The rules that apply to you
One jurisdiction answer shows the FDA preventive controls tasks, the seafood, juice and meat plan check, the SFBB check or the EU guide check. A review run adds the reanalysis phase; a new plan skips it.
HACCP Food Safety Checklist Template
A HACCP plan written once and filed is a plan for the kitchen or line you had two years ago. Inspectors and auditors check the plan you run today.
This free HACCP checklist takes a team through building a food safety plan, or reviewing an existing one, step by step. It follows the 12 steps and 7 principles of the Codex General Principles of Food Hygiene: team and scope, product description, flow diagram, hazard analysis, critical control points, critical limits, monitoring, corrective action, validation, verification and records. Two questions at the start set it up: whether this is a new plan or a review, and which rules the site works under, US FDA, a US HACCP-regulated sector, the UK or the EU.
Which HACCP Rules Apply to Your Site
HACCP is a method, not a single law. The Codex Alimentarius text CXC 1-1969, revised in 2020 and amended in 2022 with a new annex of tools for deciding critical control points, is the international reference. National rules then decide who must have a plan, who may write it and how often it is reviewed. The table summarises the main ones. It is a starting point, not legal advice, so check the current text for your sector.
| Where | Rule | What it asks for | Review cycle |
|---|---|---|---|
| US food facilities registered with FDA | 21 CFR Part 117, Subpart C (Preventive Controls for Human Food) | A written food safety plan, prepared or overseen by a preventive controls qualified individual (PCQI), with a written hazard analysis and preventive controls | Reanalysis of the whole plan at least every 3 years, and sooner after a significant change (117.170) |
| US seafood processors | 21 CFR Part 123 | A HACCP plan for each location and kind of fish product where a hazard is reasonably likely to occur | Reassessment at least annually and whenever a change could affect the hazard analysis |
| US juice processors | 21 CFR Part 120 | A HACCP plan for each location and type of juice, developed by a trained individual | Validation at least annually and whenever the process changes |
| US meat and poultry establishments | 9 CFR Part 417 (USDA FSIS) | A HACCP plan signed and dated by the responsible establishment individual | Reassessment at least annually, with the plan signed and dated again |
| Great Britain | Assimilated Regulation (EC) No 852/2004, Article 5 | Permanent procedures based on the HACCP principles, with records proportionate to the size of the business | Review whenever the product, process or any step changes |
| European Union | Regulation (EC) No 852/2004, Article 5 | The same seven-principle requirement, with national guides to good practice supporting smaller businesses | Review whenever the product, process or any step changes |
Small caterers and retailers in England and Wales can meet the UK requirement with the Food Standards Agency’s Safer Food, Better Business (SFBB) packs, which apply the HACCP principles without the formal worksheets, plus the daily diary that local authority officers ask to see. Food manufacturers usually need a full plan. In the US, the FDA’s Food Traceability Rule (21 CFR Part 1, Subpart S) adds separate traceability records for foods on the Food Traceability List. It does not replace a HACCP or food safety plan. FDA has proposed moving its compliance date to 20 July 2028, and a 2026 appropriations act directed FDA not to enforce the rule before that date.
What the HACCP Food Safety Checklist Covers
Seven phases follow the Codex sequence from the team to the signed plan. A review run adds a phase on what has changed, the jurisdiction answer shows the tasks for your rules, and the plan needs two approvals that each halt the checklist.
Scope
Phase 1: Team & Scope
Codex step 1, owned by the HACCP team leader. Scope questions: run type (New plan / Annual review / Review after a change), jurisdiction (US FDA food facility / US HACCP-regulated sector / UK / EU / Other). The SFBB task is shown only when jurisdiction is UK.
- Name the HACCP team leader, PCQI or trained reviewer and site manager — later tasks are assigned from these fields
- Answer the scope questions — whether this is a new plan or a review, and which rules the site works under
- Define what the plan covers — the site, product groups, process lines, and where the plan starts and ends in the food chain
- Assemble the HACCP team and record their training — production, quality, hygiene and engineering, with HACCP or PCQI course dates; bring in an outside expert where the team lacks the knowledge
- Confirm the prerequisite programmes are working — cleaning, pest control, maintenance, allergen control, supplier approval and personal hygiene
- Check whether SFBB fits the business — simple catering or retail can use the FSA pack; manufacturing needs a full HACCP plan
Changes
Phase 2: What Has Changed
Shown only when run type is Annual review or Review after a change. Owned by the HACCP team leader. A planned change is reanalysed before it goes live.
