HACCP Checklist For Verification (Free Spreadsheet)

If you're preparing for a HACCP audit — or building out your food safety system from scratch — a structured checklist is one of the most practical tools you can have. A HACCP checklist is the verification instrument that confirms your HACCP plan is actually working in practice. It's not a replacement for the plan itself; it's the mechanism that proves your system is functioning, documented, and audit-ready.

This guide walks you through exactly what our template covers, how to use it effectively, and where most manufacturers fall short when auditors arrive.

Download the Free HACCP Checklist

Before diving into the detail, grab the template. This checklist goes well beyond the 7 HACCP principles — covering prerequisite programs, allergen controls, supplier management, environmental monitoring, calibration, training, traceability, food defense, and food fraud.

We've build this for real internal audit use. (Please note: This is a template, it requires customization to your specific organization. Make sure to always consult with an expert before relying on this checklist for compliance.) 

Keep reading to understand what's inside and how to use it effectively.

What's Included in the HACCP Checklist?

Overview of the Checklist Structure

The template is organized into 14 distinct sections across two main sheets: the working checklist and a compliance dashboard that auto-updates as you score items. The sections are:

• Preliminary Steps (PA) — HACCP team assembly, product description, intended use, and flow diagram verification
• Principles 1–7 — All seven Codex HACCP principles, from hazard analysis through record-keeping.
• System Assessment (SA) — Management culture, change management, and integration with broader food safety systems
• Prerequisite Programs (PRP) — 15 items covering GMPs, sanitation, pest control, maintenance, glass/brittle plastic, chemical control, utilities, storage, transportation, and foreign material
• Allergen Management (ALG) — 9 items covering risk assessment, segregation, label control, changeovers, cleaning verification, rework, training, and incident response
• Supplier & Incoming Controls (SUP) — 8 items covering approved supplier programs, COAs, incoming inspection, verification testing, and performance review
• Product Disposition & CAPA (DISP) — Hold/release procedures, deviation handling, rework policy, and corrective action closure
• Traceability & Recall (TRC) — Lot coding, mock recall, mass balance, and customer complaint linkage
• Environmental Monitoring (EMP) — Program design, sampling controls, corrective actions, and trend review
• Calibration & Measurement (CAL) — Master device list, traceable standards, out-of-tolerance impact assessments, and in-use checks
• Training & Competency (TRN) — CCP operator competency, refresher training, and effectiveness verification
• Food Defense (FD) — Defense plan, vulnerability assessment, mitigation monitoring, and incident response
• Food Fraud (FF) — Vulnerability assessment and mitigation strategies for economically motivated adulteration

Each section uses a consistent column structure: a reference number, the HACCP element, a detailed verification question, the specific evidence you need to sample, a compliance score (Y/N/NA), a notes field for findings, and an evidence reference field.

How to Score and Document Findings

Scoring is straightforward: Y = Compliant, N = Nonconformance, N/A = Not applicable and not scored. The dashboard tab automatically calculates your overall compliance percentage and breaks it down by section, so you can immediately see where your gaps are concentrated.

The key instruction in the template: add comments for all N responses. A "No" with no context is useless when it comes time to write your corrective action report. The evidence reference field is equally important — auditors want to see specific record names, SOP numbers, log titles, or observation notes, not a general "records available."

How to Use This HACCP Checklist

Before the Audit: Preparation Steps

Start by completing the Audit Info tab first. It captures facility name and address, audit type (internal, external, mock, customer, or regulatory), audit scope, HACCP plan version and revision date, auditor names and qualifications, the shift being audited, number of employees on shift, and the previous audit date. This isn't administrative busywork — if your HACCP plan version on the audit info tab doesn't match what's in your document control system, that's already a finding.

Gather your prerequisite documents before anyone sets foot on the floor: HACCP team roster, training records, process flow diagrams, walk-through verification records, CCP monitoring logs, calibration records, and any corrective action reports from the previous cycle. Cross-check your HACCP plan against your current production process. If you've changed suppliers, added products, or modified equipment since the last revision, your hazard analysis may need to be updated before the audit even begins.

