Food Safety Fundamentals

By Greg Aronoff  |  Oregon State University Professional and Continuing Education

If you work in food and beverage, or are thinking about a career in it, you will hear the acronym HACCP within your first week.

You might hear it pronounced "hassup" by people who know what they are doing, or "H-A-C-C-P" by people who just learned what it stands for.

Either way, it is one of those terms that signals immediately whether someone understands food safety or is still getting there.

This guide is for people who are getting there.

HACCP stands for Hazard Analysis and Critical Control Points. It is a systematic approach to identifying, evaluating, and controlling food safety hazards, and it is the foundation of how safe food is produced, processed, and distributed across the global food supply.

Understanding HACCP is not optional for anyone working in food safety. It is the baseline.

Here is what every food safety professional is expected to know, and why it matters beyond the acronym.

Where HACCP Came From

Today, HACCP is mandated by the FDA for seafood and juice processors, and by the USDA for meat and poultry facilities. It is recognized internationally under the Codex Alimentarius framework and forms the foundation for third-party audit standards including SQF and FSSC 22000.

If you are working in food safety, you are working within a system that HACCP built.

The Three Types of Hazards HACCP Addresses

Before you can understand how HACCP works, you need to understand what it is designed to control. Food safety hazards fall into three categories:

A complete HACCP hazard analysis considers all three categories at every step of the production process, from raw materials and incoming ingredients through processing, packaging, storage, and distribution.

The Seven Principles of HACCP

HACCP is organized around seven principles, as defined by the FDA and the National Advisory Committee on Microbiological Criteria for Foods (NACMCF).

These principles are sequential, each one builds on the last. You cannot meaningfully apply Principle 3 without having done Principles 1 and 2 first.

Principle 1: Conduct a Hazard Analysis

This is where everything begins. A hazard analysis is a systematic examination of your entire production process, from the moment raw materials arrive at your facility through every step of processing, packaging, storage, and distribution, to identify hazards that are reasonably likely to cause illness or injury if not controlled.

The key phrase is "reasonably likely." HACCP is not designed to address every conceivable risk, but to focus resources on hazards that actually pose a meaningful threat to food safety. Biological, chemical, and physical hazards are all considered.

For each hazard identified, the team assesses its severity and likelihood, then identifies potential control measures.

Principle 2: Determine the Critical Control Points (CCPs)

Once hazards have been identified, the next step is determining where in the process those hazards must be controlled.

A Critical Control Point is a step in the production process where control can be applied, and is essential, to prevent, eliminate, or reduce a food safety hazard to an acceptable level.

Not every step in a food production process is a CCP.

Only the points where a loss of control would directly result in a food safety hazard qualify. A standard tool for making this determination is the CCP decision tree, which asks a structured series of questions about each process step and identified hazard to determine whether a CCP is needed.

Common examples of CCPs include cooking steps designed to destroy pathogens, chilling steps designed to prevent bacterial growth, and metal detection designed to identify physical hazards before products leave the facility.

Principle 3: Establish Critical Limits

For each CCP, a critical limit must be established. A critical limit is a measurable value, a maximum or minimum, that separates safe from unsafe conditions at that control point.

Critical limits must be measurable.

"Cook the product until it looks done" is not a critical limit. "Cook the product to an internal temperature of 165°F (74°C)" is. Critical limits are typically based on scientific literature, regulatory standards, or validated process data. They are the line between a product that is safe and one that is not.

Principle 4: Establish Monitoring Procedures

A critical limit is only useful if it is being monitored.

Monitoring procedures define exactly how each CCP will be observed or measured, how frequently, by whom, and how the results will be recorded.

Effective monitoring must be practical and timely. Because of the time required to obtain results, microbiological testing is rarely suitable for CCP monitoring. Most monitoring relies on physical measurements, temperature, time, pH, water activity, or visual observation.

The monitoring frequency must be sufficient to detect a loss of control before unsafe product reaches the next step in the process or the consumer.

Principle 5: Establish Corrective Actions

When monitoring reveals that a CCP has deviated from its critical limit, corrective actions must be taken.

These are predetermined procedures that define what happens when control is lost: what is done with the affected product, how the process is brought back under control, and how the event is documented.

Corrective actions serve two purposes: preventing potentially unsafe product from reaching consumers, and identifying and correcting the root cause of the deviation so it does not happen again.

