Section 2 of BRC Issue 9 is the HACCP food safety plan — the core of the entire standard. It's a fundamental requirement, which means any non-conformance raised against clause 2 is automatically a major non-conformance at minimum. Get a critical against a fundamental clause and your certification is gone. This isn't a section you can treat as administrative paperwork.
I've been on both sides of Section 2 audits — as the Technical Manager being audited and as an IRCA Lead Assessor auditing others. The difference between a Grade A result and a string of major findings almost always comes down to the same things: depth of hazard analysis, quality of validation evidence, and whether the system is genuinely used day-to-day or just dusted off before the audit.
This guide walks through the key clauses in Section 2 and explains what auditors are actually looking for versus what the standard literally says. They're not always the same thing.
Clause 2.1 — The HACCP Team
BRC requires a multi-disciplinary HACCP team with adequate knowledge and expertise. The standard says you need to cover the range of knowledge and experience relevant to your products and processes. Auditors check this against your actual team composition and their demonstrable competence.
What this means in practice: your HACCP team record needs to show who is on the team, what their role is, what relevant qualifications or experience they bring, and what HACCP-specific training they have received. A team of four QA staff all with the same qualifications is not multi-disciplinary. You need representation from production, engineering, technical, and QA as a minimum. If you make products for specific market segments (e.g., products for vulnerable consumers), demonstrable knowledge of the relevant hazards in that context is expected.
The competence-based emphasis in the 2020 Codex revision has fed through into auditor expectations under BRC. Training records showing attendance at a Level 3 HACCP course are necessary but not sufficient. Auditors want evidence that team members can apply the methodology — they may ask HACCP team members questions during the audit to assess understanding. I've seen sites lose Grade A on clause 2.1 because the Technical Manager, under questioning, couldn't explain why a particular step had been designated as a CCP. The paperwork was fine; the knowledge wasn't there.
Clause 2.3 — Product Description
The product description requirement sounds administrative but it's foundational. The description needs to cover: full description of the product (composition, ingredients, processing method), physical and chemical characteristics (pH, water activity, moisture content where relevant), packaging and packaging conditions, shelf life, storage and distribution conditions, and labelling including any consumer instructions relevant to safety.
Auditors check that the product descriptions in your HACCP documentation match what's actually produced. Discrepancies between the HACCP product description and the current specification — a formulation change that wasn't reflected in the HACCP study, a packaging change that altered shelf life without a HACCP review — are findings. They're also evidence that the HACCP system isn't genuinely being used as a live document.
Clause 2.4 — Intended Use
Intended use must be defined and must consider vulnerable consumer groups. For most products this is straightforward. For products consumed by the elderly, infants, pregnant women, or immunocompromised individuals, the intended use definition has direct implications for hazard analysis — the severity scoring for pathogens like Listeria monocytogenes changes significantly when the intended consumer is immunocompromised.
Foreseeable misuse is also part of clause 2.4. If your product could reasonably be consumed by groups outside your intended use description, your hazard analysis needs to reflect that. Auditors look for consistency between the intended use statement and the severity scores applied in hazard analysis. If you've said your product is for the general population but you're making a product sold in care homes, that inconsistency will be found.
Clause 2.5 — Process Flow Diagram
The flow diagram must accurately represent every step in the process from raw material receipt through to despatch. It must show all inputs (ingredients, packaging, water, processing aids, cleaning chemicals, rework) and outputs (waste streams, rework loops). Outsourced steps must be included — if a step in your process is performed by a third party, it goes on the flow diagram.
Clause 2.5.1 requires documented verification of the flow diagram by physical walk-through, covering all operational shifts. This is a perennial audit finding — sites have a flow diagram that was accurate when it was drawn but hasn't been updated to reflect process changes, equipment additions, or layout modifications. The on-site verification record needs to show who verified it, when, what was checked, and whether any amendments were needed.
Auditors will often walk the process during the audit and mentally check it against the flow diagram. Any discrepancy — a step not on the diagram, an input not shown, a rework loop missing — is a finding against clause 2.5.
Clause 2.7 — Hazard Analysis
This is where most Section 2 audits either pass or fail. The hazard analysis must cover all potential biological, chemical, physical, and radiological hazards at every step of the process. For each hazard, there must be a documented significance assessment — severity, likelihood, and the conclusion on whether the hazard is significant. For every significant hazard, there must be an identified control measure.
The most common major non-conformance I see against clause 2.7 is incomplete hazard analysis — hazards that are present in a real product from a real process but don't appear in the HACCP study. Allergen cross-contact at shared equipment steps is frequently missing. Radiological hazards are frequently absent with no documented rationale. Chemical hazards from packaging migration are sometimes missing for products in contact with certain materials. Environmental pathogens (Listeria spp.) are sometimes missing for chilled ready-to-eat products with extended shelf life.
The second most common major non-conformance is hazard analysis without significance justification — a table of hazards with severity and likelihood scores but no documented rationale for why those scores were assigned. "Salmonella — severity 3, likelihood 1, not significant""tells an auditor nothing. The rationale matters as much as the conclusion.