During the Audit: Working Through Each Section

Work through the checklist in two parallel tracks: document-based verification and observational verification. Document review covers monitoring logs, calibration records, training certifications, and corrective action closure. Observational verification means watching your CCPs in action — confirming monitoring is happening at the stated frequency, by the right person, using a calibrated instrument.

The checklist's "Evidence to Sample" column tells you exactly what to look for at each step. For example, item PRP.6 (sanitation effectiveness verification) specifies pre-op forms, ATP/micro results, and trending data — not just "sanitation records." Item CAL.3 (out-of-tolerance impact) asks for OOT investigations and product evaluations, not just a calibration log. Use the evidence column as your document pull list before the audit begins.

Don't fill in the checklist from memory or based on what "usually happens." Record only what you observe and verify on the day of the audit. Auditors are trained to spot records that look too clean or entries that all appear to have been completed at the same time.

After the Audit: Closing Findings and Corrective Actions

Once complete, the Compliance Dashboard gives you an instant breakdown of Y, N, and N/A counts by section, along with a percentage compliant score for each area. Use this to prioritize your corrective action workload — sections with multiple N responses need attention before your next external audit.

Compile all nonconformances into a findings report. Assign each one a root cause category, an owner, and a due date. Then link each corrective action back to the specific checklist reference number that triggered it (e.g., "DISP.5 — CAPAs assigned with root cause, timelines, verification of effectiveness, and closure"). This creates an auditable trail that demonstrates your system is responsive — not just reactive when an auditor is in the building.

What Is a HACCP Checklist (And How Is It Different From a HACCP Plan)?

Your HACCP plan is the written system — the documented hazard analysis, identified CCPs, established critical limits, monitoring procedures, and corrective action protocols. It describes what your food safety controls are and why they exist.

A HACCP checklist is the verification tool. It's what you use to confirm that the plan is being followed correctly, that records are complete, and that your system would hold up under external scrutiny. Think of the plan as the blueprint and the checklist as the inspection report.

Under FDA regulations, HACCP is mandatory for juice processors (21 CFR Part 120), seafood processors (21 CFR Part 123), and meat and poultry operations under USDA/FSIS. For other food manufacturers, FSMA's Preventive Controls for Human Food rule (21 CFR Part 117) requires a similar systematic approach through a written food safety plan. In both cases, documented verification — which a checklist directly supports — is a regulatory requirement, not optional best practice.

The 7 HACCP Principles are Included in the Checklist

Principle 1: Hazard Analysis (Items 1.1–1.3)

The checklist verifies three things here: that all biological, chemical, and physical hazards are listed (1.1); that severity and likelihood are assessed with documented risk justification (1.2); and that control measures are identified and linked to each hazard (1.3). The evidence to sample for each is the hazard analysis worksheet and risk justification records — not the HACCP plan summary alone.

A complete hazard analysis in 2025 also accounts for allergen cross-contact as a chemical hazard, and radiological hazards for applicable product categories. If your hazard analysis worksheet doesn't reflect your current ingredient list, supplier base, and process, item 1.1 will likely score a "No."

Principle 2: Determine CCPs (Items 2.1–2.2)

The checklist verifies that a CCP decision tree was used and documented (2.1), and that CCPs are identified at the last control step where the hazard can be prevented, eliminated, or reduced to acceptable levels (2.2). See critical control point examples for how this plays out across different process types.

Evidence to sample here is CCP decision records and process verification documentation. If your team made CCP determinations informally or verbally — without a documented decision tree rationale — item 2.1 will be a nonconformance.

Principle 3: Establish Critical Limits (Items 3.1–3.2)

Two items: measurable critical limits must be defined (3.1), and those limits must be scientifically validated (3.2). The evidence checklist specifies "validation studies" for item 3.2 — not regulatory citations alone, though those count when applicable.

In practice, scientifically validated means your cooking temperature, pH, water activity, or time-temperature combination is traceable to a regulatory standard (e.g., USDA lethality tables), a peer-reviewed study, or a letter from a recognized process authority.An internal decision that "165°F seems right" will not satisfy item 3.2.

