The HACCP records auditors actually check
, and the gaps that write findings.
HACCP paperwork divides into two piles: the plan (hazard analysis, CCPs, limits, written once, reviewed rarely) and the records (monitoring, deviations, verification, generated every shift). Audits are lost in the second pile. This guide lists exactly which records get pulled, what auditors cross-check them against, and the recurring gaps.
Plan documents vs. operational records
The plan pile, hazard analysis, CCP determination, critical limits, process flow diagrams, proves you designed a safe process. Codex HACCP principle 7 and Regulation 852/2004 Article 5 require documentation proportionate to the business, and inspectors will read it. But a plan is static; auditors know it was polished for them.
The records pile proves the plan runs: CCP checks at the frequency the plan states, signed and timed; deviations with dispositions; verification activity; calibration. These are generated under production pressure, which is exactly why auditors trust them, and why they contain the gaps.
The records that get pulled, and the cross-checks
| Record | The cross-check an auditor runs |
|---|---|
| CCP monitoring logs | Frequency in the log vs frequency the plan promises; times realistic (not four entries at 16:58); signatures match trained people on the training matrix |
| Deviation / corrective action log | Every monitoring excursion has a disposition; affected product identified by batch; root cause beyond "operator error" |
| Verification records | Scheduled reviews of monitoring records actually happened, by someone other than the monitor, at the promised cadence |
| Calibration records | The probe used at the CCP is on the calibration schedule; readings traceable to a calibrated reference |
| Validation evidence | Critical limits justified, regulation, guidance, challenge study, not folklore |
| Training records | The person signing the 06:00 CCP check is trained for that CCP, with a date |
The five gaps that recur in findings
The connection that changes everything: records tied to batches
Most HACCP record findings share one root cause: monitoring records are organised by time and place, while product moves by batch, and nothing joins the two. The strongest single improvement a producer can make is recording batch identity on CCP checks and deviations, so 'what did this deviation touch?' is a lookup, not an investigation.
This is how Keystone structures QC execution: checks and deviations attach to the make-day and batch they belong to, so a deviation automatically knows its affected batches, and a batch's traceability report carries its QC history with it. During a vertical audit, the auditor's nominated lot arrives with its monitoring evidence already attached, which converts the tensest hour of a BRCGS audit into a screen-share.
Retention and format
Regulation 852/2004 requires documents and records to be retained for an appropriate period, proportionate guidance, not a single number. Practical practice: keep HACCP records at least as long as product shelf life plus a margin, and align with your traceability retention (commonly 5 years) so an incident investigation never outlives its evidence. Paper, spreadsheet or system are all acceptable formats; what matters is legibility, attributability (who, when), protection from casual amendment, and retrievability, an auditor asking for last February's CCP logs expects minutes, not a loft expedition.
- Audits are decided by operational records (monitoring, deviations, verification), not the HACCP manual.
- Every monitoring excursion needs a disposition for both the process and the product, by batch.
- Match reality to promises: monitor at the frequency the plan states, verify at the cadence it commits to.
- Tie CCP checks and deviations to batch identity, it converts investigations into lookups.
- Calibration is part of the CCP: an uncalibrated probe makes every reading arguable.
Frequently asked questions
What HACCP records am I legally required to keep?
How long should HACCP records be kept?
Can HACCP records be digital?
What is the difference between verification and validation in HACCP?
What do auditors check most in HACCP records?
See this done in software, on real production data.
Keystone runs the full chain, supplier delivery → batch → dispatch → customer, in under 30 seconds. 20-minute discovery call, no sales pitch.