The 7 Principles of HACCP
Explained with Kenyan Food Industry Examples

1. What are the 7 principles and why do they matter?

The 7 principles of HACCP are the operational backbone of every food safety management system in the world. They were formally established by the Codex Alimentarius Commission — the joint FAO/WHO body that sets international food standards — in the General Principles of Food Hygiene (CXC 1-1969), most recently revised in 2023. As Kenya participates in Codex through KEBS as its national contact point, these principles are the direct reference for Kenyan food safety regulation.

The principles are not abstract theory. They are a practical sequence of decisions and actions that transform the way a food business thinks about safety — from testing products at the end of a production line hoping for the best, to systematically preventing hazards from occurring in the first place.

2. Before you start: prerequisite programmes

The Codex HACCP guidelines are clear on this point: HACCP cannot work without prerequisite programmes (PRPs) in place first. PRPs are the foundational hygiene and operational controls that create the environment in which HACCP can function — Good Manufacturing Practices (GMP), pest control, cleaning and sanitation, water quality management, waste disposal, and staff hygiene training.

A HACCP plan built on a facility with poor GMP is like building on sand. The 7 principles tell you where the critical risks are and how to control them — but if your facility has cockroach infestations, untrained staff, or contaminated water, no HACCP plan will keep your product safe.

3. Principle 1 — Conduct a Hazard Analysis

The first principle is the foundation of everything that follows. A hazard analysis requires you to systematically go through every step of your production process — from receiving raw materials through to dispatch of finished product — and identify all potential food safety hazards at each step.

HACCP defines a hazard as any biological, chemical, or physical agent in food that has the potential to cause an adverse health effect. Hazards fall into three categories:

The hazard analysis must consider the significance of each identified hazard — assessing its likelihood of occurrence and the severity of harm it would cause if it reached a consumer. Only hazards that are both reasonably likely to occur and capable of causing significant harm are carried forward in the HACCP plan.

4. Principle 2 — Identify Critical Control Points

A Critical Control Point (CCP) is a specific step in the production process where a control measure can be applied that is essential to prevent or eliminate a food safety hazard, or reduce it to an acceptable level. The word "essential" is key — not every process step is a CCP, only those where loss of control creates an unacceptable food safety risk that cannot be corrected at a later stage.

The Codex HACCP guidelines (2023 revision) introduced new tools for determining CCPs, moving beyond the traditional decision tree as the sole method. The core questions remain the same:

• Is there a control measure for this hazard at this step?
• Is this step designed specifically to eliminate or reduce the hazard to an acceptable level?
• Could contamination occur at or increase beyond an acceptable level at this step?
• Will a subsequent step eliminate or reduce the hazard to an acceptable level?

If the answer to the last question is no — there is no later step that will correct the problem — the step is likely a CCP. If a hazard is identified but no CCP can be found to control it, a process redesign should be considered. This is a key point from the Codex guidelines: you cannot simply accept an uncontrolled significant hazard.

5. Principle 3 — Establish Critical Limits

Every CCP must have at least one measurable critical limit — a criterion that separates acceptable from unacceptable at that control point. Critical limits are not targets or guidelines — they are hard boundaries. If a critical limit is exceeded, the product is presumed unsafe until it can be verified otherwise.

Critical limits must be:

• Measurable — a temperature, a time, a pH level, a water activity value, an aflatoxin concentration in ppb
• Science-based — derived from scientific evidence, regulatory standards, or validated industry practice
• Specific to the hazard — the limit must be set at the level that separates safe from unsafe for the particular hazard being controlled

6. Principle 4 — Establish Monitoring Procedures

Once critical limits are established, you need a real-time system to monitor them. Monitoring is the scheduled measurement or observation at a CCP to assess whether the step is under control — within its critical limits. Good monitoring answers four questions:

• What is being measured? (The specific parameter — temperature, aflatoxin level, metal detector sensitivity)
• How is it being measured? (The specific method, equipment, and calibration requirements)
• How often? (The monitoring frequency — each batch, every 30 minutes, every hour)
• Who? (The named, trained individual responsible for monitoring)

Monitoring is the daily operational heartbeat of HACCP. Without consistent, documented monitoring, you cannot demonstrate control — and you cannot detect a deviation before it causes harm. The Codex guidelines note that monitoring systems should ideally provide results quickly enough to allow corrective action to be taken before the product is used or consumed.

7. Principle 5 — Establish Corrective Actions

Despite best efforts, critical limits will sometimes be exceeded. A power cut drops pasteurisation temperature. A test piece fails to trigger the metal detector. A grain consignment tests above the aflatoxin limit. What happens next must be pre-planned, not improvised.

Corrective actions are the pre-defined procedures that are taken when monitoring indicates a deviation from a critical limit. Effective corrective actions must:

• Correct the problem — address the root cause of the deviation, not just the symptom
• Control the affected product — isolate, hold, and assess any product produced while the CCP was out of control
• Restore control — verify that the CCP is back under control before production resumes
• Document everything — the deviation, the corrective action taken, the disposition of affected product, and who authorised the decision

The corrective action must be completed by a trained, designated person — not improvised by whoever is nearest the problem at the time.