Principle 4: Monitoring Procedures (Items 4.1–4.4)

Four items: the monitoring plan is defined in CCPs SOPs (4.1); monitoring is real-time, verified by observation (4.2); monitoring devices are calibrated, supported by calibration logs (4.3); and records are accurate and timely, verified through CCP logs (4.4).

Item 4.2 — real-time monitoring verified by observation — is one of the items that can only be scored through direct observation on the floor, not document review. If your line worker is filling in temperature logs at the end of the shift rather than at the time of monitoring, this is a major nonconformance regardless of what the logs show.

Principle 5: Corrective Actions (Items 5.1–5.3)

Three items: corrective actions are pre-defined in the HACCP plan table (5.1); actions have been implemented as evidenced by deviation records (5.2); and root cause analysis is performed, documented in CAPA logs (5.3).

Item 5.2 is scored against actual deviation records. If you've had no CCP deviations in the review period, that may be legitimate — but it's worth confirming your monitoring is sensitive enough to actually catch deviations when they occur. Item 5.3 requires CAPA logs specifically, not just disposition records. A product hold and release is not a corrective action.

Principle 6: Verification (Items 6.1–6.3)

Three items: a verification schedule is defined (6.1); the HACCP plan is validated annually (6.2); and ongoing verification activities are performed and documented through audit and test records (6.3).

Verification is frequently confused with monitoring. Monitoring happens in real time at the CCP. Verification is the periodic review that confirms your monitoring system is working — a supervisor reviewing a week of temperature logs, or a third-party lab re-validating your critical limit. Item 6.2 specifically asks whether the plan is validated annually, which requires documented validation reports — not just an annual HACCP plan review meeting.

Principle 7: Documentation (Items 7.1–7.2)

Two items: documents are controlled through a document control system (7.1); and records are retained per your retention policy (7.2). Under FDA seafood and juice HACCP regulations, records must be retained for a minimum of one year for refrigerated products and two years for shelf-stable products processed under certain conditions.

Item 7.1 is worth noting: the evidence required is a "document control system" — not just a shared drive folder. If your HACCP plan exists in multiple versions across email attachments and shared folders with no formal version control, this will be a finding. See Allera's document control capabilities for how a centralized system addresses this directly.

System Assessment: Beyond the 7 Principles (Items SA.1–SA.3)

The checklist includes three system-level assessment items that are easy to overlook but consistently surface in third-party audits.

SA.1 — Management and culture: Do CCP operators actually understand what they're monitoring and why? The evidence here is operator interviews — not training records. An auditor who walks up to a line worker and asks "what happens if your thermometer reads below the critical limit?" expects a clear, correct answer. If operators can't articulate the answer, it signals that training is happening on paper but not in practice.

SA.2 — Change management: Is the HACCP plan reassessed after process changes? The evidence is change records — a formal log showing that ingredient substitutions, equipment modifications, or new product introductions triggered a HACCP review. This is one of the most frequently missed items in facilities that run reactive rather than systematic food safety programs.

SA.3 — Integration: Is HACCP integrated with your recall and GMP programs? Recall and GMP evidence is specified here. An isolated HACCP plan that isn't connected to your traceability system, allergen program, or environmental monitoring program is a red flag for auditors evaluating overall system effectiveness.

Prerequisite Programs: The Foundation Your HACCP Checklist Assumes (PRP.1–PRP.15)

What Are PRPs and Why They Matter Before HACCP

Prerequisite programs are the foundational operational and sanitation practices that make your production environment suitable for HACCP to function. Your HACCP plan controls specific hazards at defined CCPs — your PRPs control the broader environment those CCPs operate within. If your sanitation program isn't working, your metal detector CCP is operating in a compromised environment.

The checklist includes 15 PRP items, making it one of the most comprehensive sections in the template. This matters because PRP deficiencies consistently rank among the top findings in third-party audits — yet most publicly available HACCP checklists barely address them.

