The annual HACCP review is one of those requirements that almost every site technically complies with and very few sites actually do well. It appears in every audit checklist. The box gets ticked. A record exists. But the record is often a single page with a date, a signature, and the words "HACCP plan reviewed and found to be adequate""— which tells an auditor nothing about whether the review was substantive and tells the business nothing useful about the state of its food safety system.
This guide covers BRC Issue 9 clause 2.14, what "significant change""means in practice, how to structure the review so it produces genuine value rather than just documentation, and the distinction between annual review and triggered review.
The BRC Requirement
BRC Issue 9 clause 2.14 requires that the HACCP food safety plan is reviewed at least annually and whenever there is any change that may affect the food safety analysis. The review must be documented. Any changes arising from the review must be incorporated into the HACCP plan and related procedures.
The clause also links to the broader requirement in clause 2.12 (verification) — the annual review is itself a verification activity. It's the top-level confirmation that the entire HACCP system remains appropriate, effective, and reflective of current operations. That framing is important: the review isn't just about whether anything has changed. It's about whether the evidence accumulated over the preceding year confirms that the system is working.
Annual Review vs Triggered Review
These are two distinct activities that are often conflated. The annual review is a scheduled, comprehensive review of the entire HACCP plan — it happens on a calendar basis regardless of whether anything specific has occurred. A triggered review is a focused, immediate review prompted by a specific change or event that could affect the food safety analysis.
Triggers for a between-cycle triggered review include: introduction of a new product or product line; significant changes to raw material specification or supplier; changes to formulation or recipe; changes to process equipment or process parameters; changes to production volumes or production patterns that affect process control; new regulatory requirements or food safety alerts; significant corrective action events indicating a systemic issue; customer complaints indicating a potential food safety concern; and food safety intelligence (outbreak data, recall notifications, new scientific guidance) suggesting a hazard not adequately addressed in the current plan.
A triggered review doesn't replace the annual review — it supplements it. If you have a triggered review in March and your annual review is due in September, you still conduct the September review. The triggered review record should be referenced in the annual review documentation as evidence of the system's responsiveness to change.
Who Should Attend
The annual review should be attended by the core HACCP team — the same multi-disciplinary group responsible for the HACCP plan. This means Technical/QA, Production, Engineering, and ideally Procurement (for raw material intelligence). The team leader (typically the Technical Manager or Food Safety Manager) should chair the review and be responsible for the minutes and action log.
Senior management representation matters for two reasons. First, it demonstrates management commitment — a BRC requirement in its own right, and something auditors genuinely assess rather than just acknowledge. Second, it ensures that any resource implications of review outcomes (investment in new equipment, change to production scheduling, additional verification testing) can be decided by someone with the authority to commit to them. Review meetings that identify actions requiring management approval but have no management present tend to produce incomplete action logs.
What Evidence to Review
The annual review should work through a structured agenda. The following are the minimum inputs that should be reviewed and documented:
CCP monitoring trends. Are critical limits being consistently achieved? Are there any trends of approaching-limit results that suggest a deteriorating process? Are there any corrective actions recorded for CCP deviations, and have those corrective actions been effective? Reviewing monitoring data for trends is more valuable than reviewing individual records — a cooking temperature that's consistently 76-77°C (1-2°C above the 75°C critical limit) is fine, but if it's trending down over the year toward the limit, something is changing that needs investigation before it becomes a problem.
Corrective action log. What corrective actions were recorded during the year? What were the root causes identified? Were the corrective actions effective? Are there any recurring themes suggesting a systemic issue that the HACCP plan hasn't adequately addressed? A single corrective action for a metal detection reject is an operational event. Six corrective actions for metal detection rejects across the year, all from the same piece of equipment, is a pattern that should trigger a review of that CCP and potentially a review of the maintenance PRP.
Verification results. What were the outcomes of verification activities during the year? Internal audit findings, microbiological and chemical verification test results, calibration records, allergen swab results. Are there any verification results suggesting the HACCP plan isn't achieving what it's designed to achieve?
