From Compliance to Capability: When HACCP Becomes a Living System
Article By Shingai P. Nyarugwe, Ph.D., Advisor, Cultivate SA and Heidi Gough, Ph.D., Advisor, Cultivate SA
Article Source: https://digitaledition.food-safety.com/august-september-2026/feature-pc/?utm_medium=emailsend&utm_source=DG-FS-Food+Safety&utm_content=BNPCD260730093_01&oly_enc_id=5144A7749701F4Y
Reframing HACCP as a living management system for frontline decision-making, leadership behavior, and real-world risk control
An essential question: Why does HACCP still fall short?
Many organizations continue to approach food safety primarily as a compliance exercise rather than as an embedded part of everyday operations. Hazard Analysis and Critical Control Points (HACCP) and its prerequisite programs are well-established, widely understood tools for managing food safety1 risk. However, in practice, HACCP is rarely experienced as a living system that shapes how people think, make decisions, and work2 across sites such as manufacturing plants, warehouses, and distribution centers.
Although senior leadership commitment is a stated requirement of GFSI standards,3 it is seldom translated into clear expectations around specific leadership behaviors and day-to-day actions. As a result, a gap often develops between strategic intent and operational reality.
Why does this happen? For many organizations, food safety risks can feel implicit and already under control. Companies with this mindset often hold the view that they have been operating a HACCP-based food safety and quality management system (FSQMS) for some time, perhaps many years, and this experience means that everything is fine, even if they have not taken a close look at their systems in a while.4 After all, there is a HACCP plan in place, and it is routinely audited by GFSI-recognized schemes and customer standards. Once accepted externally by a regulator or certification body, the HACCP program is seldom revised or reviewed in detail. Team meetings become a "must do" that is checked off to remain compliant, rather than a meaningful challenge of hazard control capabilities. This "symbolic value" of HACCP, and the certification schemes that audit HACCP plans, may overshadow the technical benefits that HACCP programs impart,5 raising concerns about the potential capability in HACCP application beyond the third-party audit certificate.
HACCP as a Static Requirement vs. a Living System
In many facilities, the HACCP plan is fully compliant and reviewed at least annually, as required by external certification requirements. The meeting takes place, attendance is recorded, verification activities are reviewed, and any mandated outputs are produced. On paper, the system works exactly as intended.
Yet outside those scheduled reviews, the HACCP plan often exists more as an archived document than as a management tool. It lives in a large binder or shared drive that relatively few people have read in full and even fewer actively use or even understand. Discussion of hazards, controls, and assumptions rarely features in day-to-day operational or management conversations unless a problem arises.
HACCP meetings can reinforce this dynamic. Verification results are reviewed collectively, but often at a high level. Operations and maintenance representatives may attend, yet real ownership frequently sits with the technical or quality function. When HACCP non-conformities are raised in external audits, it is the technical specialist who feels the impact most acutely, inadvertently reinforcing the idea that HACCP is a technical or quality obligation rather than a shared management system.
The system remains compliant throughout. The problem is not that requirements are not met, but that opportunities are missed and unnoticed gaps do not get addressed. Food safety risks are not routinely discussed in management forums, changes in operating conditions may not trigger meaningful reassessment, and hazard awareness remains disconnected from everyday decision-making—all of which could lead to unsafe product being sold.
HACCP Reframed
Now consider a different, equally compliant approach.
In this model, HACCP is treated as an active and evolving management system rather than an annual event. Reviews still take place at required frequencies, but risk discussion also occurs between those formal checkpoints. A genuinely engaged, cross-functional team contributes to keeping the system current and relevant.
Operators who carry out the work are involved in shaping process flow diagrams and in developing the monitoring activities they perform. Verification data is integrated into the Manufacturing Operating System (MOS), reviewed in real time and at appropriate intervals of control. This is not solely to confirm compliance but also to understand what it says about how well food safety risks are being controlled.