Key PRP Categories in the Checklist

GMP and Personnel Hygiene (PRP.1–PRP.3): Three items covering whether GMP requirements are documented and communicated, whether employee hygiene practices (handwashing, illness reporting, jewelry policy, gloves) are implemented and verified through observations and hygiene audits, and whether protective clothing including hair and beard restraints is consistently used. All three require observational evidence, not just policy documents.

Facility, Sanitation, and Pest Control (PRP.4–PRP.7): Four items covering facility and grounds maintenance, documented SSOPs that are followed as written, sanitation effectiveness verification through ATP or microbiological testing with defined acceptance criteria, and a licensed pest management program with trend review. Item PRP.6 — sanitation effectiveness verification with trending — is a frequent gap. Having ATP test results in a binder is not the same as having defined acceptance criteria and a trending program with escalation thresholds.

Maintenance, Glass/Brittle Plastic, Chemical Control, and Waste (PRP.8–PRP.11): Four items covering preventive maintenance controls (including food-grade lubricants), a glass and brittle plastic register with documented inspections, chemical approval and segregation with titration logs, and waste removal practices. The glass register requirement (PRP.9) surprises many facilities — you need a register of all glass and brittle plastic in food areas, documented inspection results, and a defined breakage procedure.

Utilities, Storage, Transportation, and Foreign Material (PRP.12–PRP.15): Four items covering water, ice, steam, and compressed air verification; storage condition monitoring including FIFO/FEFO practices; outbound trailer inspections and temperature controls; and foreign material controls including sieves, magnets, metal detection, and rejection handling. Item PRP.15 on foreign material control requires evidence of the program SOP, verification checks, and records of rejects and holds — a complete paper trail, not just a functioning metal detector.

Beyond GMPs: What Else the HACCP Checklist Covers

Most HACCP checklists stop at the 7 principles and maybe a brief PRP section. This template goes significantly further — and those additional sections reflect exactly what modern GFSI audits and FDA inspections focus on.

Allergen Management (ALG.1–ALG.9)

Nine items covering the full allergen control lifecycle: risk assessment, ingredient segregation, label approval and revision control, label reconciliation at changeovers, allergen changeover SOPs with validated cleaning, allergen swab verification with defined limits and trending, rework controls, allergen training with competency checks, and an allergen incident response plan with mock exercises.

Item ALG.6 (allergen cleaning verification with defined limits and trending) and ALG.3 (label control with revision control and approvals) are among the most commonly cited allergen-related findings in GFSI audits. If your allergen cleaning is verified by a visual inspection alone, that's likely a nonconformance under modern scheme requirements.

Supplier and Incoming Controls (SUP.1–SUP.8)

Eight items covering your entire supplier program: risk-based approval process, evidence supporting each approval (GFSI certificates, audits, questionnaires, or performance history), material specifications with COA acceptance criteria, incoming inspections by risk level, verification testing for high-risk materials, foreign material controls from suppliers, nonconforming material documentation, and supplier performance scorecards reviewed at defined frequency.

Item SUP.2 is worth highlighting: it requires evidence supporting each supplier approval. A supplier being on your approved list without a documented basis for approval (audit, questionnaire, certificate) will score a "No."

Traceability and Recall (TRC.1–TRC.6)

Six items: forward and backward lot traceability, lot code integrity verification during production runs, a current and tested recall plan, mock recall completion within target time, mass balance reconciliation in mock recalls, and customer complaint linkage to trend analysis. Most facilities have the recall plan documented. Fewer have completed mock recalls within target timeframes (typically two to four hours) and can produce the mass balance worksheets to prove it. Item TRC.5 specifically requires mass balance worksheets with defined acceptance criteria.

Environmental Monitoring (EMP.1–EMP.4)

Four items covering your EMP program design (zones, sites, frequency, rotation appropriate to product risk), sampling methodology controls, corrective action response to positives including intensified cleaning and root cause analysis, and trending with defined escalation thresholds. Item EMP.4 — trending with escalation thresholds — is a gap in many facilities. Collecting environmental samples and filing results is not the same as having a trending program that tells you when to escalate.

