Step-by-step HACCP implementation for Australian hospitality. Prerequisites, hazard analysis, CCPs, monitoring, verification, and records.
What HACCP Is — and What It Is Not Hazard Analysis and Critical Control Points (HACCP) is an internationally recognised, science-based system for identifying and controlling food safety hazards. It was developed by NASA, Pillsbury, and the US Army in the 1960s to ensure that astronauts would not get food poisoning in space. Six decades later, it has become the dominant framework for food safety management worldwide and is embedded in FSANZ Standard 3.2.2A as one of three substantive tool options for Category One Australian food businesses. HACCP is not a folder. It is not a poster. It is not the FSS course your supervisor completed. It is a working system that links the specific hazards of your specific operation to specific control points, monitored by specific people, with specific corrective actions, all evidenced in specific records. A HACCP plan that lives in a manager's desk drawer and is never opened is not a HACCP plan — it is a paperweight. This guide walks through the full implementation pathway laid out in the Codex Alimentarius — five preparatory steps followed by seven principles — at the level of detail an operator actually needs to apply it. For a faster overview see our seven principles primer; for the regulatory context, see our definitive 2025 compliance guide. Before You Start: Prerequisite Programs (PRPs) HACCP is not the first thing you build — it is the last. It assumes that a foundation of Good Manufacturing Practices (GMPs) is already in place. Trying to bolt HACCP onto a kitchen that does not yet have functioning cleaning, pest control, supplier approval, and personal hygiene programs is like installing a smoke alarm in a house that has no walls. The prerequisite programs you need before HACCP makes sense are: Premises and equipment: Layout, surfaces, drainage, lighting, ventilation, and equipment all comply with Standard 3.2.3. Cleaning and sanitising: A documented schedule with chemicals, concentrations, contact times, and verification — see our cleaning and sanitation pillar. Pest control: A documented Integrated Pest Management program with trend records. Maintenance: A scheduled program for refrigeration, ovens, gas, electrical, and structure. Calibration: Defined frequency for thermometers, scales, and other measurement devices, with records. Supplier approval: Documented criteria for accepting suppliers, with current contact details, allergen statements, and product specifications on file. Personal hygiene and health: Hand-washing, illness reporting, uniforms, jewellery, and exclusion of unwell staff. Training: Induction, role-specific training, and refresher cycles, all evidenced — see our food safety training playbook. Receipt, storage, and traceability: Date marking, FIFO rotation, supplier batch identification, and one-up/one-down traceability. Allergen management: Recipe matrices, segregation, and verification — see our allergen pillar. Waste management: Internal waste handling, external collection, and prevention of cross-contamination. If any of these are missing, build them first. HACCP will identify the few critical points that the prerequisites cannot fully control. Without prerequisites, HACCP collapses under the weight of every hazard becoming "critical." The Five Preparatory Steps The HACCP framework underpinning Standard 3.2.2A is drawn from the international Codex Alimentarius and is supported in Australia by guidance from the Australian Department of Health and Aged Care and the NSW Food Authority . These bodies publish industry-specific HACCP templates and worked examples that operators can adapt to their own venue. Codex divides HACCP into a 12-step process: five preparatory steps followed by the seven principles. The preparatory steps are not optional and not bureaucratic — they are what makes the principles applicable to your operation rather than a generic checklist. Step 1 — Assemble the HACCP Team A HACCP team should be multidisciplinary: a head chef or kitchen leader, a Food Safety Supervisor, an operations manager, and ideally someone from front-of-house who understands how food is described to customers. In a small business, the same person may wear all those hats; what matters is that every operational perspective is represented. Document who is on the team, what their qualifications are, and how decisions are made. Step 2 — Describe the Product For each menu item or product family, document the composition, packaging, intended shelf life, storage conditions, and any preservation factors (pH, water activity, salt, refrigeration). For a hospitality operator with a large menu, group similar products: "cold sandwiches," "hot rice dishes," "raw seafood preparations." The description is the basis for the hazard analysis that follows. Step 3 — Identify Intended Use Who eats this food, and how? Vulnerable populations (elderly, immunocompromised, pregnant, children under five) require stricter controls than the general adult population. If you operate in aged care, childcare, or a hospital, this is non-negotiable and changes which hazards become critical. Step 4 — Construct a Flow Diagram Draw, in linear form, every step a product passes through from receipt to service. For a beef burger this might run: receipt → cold storage → portioning → cold storage → cooking → assembly → service . Be granular: separate "cold storage in walk-in" from "cold storage in service fridge." Steps you don't draw are steps you can't analyse. Step 5 — Verify the Flow Diagram On-Site Walk the diagram. Watch the food move. Almost every flow diagram drawn in an office is wrong in at least one place — a step out of order, a transfer omitted, a piece of equipment that has been replaced. The verification walk turns the diagram from a theory into a description of reality. Principle 1 — Conduct a Hazard Analysis For every step in the verified flow diagram, list the potential hazards and assess them on two axes: severity (how bad is the harm if it occurs?) and likeliho