Food safety risk awareness is further strengthened by making risk concepts visible and usable beyond the technical team (Figure 1). When likelihood and severity are commonly understood, frontline managers are better equipped to assess risk dynamically, including during unplanned events or out-of-hours incidents.
FIGURE 1. Visualization on how HACCP can be used in different ways to increase risk visibility and reduce actual food safety risk (Image credit: S.P. Nyarugwe and H. Gough)
Figure 1 shows how incorporating food safety risk into the day-to-day management of an organization increases risk visibility and reduces food safety risk. When a HACCP plan is more of a document than a living system, the plant may be fully audit-compliant but not truly manage food safety. A living HACCP system does not replace compliance; it uses compliance as a foundation and builds capability, awareness, and resilience on top of it.
Transforming Your HACCP into a Living System
High-performing organizations recognize that value is created at the frontline.6 The people who handle products, monitor Critical Control Points (CCPs), and respond to deviations every day sit closest to food safety risk. If HACCP is genuinely risk-based, then it must be designed with the same focus.
Focus on the frontline drives different leadership behaviors. It requires humility, in the sense that leaders may not know everything. When leaders accept that operators play one of the most critical roles in food safety, they actively seek their input and test assumptions against lived experience. Work that looks robust on paper is often revealed to be fragile when examined at the point of use. These "gaps" present real food safety risk to the consumer.
Leaders who prioritize the frontline involve operators in the design and implementation of monitoring activities. They ensure workloads are realistic, instructions are usable in real operating conditions, and controls can be applied consistently under time pressure. Feedback from those performing the tasks is not treated as anecdotal, but as essential data for improving system effectiveness.
This approach is not risk-free. Both leaders and operators may feel exposed. Operators may hesitate to acknowledge where shortcuts are routinely taken or where controls are difficult to sustain. Leaders may worry about uncovering uncomfortable truths. This is where leadership behaviors have a decisive impact. Psychological safety does not emerge from policy statements, but instead from consistent responses. When honesty is met with curiosity, support, and visible follow-through, participation increases and risk becomes easier to surface and manage.
Organizational Stability
Work on food safety culture routinely highlights organizational instability as a significant challenge. In the past three years, the authors' organization has seen 61 percent of its top 30 clients undergo changes in food safety and quality (FSQA) leadership.7 Staff turnover, restructuring, and shifting priorities all affect system health. In the context of HACCP, instability often leads not to excessive change, but to stagnation.
Where a HACCP system is compliant and long established but the team has frequent fluctuations, there can be a strong perception that it is mature and, therefore, effective. If certification is maintained and audit outcomes are acceptable, the question becomes, "Why challenge something that appears to be working?" Over time, this assumption reduces the depth of review rather than encouraging it.
Stability within the HACCP team and the organization's governance structure is critical to system effectiveness. Without a stable, skilled team, the HACCP plan struggles to receive the focused attention it requires. Assumptions embedded years earlier may go unchallenged, even as products, equipment, processes, and risk profiles evolve.
When stability is present, cross-functional collaboration can develop and mature. Team members build confidence in their roles, challenge becomes constructive rather than defensive, and food safety discussions move beyond individual expertise. Knowledge begins to spread outside the HACCP team itself, with tools such as risk matrices and severity concepts becoming part of wider management understanding.
Change in HACCP teams will occur from time to time for valid reasons, and that change needs to be anticipated to ensure continuity within the HACCP team. This established team, working to a regular cadence, creates conditions where ownership is shared rather than concentrated. HACCP remains compliant, but it also becomes resilient and more thorough. The system no longer depends on individual technical expertise alone, and responsibility for food safety risk is evenly distributed across the organization.