Calibration, Training, Food Defense, and Food Fraud

Calibration (CAL.1–CAL.4) covers a master device list, traceability to recognized standards, out-of-tolerance impact assessments on affected product, and daily in-use checks for critical devices. Item CAL.3 is frequently missed: when a thermometer is found out of tolerance, you must assess the impact on all product monitored since the last successful calibration — not just recalibrate the device.

Training (TRN.1–TRN.4) covers CCP operator competency verification, refresher training schedules, role-based PRP and allergen training, and effectiveness verification through observations or quizzes. TRN.1 requires competency verification specifically for CCP operators — training attendance alone is not sufficient evidence of competency.

Food Defense (FD.1–FD.4) and Food Fraud (FF.1–FF.2) round out the template. Food defense covers the defense plan, an intentional adulteration vulnerability assessment, mitigation monitoring, and a tested incident response plan. Food fraud covers a vulnerability assessment for economically motivated adulteration and defined mitigation strategies with periodic review. Both sections are now required under major GFSI schemes and FDA's FSMA rule on intentional adulteration.

Where HACCP Meets Other Compliance Standards

HACCP and FSMA Preventive Controls: Overlap and Differences

FSMA's Preventive Controls for Human Food rule shares significant overlap with HACCP but extends the scope to supply chain program documentation and sanitation preventive controls as distinct categories. It also requires a written food safety plan maintained by a Preventive Controls Qualified Individual (PCQI). See FSMA 204 for the most recent traceability requirements layered on top of these foundations — the TRC section of this checklist directly supports those requirements.

HACCP Within SQF, BRCGS, and FSSC 22000

All three major GFSI-benchmarked schemes require a functioning HACCP system as a core element. Here's how the checklist sections map to each standard:

Whether you're pursuing SQF certification, BRCGS certification, or FSSC 22000, this checklist is directly transferable to scheme-specific audit preparation.

The Most Common HACCP Audit Failures (And How to Prevent Them)

Hazard analysis not updated after process changes. The SA.2 item catches this directly. When you change an ingredient, supplier, process step, or equipment, your hazard analysis must be revisited. Establish a formal change management protocol — ideally one that requires HACCP team sign-off before any significant change goes live.

Critical limits without scientific validation. Item 3.2 requires validation studies. If you can't produce the regulatory standard, peer-reviewed study, or process authority letter that supports each critical limit, expect a major finding. This applies to every CCP, not just cooking temperatures.

Monitoring records with gaps or backdated entries. Item 4.2 is scored by observation, not document review. Supervisory review of monitoring records at the end of each shift — before gaps become audit findings — is the most practical preventive control here.

Corrective actions without root cause evidence. Item 5.3 requires CAPA logs with documented root cause analysis. A product disposition (hold, rework, destroy) answers "what did you do with the product?" Root cause analysis answers "why did the deviation occur and what prevents it from recurring?" Both are required; only one is typically documented.

Verification activities not scheduled or documented. Item 6.1 asks whether a verification schedule is defined. Item 6.3 asks whether activities are actually being performed and documented. If your QA team reviews monitoring records informally but never documents the review with a signature and date, items 6.1 and 6.3 are both at risk.

Calibration out-of-tolerance impact not assessed. Item CAL.3 is one of the most under-addressed items in the calibration section. When a device is found out of tolerance, the required response is an impact assessment on all product monitored since the last successful calibration — not just recalibration of the device.

EMP results not trended with defined thresholds. Item EMP.4 requires trending and a management review process with defined escalation thresholds. Having results filed is a starting point; having a trending program that generates actionable data is what auditors are looking for.

Digital HACCP Checklists vs. Paper: When It's Time to Transition

Where Spreadsheets and Paper Break Down

This checklist template works well as a starting point in spreadsheet form for a single facility with a stable program. The limitations become apparent quickly when you add complexity: multiple sites running different versions of the same form with no visibility into which is current; corrective actions logged in one place and lost when following up in another; EMP trending that lives in a separate spreadsheet from the monitoring data it's supposed to reflect; and audit preparation that requires manually compiling records from a dozen different sources.

