Prerequisite Programs for HACCP: Clauses That Set the Baseline

What prerequisite programs for HACCP actually do

A Hazard Analysis and Critical Control Point (HACCP) system works only when the plant can reliably control biological, chemical, and physical hazards. Prerequisite programs for HACCP create that foundation by managing the conditions that affect food safety across the whole operation. They are not a separate paperwork exercise; they are the controls that make the HACCP plan workable.

The practical distinction matters. A prerequisite program addresses broad, routine conditions such as sanitation, employee hygiene, equipment maintenance, and pest control. The HACCP plan then identifies specific hazards and establishes critical limits at defined control points. For example, cold storage may be a prerequisite control, while the critical limit for chilled product could be a stated temperature and monitoring frequency.

Regulators and certification assessors expect prerequisite controls to be in place before they accept the rest of the food safety system. The same principle appears in US FDA and USDA-FSIS inspection frameworks, in GB and EU food law, and in Australian and Canadian food safety programs.

The standards and guidance commonly used

There is no single global list of prerequisite programs for HACCP. Most operators work from a combination of regulatory requirements, national codes, and internationally recognized standards.

Codex Alimentarius sets the baseline in General Principles of Food Hygiene, CXC 1-1969. Its Chapter 1 covers good hygiene practices, Chapter 2 covers HACCP principles, and Chapter 3 covers the application of HACCP principles. These documents are widely referenced by export-oriented businesses and by certification assessors.

ISO 22000:2018, Food safety management systems — Requirements for food safety management systems, uses a different structure. It does not create a separate prerequisite program. Instead, Clause 8.2 requires the organization to establish prerequisite programmes, and Clause 8.4 requires it to establish and maintain a process to control hazards. ISO 22002-1:2009, Prerequisite programmes on food safety management, covers the operational and environmental prerequisites for food manufacturing and processing.

ISO/TS 22003:2018 provides auditing guidance for food safety management systems. It includes an Annex F with examples of prerequisite programmes for food manufacturing and processing. Auditors use this material to test whether prerequisite controls are deployed, documented, and effective.

In the United States, the FDA Food Code contains baseline provisions on sanitation and personnel training, while USDA-FSIS applies its own sanitation performance standards and Hazard Analysis and Critical Control Point requirements to meat and poultry establishments. Operations must follow the rules that apply to their product and jurisdiction.

The core prerequisite controls

The exact wording depends on the governing scheme, but the substance is consistent across most systems.

Site and environmental controls

Food and packaging materials should be stored off the floor and away from walls in a way that prevents contamination and allows inspection. Pest control uses a documented monitoring program with receiving logs, trend records, and evidence of corrective action. Drains, floors, ceilings, and lighting should be maintained so the operation can be cleaned and inspected effectively.

Equipment and maintenance

Equipment must be suitable for the product and kept clean, sanitized, and in good repair. Maintenance schedules should cover both routine tasks and breakdown response. A common failure pattern is a preventive maintenance record that exists on paper but does not identify the actual calibration or servicing interval.

Personnel hygiene and training

Supervisors need training in sanitation, allergen handling, personal hygiene, and the correct use of cleaning chemicals. Handwashing facilities should be accessible, supplied, and used as required. Training records should show what was taught, who attended, and when competence was assessed.

Supplier and material control

Incoming materials should be assessed against documented specifications, and supplier approval should consider both food safety performance and traceability. Records should link a received lot to the supplier, the receiving inspection, and the disposition decision.

Cleaning and chemical control

Cleaning and sanitizing procedures should state what is to be removed, which chemical is used, at what concentration, for how long, and how the result is verified. Concentration is a common audit focus. A sanitizer at 200 ppm is not equivalent to one at 50 ppm, and the required range depends on the chemistry and the authority having jurisdiction.

Operational limits, records, and verification

Prerequisite programs need measurable criteria. A statement that the floor is clean is a preference, not a control. A stronger specification defines the frequency, the method, the acceptance criteria, and the action required when the criterion is not met.

Typical records include cleaning schedules, sanitation chemical concentration checks, temperature logs for refrigeration and cooking equipment, calibration certificates, pest-control trend reports, maintenance work orders, receiving inspections, training records, and corrective-action logs.

Every record should identify the responsible person, the date and time, the actual result, and the signature or electronic approval. Verification confirms that the records reflect reality. Supervisors should review logs against production volumes, for example checking that a receiving inspection exists for each delivery.

Corrective action should follow a defined sequence. First, contain the problem and protect the affected product. Second, identify the cause. Third, correct the cause. Fourth, verify that the correction worked. Fifth, document all of it, including the disposition of affected food.

How to build the program without duplicating work

Start by mapping the process from incoming materials through dispatch. For each step, ask what could go wrong before the HACCP analysis begins. That list becomes the candidate prerequisite control set.

Next, classify each control as a regulatory requirement, a customer requirement, a certification requirement, or a company decision. This prevents overbuilding the program and makes later audits easier to prepare.

Then assign an owner and a verification method to every control. Use the same document control system as the HACCP plan so that a single corrective action can address both a prerequisite failure and a CCP deviation.

Finally, test the program through an internal audit and a management review. ISO 22000 requires internal audits at planned intervals and management review, and ISO/TS 22003 provides guidance on audit planning, competence, and reporting. Internal audit findings should feed into corrective action rather than being logged and forgotten.

What assessors look for first

Assessors usually sample the records rather than rely on descriptions. They check whether the documented frequency matches actual practice, whether monitoring results are complete, and whether corrective actions close the loop. Gaps between the written procedure and the observed floor are the most common source of nonconformity.

A well-run prerequisite program also makes the HACCP plan more credible. When the receiving area, sanitation schedule, and calibration records are under control, the team can spend its hazard analysis effort on the steps that genuinely determine product safety.

Key takeaways

Prerequisite programs for HACCP are the operational controls that make hazard analysis meaningful, not an administrative appendix. Use ISO 22000 Clause 8.2 and ISO 22002-1 to structure the system, and use Codex CXC 1-1969 as the international baseline for good hygiene practice. Give every control a measurable criterion, an owner, a record, and a verification method. Keep the prerequisite program, the HACCP plan, and corrective action in one connected document system so that failures are contained quickly and evidence is easy to produce during an audit.

Frequently asked questions

Are prerequisite programs part of HACCP?

Prerequisite programs are a separate set of controls, but they are a required foundation for a HACCP system. ISO 22000 treats them as part of the food safety management system, and Codex places good hygiene practice before HACCP principles in its framework.

Does ISO 22000 require prerequisite programs?

Yes. ISO 22000 Clause 8.2 requires the organization to establish prerequisite programmes, and Clause 8.4 requires a process for controlling hazards across the food safety management system.

Which documents should a prerequisite program include?

A typical set includes a sanitation and cleaning program, a pest control program, a maintenance and calibration program, a personnel hygiene and training program, a supplier approval procedure, and a chemical control procedure. Each should specify responsibilities, frequencies, limits, records, and corrective actions.

How often should prerequisite checks be performed?

The interval depends on the control and the risk. Sanitizer concentration may need checking with every use or each shift, while pest monitoring may be weekly or monthly. The governing code, customer specification, and the plant's own validation should set the frequency, and the records must show that the stated frequency was met.