HACCP Plan Worksheet Template

What requires or shapes this record

No source we read prescribes a layout for a HACCP plan; FDA's guidelines say the format will vary. What the law asks depends on where you are and what you make. In the European Union, Article 5 of Regulation (EC) No 852/2004 obliges food businesses after primary production to set up, apply and keep up a permanent procedure built on seven HACCP principles, to review it whenever the product, the process or any step changes, and to keep documents and records in proportion to the nature and size of the business. The Commission's 2022 Notice, which is guidance, explains how, allows simplified procedures for some small businesses and says its HACCP annex is in line with the Codex General Principles of Food Hygiene (CXC 1-1969). Great Britain keeps Article 5 in the same words except paragraph 5, which it omitted, and the GOV.UK guide that the Food Standards Agency's HACCP page now leads to says the system a business needs depends on its size, risk and complexity. In the United States, the NACMCF guidelines that FDA publishes set out five preliminary tasks and the seven principles; seafood and juice have their own HACCP regulations, and a facility covered by subpart C of 21 CFR part 117 needs a written food safety plan, which has more parts than a HACCP plan. The Codex text itself was not opened for this page. The worksheet therefore follows the order of steps those sources share, prints no critical limit, scale, frequency or retention period, and asks for the source of every value you write in. Completing the worksheet does not prove that you meet any food law or certification scheme; this page is general information, not legal or food safety advice.

• NACMCF, HACCP Principles & Application Guidelines, adopted 14 August 1997, published on FDA's website (page content current as of 25 February 2022; read on 21 October 2026)

  The National Advisory Committee on Microbiological Criteria for Foods revised its 1992 document after comparing it with the guidance of the Codex Committee on Food Hygiene. Before the seven principles it sets five preliminary tasks: assemble a multidisciplinary team that includes local staff (it warns that a plan written entirely by outsiders may be wrong, incomplete and unsupported on site), describe the food and how it is distributed (frozen, refrigerated or ambient), describe its intended use and consumers, which may be a segment such as infants, immunocompromised people or the elderly, draw a flow diagram covering every step under the establishment's control (a block diagram is enough), and check the diagram on site. The hazard analysis has two stages: identifying potential biological, chemical and physical hazards at each step, then evaluating each by severity and likely occurrence if it is not controlled, separating safety from quality, and keeping a summary of the team's reasoning for later reviews; hazards and CCPs can differ between facilities making the same product. A CCP decision tree is called a useful tool, not a mandatory element and no substitute for expert knowledge. Critical limits must be scientifically based, can come from regulatory standards and guidelines, literature, experiments and experts, and are not to be confused with operational limits set for other reasons. Continuous monitoring is preferred where feasible, monitoring records are dated and signed or initialled, and microbiological tests are seldom effective for monitoring because they take too long. Corrective actions find and correct the cause, decide what happens to non-compliant product and are recorded. Verification covers the initial validation of the plan, validation again after significant changes or an unexplained failure, review of monitoring and corrective action records, and a periodic comprehensive verification by an unbiased authority. Prerequisite programmes are managed separately from the plan, but their existence and effectiveness should be assessed while it is designed. Its worked examples include time and temperature figures for one product; none of them is used on this form.

• Regulation (EC) No 852/2004 on the hygiene of foodstuffs, Article 5 and Annex II, Chapters XIa and XII (EUR-Lex consolidated text of 24 March 2021, shown as the current consolidated version on 21 October 2026), with Article 5 as it applies in Great Britain (legislation.gov.uk, read the same day)

  Article 5(1) requires food business operators to put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. Article 5(2) lists them in points (a) to (g): identify the hazards to be prevented, eliminated or reduced to acceptable levels; identify the critical control points; set critical limits that separate acceptability from unacceptability; set up and implement effective monitoring at those points; set corrective actions for when a point is not under control; set procedures, carried out regularly, to verify that the measures work; and keep documents and records in proportion to the nature and size of the business. After any modification of the product, the process or any step the operator reviews the procedure and changes it as needed. Article 5(3) leaves out primary production and the operations linked to it that Annex I lists. Under Article 5(4) the operator shows the competent authority that it complies, in the form the authority asks for, keeps the written procedures current at all times and holds other records for an appropriate period; no number of years is set there. Article 5(5) allows detailed arrangements, including the use of guides to applying the principles. Annex II, Chapter XII, point 2, expects those who develop and maintain the procedure to have adequate training in applying the principles. Since Regulation (EU) 2021/382, Chapter XIa also requires an appropriate food safety culture; this worksheet does not assess it. On legislation.gov.uk, Article 5 as it applies in Great Britain has the same wording without paragraph 5, which was omitted from 31 December 2020 by S.I. 2019/642, and no outstanding effects were listed when read. Northern Ireland was not checked for this page.