8. Principle 6 — Establish Verification Procedures

Verification answers a different question from monitoring. Where monitoring asks "is this CCP under control right now?", verification asks "is the HACCP system as a whole actually working as intended?"

Verification activities confirm that the HACCP plan is correctly implemented, that monitoring is being done as specified, that corrective actions are effective, and that critical limits are set at the right level. Verification typically includes:

• Equipment calibration — periodic independent calibration of all monitoring equipment against certified reference standards
• Product testing — periodic microbiological, chemical, or physical testing of finished product to confirm the HACCP system is delivering safe output
• Internal HACCP audits — systematic review of monitoring records, corrective action logs, and operational compliance with the HACCP plan
• HACCP plan review — formal review of the entire plan whenever there is a change in product, process, raw materials, equipment, intended use, or consumer information

9. Principle 7 — Establish Record-Keeping and Documentation

The seventh principle is often underestimated — but it is what transforms HACCP from a concept into a system that can be audited, defended, and continuously improved. Documentation provides the evidence that your HACCP system is real and functioning. Without records, a HACCP plan is just a document.

The minimum documentation required for a HACCP system includes:

• The HACCP plan itself — the written document describing the HACCP team, product, process flow diagram, hazard analysis, CCPs, critical limits, monitoring procedures, corrective actions, and verification activities
• CCP monitoring logs — dated, signed records of every monitoring measurement at every CCP
• Corrective action records — documentation of every deviation, including the corrective action taken and the disposition of affected product
• Calibration records — certificates and logs for all monitoring equipment
• Verification records — internal audit reports, laboratory results, equipment calibration logs, HACCP plan review records
• Training records — evidence that all staff involved in HACCP have been trained appropriately

10. Putting the 7 principles together: a worked example

To see how the 7 principles work as an integrated system — not just as separate steps — consider a fresh produce packhouse in the Rift Valley packing French beans for EU export.

Principle 6 (verification) confirms through quarterly independent pesticide residue testing that the monitoring system is catching violations before product is dispatched. Principle 7 (records) means every delivery, every pre-harvest interval check, every residue test result, and every rejection is documented — so when the EU border inspection queries a shipment, DESMA's client has a complete evidence trail to produce immediately.

11. Common HACCP mistakes Kenyan food businesses make

Based on the DESMA Consult team's experience working with Kenyan food manufacturers, processors, packhouses, and cooperatives, these are the most common HACCP implementation failures:

• Too many CCPs. Some HACCP teams identify every process step as a CCP, which makes the system unworkable. A CCP must be a step where control is essential and where a later step cannot correct a deviation. Most operations have between 2 and 8 genuine CCPs.
• Critical limits not validated. Setting a temperature of 70°C as a critical limit because it sounds about right — without scientific validation that 70°C achieves the required log reduction of the target pathogen — is a system weakness that will not survive external audit.
• Monitoring done but not recorded. A production manager who checks the pasteuriser temperature every hour but records it at the end of the shift from memory is not running a HACCP system. Records must be made at the time of observation.
• Corrective actions that treat symptoms not causes. If the metal detector keeps failing the test piece check, rejecting the products and resetting the detector is not a corrective action — it is a band-aid. The root cause (aging detector, worn components, interference) must be identified and addressed.
• HACCP plan never reviewed. A HACCP plan written in 2020 that has never been updated, despite new suppliers, new products, and a new production line, is an obsolete plan. It will not reflect current risks and will fail verification.
• No management commitment. This is cited by the Codex guidelines as essential. A HACCP team without management backing — time, resources, authority to reject product — will produce a document that does not translate to practice on the floor.

12. How to get started with the 7 principles in your Kenyan food business

If you are ready to implement HACCP — or improve a system that already exists — the recommended sequence is:

1. Train your HACCP team leader. The person leading your HACCP implementation must understand all 7 principles and how to apply them. DESMA Learn's free HACCP Fundamentals course is designed for exactly this purpose.
2. Assemble a cross-functional HACCP team. Include production, quality, engineering/maintenance, and a member of senior management. HACCP cannot be a solo exercise.
3. Write your product and process description. Document your product, its intended use and consumer, its shelf life, storage and distribution conditions, and draw a complete process flow diagram.
4. Work through the hazard analysis methodically. Use a structured hazard analysis worksheet — go through every process step, list every potential hazard, assess significance, and document your reasoning.
5. Apply the decision questions to identify CCPs. Be rigorous. Only identify a step as a CCP if control at that step is truly essential and no later step can correct a deviation.
6. Set evidence-based critical limits. Reference Kenyan regulatory standards (KEBS, KDB, AFA) and your buyers' requirements. Where scientific evidence is needed, consult the relevant Codex guidelines or engage DESMA Consult.
7. Build simple, realistic monitoring and corrective action systems. The system must be workable by the actual people on the production floor — not just in theory.
8. Create your records system before you go live. Design your monitoring logs, corrective action forms, and calibration records before implementation begins.
9. Implement, train all relevant staff, and conduct a 90-day review.