The five preliminary steps that make a HACCP plan buildable — assemble the team, describe the product, name its use and its eaters, draw the process flow, and prove the flow true on the floor.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can lay the five pieces of groundwork a HACCP plan stands on — a team, a described product, an intended-use statement, a process flow diagram, and a floor walk that proves the diagram is true. Do them first, and when you start hunting hazards you are judging your real operation instead of a tidy fiction of it.
Most people can recite the seven principles of . Fewer know that in front of those seven sit five preliminary steps, and that they are not a warm-up. The principles are the analysis. The preliminary steps are the thing you analyze. Do them loosely and every principle after inherits the mistake.
The method US regulators use was set out by the National Advisory Committee on Microbiological Criteria for Foods and adopted on August 14, 1997. FDA still publishes it as the HACCP Principles and Application Guidelines, and that document lists the five preliminary steps first, then the seven principles — in that order, on purpose. FDA's word for the five is "tasks"; this course calls them steps. Same five things.
You may or may not be legally required to run a formal HACCP plan. Federal law mandates one for a few sectors — seafood processors under 21 CFR part 123, juice processors under 21 CFR part 120, and meat and poultry establishments under USDA FSIS's 9 CFR part 417. Most other FDA-registered manufacturers instead owe a written under FSMA's Preventive Controls rule. Which one applies to you is its own question. The good news for this lesson: the five preliminary steps are the same groundwork either way. A classic HACCP plan and a 21 CFR 117 food safety plan both begin by understanding your operation before you judge it.
One thing comes before even these five steps: your . They are the foundation the whole system sits on, and the guidelines are blunt about it: a HACCP system has to be built on a solid foundation of prerequisite programs. If your sanitation or your allergen control is shaky, that is the real first job. The five steps below assume the floor under them is sound.
The first step is to gather the people who will build and own the plan — the . The guidelines want it multidisciplinary. Someone who knows the production process. Someone who knows sanitation. Someone who knows quality. Someone who knows the equipment and how it fails. The point is coverage — a hazard hides in whichever discipline is not in the room.
Just as important, put someone on the team who actually runs the operation day to day. The people on the line know the variability and the limits of the process in a way a plan written from a desk never will, and they are the ones who have to live with what the plan asks of them. You can bring in an outside expert for the technical parts — the microbiology, a process authority's letter — and often you should. But a plan written entirely by outsiders tends to be wrong in the details and unsupported on the floor, which is a good way to fail an audit and a better way to fail a batch.
If you are a small shop, your team might be three people wearing six hats: the owner, the production lead, and whoever handles sanitation. That is a real team. Name them, write down what each one knows, and note where you will reach for outside help.
Next, write down exactly what you make. A product description is a plain, factual account of the food — what it is, what goes into it, and how it is processed and packaged. It is not a spec sheet for a buyer and it is not marketing copy. It is the safety-relevant truth about the product, on one page.
Capture the things that bear on safety: the ingredients, and any that are hazards in their own right; the process the food goes through; how it is packaged; and — the guidelines call this out specifically — how it is distributed and held, whether frozen, refrigerated, or at room temperature. A shelf-stable jar and a refrigerated tub of the same recipe are two different safety problems, and the description is where that difference gets named. You do not solve the hazards here. You describe the product accurately enough that the hazard analysis can.
Now say how the product is meant to be used and who is meant to eat it. This step is short, and it moves the whole plan.
Intended use is the normal, expected way a customer handles the food: cooked before eating, or eaten straight from the package. A product the buyer will cook carries a different hazard profile than a product, because for the ready-to-eat food your process is the last line of defense — nothing downstream of you fixes what you miss.
Consumers is who those eaters are. The general public is one answer. Infants, the elderly, hospital patients, the immunocompromised are different answers, and they raise the bar. The guidelines name vulnerable populations directly, because a hazard a healthy adult would shrug off can seriously hurt someone whose body cannot fight it. If you sell into that population, your hazard analysis has to be stricter — and this is the step where you commit to knowing it.
With the product and its use pinned down, map the process. A is exactly what it sounds like: a clear list of the steps, in order, that the food passes through under your control.
Keep it plain. The guidelines are explicit that this is not an engineering drawing — a block diagram, one box per step, is enough. Cover the whole path: receiving raw materials, storage, each processing step, packaging, and shipping. You can include steps that happen before the food reaches you and after it leaves, but the part that must be complete is the part you control. A simple schematic of the facility alongside it often helps you see how product and people actually move through the room.
Why the care? Because the hazard analysis is done step by step, walking straight down this diagram. Every step on it gets examined for hazards; a step that is not on it gets examined by no one. A missing step is a missing hazard. That is the whole reason the diagram is a preliminary step and not an afterthought — it is the skeleton the seven principles hang on.
A diagram drawn at a desk is a hypothesis. The fifth step is to test it: walk the actual operation, start to finish, and confirm the diagram matches what really happens. The guidelines call for an on-site review of the operation to check the flow diagram for accuracy and completeness, and to correct and document whatever is off.
This is where desk diagrams reliably fall apart. The rework loop, where off-spec product goes back through an earlier step, that is not on the paper. The hold cooler nobody drew. The shortcut second shift takes when the line backs up. The place two products cross that the diagram shows as separate. Walking it is how you find those, and finding them now is cheap. Finding them when an auditor walks the line with your diagram in hand is not.
Two jobs, one word: don't confuse the two verifications
Verifying the flow diagram here is not the same as Principle 6, "verification." This step confirms the diagram is true — that the map matches the plant. Principle 6, much later, confirms the whole plan is working as written. Same word, two different jobs. Keep them straight so an auditor's question about one does not get answered with the other.
When the five steps are done you have a team that owns the plan, a product described in safety terms, a clear statement of how the food is used and by whom, and a flow diagram you have proven true on the floor — all of it standing on prerequisite programs that hold. That is not paperwork for its own sake. It is exactly the input the first principle needs.
Because now the work turns from describing your operation to judging it. The next step is Principle 1, the hazard analysis: walk down that verified flow diagram, one step at a time, and ask at each step which biological, chemical, and physical hazards are reasonably likely to hurt someone — and which of those you have to control. A hazard analysis is only ever as honest as the five steps under it. Get these right, and the hardest part of the plan has something solid to stand on.
Do this in your operation