Psychosocial Factors
HACCP systems have been widely adopted across the food industry, yet continued food safety outbreaks, including within organizations that are certified and routinely pass audits, suggest that significant risks may remain overlooked, which could lead to unsafe product being sold. Jespersen and Lijana2 suggest that many of these food safety failures emerge from risks associated with organizational culture, for which executive teams are ultimately responsible. These risks often manifest as psychosocial hazards, defined as "the interactions among job content, work organization and management, and other environmental and organizational conditions, on the one hand, and the employees' competencies and needs on the other."8 Such hazards are well established as contributors to sickness absence, reduced productivity, and increased human error.7 In food manufacturing environments, these psychosocial factors typically include job demands, role clarity, workplace relationships, job control, and the level of support available to carry out tasks effectively.9
“When psychosocial factors are weak, even well-designed HACCP plans are undermined. The result is often a compliance-driven culture and a false sense of security…”
In food safety contexts, higher levels of psychosocial safety have been associated with an increased willingness among frontline employees to report near misses, deviations, and uncertainty, especially where controls are difficult to sustain under pressure, with some studies suggesting increases of 21 percent in near-miss reporting.7
When psychosocial factors are weak, even well-designed HACCP plans are undermined. The result is often a compliance-driven culture and a false sense of security, where systems appear robust, but control effectiveness quietly erodes in practice.2 When psychosocial risks are not explicitly considered during HACCP development and review, organizations risk underestimating the true level of operational food safety risk present onsite.7
When psychosocial safety is weak, adaptation becomes silent and insidious. Employees adjust how work is performed to cope with workload and time pressure. These adaptations include shortcuts, informal workarounds, reduced vigilance, and delayed escalation. These are not indicators of poor motivation or weak food safety values. They are rational responses to perceived production pressure and the need to manage personal and organizational consequences.10
Leadership behavior influences whether these adaptations surface or remain hidden. Trust in leadership responses becomes critical. Consistent and supportive reactions to reported issues improve reporting frequency and risk detection. When the reactions are inconsistent, dismissive, or punitive, trust erodes, information flow narrows, and organizations lose access to early warning signals. Leaders may believe they have full visibility of risk, while frontline teams quietly manage problems below the surface.
Workload and time pressure further exacerbate these negative dynamics. High workload reduces rule compliance and increases reliance on shortcuts or heuristics—i.e., strategies used for making decisions unconsciously or consciously,11 particularly among less experienced staff.12 This often manifests as incomplete monitoring, delayed corrective actions, or normalizing deviations during peak production periods. When organizations continue to add requirements, such as additional checks, documentation, or verification without removing or redesigning existing tasks, they inadvertently exceed human capacity. The cost of this addition sickness—i.e., "doing more" without redesigning tasks—is often hidden until controls fail.
Leadership presence also influences how workload and capacity pressures are interpreted at the frontline. When leaders openly acknowledge workload pressures and actively support teams in prioritizing work, food safety controls remain achievable. When pressure is normalized or left unspoken, deviation becomes increasingly accepted, even in systems that are well designed on paper. Phrases such as "We all know it's busy" can unintentionally signal that reduced control is understandable, even if it is truly unacceptable.
This perspective aligns strongly with psychosocial concepts, which emphasize that resilience is built through sustained attention to the conditions that shape daily decision-making, not solely through technical control design.7 As such, psychosocial factors shape risk awareness, how controls are enacted under pressure, and how organizations adapt over time. Strong technical systems operating within weak psychosocial environments tend to be fragile. When robust HACCP design is paired with healthy psychosocial conditions, food safety systems become more resilient, transparent, and capable of responding to change before failure occurs.
Leadership Presence
Leadership influence on food safety is often discussed in terms of structures, governance, commitment, messaging, and priority setting. Far less attention is given to how leadership shows up in everyday interactions. Yet understanding risk and fostering collaboration depends not only on commitment, but also on leadership presence, visibility, and engagement where actual work is done.
In organizations with a mature food safety culture, leaders are consistently visible and curious about hazards and controls, and how systems function in practice. Leadership presence in these environments is not limited to compliance checks. It is about engaging with HACCP as a living system rather than a documentation exercise.
