HACCP Certification for Food Safety Systems

HACCP is a preventive approach to food safety, and itmad provides HACCP certification for organisations in the food chain, conducted in accordance with the principles of ISO/IEC 17021-1. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

HACCP in brief

HACCP asks where in a process a hazard could make the product unsafe, how to control those points, and how to prove that the control worked. It replaces end-product testing, which can only show that a batch was already contaminated, with control at the steps where contamination happens. HACCP does not make food risk-free. It brings identified hazards down to acceptable levels and produces the evidence that controls operated, which is what a regulator or a client asks to see.

Who HACCP is for

HACCP applies to any organisation in the food chain, including:

• Food manufacturers and processors
• Central production kitchens and catering companies
• Restaurants, hotels and hospitality groups
• Bakeries, dairies and beverage producers
• Cold stores, distribution and food logistics
• Retail food operations and supermarkets
• Agricultural producers and packhouses

The seven HACCP principles

• 1. Hazard analysisIdentify biological, chemical, physical and allergen hazards at each process step, and decide which are significant enough to need control.
• 2. Critical control pointsFind the steps where control is essential to prevent or eliminate a hazard. A critical control point is one where loss of control means the product is unsafe, not just a point that happens to be monitored.
• 3. Critical limitsSet a measurable boundary at each critical control point, such as temperature, time, pH or water activity. A limit that cannot be measured cannot be controlled.
• 4. MonitoringDefine what is measured, how, how often and by whom, and record results as they are taken.
• 5. Corrective actionDecide in advance what happens when a limit is breached, including what is done with the affected product.
• 6. VerificationConfirm that the system works through calibration, review of records, testing and internal audit. Monitoring shows that the control ran; verification shows that it was the right control.
• 7. Documentation and recordsThe plan, and the records that show it was followed. Without records there is no evidence, and without evidence there is no defence.

Prerequisite programmes

HACCP works only on a foundation of prerequisite programmes: cleaning and sanitation, pest control, personal hygiene, water quality, waste management, maintenance, supplier control and staff training. Where the basics are missing, trying to control everything through critical control points produces an unmanageable plan with a dozen points that nobody can monitor properly. A well-built plan usually has few, because the prerequisites deal with most hazards before they get that far. An audit that finds too many critical control points is usually finding weak prerequisites.

Where HACCP audits find gaps

Four gaps recur. Records are filled in afterwards, in one handwriting, at the end of a shift. Corrective action is recorded as taken, with nothing to show what happened to the affected product. Critical limits are set at levels that nobody monitors in practice. And thermometers and probes are uncalibrated, which invalidates every temperature record that they produced.

HACCP and ISO 22000

HACCP is a method; ISO 22000 is a management system standard that includes the HACCP principles within a wider framework of leadership, planning, competence and improvement. Organisations often begin with HACCP to meet a regulator's requirement and move to ISO 22000 when a customer wants a certified management system. The HACCP plan carries across, so the work is not repeated.

How an itmad audit runs

Stage 1 reviews the HACCP plan, the hazard analysis and the prerequisite programmes, and confirms the scope of products and processes. Stage 2 tests the system on site: monitoring records, the corrective actions taken, calibration, staff practice observed and not merely described, and the condition of the premises.

The certificate cycle

A HACCP certificate from itmad runs for three years. Surveillance audits take place in each of the two intervening years, and recertification is completed before expiry.

Independence

A certification body has to stay separate from the systems it certifies. Under ISO/IEC 17021-1, itmad does not design, implement or consult on an organisation's HACCP system. What itmad offers is the audit, the certification decision, and an optional pre-assessment that shows where the gaps against HACCP lie, leaving the organisation to decide how to close them.

What itmad delivers

• A Stage 1 report setting out readiness gaps ahead of the main audit
• A Stage 2 report with findings tied to objective evidence
• Nonconformities classified by severity, with defined response timescales
• A certificate of registration stating the certified scope and locations
• The certification mark, under the terms of itmad's mark and seal policy
• Annual surveillance audits and reports for the full three-year cycle

Frequently asked questions

What is HACCP?

HACCP is a preventive approach to food safety: identify where in the process a hazard could make the product unsafe, control those points, and prove that the control worked. It replaces end-product testing with control at the steps where contamination happens.

What are the seven HACCP principles?

They are hazard analysis, determining critical control points, setting critical limits, establishing monitoring, establishing corrective action, establishing verification, and keeping documentation and records. A critical control point is one where loss of control means the product is unsafe.

Why do prerequisite programmes matter?

HACCP works only on a foundation of cleaning, pest control, hygiene, water quality, waste management, maintenance, supplier control and training. An audit that finds too many critical control points is usually finding weak prerequisites.

What are the most common HACCP audit findings?

Records completed afterwards in one handwriting, and corrective action recorded without any note of what happened to the affected product, are common. So are critical limits that nobody monitors in practice and uncalibrated thermometers, which invalidate every temperature record they produced.

What is the difference between HACCP and ISO 22000?

HACCP is a method, while ISO 22000 is a management system standard that includes the HACCP principles in a wider framework of leadership, planning, competence and improvement. The HACCP plan carries across to ISO 22000, so the work is not repeated.

How does a HACCP audit work?

itmad audits in two stages. Stage 1 reviews the HACCP plan, the hazard analysis and the prerequisite programmes. Stage 2 tests implementation on site, including monitoring records, corrective actions and calibration.