• Commission Notice on the implementation of food safety management systems covering Good Hygiene Practices and procedures based on the HACCP principles (2022/C 355/01), OJ C 355, 16 September 2022, Annex II (EUR-Lex, read on 21 October 2026)

  The Notice replaces the 2016 Notice and says it is not legally binding. Its Annex II says it is in line with Chapter II of Codex CXC 1-1969 and describes five preliminary activities which, with the seven principles, give a 12-step approach. The product description covers the origin of ingredients, composition including allergens, structure and physico-chemical characteristics, processing, packaging and labelling, storage and distribution, shelf life, instructions for use and the microbiological or chemical criteria that apply. The flow diagram includes delays during or between steps and is confirmed on site during operating hours. Allergens are chemical hazards, but the Notice's hazard analysis worksheet lets them be treated as a fourth group, and likelihood is judged taking prerequisite programmes into account. Control measures must be validated. A step is not a CCP for a hazard if the control measure cannot be used there or if a later step controls it; steps that control a hazard only in combination are both considered as CCPs or OPRPs; a significant hazard with no control measure calls for a change to the product or process. Operational prerequisite programmes (OPRP) handle significant hazards where no critical limit can be set or no deviation can be detected in real time, allergen cross-contamination being its example, and the Notice notes that Codex speaks instead of good hygiene practices requiring greater attention. Critical limits are validated, have clear values and need not always be numerical when monitoring is visual; tighter target levels may be set. When a critical limit is exceeded, all production since the last satisfactory check is to be checked. Corrective actions name who acts, correct the process, deal with the product, are recorded and consider longer-term action; verification is done by someone other than the person who monitors and corrects. Records are kept long enough for tracing food in an alert and for official controls, and recital 15 of the Regulation, which it quotes, accepts that some businesses have no CCP. Its examples include time and temperature values for pasteurisation; none is used on this form.

• Codex Alimentarius, General Principles of Food Hygiene, CXC 1-1969: entry in the Codex list of texts (codex.fao.org, Committee on Food Hygiene, last modified 2022) and FAO Knowledge Repository record of the 2023 FAO/WHO edition (both read on 21 October 2026)

  The Codex list gives CXC 1-1969 as a code of practice of the Codex Committee on Food Hygiene (CCFH), last modified in 2022, with downloads in six languages. FAO's repository record (https://openknowledge.fao.org/handle/20.500.14283/cc6125en) lists a 2023 FAO/WHO edition of 60 pages, describes it as the general principles that food business operators should follow at all stages of the food chain and that give competent authorities a basis for oversight, and says this edition contains a new annex introducing tools to determine critical control points. The Commission Notice cites the 2020 revision (Rev. 2020) for several of its definitions. What we could not verify (21 October 2026): the Codex text is published as a PDF that was not opened for this page, so its wording of the steps, its decision tree and the new annex were not read or compared, and nothing on the worksheet is presented as Codex wording. Check the current edition yourself before relying on it.

• GOV.UK, Food safety management systems for businesses, parts 1 to 3 (the Food Standards Agency's HACCP page redirected to it on 21 October 2026, when it was read)

  The guide describes a food safety management system as a written set of processes, checks, rules and records that must meet the HACCP principles, which it lists in seven plain steps, and says that after a food safety incident the records are the evidence of how food was kept safe. It names three types of hazard: microbiological, chemical (including cleaning chemicals and allergens) and physical. The system a business needs depends on its size, its risk level and its complexity; the local food safety team advises, smaller caterers can use the FSA's Safer Food, Better Business packs (Safe Catering in Northern Ireland), and the system is reviewed regularly and whenever food processes or suppliers change. It calls a HACCP plan the more detailed part, with formal hazard analysis, critical control points, monitoring procedures and detailed records, which the local team may advise for larger or higher-risk businesses, and points to the FSA's MyHACCP online service (sign-in needed) and its own HACCP plan template. Meat plants have different HACCP rules. This worksheet is not an FSA template and was not reviewed by the FSA.

• 21 CFR 117.5(b) to (d), 117.126, 117.130 and 117.135 (United States; eCFR, Title 21 up to date as of 19 October 2026, read on 21 October 2026)

  Section 117.126 requires a written food safety plan, prepared or overseen by a preventive controls qualified individual, holding the hazard analysis, the preventive controls, the supply-chain programme, the recall plan and the procedures for monitoring, corrective action and verification. Section 117.130 requires a hazard analysis, written whatever its outcome, of known or reasonably foreseeable biological, chemical (food allergens included) and physical hazards, including hazards that occur naturally, are introduced unintentionally or are introduced intentionally for economic gain, evaluated for severity and for the probability of occurring without preventive controls, with factors such as formulation, equipment, ingredients, storage and intended use. Section 117.135 says preventive controls include controls at critical control points, if there are any, and other controls: process, food allergen, sanitation and supply-chain controls and a recall plan. Section 117.5(b) and (c) takes activities that are subject to, and comply with, the seafood HACCP regulation (part 123) or the juice HACCP regulation (part 120) out of subparts C and G; 117.5(d) does the same for the microbiological hazards of low-acid canned foods under part 113. A HACCP worksheet can therefore feed the hazard analysis and CCP part of a food safety plan, but it is not one on its own.

