HACCP Certification in Malaysia: Principles, Requirements and Process

HACCP means Hazard Analysis and Critical Control Point. It is a preventive food safety system: a business identifies significant hazards in its food and processes, establishes controls, and keeps evidence that those controls work. HACCP certification is a separate assessment of that implemented system against a particular scheme’s requirements. A training attendance certificate is different again; it records a person’s participation in a course, not certification of a factory or its products.[1][2]

For the Ministry of Health Malaysia (MOH/KKM) HACCP scheme, prepare the applicable HACCP and prerequisite programmes, operate them with records for at least three months before applying, and submit through FoSIM. MOH-appointed auditors review the documents and actual production, assess corrective actions, and report for the authority’s certification decision. Other certification bodies have their own criteria and conditions, so establish which certificate your buyer or export arrangement accepts before choosing a route.[1][2]

Is HACCP certification compulsory in Malaysia?

For food-manufacturing premises, the general duty is to establish a food safety assurance programme; it does not mean every food business must obtain a HACCP certificate.[3]

MOH explains that the Food Hygiene Regulations 2009 require owners and occupiers of food-manufacturing premises to establish a food safety assurance programme, or Program Jaminan Keselamatan Makanan (PJKM). It lists GMP, HACCP and ISO 22000 as examples. MOH introduced MeSTI, Makanan Selamat Tanggungjawab Industri, to help manufacturing premises develop a programme meeting the regulations’ minimum requirements.[3]

That food safety duty is distinct from a requirement for a particular certificate. For your operation, establish:

• What Malaysian food legislation and any product-specific licensing conditions require.
• Whether an importing country’s rules, export listing or health-certificate arrangements impose additional conditions for your product.
• What your customer’s written supplier specification requires, including the issuer, scheme and certified scope.

MOH identifies fish and fish-product export requirements among the purposes of its HACCP scheme. That does not establish one identical certification requirement for every food exported to every country. Nor does a customer’s purchasing condition become a universal legal obligation.[1]

MeSTI, GMP and HACCP are not a compulsory sequence of certificates that every business must buy. Choose the system and certification route that address your obligations, hazards and market requirements.

Which HACCP certification route should you choose?

Start with the certificate you need to present, rather than the cheapest quotation or the most familiar logo.

The MOH webpage requires the latest revisions of MS 1480 and MS 1514. MS 1480:2025 is the current edition used for this guide’s Malaysian HACCP explanation; MS 1514 provides the GMP/PRP foundation. A Malaysian Standard is a technical reference, not the Food Act itself. Obtain the applicable standards legitimately and confirm any transition instructions for an existing certificate directly with its issuer.[1][2][5]

MOH’s published notice sets a two-year transition from MS 1480:2019 to MS 1480:2025, from 24 October 2025 to 24 October 2027. Existing audit checklists remain applicable during this period, and industry and auditors will be informed of updates. Do not assume this MOH notice sets every private certification body’s timetable.[7]

Some other schemes describe a Codex basis. For example, LL-C’s Malaysian HACCP page identifies the seven principles and twelve steps in Codex CXC 1-1969 as its technical reference. That statement does not establish that every certification body uses identical criteria or that its certificate replaces an MOH certificate for every purpose. Request the body’s current scheme documents and the applicable edition in writing.[6]

Codex supplies international technical guidance; it does not issue your premises certificate. The reference used here is CXC 1-1969, revised in 2022 and published by FAO/WHO in 2023.[4]

Does the MOH scheme cover only factories?

Food manufacturers are its main audience, but the scope needs a more careful answer. MOH’s Rev.7 guide covers registered Category P1 premises and certain Category P2 premises, giving central kitchens and hospitals as examples. HACCP certification is granted for specific food categories, whereas the guide describes GMP certification for the entire manufacturing premises.[2, §3.1]

A restaurant, caterer or other food-service operator should therefore confirm its registration category and proposed scope with MOH rather than assume either automatic eligibility or automatic exclusion. A certificate also does not automatically cover another site or every new product your company introduces.

