HACCP Implementation Guide Australia

What HACCP Is — and What It Is Not Hazard Analysis and Critical Control Points (HACCP) is an internationally recognised, science-based system for identifying and controlling food safety hazards. It was developed by NASA, Pillsbury, and the US Army in the 1960s to ensure that astronauts would not get food poisoning in space. Six decades later, it has become the dominant framework for food safety management worldwide and is embedded in FSANZ Standard 3.2.2A as one of three substantive tool options for Category One Australian food businesses. HACCP is not a folder. It is not a poster. It is not the FSS course your supervisor completed. It is a working system that links the specific hazards of your specific operation to specific control points, monitored by specific people, with specific corrective actions, all evidenced in specific records. A HACCP plan that lives in a manager's desk drawer and is never opened is not a HACCP plan — it is a paperweight. This guide walks through the full implementation pathway laid out in the Codex Alimentarius — five preparatory steps followed by seven principles — at the level of detail an operator actually needs to apply it. For a faster overview see our seven principles primer; for the regulatory context, see our definitive 2025 compliance guide. Before You Start: Prerequisite Programs (PRPs) HACCP is not the first thing you build — it is the last. It assumes that a foundation of Good Manufacturing Practices (GMPs) is already in place. Trying to bolt HACCP onto a kitchen that does not yet have functioning cleaning, pest control, supplier approval, and personal hygiene programs is like installing a smoke alarm in a house that has no walls. The prerequisite programs you need before HACCP makes sense are: Premises and equipment: Layout, surfaces, drainage, lighting, ventilation, and equipment all comply with Standard 3.2.3. Cleaning and sanitising: A documented schedule with chemicals, concentrations, contact times, and verification — see our cleaning and sanitation pillar. Pest control: A documented Integrated Pest Management program with trend records. Maintenance: A scheduled program for refrigeration, ovens, gas, electrical, and structure. Calibration: Defined frequency for thermometers, scales, and other measurement devices, with records. Supplier approval: Documented criteria for accepting suppliers, with current contact details, allergen statements, and product specifications on file. Personal hygiene and health: Hand-washing, illness reporting, uniforms, jewellery, and exclusion of unwell staff. Training: Induction, role-specific training, and refresher cycles, all evidenced — see our food safety training playbook. Receipt, storage, and traceability: Date marking, FIFO rotation, supplier batch identification, and one-up/one-down traceability. Allergen management: Recipe matrices, segregation, and verification — see our allergen pillar. Waste management: Internal waste handling, external collection, and prevention of cross-contamination. If any of these are missing, build them first. HACCP will identify the few critical points that the prerequisites cannot fully control. Without prerequisites, HACCP collapses under the weight of every hazard becoming "critical." The Five Preparatory Steps The HACCP framework underpinning Standard 3.2.2A is drawn from the international Codex Alimentarius and is supported in Australia by guidance from the Australian Department of Health and Aged Care and the NSW Food Authority . These bodies publish industry-specific HACCP templates and worked examples that operators can adapt to their own venue. Codex divides HACCP into a 12-step process: five preparatory steps followed by the seven principles. The preparatory steps are not optional and not bureaucratic — they are what makes the principles applicable to your operation rather than a generic checklist. Step 1 — Assemble the HACCP Team A HACCP team should be multidisciplinary: a head chef or kitchen leader, a Food Safety Supervisor, an operations manager, and ideally someone from front-of-house who understands how food is described to customers. In a small business, the same person may wear all those hats; what matters is that every operational perspective is represented. Document who is on the team, what their qualifications are, and how decisions are made. Step 2 — Describe the Product For each menu item or product family, document the composition, packaging, intended shelf life, storage conditions, and any preservation factors (pH, water activity, salt, refrigeration). For a hospitality operator with a large menu, group similar products: "cold sandwiches," "hot rice dishes," "raw seafood preparations." The description is the basis for the hazard analysis that follows. Step 3 — Identify Intended Use Who eats this food, and how? Vulnerable populations (elderly, immunocompromised, pregnant, children under five) require stricter controls than the general adult population. If you operate in aged care, childcare, or a hospital, this is non-negotiable and changes which hazards become critical. Step 4 — Construct a Flow Diagram Draw, in linear form, every step a product passes through from receipt to service. For a beef burger this might run: receipt → cold storage → portioning → cold storage → cooking → assembly → service . Be granular: separate "cold storage in walk-in" from "cold storage in service fridge." Steps you don't draw are steps you can't analyse. Step 5 — Verify the Flow Diagram On-Site Walk the diagram. Watch the food move. Almost every flow diagram drawn in an office is wrong in at least one place — a step out of order, a transfer omitted, a piece of equipment that has been replaced. The verification walk turns the diagram from a theory into a description of reality. Principle 1 — Conduct a Hazard Analysis For every step in the verified flow diagram, list the potential hazards and assess them on two axes: severity (how bad is the harm if it occurs?) and likelihood (how often will it occur if not controlled?). Hazards fall into four categories: Biological: bacteria (Salmonella, Listeria, E. coli O157, Campylobacter), viruses (Norovirus, Hepatitis A), parasites, prions. Chemical: cleaning chemical residues, heavy metals, mycotoxins, pesticide residues, lubricants. Physical: glass, metal, plastic, bone, stones, hair. Allergen: the 24 declarable allergens under Standard 1.2.3 (PEAL). For each significant hazard, identify the control measures that will prevent, eliminate, or reduce it to an acceptable level. Many hazards are controlled by prerequisite programs — pest control prevents physical contamination by rodents, supplier approval reduces chemical residues. The hazards that cannot be adequately controlled by prerequisites are candidates for Principle 2. A worked example Consider a hot rice dish for service from a bain-marie. Significant hazards across the flow include: Receipt: chemical hazards from supplier — controlled by supplier approval (PRP). Cold storage: biological growth in raw ingredients — controlled by temperature monitoring (PRP). Cooking: survival of vegetative pathogens in rice and proteins — significant hazard, requires verified time/temperature control. Likely a CCP. Cooling (if held overnight): Bacillus cereus spore germination and toxin production — significant hazard, requires controlled cooling. Likely a CCP. Hot holding for service: growth of pathogens if temperature drops below 60°C — significant hazard, requires monitoring. Likely a CCP. Service: physical contamination from utensils — controlled by GMP (PRP). Principle 2 — Determine the Critical Control Points A Critical Control Point (CCP) is a step at which a control measure is essential to prevent or eliminate a food safety hazard, or reduce it to an acceptable level. The Codex CCP decision tree helps you determine whether a step is a CCP. Apply each question in order: Q1: Are there preventive measures for the identified hazard at this step? If no , modify the step or process; if yes , proceed. Q2: Is the step specifically designed to eliminate or reduce the hazard to an acceptable level? If yes , the step is a CCP. If no , proceed. Q3: Could contamination occur at or increase to unacceptable levels at this step? If no , the step is not a CCP. If yes , proceed. Q4: Will a subsequent step eliminate or reduce the hazard to acceptable levels? If yes , this step is not a CCP. If no , the step is a CCP. The decision tree is conservative — it deliberately produces a small number of CCPs. For a typical hospitality operator, you should expect three to seven CCPs across the menu, not fifty. If you find yourself with twenty CCPs, your prerequisite programs are doing too little of the work. Principle 3 — Establish Critical Limits For each CCP, set a measurable critical limit that separates safe from unsafe. Limits must be based on scientific data, regulatory requirements, or expert validation. Examples: Cooking poultry: internal temperature ≥ 75°C for 30 seconds. Hot holding: ≥ 60°C continuously. Cooling: from 60°C to 21°C within 2 hours, and from 21°C to 5°C within a further 4 hours (Australian "two-hour/four-hour rule"). Cold storage: ≤ 5°C. Sanitiser concentration: chlorine 100–200 ppm at 20°C with 1-minute contact, or per manufacturer instructions. Limits