A well-designed corrective action procedure closes the loop, it does not just address the immediate problem but builds learning into the system.

Principle 6: Establish Verification Procedures

Verification is distinct from monitoring.

While monitoring checks that a CCP is under control in real time, verification activities confirm that the HACCP system as a whole is working as intended, that the hazard analysis is current, the CCPs are correct, the critical limits are appropriate, and the monitoring is effective.

Verification activities include reviewing monitoring records, calibrating monitoring equipment, conducting periodic HACCP plan reviews, and in some cases, microbiological testing of finished products or environmental samples.

Internal audits are a form of verification. Third-party audits are also a form of verification. The HACCP plan itself must be revalidated whenever there are changes to the process, equipment, or emerging scientific information about hazards.

Principle 7: Establish Record-Keeping and Documentation Procedures

HACCP depends on documentation. Records provide the evidence that the system is operating as designed, that critical limits are being met, that monitoring is being performed at the required frequency, that deviations are being detected and corrected, and that the system is being verified.

Required records typically include the hazard analysis and supporting documentation, the HACCP plan itself, CCP monitoring records, corrective action records, and verification records. As auditors and food safety professionals often note: if it is not documented, it did not happen.

This is not bureaucratic cynicism, it is a reflection of how food safety accountability actually works.

The Two Principles That Are the Foundation of Everything Else

HACCP practitioners often note that Principles 1 and 2 are the foundation of the entire system, not because the other five principles are less important, but because the quality of the hazard analysis and the accuracy of the CCP identification determine whether the plan that follows is actually protecting anyone.

A HACCP plan built on a shallow hazard analysis will have gaps. CCPs that are missed at the identification stage cannot be controlled by monitoring procedures that were never written.

This is why the first two principles require significant time, expertise, and rigor, and why experienced food safety professionals will tell you that most HACCP plan problems trace back to the hazard analysis.

HACCP and FSMA: Understanding the Relationship

One question that comes up frequently for professionals entering the food safety field is how HACCP relates to FSMA, the Food Safety Modernization Act, signed into law in 2011 and representing the most significant overhaul of U.S. food safety regulation in decades.

FSMA introduced a new framework called HARPC, Hazard Analysis and Risk-Based Preventive Controls, which applies to most food facilities regulated by the FDA.

HARPC shares the HACCP framework's emphasis on hazard analysis and preventive controls, but extends it to include supply chain controls, allergen controls, and sanitation controls as part of a comprehensive food safety plan.

For facilities already operating under HACCP mandates, seafood, juice, meat, and poultry, the relationship between HACCP and FSMA requirements requires careful navigation. For facilities not previously subject to HACCP mandates, FSMA's preventive controls requirements represent the first time a HACCP-like approach has been required.

In both cases, the conceptual foundation is the same: identify hazards, implement controls at critical points, monitor those controls, and document everything.

What HACCP Is Not

Understanding what HACCP does not do is as important as understanding what it does.

HACCP is not a quality management system. It is a food safety management system.

Issues that affect taste, texture, appearance, or other quality attributes, but do not present a safety risk, are not addressed by HACCP. They may be addressed by separate quality programs, but they do not belong in the HACCP plan.

HACCP is also not a substitute for prerequisite programs.

Before a HACCP plan can be effective, the facility must have a solid foundation of prerequisite programs in place, sanitation procedures, pest control, employee hygiene, equipment maintenance, supplier controls, and others. These programs create the environment in which HACCP can work. Without them, even a technically correct HACCP plan will struggle.

Finally, HACCP is not a one-time document.

It is a living system that must be reviewed and updated when processes change, new hazards emerge, or monitoring data suggests the plan is not performing as intended. A HACCP plan that has not been reviewed in several years is almost certainly out of date.

The Bottom Line

HACCP is the language of food safety.

Understanding its seven principles, not just their names, but their logic, their sequence, and why each one depends on the ones that came before, is foundational knowledge for anyone working in or entering the food safety field.

It was developed to keep astronauts safe in space.

It is now the system that keeps the global food supply safer for everyone. For food safety professionals, it is not optional background knowledge. It is the baseline from which everything else is built.

Greg Aronoff is the Communications Manager for Oregon State University's Professional and Continuing Education program. Sources: FDA HACCP Principles and Application Guidelines; National Advisory Committee on Microbiological Criteria for Foods (NACMCF).