HACCP Food Safety System Consultancy

The documents HACCP asks you to have

A standard does not ask for a library. It asks for evidence that you decide things deliberately and can show how. This is what an auditor will look for on a HACCP system — specific to the standard first, then the records every management system needs.

• Roles, responsibilities and authorities, written down and known to the people holding them
• Competence and training records for anyone whose work affects the system
• Internal audit programme, audit reports and the findings raised
• Management review minutes, showing what was decided rather than that a meeting happened
• Nonconformity and corrective action records, with root cause and effectiveness checked
• Document and record control — what is current, who approved it, how long it is kept

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor will find the gap between the two. Our test is whether the person who has to do the job recognises their own work in it.

How to start

Beginning well is mostly a matter of sequence. Almost everything that goes wrong in a HACCP project can be traced to documentation written before anybody established what the organisation already does.

• Establish what is being asked, and by whom. A customer, a tender, a regulator and a parent company each want something slightly different, and the answer decides the scope.
• Fix the scope in writing — which sites, which activities, which products. Scope drives cost more than any other single decision, and a scope widened after the audit is booked is re-work.
• Have a gap assessment done against HACCP, on evidence rather than on a questionnaire. You can score yourself first with the free readiness checklist on this site; the expert assessment is what turns that score into a plan.
• Appoint somebody internally who owns it. Not necessarily full time, but named, and senior enough to get decisions made.
• Document only what the gap assessment showed is missing, in the words the people doing the work already use.
• Train, then run the system long enough to generate real records. Three months of genuine records cannot be produced in a fortnight, and this is the step organisations try hardest to skip.
• Audit yourself, hold a management review that actually decides something, then book the certification audit.

How to choose a certification body

Choosing the body is the one decision in a HACCP project that you cannot delegate to us, and the one where the cheapest answer is most often the wrong one.

Four things decide it. Accreditation: the body should be accredited for your standard and your industry by a recognised accreditation body, and the certificate should carry that mark. Sector competence: an auditor who has audited your industry asks better questions and wastes less of your time. Recognition: ask the customer or tender that triggered this whether they name particular bodies. Cost and diary: audit days are set by your headcount and scope, so quotes should be comparable — and if one is far cheaper, look at the audit days before the price.

Among the bodies most widely recognised, in no particular order: BSI, TÜV, SGS, SIS Certifications, Intertek, DNV, BVQI.

MSCi works with a pool of accredited certification bodies rather than one. That is a commercial advantage to you, and worth being plain about why: bodies differ in audit-day rates, in travel cost to your location, in how quickly they can get an auditor to you, and in which sectors they are accredited for. Having several to approach means we can put your scope in front of the ones that fit it and bring you back comparable quotes, instead of you taking the first number offered.

What it does not change is the audit. We cannot influence a finding and would not try — the body's independence is the entire value of the certificate, and any consultancy offering otherwise is selling you something worthless. We prepare you so that the audit is uneventful, and the body decides.

Note also that whoever builds your management system must not be the body that certifies it. Accreditation rules prohibit it, which is why we prepare and never certify.

What HACCP is usually taken with

Few organisations stop at one standard, and the second costs far less than the first — the clauses that take longest are the ones they share. Where HACCP sits next to something else, this is what carries over.

• ISO 22000 consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.
• FSSC 22000 consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.
• BRC consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.

Certified to more than one, you hold a single management system with one set of objectives, one internal audit programme and one management review — audited in one visit. Run as separate systems they cost roughly twice as much to keep, which is the usual reason a second certificate feels harder than it was.

Seven principles, applied to your actual process

HACCP is a systematic method for identifying food safety hazards and controlling them at the points in the process where control genuinely matters. It rests on seven principles: hazard analysis, determining critical control points, setting critical limits, monitoring, corrective action, verification and record keeping. It came out of Codex Alimentarius and now sits underneath almost every food safety regulation and scheme in use. It is a method rather than a management system, which is why it is usually paired with one.

It is asked for by retailers and food service chains during supplier approval, by export buyers, by regulators inspecting manufacturing and catering premises, and by hotel and hospital procurement teams. Processors, packers, cold stores, transporters, central kitchens, bakeries, dairies, spice and grain handlers and packaging suppliers all fall within scope. If a scheme certificate is coming later, the study has to be right first, because everything else is built directly on top of the hazard analysis.

Walking the line, from receipt to dispatch

We start on the floor, not in the office. Product description and intended use first, then a process flow diagram drawn by walking the line and verified against what operators actually do rather than what the drawing says. Hazard analysis follows for biological, chemical, physical and allergen hazards at every step, including hazards introduced by rework, maintenance, and the movement of people and waste through the building. Prerequisite programmes are examined at the same time, since a study resting on weak hygiene control will not hold.

Critical control points are then determined using a decision method your team can defend, and limits are set from published science and validation data rather than round numbers that feel comfortable. We design monitoring that is realistic for the shift pattern, write corrective actions naming who acts and what happens to affected product, and set verification through calibration, sampling and record review. Training happens at the line, with the people who will be filling in the checks.

A live plan, not a folder on a shelf

The deliverable is a HACCP plan with its hazard analysis, control point determination, monitoring and verification schedules, corrective action procedures and the record formats needed to run it, along with the prerequisite programmes underneath. MSCi carries out the study and delivers the training directly. Where third party recognition is wanted, an independent certification body audits and certifies against whichever scheme you choose. We also run the first internal verification audit so the team sees how it gets tested.

What changes on site is usually visible within weeks. Checks that were done from habit become checks with a limit and a consequence, so a reading outside range triggers action instead of a shrug. Customer complaints get traced back to a step rather than argued over in a meeting. And when a buyer's auditor arrives unannounced, the records exist for the days they choose to look at, which is the only test that ever counts.