A bakery HACCP plan identifies the significant hazards in each product, from flour and eggs to fresh cream and allergens, and sets controls at the few steps where control is essential. For most bakeries those critical control points (CCPs) are baking, chilled storage of cream products and allergen labelling, with metal detection added where bread is sliced.
This post walks through one complete example: a Sharjah bakery making fresh cream cakes and sliced bread, following the Codex General Principles of Food Hygiene, CXC 1-1969 (rev. 2020).
Treat every limit below as an illustration. Your team must set and validate its own limits and confirm requirements with your authority, such as Sharjah Municipality.
Step 1: Scope and HACCP team
Scope: receipt of raw materials to dispatch of finished product for two product groups: fresh cream cakes (vanilla sponge, whipped dairy cream, fresh fruit) and sliced white and wholemeal bread. Prerequisites such as cleaning, pest control, personal hygiene and supplier approval are documented separately.
Team: the owner (team leader, holds a Level 3 HACCP qualification), the production supervisor, the head pastry chef, the maintenance technician and an external consultant. Each member's training is recorded, because Codex expects a multidisciplinary team.
Step 2: Product description and intended use
| Item | Fresh cream cake | Sliced bread |
|---|---|---|
| Key ingredients | Flour, eggs, sugar, butter, pasteurised dairy cream, fresh fruit, gelatine | Flour, water, yeast, salt, oil, improver |
| Allergens | Wheat (gluten), egg, milk; nuts on some lines | Wheat (gluten); sesame on some lines; soya in improver if declared by the supplier |
| Processing | Baked sponge, cooled, filled and decorated after baking | Baked, cooled, sliced, bagged |
| Storage | Chilled, e.g. 5 °C or below | Ambient, dry |
| Intended use | Ready to eat, no further cooking | Ready to eat or toasted |
| Consumers | General public, including children, older people and pregnant women | General public |
Cream cakes are often bought for children's parties, so allergen and pathogen controls carry extra weight.
Step 3: Flow diagram
The team drew the flow diagram and confirmed it on the floor during both shifts. The combined version is:
- Receive raw materials (flour, eggs, cream, fruit, packaging)
- Store: dry store, chiller, freezer
- Sieve flour
- Weigh and mix
- Prove (bread only)
- Bake
- Cool on racks
- Fill and decorate with cream and fruit (cakes only)
- Slice and bag (bread only)
- Metal detection (sliced bread)
- Label
- Chilled storage and display (cakes) or ambient storage (bread)
- Dispatch to retail outlets
The floor check found cakes waiting for decoration sometimes sat on racks near the oven for over an hour, which fed into the hazard analysis.
Step 4: Hazard analysis
The team scored likelihood and severity as low, medium or high. Extracts are shown below.
| Step | Hazard | Likelihood | Severity | Significant? | Control |
|---|---|---|---|---|---|
| Receive flour | Pathogens such as Salmonella and E. coli in raw flour; mycotoxins | Medium; low | High; high | No, at this step | Baking controls pathogens later; supplier approval and certificates for mycotoxins |
| Weigh and mix | Allergen cross-contact (nuts, sesame) | Medium | High | Yes | Segregation, scheduling, cleaning: GHP requiring greater attention |
| Bake | Survival of Salmonella from egg and flour | Medium | High | Yes | Validated baking time and temperature |
| Cool | Recontamination; delay before decorating | Medium | Medium | No | Time limit and covered racks (prerequisite) |
| Fill and decorate | Listeria, S. aureus from hands, piping bags, fruit | Medium | High | Yes | Hand hygiene, single-use piping bags, washed fruit, time out of chill: GHP requiring greater attention |
| Chilled storage | Growth of pathogens in cream | High if abused | High | Yes | Temperature control |
| Slice bread | Metal fragments from slicer | Low | High | Yes | Metal detection |
| Label | Undeclared allergen from wrong label | Medium | High | Yes | Label check against recipe |
Step 5: CCP determination
The team used the Codex decision tree with judgement and recorded its reasoning (see HACCP decision tree: how to identify CCPs). Four CCPs resulted:
- CCP 1, Baking: designed to eliminate vegetative pathogens from egg and flour; no later step does so.
- CCP 2, Chilled storage of cream cakes: nothing after decoration controls growth.
- CCP 3, Metal detection of sliced bread: the only step that detects slicer fragments.