This presence is most effective when leaders conduct Gemba walks at the actual workplace (e.g., factory floor or site) to observe processes and engage with employees. These Gemba walks allow senior leaders to observe the real challenges faced by frontline teams and to build stronger relationships grounded in operational reality.13 When leaders ask frontline teams about hazards, they signal that food safety is not owned solely by the leadership, HACCP, or FSQA teams but instead embedded in daily operations.
The questions leaders ask matter. Questions that move away from asking "Are we compliant?" send a very different message than asking, "Where does this process struggle on a bad day?", "Which controls are hardest to sustain?", or "Where do you see opportunities to improve this process?"
When senior leaders spend time in operational areas observing work as it is being done, asking meaningful questions, and listening, employees perceive HACCP as a genuine organizational priority rather than a competing objective. These perceptions matter as employees calibrate their own behavior based on where leadership attention is consistently focused.13 Research has shown that visible leadership engagement can result in significant improvements in Good Manufacturing Practices (GMP), with reported gains of up to 51 percent.8
“Regular engagement at the frontline gives leaders a more accurate understanding of how controls perform in practice under workload pressure, as well as competing demands. This insight improves the quality of risk decisions across the organization.”
When HACCP concepts are routinely discussed in Gemba walks, shift handovers, and performance meetings, food safety becomes part of how work is planned, prioritized, and adapted in real time. HACCP evolves into a shared language rather than a technical specialty. Teams begin to raise issues proactively rather than waiting for audits or formal review cycles. They become more willing to report near misses and where controls are fragile before escalation into incidents. Moreover, trust deepens and participation increases when food safety concerns are explored and when leaders consistently act on these concerns. Over time, risk information flows improve. Regular engagement at the frontline also gives leaders a more accurate understanding of how controls perform in practice under workload pressure, as well as competing demands. This insight improves the quality of risk decisions across the organization. Without such engagement, systems tend to drift as conditions change.
Where leadership maintains a consistent presence and demonstrates a clear focus on frontline operations, a different dynamic emerges. In these environments, the system is not merely compliant; it becomes adaptive, resilient, and proactive. HACCP functions as a living system that continuously responds to changing conditions and emerging risks. Moreover, leaders are better positioned to detect system drift early and sustain control effectiveness over time.
HACCP Proficiency
A living HACCP system is not sustained by behavior alone. HACCP is a defined, long-established methodology that depends on technical competence, as well as cultural engagement. Without sufficient proficiency, even the most committed teams are limited in their ability to identify, assess, and manage food safety risk effectively.
For many professionals, formal HACCP training takes place once, often early in a career, followed by occasional refreshers required for compliance. Rarely is time taken to reassess whether knowledge remains current, complete, or sufficiently deep to support increasingly complex products, processes, and regulatory expectations.
To address this, Cultivate SA has used a HACCP proficiency assessment15 tool developed by the University of Lancashire in the UK. The tool evaluates understanding across five core areas of HACCP practice:
Codex preliminary steps
Hazard analysis
Identification and control of CCPs
Implementation
Maintenance and review.
Revisiting HACCP knowledge after years of practical experience requires a degree of professional courage. For established practitioners and leaders, there can be an assumption that experience equates to proficiency. What makes this proficiency assessment valuable is not the identification of gaps for their own sake, but rather the clarity it provides. It establishes an honest picture of current capability and enables targeted development where it is most needed, rather than broad or generic retraining.
This matters because HACCP terminology and structure are not academic concepts. They are the mechanisms through which risk is understood and controlled. If a HACCP team member cannot clearly distinguish between validation and verification, then the system cannot deliver robust validation by definition. In that situation, the HACCP plan may remain compliant, but it cannot be relied upon as a fully effective risk management tool.
Competence, like culture, requires maintenance. When proficiency is taken seriously, HACCP becomes easier to sustain, the HACCP team is open to challenging the existing plan and the assumptions behind it, and the resulting HACCP plan becomes far more effective in protecting consumers and businesses alike.
