How do I write a HACCP plan?

Follow the FDA/Codex sequence: assemble a cross-functional team, describe the product and its intended use, draw and verify the process flow diagram, then apply the seven principles — hazard analysis, CCP determination, critical limits, monitoring, corrective actions, verification, and record-keeping. Our free template provides the worksheet for each step.

What are the 7 principles of HACCP?

1) Conduct a hazard analysis; 2) determine the critical control points; 3) establish critical limits; 4) establish monitoring procedures; 5) establish corrective actions; 6) establish verification procedures; 7) establish record-keeping and documentation. They are applied after five preliminary steps: assemble the team, describe the product, identify intended use, construct the flow diagram, and verify it on the floor.

What is the difference between a HACCP plan and a FSMA food safety plan?

They share the same backbone — hazard analysis followed by controls, monitoring, corrective actions, verification, and records. The FSMA Preventive Controls rule (21 CFR 117) broadens classic HACCP: controls are not limited to CCPs and can include allergen, sanitation, and supply-chain preventive controls, and it requires a preventive controls qualified individual. If you have a solid HACCP plan, you are most of the way to a FSMA plan.

Who should be on the HACCP team?

People who know the process from different angles: quality assurance, production, maintenance, and sanitation, with at least one member formally trained in HACCP. Include operators who run the line — they know where practice differs from the SOP. A plan written by one person at a desk is the most common structural weakness auditors find.

How often should a HACCP plan be reviewed?

Reassess whenever anything changes — product, ingredients, equipment, process, or supplier — and on a fixed schedule regardless. USDA FSIS requires reassessment at least annually for meat and poultry plants, and the FSMA Preventive Controls rule requires reanalysis at least every three years. Most GFSI-certified plants review annually as a matter of practice.

HACCP Plan Template: Free, Complete, and Auditor-Friendly

Q: Is a HACCP plan required?

It depends on your product. HACCP is legally mandatory in the U.S. for meat and poultry (9 CFR 417), seafood (21 CFR 123), and juice (21 CFR 120). Most other FDA-registered facilities must run a HACCP-based food safety plan under the FSMA Preventive Controls rule, and GFSI certification schemes required by major buyers all demand a documented HACCP plan.

Build an auditor-ready HACCP plan section by section, then take the free printable template with you. No email gate, no catch.

A HACCP plan is the written document that identifies the food-safety hazards in a specific product and process, and defines the critical control points, critical limits, monitoring, corrective actions, verification, and records that keep those hazards controlled. This guide builds one section by section — and the complete printable template is free, with no email gate.

Download the HACCP plan template here. It covers the five preliminary steps and all seven principles: a product description table, process-flow worksheet, hazard-analysis worksheet, CCP decision worksheet, and a full CCP monitoring plan table. Print it, or use it as the outline for your own document. The rest of this post explains how to fill in each section so it survives an auditor's reading.

What is a HACCP plan?

A HACCP (Hazard Analysis and Critical Control Point) plan is a preventive food-safety document: instead of relying on testing finished product, it identifies where in your process a biological, chemical, or physical hazard could occur and builds controls at those points. The structure comes from the Codex Alimentarius framework and is codified in the FDA's HACCP Principles and Application Guidelines and USDA FSIS's Guidebook for the Preparation of HACCP Plans. Two things trip up first-time authors: a HACCP plan is specific to one product and process (or a justified family of similar ones), not to the whole plant; and it sits on top of prerequisite programs — GMPs, sanitation, pest control — that must already be working. HACCP controls the hazards your prerequisites cannot.

How do you write a HACCP plan?

Follow the sequence FDA and Codex define: five preliminary steps, then the seven principles. Each numbered item below corresponds to a section of the template.

Assemble the HACCP team. Cross-functional and named in the plan: quality, production, maintenance, sanitation, and someone HACCP-trained. One person writing the plan alone at a desk is the most common structural weakness auditors find.
Describe the product. Name, ingredients, allergens, packaging, shelf life, storage and distribution conditions, and labeling instructions (e.g., "keep refrigerated"). The hazard analysis depends on this being complete.
Identify the intended use and consumers. Ready-to-eat or requires cooking? General public, or sensitive populations — infants, elderly, immunocompromised? Sensitive consumers raise the stakes of the entire analysis.
Construct the process flow diagram. Every step from receiving to shipping, in order, including rework loops and storage steps. Simple numbered boxes beat fancy diagrams.
Verify the flow diagram on the floor. Walk the line during operation, on more than one shift if practice varies. Sign and date the verification — auditors look for it.
Principle 1 — Conduct a hazard analysis. For each process step, list potential biological, chemical (including allergens and radiological), and physical hazards; rate severity and likelihood; decide which are significant; and identify control measures. This worksheet is the heart of the plan.
Principle 2 — Determine the critical control points (CCPs). A CCP is a step where control can be applied and is essential to prevent, eliminate, or reduce a significant hazard to an acceptable level. Use the decision-tree questions in the template — most plans end up with a small number of true CCPs, not dozens.
Principle 3 — Establish critical limits. Each CCP gets a measurable limit — a time, temperature, pH, water activity, or detector sensitivity — that separates safe from unsafe. Limits must be validated: drawn from regulation, published science, or a process authority, and you must be able to show where each number came from.
Principle 4 — Establish monitoring procedures. For each CCP: what is measured, how, how often, and by whom. Monitoring must be able to catch a loss of control in time to act — which is why continuous or high-frequency monitoring beats a once-a-shift check.
Principle 5 — Establish corrective actions. Decide in advance what happens when a critical limit is missed: control the affected product, fix the cause, and record both. "Operator will notify supervisor" is not a corrective action; it is a delay.
Principle 6 — Establish verification procedures. The activities that prove the system works as written: calibration of monitoring instruments, review of monitoring and corrective-action records, testing where applicable, and periodic reassessment of the whole plan.
Principle 7 — Establish record-keeping and documentation. The records that prove, day after day, that you did what the plan says: monitoring logs, corrective actions, calibrations, verifications, and the plan itself with its supporting documents.

