A Signed HACCP Plan Does Not Mean Your CCPs Are Under Control: Why Food Factories Must Prove It on Every Shift

By Isaac Muthui, CEO, Tamalaki Business Network Ltd. Originally published at factoraerp.com.

Most food factories that have been through a KEBS, buyer or certification audit own a HACCP plan. It sits in a ring binder in the QA office: the team list, the flow diagram, the hazard analysis table and, on one page, the critical control points with their limits. It was signed off carefully. The question an auditor, a customer or an investigator will ask is a different one: what happened at each of those control points on the night shift last Tuesday, who checked it, what did they do when a reading was wrong, and which batches were made while it was wrong?

That is where many plants struggle. The plan describes control. The monitoring records are supposed to prove it. In between sit a pasteuriser chart nobody initialled, a metal detector check that was "done but not written", a sieve inspection recorded at the end of the shift for the whole shift, and a corrective action that lives in somebody's memory.

This HACCP CCP monitoring checklist is written for dairies, millers, juice, bakery, meat and snack processors and any Kenyan or East African food factory that has a HACCP plan, or is building one. It does not replace your HACCP team, your KEBS product standards or the guidance of your competent authority. It sets out ten practical checks that turn the CCP page of your plan into something that runs, and can be shown to run, on every shift.

What the standards actually say

The Codex HACCP principles. The Codex General Principles of Food Hygiene, CXC 1-1969, sets out HACCP as twelve steps, the last seven being the seven principles. On critical limits, it says they "establish whether a CCP is in control" and "should be measurable or observable", and that "a deviation from the critical limit indicates that it is likely that unsafe food has been produced" (section 19.8). On monitoring, it says the method and frequency "should be capable of timely detection of any failure to remain within critical limits, to allow timely isolation and evaluation of the product", that "where possible, monitoring of CCPs should be continuous", and that if monitoring is not continuous, its frequency should "limit the amount of product impacted by a deviation" (19.9). Records of CCP monitoring "should be signed or initialled by the person performing the monitoring and should also report the results and timing of the performed activity". Data from monitoring should be evaluated "by a designated person with knowledge and authority to carry out corrective actions".

On corrective action, Codex is equally direct: "specific written corrective actions should be developed for each CCP", and when a deviation occurs and monitoring was not continuous, the business "should determine what product may have been impacted by the deviation" (19.10). Actions should include "segregating the affected product and analysing its safety to ensure proper disposition", and a root cause analysis should be carried out where possible. On verification, it says it "should be carried out by someone other than the person who is responsible for performing the monitoring and corrective actions", and lists record review, calibration, observation, sampling and audits as examples (19.11.2). Any change with a potential impact on food safety "should require a review of the HACCP system".

The US reference guidance. The HACCP Principles and Application Guidelines adopted in 1997 by the US National Advisory Committee on Microbiological Criteria for Foods and published by the FDA are still one of the clearest practical texts. They say "continuous monitoring is always preferred when feasible", that "monitoring equipment must be carefully calibrated for accuracy", and that "all records and documents associated with CCP monitoring should be dated and signed or initialed by the person doing the monitoring". They note that microbiological tests "are seldom effective for monitoring" because of the time they take, which is why the safety of pasteurised milk "is based upon measurements of time and temperature of heating rather than testing the heated milk". They also warn that "critical limits should not be confused with operational limits", and give an example verification schedule that includes a monthly review of monitoring and corrective action records and a yearly comprehensive verification.

The East African code. EAS 39:2001, the East African code of practice for hygiene in the food and drink manufacturing industry, says that "on their own, inspection and testing of food products is insufficient to assure that food is free from contamination", and that the HACCP system "may be used" to assess what is required. It describes critical control points as "the vital key points in the process that shall be controlled to safeguard the health of the consumer", and names pasteurisation, cooking, the exclusion of foreign bodies and the cold chain as examples. Its records clause (14.3.3) lists "a record of all critical parameters and tests carried out to assure the safety of the finished product", and the calibration status of the devices used to assure safety.

Kenya. For dairy, the Dairy Industry (Dairy Produce Safety) Regulations, 2021 define pasteurisation as "heating every particle of milk or dairy produce in properly designed and correctly operated equipment in accordance with the relevant standard", and list pasteurisation, aseptic processing, retort sterilisation and refrigeration after pasteurisation as the permitted ways to destroy or deactivate micro-organisms (regulation 7). "Every particle" is exactly why time and temperature at the pasteuriser are monitored, not assumed. More broadly, the Food and Feed Safety Control Co-ordination Act, 2026 has established an Office of the Food Safety Controller to coordinate the many institutions that regulate food safety in Kenya, including audit and verification of enforcement and compliance and a national pool of food safety data. Factories that can already show their CCP records, batch by batch, will find that shift far easier.

Why a HACCP plan on paper is not enough

A HACCP plan is a design. It says which steps matter, what "safe" looks like at each one, and what should happen when something goes wrong. Whether the plant is actually under control is decided on the floor, by people working against output targets, on night shifts, during breakdowns and changeovers.

