Second, the language shifts. Where HACCP sets critical limits, the preventive controls rule specifies parameters and values, and applies them to controls that may not have a numeric threshold at all.

Third, the plan must be prepared or overseen by a Preventive Controls Qualified Individual (PCQI), a defined role with a training requirement, with no direct equivalent in classic HACCP.

The seven principles remain the intellectual foundation of both. Learn them first, then map them onto whichever rule applies to your facility.

Common HACCP Mistakes

Six failures account for most of what goes wrong in practice.

1. Copied template plans. A plan downloaded or borrowed from another facility describes that facility's equipment, product, and flow — not yours. Auditors spot it immediately, usually because the flow diagram doesn't match the floor.

2. Too many CCPs. Most operations have three to six. Twelve means prerequisite programs were promoted to critical status, and the monitoring burden that follows is the reason records start getting filled in from memory.

3. Unvalidated critical limits. A number is not a critical limit until there's scientific evidence it controls the hazard for your product, at your mass, in your process. Borrowed limits are guesses with a decimal point.

4. Retroactive record completion. Logs written at the end of shift aren't monitoring records, they're recollections. Uniform handwriting and implausibly steady values are the first thing an auditor tests.

5. No reassessment after change. New supplier, larger batch size, different packaging film, a replaced chiller, each one can invalidate a limit that was correct last year. Reassess annually at minimum, and immediately on change.

6. Untrained frontline monitors. This is the one that undoes the other five. The person holding the thermometer is the control, if they don't understand why 165°F matters, what a deviation means, or that they're authorized to stop the line, the plan exists only on paper. 

The Takeaway

The HACCP principles describe a control system, not a binder. A plan that lives in a drawer while the line runs on habit isn't HACCP, it's documentation of an intention. 

What makes the system work is the daily loop: someone measures a real value at a real step, knows the number that separates safe from unsafe, and has the authority to stop the process when it isn't met.

Start with the two decisions everything else depends on which hazards are genuinely significant, and which steps are genuinely critical. 

Get those right and the remaining five principles largely design themselves. For the wider picture on HACCP requirements and implementation, including who needs a plan and how to build one, start with our full guide.