HACCP Consultancy Services: Why Your Prerequisite Programmes Do More Work Than Your HACCP Plan

Food safety systems get built in a particular order. HACCP first, because it feels like the technical core, and prerequisite programmes afterwards, because they feel like housekeeping.

That order is backwards, and it shows up in audits and in incidents. If you’re comparing HACCP consultancy services for a food factory in India, Nigeria, Kenya, Oman or the Philippines, ask where the consultant starts. The answer tells you a lot.

Where do food safety incidents actually come from?

Recall data points to the environment around your critical control points.

Undeclared allergens are the leading cause of food recalls in Australia and New Zealand, and they topped FDA recalls in the first half of 2026. Allergen errors, cleaning, changeover, maintenance, pest control and suppliers all sit in prerequisite territory.

Food Standards Australia New Zealand found undeclared allergens caused 48 percent of recalls from 2020 to 2024, followed by microbial contamination at 20 percent. In New Zealand, undeclared allergens caused 26 of 57 consumer-level recalls in 2025. In the first half of 2026, undeclared allergens were the leading cause of FDA food recalls, with 105 events. Source: https://afgc.org.au/newsletter_post/fsanz-releases-latest-statistics-on-food-recalls/ 

In Australia, the most common root cause of allergen recalls was errors during packaging, with accidental cross-contamination and supplier verification issues also significant. None of those is a pasteuriser failing. Source: https://www.foodstandards.gov.au/food-recalls/recallstats 

The CCPs tend to work, because they’re monitored continuously, recorded, and everyone knows they matter. It’s the environment around them that drifts.

What do ISO 22000 and ISO 22002-1 require for prerequisites?

ISO 22000:2018 clause 8.2 requires prerequisite programmes, and clause 8.8 requires verification of them. ISO 22002-1:2025 and ISO 22002-100:2025 now set the detailed food-manufacturing requirements, replacing ISO/TS 22002-1:2009. Construction details, such as drainage, count directly.

Clause 8.2.4 asks you to consider construction and layout of buildings and associated utilities when setting up prerequisite programmes. ISO published the 2025 update to the 22002 series on 29 July 2025. Under ISO 22002-1:2025, drains can’t pass over processing lines, and drainage can’t flow from contaminated to clean areas. 

Those are construction problems, and they get deferred. An ISO 22000 consultant will walk your site against them before the auditor does.

What does a strong prerequisite programme look like?

A strong programme is specific, verified and owned. Where it controls a significant hazard, it’s also validated. “Clean daily” isn’t specific. The method, chemical, concentration, contact time, person, frequency and verification are.

Specific. Write the details down. Cleaning that doesn’t name the chemical, concentration, and contact time can’t be checked.

Verified. Somebody checks the cleaning was effective, not just that it happened. Visual inspection works, and analytical checks do too where the hazard warrants it. A pasteuriser produces a chart. A cleaning programme produces a signature, and a signature proves that somebody signed.

Owned. A named person is accountable for each programme. Distributed across everyone usually means nobody.

Validated. If your allergen changeover cleaning is the control for an allergen hazard, you need evidence it removes the allergen, not just that the procedure is followed.

What evidence do you have that your allergen changeover works?

Ask that one question if you handle allergens. You need evidence the changeover works, not that it’s followed. That means analytical results, taken where product restarts, measured against a defined acceptance level. In our experience, a minority of sites can answer, and it’s the single most likely source of a serious incident.

Check each rule. An FDA training deck says the US preventive controls rule doesn’t require validation of allergen and sanitation controls. FSSC 22000 asks for a documented allergen management plan, with validation and verification of the control measures. Whatever the law says, a buyer or a recall investigator will ask for evidence. 

Which industries need strong prerequisite programmes most?

Any site that handles allergens, ready-to-eat food or shared lines needs them most: bakeries, dairy, confectionery, snack and sauce producers, meat and seafood processors, and contract packers. Importers and distributors need them too, because storage, relabelling and repacking create their own allergen and cross-contact risks.

The pattern isn’t local. US preventive controls rules build on a foundation of good manufacturing practices and prerequisite programmes, and include allergen and sanitation controls. HACCP consultants in Oman or an ISO consultant in Singapore will start with the same walk-through as a team in New Zealand or Nigeria. 

How do HACCP consultants play a main role?

HACCP consultants turn the standard into your site’s reality. They walk the plant, test whether prerequisite programmes are specific and verified, run the hazard analysis and prepare you for audits. ISO certification consultants then link the system to ISO 22000. Neither issues a HACCP certificate or an ISO 22000 certificate.

The benefit of good HACCP consulting services is mostly avoided rework. You find the drain that doesn’t drain before an auditor does. You also learn which controls need evidence and which only need a record.

What advice do MSCi’s HACCP consultants give about your HACCP certificate?

Our advice is practical. Most weak systems have a strong plan and a weak plant.

• Start on the shop floor, not with the plan. Walk the drains, wall-to-floor junctions and airflow before you write anything.

• Name an owner for every programme.

• Verify effectiveness, not activity. Ask what you’d see if the cleaning had failed.

• Test your allergen changeover with analytical results at restart.

• Budget for construction fixes early. They take the longest and cost the most.

• Treat the HACCP certificate as evidence, not a guarantee. It shows a system was audited at a time, for a scope.

How can HACCP consultancy services help your business?

MSC Incorporation (MSCi) is an ISO consultancy with 40+ years of experience in ISO consultation. Our HACCP consultancy services cover site walk-throughs, hazard analysis, prerequisite programme design, allergen controls, training and internal audits. We prepare your company for the audit. An independent accredited certification body issues the certificate, not MSCi.

5. FAQ

What do HACCP consultants actually do?

They help you identify hazards, design controls, and prove they work. A good consultant starts on the plant floor and tests your prerequisite programmes before building the HACCP plan.

How do I choose HACCP consulting services?

Ask who will walk your site, how they test prerequisite programmes, and whether they say plainly that they don’t issue the certificate. Be careful with anyone who promises a certificate date before seeing the plant.

Is there a HACCP readiness checklist?

Start with five questions. Is each prerequisite programme specific? Is its effectiveness verified? Does each have a named owner? Do you have evidence your allergen changeover works? Have you fixed known construction problems? Any ISO readiness checklist should include these before the audit. HACCP readiness checklist: https://mscincorporation.com/iso-readiness-checklist/ 

What do ISO 22000 certification consultants add on top of HACCP?

They connect HACCP to a full management system, with leadership, internal audit, and improvement. ISO 22000 certification consultants prepare you for that audit.

Do HACCP consultants in Oman or Kenya follow local rules?

HACCP principles come from Codex and are global. Local authorities set their own legal requirements, so ask any adviser, including HACCP consultancy services in Kenya, how they check yours.

Does a HACCP certificate mean my food is safe?

No. It shows an auditor found your system met the requirements at that time, for a defined scope. Safety depends on running the system every day.