must be observable in real time by the person doing the work — "the meat is hot enough" is not a limit; "≥ 75°C on a calibrated probe" is. Principle 4 — Establish a Monitoring System Define how each critical limit will be checked, by whom, with what equipment, and how often. Effective monitoring answers four questions: What: the parameter being measured (temperature, time, concentration). How: the equipment used (probe, data logger, test strip). When: the frequency (every batch, every two hours, continuous). Who: the named role (head chef, opening lead, FSS). Continuous monitoring is preferable when the technology allows it — wireless temperature loggers in fridges and cool rooms have made this practical and affordable. For steps that can only be checked manually (cooking, cooling), the monitoring frequency must be high enough that a deviation is caught before unsafe food reaches a customer. Digital temperature monitoring turns this from a clipboard exercise into a tap-and-forget process. Principle 5 — Establish Corrective Actions For every CCP, document what will happen if the critical limit is not met. Effective corrective actions have four parts: Immediate action on the food: reject, recook, recool, hold pending evaluation, or discard. Action on the process: recalibrate equipment, retrain the operator, repair the unit. Root cause investigation: identify why the deviation occurred to prevent recurrence. Documentation: a permanent record of what was found, what was done, and by whom. Built-in corrective action workflows are one of the highest-value features of a digital HACCP system, because they ensure no failed check is ever left undocumented. Principle 6 — Establish Verification Procedures Verification is the difference between a HACCP plan that is documented and a HACCP plan that is working. Verification activities include: Calibration of monitoring equipment on a defined schedule, with records. Review of monitoring records by someone other than the person who took them, ideally weekly. Targeted microbiological sampling of high-risk products or surfaces (ATP swabs are useful for ongoing surface sanitation verification). Periodic on-site audits against the HACCP plan, ideally by an external party annually. Review of customer complaints, illness reports, and corrective action trends to detect recurring failures. Reassessment of the entire HACCP plan at least annually, and whenever there is a change to menu, equipment, suppliers, premises, or staff structure. Principle 7 — Establish Documentation and Record-Keeping Documentation is the spine of HACCP. The records you must maintain include: The HACCP plan itself (team, product descriptions, intended use, flow diagrams, hazard analysis, CCPs, critical limits, monitoring procedures, corrective actions, verification procedures). Monitoring records for every CCP for every operating day. Corrective action records. Verification records (calibration, review sign-offs, audit reports). Training records linking each food handler and the FSS to the HACCP plan they have been trained on. Supplier approval and ingredient specifications. Cleaning and sanitation records. Pest control records. Standard 3.2.2A explicitly requires three months of monitoring records to be available on demand. In practice, most jurisdictions expect twelve months, and insurers expect indefinite retention for any record connected to a complaint or illness incident. Common HACCP Mistakes — and How to Avoid Them Borrowing someone else's plan. A HACCP plan that does not match your menu, equipment, suppliers, and team is not a HACCP plan. Use templates as inspiration, never as substance. Too many CCPs. If your prerequisites are weak, every step looks critical. Strengthen the prerequisites first. Critical limits set by guesswork. Limits must be defensible. Cite the regulatory or scientific source for each. Monitoring frequency too low. Checking the bain-marie once a service is not enough — by the time you find a deviation, the food may have been served. Corrective actions that end at "discard the food." Without root cause, the failure repeats next week. Plans that never get reassessed. A plan written five years ago for a menu that has tripled in size is not a plan; it is fiction. Records that never get reviewed. Verification is the principle most often skipped, and the principle most often cited in serious enforcement actions. Keeping Your HACCP Plan Alive A HACCP plan is a living document. Every menu change, every new piece of equipment, every supplier swap, every personnel change is a trigger for review. Build a quarterly cadence: Quarter 1: Review monitoring trends and corre