Clause 2.8 — CCP Determination
Each significant hazard identified in clause 2.7 must be assigned to a control level — CCP, OPRP (under BRC terminology, a PRP with enhanced monitoring), or PRP. The determination must use a documented, systematic approach, and the reasoning for each designation must be recorded.
Auditors check consistency between the hazard analysis output and the CCP determination. If a hazard is identified as significant in clause 2.7 but doesn't appear in the clause 2.8 determination records, that's a finding. If a step is designated as a CCP but the hazard analysis for that step doesn't identify a significant hazard requiring a CCP, that's also a finding — it suggests the two sections were completed independently rather than as part of an integrated system.
The presence of CCPs that auditors would question — cleaning as a CCP, allergen labelling as a CCP — are findings against clause 2.8. They indicate a misunderstanding of what a CCP is.
Clause 2.9 — Critical Limits and Monitoring
Every CCP must have a critical limit that is validated — there must be evidence that the limit, if met, will effectively control the hazard. Validation evidence can come from published scientific guidelines, regulatory requirements, challenge testing, or expert opinion. "Industry standard""alone is not validation. "Our customers require it""is not validation. The evidence must show a scientific basis for the specific limit applied to the specific hazard in the context of your specific product.
The monitoring system for each CCP must specify what is monitored, how, with what equipment, at what frequency, and by whom. The frequency must be adequate to detect loss of control in time to prevent non-conforming product reaching the next step or leaving the site. Monitoring records must be completed at the time of monitoring — not retrospectively — and must be reviewed and signed by an authorised person.
Clause 2.9 findings in audits typically involve: critical limits without validation evidence; monitoring records that are evidently completed retrospectively; monitoring frequency that's too low to detect a plausible loss of control in time; or monitoring methods that aren't actually capable of measuring the critical limit reliably.
Clause 2.10 — Corrective Actions
Pre-determined corrective actions must be documented for each CCP. Each corrective action record must address: what was done with non-conforming product; how process control was restored; the root cause analysis; and who was responsible. BRC requires corrective actions to be taken by trained, authorised personnel.
The most common audit failure here is corrective action records that address the immediate event (product quarantined, process stopped) but don't include root cause analysis. Auditors expect to see evidence that the root cause was investigated and that the corrective action addresses the cause, not just the symptom. A corrective action record that says "product placed on hold, production restarted""without any analysis of why the critical limit was breached is not compliant with clause 2.10.
Clause 2.12 — Verification
Verification activities confirm that the HACCP system is functioning as intended. This is distinct from monitoring (which confirms individual CCPs are under control) and from validation (which proves control measures are capable of controlling hazards). Verification activities typically include: review of CCP monitoring records; internal audits of the HACCP system; microbiological or chemical testing of finished product; calibration records for monitoring equipment; and review of customer complaints and corrective action trends.
Auditors look for a documented verification schedule, evidence that the schedule is being followed, and evidence that the results of verification activities are being reviewed and acted upon. A verification schedule that says "quarterly internal audit""but has no audit records, or audit records that identify non-conformances that haven't been addressed, are findings against clause 2.12.
Clause 2.14 — Annual Review
The HACCP plan must be reviewed at least annually or whenever there is a significant change to any factor that could affect the food safety analysis — new products, ingredient changes, process changes, new equipment, regulatory changes, customer feedback trends, emerging hazard intelligence. The review must be documented with a record of what was reviewed, who participated, what conclusions were reached, and what changes were made to the HACCP plan as a result.
Auditors distinguish between a genuine review and a box-ticking exercise. A review record dated the same day as the previous year's review with no changes noted and no specific discussion documented looks like the latter. A review record with dated agenda, attendance list, specific items discussed (including CCP monitoring trend data, corrective action log summary, any external intelligence reviewed), conclusions, and action items with owners and due dates looks like the former.
The Difference Between Grade A Evidence and Minimum Compliance
Minimum compliance for Section 2 means documented HACCP study, documented CCPs, monitoring records, and review evidence. Grade A evidence means all of that, plus: hazard analysis with detailed rationale not just scores; validation evidence that is specific and scientific rather than generic; CCP monitoring records that show real operational data including variability; corrective action records with genuine root cause analysis; verification results that have been reviewed and acted upon; and a review record that demonstrates active engagement with the HACCP plan rather than annual paperwork processing.
The question I always ask when reviewing a HACCP system before an audit is: if I showed this to someone who had never been to this site, would they understand what this business makes, what the hazards are, how they're controlled, and whether the system is working? If the answer is yes, you have Grade A evidence. If the answer is no, you have minimum compliance at best.
The BRC standard asks whether your HACCP system is documented. Your auditor asks whether it's real. The difference between the two questions determines your grade.
SafetyCore structures your entire BRC Section 2 system — hazard analysis, CCP determination, critical limits, annual reviews, and triggered reviews — in a format that produces audit-ready evidence at every clause, not just at review time.
Start Free Trial