The Critical Role of Food Safety Culture
Many organizations invest heavily in HACCP design, training, and certification, yet still experience very different food safety outcomes across sites that appear technically similar. Effectiveness of HACCP is limited when behavioral consistency, leadership commitment, resource availability, psychosocial factors, and team health are weak.16 However, one of the clearest explanations for this divergence is food safety culture maturity. An organization's level of cultural maturity explains why some sites continue to progress toward excellence, while others stabilize at a level of basic compliance and struggle to move beyond it.
Food safety culture maturity reflects how deeply food safety is integrated into everyday decision-making, not just how well systems are documented. In more mature organizations, HACCP is understood as a shared responsibility, and actions are driven by risk management across the organization. In less mature environments, HACCP tends to be treated as a specialist function, activated primarily during audits, incidents, or external pressures (e.g., regulators).
“Food safety culture maturity determines whether issues are surfaced early or remain hidden.”
Maturity also influences how risk is interpreted. In lower-maturity settings, risk is often viewed through a narrow, binary lens: compliant or non-compliant. If records are complete and audits are passed, then risk is assumed to be controlled. In more mature organizations, risk is understood as dynamic and context-dependent. Leaders and teams recognize the importance of the organization's context and the need to adapt and remain proactive.
Maturity also shapes food safety responsibilities when issues arise. In organizations where food safety culture is less developed, responsibility for identifying and addressing risk tends to sit primarily with the HACCP team or FSQA function. Operational teams may see deviations as "someone else's problem," particularly if raising concerns is perceived to create extra work or conflict. By contrast, mature organizations distribute ownership more broadly. Operators, supervisors, engineers, and leaders work collaboratively, and all see themselves as responsible for managing risk.
More importantly, food safety culture maturity determines whether issues are surfaced early or remain hidden. In lower-maturity cultures, deviations and near misses are often managed quietly. Normalization of deviance is a prevailing social norm and labeled as "acceptable risk." Teams adapt their work locally to keep production moving, while food safety issues reoccur and remain unresolved. Data is rarely used in decision-making. This creates an illusion of stability, where systems appear to function until a significant food safety incident or external pressure directs attention to the issue. In more mature food safety cultures, variability is treated as valuable information. Near misses, workarounds, and uncertainty are discussed openly, and making food safety problems visible and solving them is a social norm.
Organizational maturity also affects how improvement efforts and change initiatives are approached. Less mature sites often focus on reactive controls, which may improve short-term compliance. In more mature organizations, everyone proactively seeks ways to continuously improve, and food safety evolves to a forward-thinking, data-driven, and collaborative process.
The maturity of the food safety culture determines whether the HACCP plan functions as intended over time. This maturity explains how different outcomes across sites can be seen even when the same tools, standards, and training are used. Where organizational maturity is low, the HACCP system may remain compliant but still be vulnerable to drift, blind spots, and unexpected outcomes and failure. Where maturity is high, the HACCP approach becomes resilient and capable of adapting to change without control being lost. Evidence from the literature consistently shows that even the most advanced HACCP-based systems remain vulnerable when safe behaviors are not embedded, risk communication breaks down, or leadership support is absent.16
Takeaway
HACCP remains a cornerstone of food safety management, yet compliance alone does not guarantee control of real-world risk. As this article has explained, many organizations operate technically compliant systems that function as static artifacts rather than as active mechanisms for understanding, communicating, and managing food safety risk. When HACCP is treated primarily as documentation for audits, its ability to surface weak signals, adapt to change, and support effective decision-making is diminished.
Reframing HACCP as a living system requires attention not only to technical design, but also to how risk is experienced and acted upon at the frontline. Leadership presence, frontline focus, organizational stability, psychosocial conditions, and shared proficiency fundamentally shape whether controls hold under pressure or erode over time. Food safety culture maturity determines whether HACCP is used to learn, challenge assumptions, and strengthen resilience, or whether it provides a false sense of security.
