In this final module, we look at principles 4 to 7 of HACCP, which cover monitoring, corrective action, verification and record keeping.

A HACCP plan is only useful if it works in practice, every day. Checking that the controls stay effective, and reviewing the system regularly, makes sure it keeps working as planned and shows where it can be improved.

Steps 9 to 12 of creating a HACCP system apply the last four principles:

• Principle 4, step 9: monitor the critical control points.
• Principle 5, step 10: establish corrective actions.
• Principle 6, step 11: establish verification procedures.
• Principle 7, step 12: keep documentation and records.

Together, they make sure that problems are spotted quickly, dealt with properly, and recorded, so the business can show that its food is safe.

Principle 4 requires a way of checking whether each CCP is within its critical limit. CCPs should be monitored at all times, so that any loss of control is detected quickly. Monitoring records also provide evidence of due diligence. The monitoring system should:

• Provide a written record, such as times and temperatures.
• Detect any drift from the target level before the critical limit is breached.
• Reveal any deviation straight away, so that action can be taken.
• Show managers how well controls are working, and highlight trends.

To be effective, monitoring must:

• Give a rapid result, so that unsafe food does not move on.
• Be continuous, or frequent enough to catch every problem.
• Be accurate, and give results that can be repeated.
• Measure the same thing that the critical limit controls.
• Use calibrated equipment, such as a thermometer checked against a known standard, so that the results can be trusted.
• Be carried out by named staff who are trained to use the equipment and who understand the process.

Principle 5 requires specific corrective actions for each CCP, so that any failure can be dealt with straight away.

Corrective action is taken when monitoring shows a deviation from the critical limit. It aims to:

• Make the product safe, or stop unsafe food reaching the consumer.
• Prevent the problem from happening again.
• Keep a clear record of what was done, for audits and as evidence of due diligence.

When planning corrective actions, the team must consider:

• Immediate actions to regain control, such as stopping production, adjusting equipment or moving food to a working fridge.
• Longer-term actions to find out why it happened and stop it happening again, such as repairing equipment or retraining staff.
• What will happen to the affected food: whether it can be reprocessed, needs further testing, or must be thrown away.
• Who is responsible for each action.

Corrective actions must be written down, so that everyone knows what to do if a CCP fails. The procedure should state:

• The immediate action needed to recover control.
• Whether production or sales must stop.
• Who must be told about the problem.
• What to do with the affected product.
• Who has the authority to restart production or release the product.
• How the cause will be investigated.
• How and where the actions are recorded.
• Who is responsible for each part.

A corrective action procedure is only effective if people can follow it under pressure. The immediate steps for recovering control should be specific enough that any trained member of staff can carry them out, for example moving food from a failed fridge to a working one and recording the temperatures. The procedure should state who has the authority to stop production or sales, and who must be told, such as the designated food safety manager or supervisor.

Affected product must be dealt with clearly: it may be quarantined, tested, reworked or disposed of, but it must never simply be forgotten. Only a named, competent person should decide when production restarts or product is released. The procedure should also explain how the cause will be investigated, using root cause analysis, so that the business fixes the underlying problem rather than just the symptom. Records of the actions taken must be kept secure and available to authorised officers, because they are evidence of due diligence.

Principle 6 requires verification procedures, which confirm that the HACCP system is working correctly, effectively and as planned. For a HACCP plan to be verified, it must be proven to be effective.

Auditing is different from monitoring. It looks at the whole system, not single checks, to make sure each part works and the system is up to date.

Audits are often carried out by supervisors, or by outside consultants. The auditor should be a different person from the one responsible for corrective actions.

Auditing takes an overview of the whole HACCP system rather than individual checks. It validates each element, verifies that it is working, and makes sure the system is up to date and compliant with current UK food safety requirements. For an audit to mean something, it has to be objective. That is why the person undertaking the audit should be different from the person responsible for implementing corrective actions.

Someone checking their own work is far more likely to miss weaknesses, or to explain them away. This separation of duties is considered best practice in food safety management. Supervisors often carry out internal audits, and they need a sufficient understanding of the entire HACCP process, not just their own area, to do it well. Some businesses choose to bring in external consultants or food safety specialists, who produce independent audit reports. These can give additional assurance that the system really does work as planned.

HACCP procedures should be verified internally on a regular basis, at least once a year, and also:

• Whenever the process, equipment or ingredients change.
• Whenever new hazards are identified.
• After an outbreak of food poisoning, a product recall or a food safety complaint linked to the business.

Verification can include reviewing the whole system and its records, talking to staff about how it works in practice, and confirming that the CCPs are under control. Any changes must be recorded and explained to staff.

Changes inside the business can mean the HACCP plan needs to be reviewed, such as:

• A new recipe, or a change to an existing one.
• A new supplier of an existing ingredient.
• New packaging, or a new packaging method.
• New equipment.
• Changes to the order of the process, or to the working environment.
• Weaknesses found during an audit or an inspection.

Any change to the flow diagram means the hazard analysis must be looked at again.

Changes outside the business can also mean the plan must be reviewed urgently:

• New information on food safety, or on existing hazards.
• Newly emerging hazards.
• Changes to the law or to official guidance.
• Changes in what customers eat, such as more demand for raw or lightly cooked foods.

Keep the HACCP team up to date with new information, and make sure every change to the plan is recorded and shared with staff.

Principle 7 requires accurate records for each stage of the food safety system.

HACCP documentation and records must be adequate to verify that food safety is being effectively controlled and monitored. They show that the controls are working as planned, and they are essential evidence of due diligence.

Records should be simple, filled in at the time of the check, signed, and kept where they can be found when needed.

The documents that support a HACCP plan include:

• The hazard analysis, including the flow diagram.
• How each CCP was decided.
• Training records.
• Monitoring and verification records, such as temperature checks, calibration records and audit reports.
• Cleaning schedules.
• Pest control reports.
• Supplier lists and specifications.

Record-keeping is one of the first things an inspector will examine, because without proper records a business cannot prove that it complies with the law, either to an inspector or in court. Beyond the hazard analysis, the CCP decisions and the monitoring records, several other documents support a HACCP plan. Training records should cover every member of staff involved in HACCP, showing the dates and the content of the training they received.

Cleaning schedules should record daily, weekly and deep cleaning, so that it is clear what was cleaned, when and by whom. Pest control reports should include the contractor's visits, the checks made on bait stations, and any pest sightings and the action taken. Supplier lists and specifications should be supported by approved supplier assessments and by delivery temperature records. Kept accurately and completed at the time, these records show that controls are working as planned, and they form the backbone of a due diligence defence.