Guide
HACCP per Codex CXC 1-1969: The Foundation Every Food Safety Programme Stands On
Codex Alimentarius General Principles of Food Hygiene CXC 1-1969 — most recently revised in 2020 — is the international reference for food hygiene and the HACCP system. Every GFSI-recognised scheme (BRCGS, SQF, FSSC 22000, IFS), every national food law that references HACCP (EU Regulation 852/2004, US FSMA 21 CFR 117, UK Food Safety Act regulations, ASEAN, MERCOSUR), and every food safety competent authority traces back to this document. The 2020 revision tightened the language around food safety culture, allergen management, and the distinction between prerequisite programmes and HACCP itself. This guide walks through the seven principles, the twelve application steps, the PRP-HACCP boundary, and a practical implementation path. It is written for HACCP team leaders, QA managers, technical managers and operations leads at food manufacturers of any size.
Start free trial Free trial, no credit card, onboard in days, not months.
The seven HACCP principles and the twelve logic steps
The seven principles are: conduct a hazard analysis (1); determine the Critical Control Points (2); establish validated critical limits for each CCP (3); establish a system to monitor control of each CCP (4); establish the corrective action to be taken when monitoring indicates a CCP is not under control (5); establish procedures for verification (6); establish documentation concerning all procedures and records (7). The twelve logic steps wrap the principles in the workflow: assemble the team (1); describe the product (2); identify intended use and users (3); construct the flow diagram (4); on-site confirmation of the flow diagram (5); then steps 6 through 12 map onto the seven principles. Misordering the steps — for example designating CCPs before the hazard analysis is complete — is the easiest way to undermine the plan's defensibility.
Prerequisite programmes: where HACCP starts
The 2020 revision tightened the language: PRPs are not HACCP, they are the foundation that makes HACCP possible. Cleaning and sanitation, pest control, premises and equipment maintenance, personnel hygiene and training, supplier control, allergen management at the facility level, water quality, waste management — all are PRPs. If a hazard is fully controlled by a PRP, it should not appear as a CCP; if a hazard cannot be controlled to acceptable levels without specific monitoring at a defined step, that step is a CCP. The 'too many CCPs' problem is usually a sign the PRPs are weak; the 'one CCP for the whole plant' problem is usually a sign the hazard analysis was shallow.
Hazard analysis: biological, chemical, physical, plus allergens and radiological
Step 6 / Principle 1 requires identification and analysis of biological, chemical, and physical hazards reasonably likely to occur at each step of the process, considering severity and probability. Modern Codex practice treats allergens as a chemical hazard category in their own right (with specific management requirements), and radiological hazards are increasingly named explicitly. The analysis must consider raw materials, ingredients, water and air, processing aids, packaging, equipment, and cross-contamination from people and the environment. The most common shallow-analysis pattern: listing 'microbial contamination' once and moving on, without identifying the specific organisms relevant to the product and process.
Critical limits, monitoring and corrective actions
Principles 3, 4 and 5 are inspected together because they only make sense as a chain. The critical limit must be validated — there must be scientific or technical evidence that achieving the limit controls the hazard to an acceptable level. Monitoring must be sufficient to detect loss of control (frequency, sensitivity, who does it). Corrective actions must define what happens to product produced while the CCP was out of control, with disposition decisions documented. The classic failure mode: a critical limit set at the supplier's COA without site-specific validation, monitored less frequently than the process variability would justify, with a corrective action that says 'investigate and dispose appropriately'. Each link in the chain is a separate audit question.
Verification, validation and reassessment of the HACCP plan
Principle 6 (verification) confirms the HACCP system is working as planned — through audits, calibrations, finished product testing, environmental monitoring, complaint trend analysis. Validation (related but distinct) confirms the elements of the plan are scientifically and technically capable of controlling the hazard. Reassessment of the plan is required at minimum annually and whenever process, product, equipment, ingredients, packaging or environmental conditions change. The reassessment trigger is the most-missed control — sites operate the plan for years through significant changes without formally reassessing, and the auditor's 'when was this last reassessed' question lands on silence.
Food safety culture and management commitment
The 2020 Codex revision added explicit references to food safety culture and management commitment as foundational to the entire system — recognising that no HACCP plan, however well-written, survives a culture that does not value food safety. GFSI schemes built on this addition (SQF Edition 9, BRCGS Issue 9, FSSC 22000 v6). For a site implementing the Codex baseline (without a GFSI scheme on top), the culture and commitment language is the practical place to start — leadership behaviours, employee feedback, training, performance recognition, response to near-misses.
A 60-day implementation path
Days 1 to 10: gap assessment against the twelve steps and the seven principles, with explicit check on PRP-CCP boundary, hazard analysis depth, validation of critical limits, reassessment cadence. Days 11 to 25: rebuild the priority HACCP plan with multi-disciplinary team, current flow diagram confirmed on-site, full hazard analysis including allergens and radiological. Days 26 to 45: PRP verification programme stand-up; critical limit validation refresh; corrective action workflow with disposition logic. Days 46 to 60: internal audit covering all twelve steps; management review with culture evidence; mock audit if a GFSI scheme is on the roadmap.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Food safety QMS
HACCP plan anchored in a live QMS, not a Word document.
Document control
PRPs, hazard analyses and CCP records under versioned control.
Deviations & CAPA
CCP excursions routed into corrective action with disposition logic.
Supplier control
Ingredient and raw-material risk feeding the hazard analysis.
Compliance self-assessment
Score the HACCP plan against the twelve Codex steps.
Industries this hits hardest
Frequently asked
Is Codex HACCP legally binding?
Codex itself is a reference framework, not law. But most national and regional food laws reference HACCP as the required food safety methodology — EU 852/2004, US FSMA 21 CFR 117 (with Preventive Controls as an HACCP-derived framework), UK regulations, and most Codex-member country food laws. Compliance with national law is mandatory; the Codex text is the international baseline those national laws are built on.
What's the difference between HACCP and FSMA Preventive Controls?
FSMA Preventive Controls (21 CFR 117 Subpart C) is the US framework derived from HACCP but expanded — it covers preventive controls beyond CCPs (process controls, food allergen controls, sanitation controls, supply-chain controls), requires a written Food Safety Plan, and is implemented by a Preventive Controls Qualified Individual. HACCP is a subset of the methodology Preventive Controls builds on. A facility subject to 21 CFR 117 must meet the Preventive Controls requirements; many also maintain HACCP for customer or certification reasons.
Do I need HACCP if I'm GFSI certified?
Yes — every GFSI-recognised scheme requires HACCP as a foundational element. The schemes layer additional requirements on top (food safety culture, environmental monitoring, food fraud, traceability) but HACCP per Codex is the spine. A GFSI audit will examine the HACCP plan in detail and a weak HACCP plan will produce findings under whatever scheme you hold.
How often should the HACCP plan be reassessed?
At minimum annually, plus whenever process, product, equipment, ingredients, packaging or environmental conditions change. The change-triggered reassessment is the more important one operationally — sites that wait for the annual review to catch up on changes accumulate undocumented drift that auditors find immediately.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.