HACCP — setting up the system and preparing for certification
What is HACCP?
HACCP is a system for managing food safety hazards — the abbreviation stands for ‘Hazard Analysis and Critical Control Point’. It isn’t an ISO standard but a method built on seven principles: hazard analysis, determining critical control points, critical limits, monitoring, corrective actions, verification and documentation.
In Serbia, setting up a system based on HACCP principles is a legal obligation for food business operators at the production, processing and distribution stages; primary production is exempt. Certification isn’t compulsory — the market asks for it, not the law.
Who must have HACCP?
The obligation to set up a system based on HACCP principles applies to food business operators at the production, processing and distribution stages — that is, anyone who produces, processes, stores, transports, sells or prepares and serves food. Primary production is exempt. This isn’t a voluntary standard but a legal obligation, and it doesn’t depend on the size of the company.
Exceptions exist, but they apply to establishments, not to small companies: those producing small quantities of food, using traditional methods (traditional crafts and the like), handling food with traditional characteristics, or located in areas with particular geographical constraints. The details are set by the competent minister. A small company with ordinary production isn’t entitled to an exception.
The obligation covers:
- restaurants, cafés, bakeries, patisseries and every kitchen that prepares food
- food and drink production and processing
- retail and wholesale of food products
- food storage and transport, including the cold chain
- kitchens in nurseries, schools, care homes and hospitals
- catering and food delivery
The seven principles behind HACCP
HACCP isn’t a set of documents but a seven-step method. Each step only makes sense if the one before it has been done properly:
- Hazard analysis — which biological, chemical and physical hazards can arise at each step of the process.
- Determining critical control points — the points where a hazard can be prevented, eliminated or reduced to an acceptable level.
- Establishing critical limits — the value that separates acceptable from unacceptable, such as a temperature or a time.
- Monitoring — who measures, with what, how often and where it is recorded.
- Corrective actions — what is done with the product and the process when a limit is exceeded.
- Verification — checking that the system actually works, not just that the records exist.
- Documentation and records — evidence that all of the above is being done.
If everything is declared a critical control point, monitoring becomes impossible, and people start filling in records in advance.
How do you get HACCP certification?
A HACCP system is first set up in the company, and only then can it be certified. The certificate itself is issued by an accredited certification body after an on-site audit — a consultant doesn’t and can’t issue it.
There are five steps to certification:
- Gap analysis. A visit to the premises and a review of processes, equipment and existing documentation.
- Prerequisite programmes. Hygiene, maintenance, pest control, staff training, traceability — the foundation without which a HACCP plan can’t stand.
- The HACCP plan. Flow diagrams, hazard analysis, critical control points, limits, monitoring and corrective actions.
- Operation and records. The system has to run for a while and leave records — the certification body checks records, not intentions.
- Certification audit. The certification body visits the premises and, after a successful audit, issues the certificate.
If a customer asks you for FSSC 22000 or ISO 22000, say so at the start — it changes the scope of work, because a management system is added around HACCP.
What the service includes
- An analysis of the current situation and of the requirements under the Law on Food Safety (Zakon o bezbednosti hrane) and its implementing regulations
- Preparing all elements of the HACCP system:
- Process and product description
- Hazard identification and determination of critical control points (CCPs)
- The HACCP plan and supporting documentation (procedures, instructions, records)
- Training staff in correct food handling and the HACCP principles
- Advice on premises layout, hygiene routines and traceability
- Preparation for the external audit and support throughout certification
What changes in day-to-day work
- Hazards are listed for each process step, so everyone knows where to measure and what the limit is.
- Measurements are recorded at the time, not afterwards — so the records count as evidence.
- When a limit is exceeded, there is a set procedure for the product and the process.
- A change of recipe, equipment or supplier is assessed before it goes into production.
- Customers and retail chains get evidence from existing documentation, instead of it being put together for each request.
How long implementation takes
Implementing HACCP usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- what is being implemented — HACCP alone, or together with a standard such as ISO 22000.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
What is the difference between HACCP and ISO 22000?
HACCP is a method for managing food safety hazards and comes from regulation. ISO 22000 is a management system standard that includes HACCP but adds management, communication along the chain, prerequisite programmes, internal audits and continual improvement — and an organisation can be certified against it.
Is it enough to have the system, or do we need a certificate too?
The law requires a system that is set up and applied, not a certificate. A certificate is evidence for customers, retail chains and foreign partners — it is the market that asks for it, not the inspectors.
What if we change a recipe or equipment?
The hazard analysis is reviewed. A change of raw material, temperature, packaging or equipment can shift critical control points or limits — so the change must be assessed before it goes into production.
Does the law require anything besides the system itself?
Yes, and it is easily overlooked. As well as having the system in place, a food business operator must permanently employ a suitably qualified person who is responsible for good manufacturing and hygiene practice and for applying HACCP. That means hiring someone, not writing a document — a cost to plan for in advance.
The law also requires you to use a guide to good manufacturing and hygiene practice and the application of HACCP, alongside the HACCP plan itself.
How many critical control points should we have?
There is no set number. Critical control points come from the hazard analysis for your product and process. Too many is as bad as too few: each one needs monitoring, records and a set procedure for when the limit is exceeded.
What is the difference between a CCP and a prerequisite programme?
A prerequisite programme maintains general conditions — cleaning, hygiene, pest control, maintenance. A critical control point is a specific step in the process where a hazard is prevented or reduced to an acceptable level, with a measurable limit and monitoring of that limit.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 22000 — the food safety management system; the natural next step once HACCP is working.
- ISO 9001 — the quality management system, often implemented alongside HACCP in the food industry.
- ISO 45001 — occupational health and safety.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
How STANDARDISO can help
We prepare the system and guide you through the audit — from hazard analysis and determining critical control points, through prerequisite programmes and records, to the internal audit. The certificate is issued by an independent, accredited certification body. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.