MOH HACCP requirements: what to prepare before applying

A manual alone is not enough. The application needs an operating system, suitable premises and evidence from the work being certified.

The following is a preparation summary of the public scheme guide, not an exhaustive standards checklist.[2, §6]

1. Confirm the business and premises registrations. Register the premises with MOH through FoSIM. The guide also requires SSM registration and a local-authority or relevant government-agency licence, with exceptions to those two requirements for government facilities.
2. Prepare financial and product-specific documents. The guide calls for audited accounts, or a bank statement for a company less than one year old. Premises processing packaged drinking water, natural mineral water or ice need the relevant valid MOH licence before applying.
3. Develop the applicable HACCP and GMP/PRP systems. Use MS 1480 and MS 1514, respectively, alongside any other requirements MOH imposes. The system must describe your operation, not an unrelated factory’s procedures.
4. Have management approve the manual. The required manual must be available at submission, signed and dated by management with executive responsibility.
5. Implement and retain records for at least three months before application. This is a prior-operation requirement, not a promise that MOH will complete certification within three months.
6. Check repacking and outsourced processing arrangements. Under §6.10, where an applicant repacks or outsources processing, the raw-material supplying premises and external processing premises must hold valid PJKM certification equivalent to that being sought. Resolve the application of this requirement to your supply chain before submission.

What should the HACCP manual and supporting evidence contain?

Appendix 1 of the scheme guide gives minimum content and explicitly does not limit the manual to that list. A useful way to organise readiness is to connect each part of the system with evidence of its operation:

• Company background, plant layout, management policy and objectives, responsibilities, HACCP team and defined scope.
• Product descriptions, intended consumers and process flow diagrams confirmed against the operation.
• Hazard analysis, the HACCP plan summary and the technical basis for controls and critical limits.
• Validation, internal audit, management review, and the overall verification activities and schedule.
• Control of non-conforming product, traceability, notification and recall arrangements, measuring equipment and maintenance.
• A summary of prerequisite programmes, supported by the relevant procedures and operating records.

For example, a monitoring procedure should connect to completed monitoring records, any deviations, the disposition of affected product and the review of those records. Training records should connect to what staff can explain and do. The public guide is a starting point; assess the complete applicable scheme and standard requirements for your site.[2, Appendix 1]

How to apply for MOH HACCP certification

The official application process is separate from any consultant’s service framework. A capable internal team can prepare and apply without purchasing a consultancy package.

1. Submit the application through FoSIM

Use the official FoSIM portal for a new application, renewal or additional-product application. Submit the required forms and supporting documents for the intended premises and scope. Rev.7 permits only one application at a time.[2, §7]

2. Respond to completeness checks and obtain the quotation

MOH checks the application and documentation. Once complete, it issues a quotation through FoSIM. Resolve missing or inconsistent information promptly; submission does not mean the application is accepted as complete.

3. Pay the quoted charges and allow for administrative processing

The guide requires payment within one month of quotation issuance and states that payments are non-refundable. For new and additional-product HACCP applications, payment goes through MOH Trust Account approval before auditor appointment. Rev.7 describes Finance Department approval meetings twice a year. Ask MOH how this affects your particular application rather than promise an audit date from the day you submit.[2, §§7–8]

4. Complete document review and the on-site audit

MOH appoints the audit team, and the lead auditor agrees the arrangements with the applicant. The adequacy audit reviews the HACCP and GMP manuals; the on-site audit checks implementation and records.