When a deviation occurs at 2 AM and the CCP operator needs to know the pre-defined corrective action procedure, a shared drive folder is not a reliable system.

What to Look for in HACCP Compliance Software

When evaluating HACCP compliance software or a broader food quality management software platform, prioritize these capabilities based on what this checklist actually requires:

Centralized document control with version history and approval workflows (checklist items 7.1, SA.3, ALG.3). Every team member should be working from the current version of every form, SOP, and HACCP plan. Document control with a controlled revision process eliminates the version control problem that plagues shared drive systems.

Digital monitoring records with timestamped entries (item 4.2). Timestamped digital records make it structurally difficult to backfill data after the fact — which protects both audit integrity and your regulatory standing.

CAPA management with root cause tracking, owner assignment, and effectiveness verification (items 5.3, DISP.5). A corrective action that isn't tracked to closure is a corrective action that doesn't get closed.

Supplier management with approval documentation and performance tracking (SUP.1–SUP.8). Centralizing supplier certificates, questionnaires, audit results, and COA reviews makes supplier approval defensible and auditable.

Audit-ready reporting that can generate a complete evidence package — monitoring records, verification activities, corrective action logs, calibration records, EMP results — in minutes rather than days.

A food safety management system that integrates these capabilities doesn't just make audits easier — it makes your HACCP system more likely to catch real hazards before they become recalls.

Managing HACCP verification across multiple facilities? See how Allera centralizes documentation, monitoring, and audit prep in one platform — schedule a demo with a food safety specialist.

Frequently Asked Questions

What is a HACCP checklist used for?A HACCP checklist is used to verify that your HACCP plan is being implemented correctly — that monitoring is happening, records are complete, critical limits are being met, corrective actions are documented, and prerequisite programs are functioning. It's the primary tool for internal HACCP audits and pre-audit preparation.

How many items are in this HACCP checklist?The template contains items across 14 sections: 6 preliminary steps, 14 items across the 7 HACCP principles, 3 system assessment items, 15 PRP items, 9 allergen management items, 8 supplier controls items, 6 disposition and CAPA items, 6 traceability and recall items, 4 environmental monitoring items, 4 calibration items, 4 training items, 4 food defense items, and 2 food fraud items. The compliance dashboard scores each section automatically as you complete the checklist.

Is a HACCP checklist required by law?The HACCP plan and its associated records are required by law for juice, seafood, and meat/poultry processors under FDA and USDA regulations. Documented verification is a regulatory requirement across all these frameworks — a checklist is the practical tool that structures and records that verification activity.

How often should you conduct a HACCP audit using this checklist?Most regulatory frameworks and GFSI schemes require at minimum an annual HACCP system review. Many facilities conduct internal HACCP audits quarterly, with CCP monitoring verification on a daily or shift-by-shift basis depending on production volume and process risk.

What's the difference between verification and validation in HACCP?Validation (item 6.2) confirms that your control measures are capable of controlling the identified hazard — for example, that cooking at 165°F for 15 seconds achieves the required lethality for Salmonella. Verification (items 6.1 and 6.3) confirms that validated controls are being applied correctly in practice — for example, that cooking temperatures are actually reaching 165°F based on real-time monitoring records. Validation happens before or when establishing a CCP; verification happens continuously and periodically throughout operation.

Can this checklist be used for FSMA compliance?Yes. This checklist covers the HACCP principles that form the foundation of FSMA's Preventive Controls requirements. The supplier controls (SUP), allergen management (ALG), and traceability (TRC) sections directly address FSMA-specific requirements. For full FSMA compliance, you'll also need to confirm PCQI oversight of your food safety plan, which is reflected in the SA.1 (management understanding) and TRN.1 (competency verification) items.

Ready to move beyond spreadsheets? Talk to a food safety specialist at Allera about centralizing your HACCP documentation, monitoring, and audit prep.