The common gaps are predictable. The flow diagram no longer matches the line because a tank, a sieve or a bypass was added after the plan was written. Critical limits are copied from a template and mixed up with operating targets. Monitoring is written at the end of the shift instead of when it was done. A reading outside the limit is corrected, and the product made during the deviation is never identified. And the person who checks the records is the same person who filled them in. None of these show up in the binder. All of them show up in an audit, a complaint or a recall.

The 10-step HACCP CCP monitoring checklist

1. Keep a CCP register that matches the floor today

List every CCP in one register: the process step, the hazard it controls, the control measure, the line or equipment, and the products that pass through it. Typical examples in food plants are pasteurisation, cooking, metal detection, sieving or magnets, and chilled storage, but yours must come from your own hazard analysis.
Walk the line with the flow diagram at least once a year and after any change. Codex and the FDA guidance both ask for an on-site check that the diagram is accurate. New equipment, a bypass valve or a rework route can create a hazard the plan does not cover.
Mark which products and lines each CCP applies to, so nobody has to guess whether a new product is covered.

2. Write critical limits that are measurable, validated and separate from operating targets

For each CCP, write the critical limit as a number or an observable condition: minimum temperature and holding time, maximum belt speed, the test pieces a metal detector must reject, sieve mesh size and condition.
Record where each limit comes from: a regulation or standard, scientific literature, a validation study or the equipment manufacturer's data. Codex allows limits from these sources but says they must "fully apply" to your operation.
Keep operating targets separate. If the pasteuriser is run slightly above its critical temperature to give a margin, write both values, so an operator knows the difference between "adjust" and "stop and hold".

3. Define the method, frequency and person for every CCP

For each CCP, write how it is monitored (chart recorder, probe, test pieces, visual check), how often, and by whom by job title, not by name alone.
Set the frequency from the risk and from how much product you are prepared to put at risk. If you check the metal detector every two hours, a failure can affect up to two hours of product. Codex says frequency should "limit the amount of product impacted by a deviation".
Train each monitor in the method, the limit and what to do when a reading is wrong, and keep the training record. The FDA guidance says the people who monitor CCPs must also "immediately report a process or product that does not meet critical limits".

4. Calibrate every instrument that monitors a CCP

Keep every CCP instrument on the calibration register: thermometers and chart recorders on pasteurisers and cookers, flow meters, timers, pH meters, metal detectors and checkweighers where they are CCP controls.
Check them on a schedule and before use where needed, and calibrate against a traceable reference. EAS 39 asks for records of calibration status for every device used to assure food safety. Our calibration checklist covers the routine.
When an instrument fails a check, treat the product monitored since its last good check as potentially affected until someone has assessed it.

5. Monitor continuously where you can, and act on trends before the limit

Use continuous recording wherever the parameter allows it: time and temperature on pasteurisers, cookers and cold rooms, and automatic diversion valves where fitted. Both Codex and the FDA guidance prefer continuous monitoring when it is feasible.
Where monitoring is periodic, such as metal detector test pieces, sieve checks or pH, make the check at fixed times and record the exact time.
Teach operators to act on a trend. Codex says process adjustments "should be made when monitoring results indicate a trend towards a deviation" and "before a deviation occurs". A pasteuriser drifting down towards its limit is a maintenance call, not a line on a chart.

6. Record at the time it happens, signed, with no blanks

Record each check at the moment it is made, with the date, time, reading and the initials of the person who made it. Codex and the FDA guidance both require CCP records to be signed or initialled.
Treat a blank as a failure. A missing reading means you cannot show the CCP was under control for that period, and the product made during it should be assessed.
Do not allow rewriting. Mistakes are crossed out once, initialled and corrected, so the original stays readable. Charts from recorders are kept, dated and linked to the batch.

7. Write the corrective action for every CCP before you need it

For each CCP, write in advance what happens when a limit is missed: stop or divert, who is called, how the cause is found and fixed, and how the product is handled. The FDA guidance asks that the plan specify what is done, who is responsible and that a record is kept.
Identify the product affected since the last good check and put it on hold immediately, so it cannot be packed, mixed or dispatched until a decision is made. Our QA hold checklist covers how to make a hold stick.
Record the disposition and who decided: release after assessment, reprocess, divert to another use or destroy. Codex mentions each of these options. Then record the root cause and the fix.

8. Tie every CCP record to a batch or lot

Every monitoring record should carry the batch or lot numbers that passed the CCP during that period, or a time range that can be matched to the production record without guesswork.
Make sure the link works in both directions: from a batch to all its CCP records, and from a deviation to every batch it touched, including batches already in the warehouse or with customers.
Test the link when you run a mock recall. If you cannot pull the pasteuriser chart and metal detector checks for a batch in minutes, the records exist but the control cannot be proved.