Each source checked on 21 October 2026. Not legal advice; check the text in force for your site.

Field by field

One worksheet covers one product, or a group of similar products made the same way with the same hazards. Fill the sections in order: the hazard analysis depends on the product description and on a flow diagram checked on site, and sections 8 to 10 take their CCP numbers from section 7. Write the reasoning as well as the answer, and give every value its source. The form prints no critical limit, scale, frequency or retention period; its numbering, prompts and example lines are ours.

Product or product group covered

Why: FDA's guidelines say plans are often specific to a product and a process, and the Commission Notice allows similar products to share one plan when they are made the same way and share their hazards. Naming the group sets what the hazard analysis has to cover.

Common mistake: One plan for a whole site whose products have different hazards and different kill steps.

Rules and guidance this plan is written to

Why: The duty differs by place and product: Article 5 in the EU, the same Article as it applies in Great Britain, seafood or juice HACCP rules in the United States, or a food safety plan under 21 CFR part 117, which needs parts this form does not have. A customer's scheme can add requirements of its own.

Common mistake: Writing the plan to a certification scheme and assuming that it also settles what the competent authority expects.

Prerequisite programmes the plan relies on

Why: FDA's guidelines call prerequisite programmes the foundation of the plan and say their existence and effectiveness should be assessed during its design; the Commission Notice judges the likelihood of a hazard taking them into account. The table asks whether each was seen working, not only whether it is written.

Common mistake: Rating a hazard unlikely because of a cleaning procedure that nobody has checked is followed.

Guides or generic HACCP plans used

Why: Article 5(5) and the Commission Notice allow guides and generic plans, but the Notice warns that a generic guide cannot foresee hazards that come from your layout or your process, so you check that it covers every activity and add your own procedures where it does not.

Common mistake: Adopting a sector guide whole and leaving out the rework step it never mentions.

HACCP team

Why: FDA's guidelines ask for a multidisciplinary team that includes people who run the operation and bring in outside experts where needed, and warn that a plan written entirely by outsiders may be incomplete. In the EU, Annex II, Chapter XII, expects those who develop and maintain the procedure to be trained in applying the principles.

Common mistake: A plan written by a consultant that nobody on site can explain at an inspection.

Product description

Why: The Commission Notice lists what to describe, from the origin of ingredients and allergens to pH, water activity, packaging, storage, shelf life and the criteria that apply, because the hazard analysis depends on them. FDA adds the method of distribution: frozen, refrigerated or ambient.

Common mistake: Copying the recipe card without the characteristics, such as water activity, that decide whether pathogens can grow.

Intended use and consumers

Why: FDA's guidelines name consumer groups such as infants, immunocompromised people and the elderly, and ask whether the food will be heated by the consumer and whether there will be leftovers. The Commission Notice asks for the reasonably foreseeable use, names institutional caterers and vulnerable groups, and counts the chance of mishandling by consumers in the hazard analysis.

Common mistake: Ticking 'general public' for a product that is sold to care homes.

Flow diagram and its check on site

Why: FDA's guidelines ask for a diagram covering every step under your control and an on-site review by the team; the Commission Notice adds delays during or between steps and says the check is made during operating hours, with any difference corrected on the diagram.

Common mistake: Drawing the diagram from the written procedure in the office, so the holding step on the night shift is missing.

Hazard analysis: type, likelihood, severity, significant

Why: FDA's guidelines describe two stages, identifying the hazards at each step and then evaluating their severity and likely occurrence if uncontrolled, and ask the team to keep its reasoning for later reviews. 21 CFR 117.130 requires a written hazard analysis whatever its outcome. The Notice allows allergens as a separate group.

Common mistake: Judging likelihood as if the control under study were already in place, so the hazard never looks significant.

Basis used for likelihood and severity

Why: The form supplies no scale. FDA's guidelines note that experts can differ on likelihood and severity, and the Commission Notice prints one semi-quantitative method as an example among others. Writing down your basis lets a reviewer see how each judgement was reached.

Common mistake: Changing the scale between two reviews, so the old and new results cannot be compared.

Critical control points

Why: FDA calls a decision tree a tool, not a mandatory element. The Commission Notice says a step is not a CCP for a hazard that a later step controls, that steps controlling a hazard only in combination are both considered as CCPs or OPRPs, and that a significant hazard with no control measure means changing the product or process. Some businesses find no CCP at all; recital 15 of the Regulation accepts this.

