The Codex Alimentarius 12-step process for building a HACCP system has been the global standard since 1969. BRC Issue 9 Section 2 is built directly on those 12 steps. But most HACCP plans that fail audit don't fail because they're missing a section — they fail because the sections are too thin, too generic, or too disconnected from the actual operation. This guide walks through every step as it applies in a real UK food manufacturing environment, with specific attention to what BRC Issue 9 requires at each stage.
I've spent 30 years in food manufacturing and BRC auditing. The gap between a HACCP plan that passes and one that doesn't is almost never about structure. It's about depth.
Steps 1–5: Building the Foundation Before Any Hazard Analysis Begins
These five preparatory steps are not administrative formalities. They determine the quality of everything that follows. If your product description is vague, your hazard analysis will be vague. If your flow diagram doesn't reflect reality, your CCP designation will be wrong.
Step 1 — Assemble the HACCP Team (BRC 2.1). The team must be genuinely multi-disciplinary: QA, production, engineering, and hygiene as a minimum. A team composed entirely of QA staff fails the multi-disciplinary requirement. Each member must have demonstrable competence — not just a training certificate, but the ability to answer questions about the methodology. BRC auditors increasingly question team members directly during the audit. I've seen sites lose Grade A on clause 2.1 because the Technical Manager couldn't explain why a particular step had been designated a CCP. The paperwork was in order; the knowledge wasn't.
Step 2 — Describe the Product (BRC 2.3). The product description must cover composition, physical and chemical properties (pH, water activity, moisture content where relevant), packaging, shelf life, storage and distribution conditions, and any labelling relevant to safety. Critically, it must match what is being produced today — not what was produced when the HACCP study was first written. A formulation change that was never reflected in the product description is a finding.
Step 3 — Identify Intended Use (BRC 2.4). Define who will eat the product and whether any vulnerable consumer groups are involved — elderly, infants, immunocompromised individuals, pregnant women. This is not a tick-box exercise. The intended use directly affects severity scoring in the hazard analysis: Listeria monocytogenes carries a significantly higher severity score for a product destined for care home residents than for a general population product. Auditors check for consistency between the intended use statement and the severity scores applied. If you've declared a general population product but it's sold in care homes, that inconsistency will be found.
Step 4 — Construct the Process Flow Diagram (BRC 2.5). The diagram must cover every stage from raw material receipt to dispatch. All inputs must be shown — water, packaging materials, processing aids, rework — and all outputs including waste streams and rework loops. Rework loops are frequently missing and frequently challenged in audits. If any step in your process is performed by a third party, it belongs on the diagram.
Step 5 — Verify the Flow Diagram On-Site (BRC 2.5.1 and 2.6). The HACCP team must physically walk the production line and confirm the diagram is accurate. This must cover all operational shifts — if night shift runs differently, the verification must reflect that. The verification record must be dated and signed by the person who did it, and must note any amendments made to the diagram as a result. Auditors will walk the line themselves and compare what they see to the flow diagram. Any discrepancy they find that you missed is a finding.
Step 6: Hazard Analysis — Where Most HACCP Plans Are Weakest
Hazard analysis is where the most significant audit findings originate. The requirement under BRC 2.7 and Codex Principle 1 is to identify all potential hazards at every process step, assess their significance, and determine how each significant hazard will be controlled.
All five hazard categories must be assessed at every step: biological, chemical (including allergens — assessed as a chemical hazard), physical, radiological, and food fraud or adulteration. Radiological hazards are absent from many HACCP plans with no documented rationale for exclusion. That is a finding. The absence of allergen cross-contact assessment at shared equipment or changeover steps is one of the most common major non-conformances I see under clause 2.7.
For each hazard, the significance assessment must document the rationale — not just scores. "Salmonella — severity 3, likelihood 1, not significant" tells an auditor nothing. Why severity 3? Why likelihood 1? What data or published guidance supports that assessment? The rationale matters as much as the conclusion. A well-constructed significance assessment will reference published scientific data, codes of practice, or the product's own history.
The 2020 revision of Codex CXC 1-1969 formally defined the concept of a "significant hazard" — a hazard that requires specific control by a CCP or, under ISO 22000/FSSC 22000 terminology, an OPRP. BRC Issue 9 reflects this shift in emphasis. Your hazard analysis must make the significance determination explicit, not implied.
Steps 7–10: CCPs, Critical Limits, Monitoring, and Corrective Actions
Step 7 — Determine CCPs (BRC 2.8, Principle 2). Each significant hazard must be assigned to a control level: CCP, or a PRP with enhanced monitoring. The determination must use a documented, systematic approach — a decision tree or equivalent. The Codex 2020 revision removed the original decision tree but confirmed that decision trees remain valid. BRC does not mandate a specific format, but does require documented reasoning for each designation.
One of the most reliable indicators of a poorly structured HACCP plan is too many CCPs. Sites that list 15 or 20 CCPs are almost certainly including controls that should be PRPs. Cleaning is not a CCP. Allergen label checks are not CCPs. A CCP must have a measurable critical limit that can be monitored in real time, with immediate corrective action capability when the limit is breached. If any of those three criteria cannot be met, the step is not a CCP.