Ultimately, the difference between a compliant HACCP system and an effective one lies in how deeply it is embedded in everyday work and how risk is understood by plant employees. When HACCP is visible, understood, and routinely discussed across functions and levels, it becomes more than a regulatory requirement. It becomes a practical, shared framework for protecting consumers and sustaining control in complex and changing environments.
References
Codex Alimentarius Commission. "CXC1-1969: General Principles of Food Hygiene." Revised 2022. https://openknowledge.fao.org/server/api/core/bitstreams/6866dc55-d2c0-48dd-a528-a4d634f1b0b4/content.
Jespersen, L. and B. Lijana. "Where Food Safety Culture and Systems Collide: Do You Know Your Company's Psychosocial Risks?" Food Safety Magazine April/May 2024. https://www.food-safety.com/articles/9378-where-food-safety-systems-and-culture-collide-do-you-know-your-companys-psychosocial-risks.
International Organization for Standardization (ISO). "ISO Standard No 22000:2018: Food Safety Management Systems—Requirements for Any Organization in the Food Chain." Section 5.1. Edition 2. 2018. https://www.iso.org/standard/65464.html.
Wallace, C.A., W.H. Sperber, and S.E. Mortimore. Food Safety for the 21st Century: Managing HACCP and Food Safety Throughout the Global Supply Chain. John Wiley & Sons, 2018.
Liu, F., et al. "HACCP Certification in Food Industry: Trade-Offs in Product Safety and Firm Performance." International Journal of Production Economics 231, no. 107838 (January 2021). https://www.sciencedirect.com/science/article/abs/pii/S0925527320302061.
Zook, C. and J. Allen. The Founder's Mentality: How to Overcome the Predictable Crises of Growth. Harvard Business Review Press, 2016.
Jespersen, L. A Decade of Cultivating Food Safety: Our Hard-Learned, Hands-On, Global Lessons. 2025.
Leka, S. and A. Jain. Health Impact of Psychosocial Hazards at Work: An Overview. World Health Organization, 2010. https://iris.who.int/items/32806e00-e5b0-40f7-939c-43bdcd912dea.
Gracia, F.J. and M. Martínez-Córcoles. "Understanding Risky Behaviours in Nuclear Facilities: The Impact of Role Stressors." Safety Science 104 (April 2018): 135–143. https://www.sciencedirect.com/science/article/abs/pii/S0925753517315655.
Dekker, S. and T. Conklin. Safety Differently. CRC Press, 2014.
Mousavi, S. and G. Gigerenzer. "Risk, Uncertainty, and Heuristics." Journal of Business Research 67, no. 8 (August 2014): 1671–1678. https://www.sciencedirect.com/science/article/abs/pii/S0148296314000885.
Hollnagel, E. Safety-I and Safety-II: The Past and Future of Safety Management. CRC Press, 2018.
Gesinger, S. "Experiential Learning: Using Gemba Walks to Connect with Employees." Safety Management 61, no. 2 (2016).
Singer, S.J. and A.L. Tucker. "The Evolving Literature on Safety WalkRounds: Emerging Themes and Practical Messages." BMJ Quality & Safety 23, no. 10 (2014). https://doi.org/10.1136/bmjqs-2014-003416.
Wallace, C.A., L. Jespersen, and S.P. Nyarugwe. "Testing and Improving HACCP Team Proficiency to Strengthen Food Safety Culture." IAFP European Symposium on Food Safety. Aberdeen, Scotland, 2023.
Jevšnik Podlesnik, M. and P. Raspor. "Modern Food Systems Challenged by Food Safety Culture." Food Technology and Biotechnology 64, no. 1 (2026): 81–96. https://ftb.com.hr/archives/1983-modern-food-systems-challenged-by-food-safety-culture.