The two worksheets that carry the plan

Auditors spend most of their time in two tables, so it is worth seeing their structure before you download the template. The first is the hazard-analysis worksheet — one row per process step and hazard:

Process step	Potential hazard (B/C/P)	Severity	Likelihood	Significant?	Control measure
Receiving	C — undeclared allergen in ingredient	High	Depends on supplier history	Team decision, justified in writing	Approved supplier program, label check at receipt
Metal detection	P — metal fragments	High	Process-dependent	Team decision, justified in writing	Calibrated detector at defined sensitivity
…one row per step and hazard…	—	—	—	—	—

Structure of the hazard-analysis worksheet. The justification column matters as much as the verdict — auditors want your reasoning, not just your conclusion.

The second is the CCP monitoring plan — one row per CCP, and the columns are not optional:

CCP	Critical limit	What	How	Frequency	Who	Corrective action	Records	Verification
CCP-1 (e.g., cook)	Validated time/temperature from your process authority or regulation	Internal temperature	Calibrated probe	Defined per batch or interval	Named role	Hold product, re-cook or destroy per procedure, record	Cook log	Daily record review, probe calibration
…one row per CCP…	—	—	—	—	—	—	—	—

Structure of the CCP monitoring plan. Every critical limit must trace to a validated source — never copy numbers from someone else's plan.

Note what the example rows do not include: actual limit values. Critical limits belong to your validated process — pulling numbers from a template (including this one) is exactly the shortcut auditors are trained to catch.

What do auditors look for, section by section?

An auditor-friendly plan anticipates the questions. Here is what experienced auditors check in each section — and where template-built plans usually get caught.

Product description. A complete allergen picture, including processing aids and carriers, and an honest statement of intended consumers. If sensitive populations could eat the product, the plan should say so and the hazard analysis should reflect it.

Flow diagram. Reality, not aspiration. Auditors walk the line with your diagram in hand; a rework loop or storage step that exists on the floor but not on paper is an easy finding. The verification signature and date show you did the same walk first.

Hazard analysis. Written justification for every decision — including the "not significant" ones. Allergens treated seriously as chemical hazards. Evidence that the team considered hazards even at steps where the answer is "none reasonably likely," rather than skipping those rows.

Critical limits. A documented source for every number: a regulation citation, a process authority letter, or a validation study. A limit with no traceable origin reads as copied — because it usually was.

Monitoring. Frequencies that are achievable with your actual staffing, and records whose timestamps look like real life. A month of checks logged at perfectly even intervals, in the same pen, is a red flag every auditor recognizes.

Corrective actions. Predefined product disposition — hold, rework, destroy — plus cause and prevention, with completed examples in the log that match the procedure.

Verification. Calibration records for every monitoring instrument, signed record reviews at the stated frequency, and reassessment dates that prove the plan is maintained, not shelved.

Is a HACCP plan required by law?

For many facilities, yes — and for nearly everyone else it arrives by contract. The regulatory picture in the United States:

Meat and poultry (USDA FSIS): HACCP plans are mandatory under 9 CFR Part 417, which also requires plan reassessment at least annually.
Seafood (FDA): mandatory HACCP under 21 CFR Part 123.
Juice (FDA): mandatory HACCP under 21 CFR Part 120.
Most other FDA-registered food facilities: the FSMA Preventive Controls rule (21 CFR Part 117) requires a written food safety plan built on the same hazard-analysis backbone, with preventive controls in place of classic CCPs.
By contract: GFSI-benchmarked certification schemes — which most major retail and foodservice buyers require — all demand a documented HACCP-based plan. See our HACCP certification guide for how the audit works.

Related but separate: FSMA 204 traceability records for listed foods, covered in our FSMA 204 guide — a recordkeeping rule that complements, but does not replace, the HACCP plan.

Why do HACCP plans fail in practice?

Almost never in the binder — almost always at the monitoring record. The plan says a check happens every hour; the floor gets busy; the record gets filled in from memory at end of shift. An auditor compares timestamps, finds a gap on a Tuesday three weeks back, and now a document problem is a finding. The fixes are boring and effective: make monitoring fast at the station, make missed checks visible the moment they are missed, and review records daily instead of at audit prep.

This is also where digitizing the plan pays off. When CCP checks are captured on a tablet at the station, timestamps are real, a missed check can trigger an alert instead of waiting for a signature review, and a failed check can automatically notify the right people and hold the batch — which is exactly the kind of paperwork-to-action workflow Harmony runs on plant floors. The plan stays yours; the software just makes the evidence trustworthy. Start with the paper template below — a paper plan that works beats a digital plan that does not exist.

Get the template — printable, complete, and free.