In 2020, the Codex Alimentarius Commission revised the international HACCP methodology for the first time in 17 years, adding requirements for allergen management, food safety culture, and traceability. For buyers awarding catering contracts, the stakes are concrete: a caterer’s HACCP certificate confirms a preventive food-safety system is in place — but only if the certificate is current, the certification body is accredited, and surveillance audits remain on schedule. This guide decodes HACCP (Hazard Analysis and Critical Control Points) — what the methodology demands, how Singapore’s SFA applies it under the Sale of Food Act, and how to verify a caterer’s status before you sign.

Standard at a Glance

What the Standard Is

HACCP is a science-based preventive approach adopted by Codex Alimentarius in 1969 and revised in 1997, 2003, 2020, and 2022. It identifies specific food-safety hazards and the controls needed to keep them in check. HACCP is a methodology, not a single-body certification: Codex authors the framework, and third-party bodies accredited to ISO/IEC 17021 certify individual food businesses against it.

Singapore’s regulatory framework aligns with Codex HACCP principles under the Sale of Food Act 1973. Under the SAFE framework, all Level 2 food service establishments have been required, since 2023, to implement an FSMS based on HACCP principles. That FSMS may be self-implemented or certified — HACCP, ISO 22000, and FSSC 22000 all count as certified FSMS. From SAFE Phase 2 (details by 2027), Category 1 establishments seeking Grade ‘A’ will need one of these certified FSMS plus an Advanced Food Hygiene Officer; Phase 1 (in effect since January 2026) grades on food-safety track record alone.

HACCP vs. ISO 22000: HACCP is the methodology; ISO 22000 is a certifiable management-system standard that wraps HACCP inside additional ISO management-system requirements. A caterer holding ISO 22000 has implemented HACCP; a caterer holding standalone HACCP has not met the wider ISO 22000 requirements.

What the Standard Requires

HACCP implementation follows a 12-step process: assemble the team, describe the product, identify intended use, construct and verify a flow diagram, then apply Principles 1–7. Prerequisite programmes must be in place first:

• Good Hygiene Practices (GHP)
• Good Manufacturing Practices (GMP)
• Cleaning and sanitation
• Pest control
• Traceability
• Allergen management

Principle 1 — Hazard analysis + prerequisite programs

Identify hazards at every process step and document the analysis with control measures and the rationale for significance:

• Biological — Salmonella, Listeria, allergens
• Chemical — cleaning agents, pesticides
• Physical — glass, metal, plastic fragments

Prerequisite programs — cleaning schedules, pest-control logs, hygiene protocols, supplier verification — must be documented and operational.

Principle 2 — Determine Critical Control Points (CCPs)

A CCP is a step where control is essential to prevent, eliminate, or reduce a hazard to an acceptable level. Apply a decision tree per hazard. Typical catering CCPs: cooking, cooling, hot holding, allergen segregation. Avoid designating every control measure as a CCP — many are already managed by prerequisite programs.

Principle 3 — Establish critical limits

Critical limits must be scientifically validated and measurable. Examples: cooking to ≥75°C for ≥15 seconds; cooling 60→21°C within 2 hours then to 5°C within 4 more; hot holding ≥60°C. Specify the measurement method (calibrated ±0.5°C thermometer), frequency, and the responsible person.

Principle 4 — Establish monitoring procedures

Every CCP needs a monitoring log with date, time, measurement, and the checker’s signature — in real-time or near-real-time. Cooking: temperature checked per batch immediately after cooking. Hot holding: continuous data logger, or manual checks every 2 hours.

Principle 5 — Establish corrective actions

Pre-define the response on deviation, per CCP. Cooking below 75°C: continue cooking, re-check, reject if not correctable. Cooling limit exceeded: reheat to 75°C and restart; reject if it happens twice. Hot holding below 60°C: reheat immediately; reject if below for over 2 hours. Every deviation gets a corrective-action report with date, CCP, action, product disposition, and signature.

Principle 6 — Establish verification procedures

Verification is separate from day-to-day monitoring. It covers equipment calibration against certified references, monthly internal audits of monitoring logs, periodic microbiological testing of finished product, annual review of supplier certificates, and a documented annual HACCP plan review signed off by management.

Principle 7 — Establish documentation and record-keeping

Records to keep on file: the HACCP plan itself (hazard analysis, CCP determination, critical limits, monitoring, corrective actions, verification, management sign-off); daily monitoring logs; corrective-action reports; verification records (calibration certificates, internal audits, microbiological tests); staff training records; supplier documentation. Minimum two-year retention, longer per product shelf life.

Who It Applies To

HACCP applies across the food industry — growing, processing, distribution, and food preparation. In Singapore, SFA requires an FSMS based on HACCP principles for restaurants with kitchens ≥16m², caterers, central kitchens, and food manufacturing premises. Since 2023, all Level 2 food service establishments must implement such an FSMS.

SAFE grading, Phase 1 (in effect since January 2026): grades assigned to Category 1 establishments — caterers, central kitchens, food manufacturers, ≥16m² restaurants — based on food-safety track record. From Phase 2 (details expected by 2027), a Category 1 establishment seeking Grade ‘A’ will additionally need:

• Certified FSMS (HACCP, ISO 22000, or FSSC 22000)
• Advanced Food Hygiene Officer on staff

How to Verify a Provider + Common Audit Failures

Step 1 — Request the certificate. The current HACCP certificate should show the certification body, certificate number, scope, issue date, expiry date (typically 3 years from issue), and surveillance audit dates.

Step 2 — Verify with the certification body. No centralized HACCP directory exists. Contact the issuing body directly with the certificate number and confirm current validity, that surveillance audits are up to date, and that there have been no suspensions.

Step 3 — Check SFA licensing and SAFE grade. For SFA-licensed establishments, verify via SFA Track Records. In Phase 1 (since January 2026), the grade reflects food-safety track record — Grade ‘B’ or ‘C’ signals recent lapses. From Phase 2 (details by 2027), Category 1 establishments seeking Grade ‘A’ will also need a certified FSMS and an Advanced Food Hygiene Officer.

Step 4 — Verify certification body accreditation. ISO 22000 certification bodies should appear in the SAC directory. HACCP certificates from non-SAC bodies should still be traceable to ISO/IEC 17021 accreditation from a recognized national body. Red flag: a certificate within its 3-year window with no evidence of annual surveillance audits.

Top audit non-conformances:

• Incomplete hazard analysis — hazards missed or wrongly assigned to a process step
• Wrong CCPs — too many, or too few, without a documented decision tree
• Outdated flow diagrams — not updated when the process changes
• Generic corrective actions — “retrain staff” instead of specific steps
• Missing monitoring records — gaps in logs, retrospective entries, missing signatures
• No verification evidence — no calibration certificates, no internal audits, no annual plan sign-off

SFA enforcement in Singapore: licence suspension under the 12-point demerit system for hygiene failures, pest infestation, temperature-control failures, or food-poisoning outbreaks; court convictions under the Sale of Food Act with maximum penalty SGD 50,000 and/or 2 years’ imprisonment; major lapses trigger immediate downgrade to SAFE Grade ‘C’.

Frequently Asked Questions