Customer complaints with food safety implications. Any complaint about foreign body contamination, suspected illness, allergen presence, or off-specification product that could indicate a food safety hazard needs to be reviewed in the context of the HACCP plan. Does the complaint reflect a gap in the hazard analysis? Does it suggest a CCP or PRP that isn't functioning effectively?
Previous audit findings. What non-conformances or observations were raised in internal and external audits? Were the corrective actions from those findings completed? Are there any recurring audit findings that suggest a systemic weakness?
Changes since the last review. Have there been any changes to products, processes, equipment, raw materials, or suppliers that weren't captured through a triggered review? Are there any planned changes in the coming year that should be reflected in the HACCP plan now?
Regulatory and intelligence updates. Have there been any changes to relevant regulations, guidance documents, or food safety standards? Have there been any significant food safety incidents in the industry relevant to your product types or raw materials? New Codex guidance, FSA alerts, recall notifications from your raw material supply chain — all of these are inputs to the annual review.
How to Document It Properly
Good annual review documentation consists of at minimum: a dated agenda circulated before the meeting; an attendance list with roles; minutes covering each agenda item with a summary of what was reviewed, the conclusion reached, and any actions arising; an action log with specific actions, named owners, and due dates; a formal conclusion on whether the HACCP plan remains adequate or requires amendment; and sign-off by the team leader and, ideally, a senior management representative.
The minutes don't need to be lengthy, but they need to be substantive. "CCP monitoring records reviewed — satisfactory""is not adequate. "CCP1 (cooking temperature) monitoring records reviewed for the period January–December 2024. 98% of readings were 76°C or above. Two corrective actions recorded (March and July) for temperature deviations; both were due to probe calibration drift and addressed by immediate recalibration and re-test. No product recall actions were required. Calibration interval to be reviewed — action to Technical Manager by 31 January 2025""— that's a review record that tells you something about how the system is working.
If the review concludes that the HACCP plan requires amendment — a hazard needs to be added, a critical limit needs to be changed, a new CCP needs to be established — the amendment must be documented as a change to the HACCP plan with version control, and the implications for related procedures and training must be addressed.
What Good Review Records Look Like vs Box-Ticking
The distinction is not about length — it's about whether the record demonstrates active engagement with real data and real decisions. A box-ticking review record has: a single page with a date and signature; no reference to specific data reviewed; no specific findings or observations; no actions; and a generic conclusion that the HACCP plan is adequate. An auditor sees this and knows immediately that no genuine review took place.
A genuine review record has: evidence that specific monitoring data was reviewed (even if just a summary statement with trend data); evidence that corrective action records were reviewed and patterns considered; specific items discussed including any issues identified; named actions with owners and dates; and a conclusion that either confirms the plan remains appropriate with supporting rationale, or identifies specific amendments made and why. It doesn't need to be 20 pages. It needs to be honest.
BRC auditors are experienced in distinguishing the two. A review record that was evidently completed on the day before the audit — same handwriting on the attendance list and the action items, action due dates that are all after the audit, conclusions that don't reference any of the data in the monitoring records — is a serious finding. I've seen certifications lost on clause 2.14 alone.
Common Audit Findings
The most frequent clause 2.14 findings are: no annual review record (or no evidence one was conducted, as distinct from a record existing); review record with no evidence of what was reviewed; no action log or action log with no completion dates; significant changes during the year that weren't reflected in either a triggered review or the annual review; and review conclusions that contradict the monitoring data (review says satisfactory, monitoring records show multiple corrective actions).
Less frequent but more serious: annual review identifying HACCP plan amendments that weren't subsequently implemented (the review said "add new raw material to hazard analysis""but it was never added); triggered review events that weren't recognised as such (a significant process change happened but no triggered review was conducted and no note appears in the annual review).
The annual review is the moment when the HACCP team steps back from the operational detail and asks whether the system, taken as a whole, is still fit for purpose. Done properly, it's the most valuable hour in the HACCP calendar. Done as box-ticking, it's a liability.
SafetyCore's annual and triggered review modules provide structured review workflows with pre-populated agenda items, integrated access to your monitoring trends and corrective action history, and automatic version-controlled HACCP plan amendments — so your review produces genuine evidence, not just a signature page.
Start Free Trial