9. Verify with someone other than the person who monitored

Have a supervisor or QA person review CCP records every day or every shift, before the product is released, and sign the review. Codex says verification should be done by someone other than the person responsible for monitoring and corrective action.
Set a verification schedule. The FDA guidance gives an example that includes a monthly review of monitoring and corrective action records by QA and a yearly comprehensive verification of the whole HACCP system by someone independent of the team that wrote it.
Look for patterns, not just compliance: the same CCP drifting on the same shift, a corrective action that keeps repeating, or checks recorded at suspiciously round times.

10. Review the plan whenever something changes, and keep the prerequisites strong

Review the HACCP plan when you add a product, change a recipe, supplier, packaging or equipment, move a line, after a deviation you did not expect, and at least once a year. Codex says any change with a potential impact on food safety should trigger a review and, where needed, revalidation.
Remember that HACCP sits on top of the basics. The FDA guidance lists prerequisite programmes such as supplier control, cleaning and sanitation, personal hygiene, pest control, glass control, calibration and traceability. If these are weak, your CCPs will be overloaded. Our checklists on cleaning and sanitation, personal hygiene, pest control, foreign body control, allergen control and cold chain temperature monitoring cover the most common ones.
Keep the old versions of the plan, with the date each version applied, so you can show which rules were in force when any batch was made.

The daily CCP record

At the end of each shift, the CCP records for each line should let a supervisor answer five questions without searching:

Question	What the record should show
Was every CCP checked as planned?	Every scheduled check present, with time, reading and initials; no blanks
Were all readings within the critical limits?	Each reading against its limit, deviations clearly flagged
What happened after each deviation?	Product held, cause, fix, disposition and who decided
Which batches passed each CCP?	Batch or lot numbers, or time ranges linked to production
Has someone else reviewed it?	Reviewer's name, time and signature before release

If any answer is "I would have to ask the operator", the shift is not yet closed.

Habits that make CCP monitoring stick

Put the limit on the form. Every monitoring sheet or screen shows the critical limit next to the box where the reading goes, so the operator never has to remember it.
Make stopping safe. Operators must be able to stop or divert at a CCP without being blamed for lost output. If people fear the consequences, deviations go unrecorded.
Review before release. No batch leaves the warehouse until its CCP records have been reviewed and signed. Our finished goods dispatch checklist builds this into the loading routine.
Talk about deviations openly. A short weekly look at CCP deviations and corrective actions, with production and maintenance in the room, does more than an annual audit.
Keep records long enough. Keep CCP records at least for the shelf life of the product, plus any period required by your regulator, customers or certification scheme.

Where an ERP helps

Most HACCP failures are not failures of knowledge. They are failures of connection: the reading is on a chart, the batch is in a production book, the hold is in an email and the decision is in somebody's head.

FactoraERP tracks production batches and lots, stock status including QA holds, and non-conformance records with owners and closing dates. A CCP deviation can be logged as a non-conformance against the batches it affected, those batches placed on hold so they cannot be dispatched, and the disposition recorded with the name of the person who decided. That puts the CCP record next to the batch and stock record instead of in a separate binder. See factoraerp.com.

Free download: eTIMS readiness checklist for factories

Kenyan manufacturers increasingly need their operational records, stock records and invoices to tell one consistent story. If you want a free eTIMS readiness checklist for factories, sign up for the FactoraERP Insights newsletter at https://isaacmuthui.substack.com. You will get practical operations notes for food and agro manufacturers. No spam; unsubscribe anytime. For background, see our guide to eTIMS for food and agro manufacturers.

FAQ

What should a HACCP CCP monitoring checklist include?
A current CCP register that matches the line, measurable and validated critical limits, a defined monitoring method, frequency and person for each CCP, calibrated instruments, continuous monitoring where possible, signed records made at the time, written corrective actions with product holds, a link from every record to the batches affected, independent verification and a review whenever something changes.

What is the difference between a critical limit and an operating limit?
A critical limit separates safe from potentially unsafe product at a CCP. An operating limit is a tighter target set for other reasons, such as quality or a safety margin. The FDA's HACCP guidelines warn that the two should not be confused. Missing an operating limit means adjust; missing a critical limit means take corrective action and assess the product.

How often should CCPs be monitored?
Codex says monitoring should be continuous where possible. Where it is not, the frequency should be high enough to detect a deviation in time and to limit the amount of product affected. In practice, set the frequency by asking how much product you would have to hold if a check failed.

Who should sign CCP monitoring records?
The person who performed the check should sign or initial each record, with the time and result, as both Codex and the FDA guidance require. A different person, usually a supervisor or QA, should then review and sign the records as verification before release.

What should happen when a CCP goes out of its critical limit?
Follow the written corrective action for that CCP: bring the process back under control, identify and hold all product made since the last good check, assess its safety, decide whether to release, reprocess, divert or destroy it, record who decided and why, and find and fix the root cause.

Is HACCP mandatory for food factories in Kenya?
Requirements depend on your sector, product, customers and certification scheme, so check with KEBS, your competent authority and your buyers. EAS 39 describes HACCP as the way to assess what is needed to assure food safety, and buyers and certification schemes commonly expect a working HACCP system with monitoring records.

Isaac Muthui, CEO, Tamalaki Business Network Ltd