- Record why this review is happening — the annual cycle, the FDA three-year reanalysis or a named change
- List what has changed since the last review — raw materials, suppliers, recipes, equipment, packaging, distribution, consumers and staff
- Review deviations, complaints and incidents — whether any reveal a new hazard or a CCP that is not working
- Check for new hazard information — recalls, outbreaks, regulator alerts and research for your products
- Mark which parts of the plan need revising — the later phases confirm or update each part, with the reason recorded either way
Describe
Phase 3: Product & Process
Codex steps 2 to 5. Assigned to the HACCP team leader. The last task is shown only when jurisdiction is EU.
- Describe each product — ingredients, composition, pH, water activity, preservation, packaging, shelf life and storage conditions
- State the intended use and consumers — ready to eat or cooked first, and whether infants, older people or other vulnerable groups eat it
- List the allergens on site — in each product and anywhere else they are handled, using the list your labelling law sets
- Draw the process flow diagram — every step from receipt to dispatch, including rework, storage and waste
- Confirm the flow diagram on the floor — walk the line during production, on each shift where practice differs, and correct the diagram
- Check your national guide to good hygiene practice — sector guides under Article 8 of Regulation 852/2004 show what your authority expects
Hazards
Phase 4: Hazard Analysis
Codex step 6, Principle 1. The last task is shown only when jurisdiction is US FDA food facility.
- List the potential hazards at each step — biological, chemical including allergens, and physical, plus radiological where relevant
- Rate the likelihood and severity of each hazard — using illness data, scientific reports, complaints, supplier history and your own records
- Decide which hazards are significant — those that must be prevented, eliminated or reduced to an acceptable level
- Identify the control measures for each significant hazard — what controls it at this step or a later one
- Write up the hazard analysis — including the hazards judged not significant and the reason for each
- Add the preventive controls the FDA rule expects — process, allergen, sanitation and supply-chain controls, and a written recall plan
Limits
Phase 5: Critical Control Points & Limits
Codex steps 7 and 8, Principles 2 and 3. The last task is shown only when jurisdiction is US HACCP-regulated sector.
- Determine the critical control points — use the Codex decision tree or worksheet, and record why each CCP was chosen
- Set a critical limit for each CCP — a measurable value such as time, temperature, pH or water activity
- Validate each critical limit — regulatory guidance, published studies or a process authority, with the evidence attached
- Set operating limits where useful — tighter targets that prompt an adjustment before the critical limit is reached
- Check the plan holds what your Part 120, 123 or 417 rule lists — hazards, CCPs, limits, monitoring, corrective actions, verification and records
Monitor
Phase 6: Monitoring, Corrective Action & Records
Codex steps 9, 10 and 12, Principles 4, 5 and 7. Assigned to the HACCP team leader.
- Define monitoring for each CCP — what is measured, how, how often, by whom and with which instrument
- Write the corrective action for each CCP — regain control, hold the affected product, assess it, decide its fate and record it
- Route repeated deviations to CAPA — a limit missed more than once needs a root cause, not just another correction
- Design the CCP records — monitoring logs, deviation records and verification records, each signed and dated
- Set how long records are kept — as your rules require, and at least as long as the product’s shelf life
- Train everyone who monitors a CCP — each person can state the limit and what to do when it is missed
Approve
Phase 7: Validate, Verify & Approve
Codex step 11, Principle 6. The plan approval is assigned from the PCQI or trained reviewer field, then the site manager signs off. The checklist halts at each approval until it is Approved.