Step 8 — Establish Critical Limits (BRC 2.9, Principle 3). Every CCP must have a validated critical limit — a threshold that is scientifically proven to control the hazard if met. "Industry standard" is not validation. "Our customer requires it" is not validation. The evidence must demonstrate a scientific basis for the specific limit applied to the specific hazard in the context of your specific product. That evidence can come from published kill curves, regulatory guidance, expert opinion, challenge testing, or equipment manufacturer data — but it must exist and be documented. BRC 2.9.1 makes this explicit. It is not optional.
Step 9 — Establish Monitoring (BRC 2.10, Principle 4). The monitoring procedure for each CCP must specify the parameter being measured, the method, the equipment used, the frequency, and the named responsible person. The frequency must be adequate to detect loss of control before non-conforming product reaches the next step or leaves the site. Monitoring records must be completed at the time of monitoring — not retrospectively — and must be reviewed and signed by an authorised person.
A monitoring record that shows the same reading every time — 75°C every check, for months — is a red flag. Real processes have variation. When every record shows exactly the same number, the auditor will suspect retrospective completion. Real data has variation within limits. That variation is evidence the system is working.
Step 10 — Establish Corrective Actions (BRC 2.11, Principle 5). Corrective actions must be pre-determined — documented before a deviation occurs, not improvised when one happens. Each procedure must address: what to do with non-conforming product, how to restore process control, who is responsible, and root cause analysis. The most common audit failure here is corrective action records that address the immediate event — product quarantined, process restarted — but contain no root cause analysis. A record that says "product placed on hold, production restarted" without any analysis of why the critical limit was breached is not compliant with clause 2.11.
Steps 11–12: Verification, Validation, and Documentation
Step 11 — Verification and Validation (BRC 2.12, Principle 6). These two requirements are frequently confused, and the confusion creates audit findings.
Validation answers the question "will this work?" — before implementation, or whenever a significant change occurs. It is the scientific proof that a control measure, properly applied, will effectively control the identified hazard. Validation is a one-time or change-triggered activity. For a cooking step with a 75°C critical limit, validation is the published kill curve data demonstrating that 75°C for the required time eliminates the target pathogen in this product type.
Verification answers the question "is it working?" — on an ongoing basis, through activities that confirm the HACCP system is operating as planned. Verification includes record reviews, internal audits, microbiological or environmental testing, calibration of monitoring equipment, and review of corrective action trends. BRC requires a documented verification schedule. Auditors want evidence the schedule is being followed and that findings are acted upon.
The 2020 Codex revision significantly strengthened validation as a separate, explicit requirement distinct from verification. BRC Issue 9 reflects that. Auditors who know the 2020 revision will ask specifically about validation evidence — not just monitoring records.
Step 12 — Documentation and Record-Keeping (BRC 2.13, Principle 7). All HACCP documentation must be version controlled, authorised, and current. Records must be retained for a defined period that accounts for product shelf life and any relevant legal requirements. A perennial finding: the HACCP plan on the production floor is version 5 and the office has version 7. Document control failures are among the easiest majors to pick up — and among the easiest to prevent.
The Annual Review Requirement (BRC 2.14)
The HACCP plan must be reviewed at least annually, and whenever there is a significant change — new ingredients, supplier changes, process modifications, new equipment, regulatory changes, customer feedback trends, or emerging hazard intelligence. Each triggered review must be documented with the reason for the review, who participated, what was examined, what conclusions were reached, and what changes were made.
Auditors distinguish between a genuine review and a box-ticking exercise. A review record dated the same day as the previous year's with no changes noted and no specific discussion documented is the latter. A review record with a dated agenda, attendance list, specific items discussed — including CCP monitoring trend data, corrective action log summary, any external intelligence reviewed — conclusions, and action items with owners and due dates is the former.
The BRC standard asks whether your HACCP system is documented. Your auditor asks whether it is real. The difference between those two questions determines your grade.
What Grade A Evidence Looks Like
Minimum compliance means: documented HACCP study, documented CCPs, monitoring records, and review evidence. Grade A evidence means all of that, plus hazard analysis with detailed rationale; validation evidence that is specific and scientific; CCP monitoring records showing real operational data including variability; corrective action records with genuine root cause analysis; verification results that have been reviewed and acted upon; and a review record that demonstrates active engagement with the HACCP plan, not annual paperwork processing.
The question I ask when reviewing a HACCP system before an audit: if I showed this to someone who had never been to this site, would they understand what this business makes, what the hazards are, how they are controlled, and whether the system is working? If yes — Grade A evidence. If no — minimum compliance at best.
SafetyCore is built around all 12 Codex steps and BRC Issue 9 Section 2 from the ground up — structured hazard analysis with significance rationale, built-in decision trees for CCP determination, validated critical limit records, automated annual and triggered review workflows, and an immutable audit trail at every clause. 7-day free trial, no credit card required.
Start Free Trial