Common mistake: Marking every step a CCP, so the steps that really prevent harm get no closer watch than the rest.

Critical limit (your validated value)

Why: Article 5(2)(c) asks for limits that separate acceptability from unacceptability. FDA's guidelines want them scientifically based and kept apart from operating limits, and the Commission Notice wants them validated with clear values, though a limit can be visual. The form prints no value, because a value depends on your product, your equipment and the rules that apply to you.

Common mistake: Taking a figure from another site's plan or an equipment leaflet without validating it for your product.

Source of the limit and validation reference

Why: The Commission Notice says that when a limit does not come from a regulation or a guide to good practice the team should check that it is valid, and it lists what a limit can rest on, from experience and guides to scientific publications and EFSA opinions; FDA's guidelines start verification with the initial validation of the plan.

Common mistake: Citing a validation done for the old recipe after the recipe or the cooker has changed.

Monitoring: what, how, how often, who

Why: Monitoring must detect a deviation in time to isolate the affected product. FDA prefers continuous monitoring where feasible and wants each record signed or initialled by the person checking; the Notice asks the plan to say who checks, when and how.

Common mistake: A frequency so low that a failed check cannot be traced to a batch small enough to hold.

Corrective actions

Why: FDA's guidelines name three elements: find and correct the cause, decide what happens to the non-compliant product, and record what was done. The Commission Notice adds that all production since the last satisfactory check is checked and suggests root cause analysis.

Common mistake: Writing 'recooked' with nothing about the product that had already been packed.

Verification and validation schedule

Why: FDA's guidelines give an example schedule and list verification activities such as record reviews, calibration checks and sampling; the Commission Notice says verification is done by someone other than the person who monitors and corrects, at a frequency that suits the business. Validation is repeated after a significant change or an unexplained failure.

Common mistake: Counting the supervisor's daily sign-off of the monitoring sheet as the plan's verification.

Records and documents

Why: Article 5 asks for documents and records in proportion to the nature and size of the business, documents kept up to date and other records kept for an appropriate period, without fixing a number of years. The Commission Notice ties the period to tracing food in an alert and to official controls.

Common mistake: Keeping the monitoring sheets but losing the hazard analysis reasoning when the plan is rewritten.

Review triggers and log

Why: Article 5 requires a review whenever the product, the process or any step is modified. The GOV.UK guide adds changes of food processes or suppliers, and the Commission Notice lists changes that may need validation again, such as new raw materials, packaging, storage, consumer use or information about a hazard.

Common mistake: Reviewing only on the anniversary of the plan, months after a supplier change.

Worked example

IllustrativeFive lines from an invented HACCP plan for a chilled hummus line at a small producer, October 2026 (invented business, steps, decisions and record codes; no critical limit value is given)

The producer, its steps, its decisions and its record codes are made up to show how a row is filled; they are not a model plan. No critical limit value appears: a value has to come from your own validation and from the rules that apply to you. FDA's guidelines point out that facilities making similar products can reach different hazards and CCPs, so the outcome column here does not transfer. The allergen line is an operational prerequisite programme, the Commission Notice's term for the control of a significant hazard when no critical limit can be set or a deviation cannot be detected in real time; your system may name it differently. The monitoring times in line 4 are the invented team's choice, not a recommendation.

When a spreadsheet stops being enough

A printed plan and paper logs work for one line where the team is small, the HACCP leader sees every sheet and changes are rare. They strain when several lines or sites share ingredients and hazards, when a reading has to be compared with its limit at the moment it is written, when a deviation must hold the right batch and link to its corrective action, and when a recipe or supplier change has to reopen the right part of the plan.

A software record keeps the plan in versions, links each CCP to its monitoring form with the limit shown on it, stores each reading with the person and the time, sends a deviation to a hold and a corrective action, and schedules verification. When comparing products, ask how a change to the plan reaches the forms already in use, what happens to an entry made offline, who can edit a critical limit and whether the plan and its records can be exported for an inspector. Our HACCP and food safety software guide sets the rule for the products listed below. None was checked against this worksheet or any food law, so before deciding, load one of your own CCPs, with its monitoring form and a deviation, into a trial.

Same rule for every product: tagged “Food Safety”, “Quality Management”, “Audits & Inspections” or “Quality Inspection”, with a sourced HACCP or food safety capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

• FoodDocs · HACCP plan builder · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• SafetyChain · Food safety checks and verification · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• Veeva Quality Cloud · QualityOne industry scope · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 11 October 2026

• Tekmon · Quality management application suite · Documented

  Product scope and boundaries

  Vendor source · Profile checked 28 September 2026

All 4 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.