- Validate the plan as a whole — evidence that the control measures, taken together, control every significant hazard
- Set the verification activities and how often — record review, instrument calibration, product or environmental testing and internal audit; FDA plans review monitoring records within 7 working days under 21 CFR 117.165
- Schedule thermometer and probe calibration — every instrument used to monitor a CCP, with its accuracy check frequency
- PCQI or trained reviewer approval of the HACCP plan — hazard analysis, CCPs, limits, monitoring, corrective actions and verification
- Site manager sign-off of the plan and its resources — people, equipment and time to run it as written, from a stated date
- Set the next review date — at least annually for most HACCP rules, and before any planned change goes live
A Critical Control Point, Worked Through
Most plans fail at the CCP table, not the hazard list: the limit is vague, nobody owns the monitoring, or the corrective action says “inform supervisor” and stops. Here is one CCP for cooking chicken portions in a US food service kitchen, written the way Phases 5 to 7 build it.
| Element | Example |
|---|---|
| Process step | Cooking raw chicken portions in the combination oven |
| Significant hazard | Survival of Salmonella and Campylobacter from the raw meat |
| Control measure | Cooking to a validated core temperature |
| Critical limit | Core temperature of 74°C (165°F) or above, instantaneous, as the FDA Food Code sets for poultry in 3-401.11 |
| Monitoring | Cook probes the thickest part of the largest portion in every batch and logs the reading |
| Corrective action | Keep cooking and re-probe; if the oven cannot reach the limit, hold the batch, move cooking to another oven and call maintenance |
| Verification | Supervisor reviews and signs the cooking log daily; probes are checked for accuracy weekly and calibrated on schedule |
| Records | Cooking log, corrective action log and probe calibration record |
Use the limit your own rules or validation support. UK guidance uses different time and temperature combinations, and a manufacturer’s cook step may be validated at other values. The probe is the weak point in any temperature CCP: an inaccurate probe makes every logged reading worthless. The Calibration Management Checklist runs the calibration cycle for every thermometer and probe the plan relies on.
Why Run HACCP Reviews in CheckFlow?
No plan goes live unsigned
The PCQI or trained reviewer approves the plan, then the site manager signs off its resources. Each approval halts the checklist, so a draft plan cannot be briefed to the floor by accident.
Reviews that happen on time
A recurring schedule starts the annual review on its date. Validation studies and flow diagrams sit on the task that produced them, and the audit trail shows who decided what and when.
CheckFlow is not a temperature logging system or a QMS. It runs the human process of building, approving and reviewing the plan, and a read-only, white-label share link lets an auditor follow it. Daily CCP checks can run as their own recurring checklists. See how CheckFlow’s compliance checklist software handles recurring regulated work.
When a critical limit is breached more than once, the CAPA (Corrective & Preventive Action) Checklist takes the deviation through root cause, action plan and effectiveness check.
Frequently Asked Questions
What are the 7 principles and 12 steps of HACCP?
Codex sets five preliminary steps: assemble the team and define the scope, describe the product, identify its intended use and users, draw the flow diagram and confirm it on site. The seven principles follow as steps 6 to 12: conduct a hazard analysis and identify control measures, determine the critical control points, set validated critical limits, monitor each CCP, set corrective actions, validate the plan and verify it is working, and keep documents and records.
Is HACCP a legal requirement?
In the UK and the EU, food businesses after primary production must have permanent procedures based on the HACCP principles under Article 5 of Regulation (EC) No 852/2004, scaled to the size of the business. In the US, HACCP plans are mandatory for seafood, juice, and meat and poultry. Many other FDA-registered facilities need a food safety plan under 21 CFR Part 117 instead, unless an exemption applies, which uses the same thinking but goes wider. Check the current rules for your sector.
How often should a HACCP plan be reviewed?
Whenever something changes that could affect a hazard: a new product, supplier, recipe, piece of equipment or customer group. On top of that, US seafood and meat and poultry plans are reassessed at least annually, juice plans validated at least annually, and FDA food safety plans reanalysed at least every three years. An annual review is a sensible default everywhere else.
How is an FDA food safety plan different from a HACCP plan?
A HACCP plan centres on critical control points. A food safety plan under 21 CFR 117 covers CCPs where they exist, but also allergen, sanitation and supply-chain controls, plus a recall plan, and each control is managed in proportion to its role. A preventive controls qualified individual must prepare or oversee it, and also validation, record review and reanalysis.
Who should be on the HACCP team?
People who know the product and the process: production, quality, hygiene and engineering, led by someone trained in HACCP. A small business may have one or two people, and Codex accepts outside expertise where the team lacks it. The people who do the monitoring should help write it, since they know what really happens on the line.
Is CheckFlow free for this template?
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.