- CCP 4, Allergen label check: the last point at which a wrong label can be stopped.
Mixing and decorating were managed as GHPs requiring greater attention, because segregation, cleaning and hand hygiene have no real-time critical limit.
Step 6: The HACCP plan table
| CCP | Critical limit (validated limit set by the team, e.g.) | Monitoring | Corrective action | Verification | Records |
|---|---|---|---|---|---|
| 1 Baking | e.g. validated oven temperature and time per product and tray load, with core temperature of at least 75 °C on the slowest-baking item | Probe one item per batch from the coolest oven position | Continue baking and re-probe; hold product if not corrected; check oven | Weekly probe calibration check; supervisor reviews records daily | Baking log, calibration log |
| 2 Chilled storage | e.g. product 5 °C or below; confirm the required limit with Sharjah Municipality | Chiller display read and product probed at set times each shift | Move product to a working chiller; assess time above limit; discard per the team's rule | Data logger download weekly; thermometer calibration | Chiller log, corrective action log |
| 3 Metal detection | e.g. detects certified test pieces of the sizes set by the team; reject device working | Test pieces passed through at start, every hour and at end | Stop line; hold product since last good check; re-inspect | Monthly supervisor witness test; annual service | Metal detector log |
| 4 Allergen label | Label matches recipe and allergen declaration for every batch | Packer checks first label of each batch against the specification | Stop packing; re-label; hold affected product | Supervisor countersigns; weekly audit of retained labels | Label check sheet |
Worked example: one shift in the Sharjah bakery
At 09:15 the chiller check shows the display cabinet at 7 °C after a door was propped open during a delivery. The supervisor moves the cakes to the walk-in chiller, checks the logger to see how long the cabinet had been warm, and applies the rule in the plan.
At 11:00 the packer sees sesame-topped loaves being bagged with the plain white label. She stops packing, holds 40 bags, re-labels them and records the deviation. The weekly review traces the error to labels stored in one tray, and each product gets its own slot. Monitoring caught the problem, corrective action protected consumers and verification fixed the cause.
Common mistakes
- Copying a generic plan. It will not match your ovens, recipes or layout.
- Unvalidated critical limits. You need evidence the limit controls the hazard in your product.
- Ignoring allergens. Nuts, sesame, egg, milk and gluten need the same rigour as microbial hazards.
- No time limit for decorating. Cream left at room temperature between steps is a classic gap.
- Monitoring without action. A recorded failure with no corrective action is a serious finding.
- Never reviewing the plan. New recipes, suppliers or equipment require a review.
Key takeaway: A good bakery HACCP plan is short and specific. Focus CCPs on baking, chilled storage of cream products, metal detection and allergen labels, back them with strong prerequisites, and validate every critical limit for your own products.
Frequently Asked Questions
What are the CCPs in a bakery?
Common bakery CCPs are baking, chilled storage of cream or custard products, metal detection after slicing and allergen labelling. The exact list depends on your hazard analysis. A bakery making only shelf-stable biscuits may have fewer CCPs than one producing fresh cream cakes, so do not copy another business's list.
Is baking always a CCP?
Not always. Baking is often a CCP because it is the only step that controls pathogens from raw ingredients such as egg and flour. If a product contains no ingredients carrying a significant pathogen hazard, or a later validated step controls it, the team may reach a different decision. Record the reasoning either way.
Do small bakeries in the UAE need a HACCP plan?
Requirements depend on the emirate and the type of business. Many food authorities in the UAE expect food businesses to operate a food safety management system based on HACCP principles, scaled to the size of the operation. Confirm the current requirement with your local authority, such as Sharjah Municipality, Dubai Municipality or ADAFSA.
How often should a bakery HACCP plan be reviewed?
Review the plan at least once a year and whenever something changes: a new product, recipe, supplier, piece of equipment or layout, or after a complaint, incident or new hazard information. Check that the flow diagram, hazard analysis, CCPs and limits are still valid.
Next steps
If you build or supervise HACCP plans, the Highfield Level 3 International Award in HACCP covers hazard analysis, CCPs and critical limits in depth. If you are new to the topic, start with HACCP Essentials. Innoryx is a Highfield Approved Centre and offers both online to learners in India and the GCC.
Read next: How to build a HACCP plan step by step, Food allergen cross-contact prevention guide and HACCP validation vs verification explained. Not sure where to start? Speak to a counsellor.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.