Actual processing within the applied scope must be available during the official on-site audit. Mock production is not allowed. Coordinate the audit with the relevant production activities. A consultant’s mock audit can help with preparation, but cannot replace this official assessment.[2, §§9–10]

5. Address findings and provide evidence of effective correction

Where auditors issue Corrective Action Requests (CARs), respond with the required actions and evidence. Rev.7 calls for a response to the lead auditor within two weeks after the on-site audit. Serious non-conformities require immediate action and satisfactory closure within two weeks. For new and additional-product audits, the guide gives a maximum of one year from the on-site audit to complete the process and satisfactorily close other CARs; renewal and surveillance audits have a six-month maximum. These are outer closure limits, not expected certification times or permission to delay food safety action. Follow-up audits may be needed.[2, §§10–11]

Correcting a form without correcting the underlying practice will not demonstrate that a food safety problem has been controlled.

6. Await the authority’s decision

The lead auditor reports to the secretariat, and the relevant committee decides the application status. Certification is granted upon approval. Neither training attendance, payment nor a consultant’s involvement guarantees that decision.[2, §§10–11]

How long does certification take?

Separate the time needed to become ready from the time needed to process and audit the application. Under the MOH route, at least three months of implemented records must already exist before applying. Facility work, technical validation, application completeness, payment approval, production scheduling and corrective-action closure can add time.

An existing well-maintained system and a new operation with unfinished facilities will not have the same preparation programme. Obtain a site-specific schedule, then confirm authority-controlled stages with MOH. A certification body’s advertised timetable should not be treated as the timetable for a different scheme.

How much does HACCP certification cost in Malaysia?

Budget for the official scheme charges and the work needed to operate the system. They are different costs.

The following published MOH HACCP amounts were checked against its public scheme webpage and Rev.7 fee schedule for this guide on 30 October 2026. They are not an all-inclusive quotation.[1][2, §8 and Appendix 2]

 

The application-fee unit matters. Appendix 2 describes one application as one food category with a maximum of three processes, or various food categories with one process. MOH’s final quotation depends on the food categories and processing complexity. Do not assume one payment covers an unlimited product range.

The official webpage and Rev.7 use different wording for industry-size thresholds. Ask MOH to confirm your fee category, particularly at a workforce or turnover boundary, rather than classify your business from a generic SME definition. Rev.7 expressly leaves the final classification decision to MOH and provides a 50% HACCP certification-fee reduction for applications from government agencies other than MOH; confirm its application in the quotation.[2, Appendix 2]

Auditor expenditure and other costs

Rev.7 separately lists auditor expenditure of RM3,420 for Peninsular Malaysia and RM4,040 for Sabah, Sarawak and W.P. Labuan, applicable to new and additional-product applications. The MOH webpage describes its auditor-travel charge as applying to new HACCP and additional non-variant-product applications. Confirm the treatment of a proposed product addition and the payable quotation before budgeting.[1][2, Appendix 2]

Beyond those charges, your budget may need to cover:

• Staff time and any training needed to close competence gaps.
• Optional consultancy and documentation support.
• Technical studies, laboratory testing and calibration appropriate to the operation.
• Premises repairs, hygienic design, equipment or other facility improvements.
• Ongoing monitoring, verification, maintenance and record control.

Request separate scopes and prices for these items. Another certification body’s audit fees and surveillance charges need their own quotation; the MOH table is not its price list. Training-funding eligibility also depends on the programme, employer and claim conditions, not simply on choosing HACCP training.

HACCP, GMP and the seven principles

GMP and other prerequisite programmes establish the conditions needed for safe food production: suitable facilities, cleaning, pest control, personal hygiene, water, maintenance and control of materials, among other activities. HACCP focuses on significant food safety hazards and the controls required for the particular product and process. A written HACCP plan cannot compensate for prerequisite programmes that do not work.[2][4, §18]

For a sambal producer, that means understanding ingredients and allergens, equipment, filling and storage conditions, and how the finished product will be used. A frozen-meal line or a chilled dairy process needs a different assessment. Finished-product testing can support verification, but it does not replace control during production.

How the twelve steps relate to the seven principles

The first five Codex steps prepare the information needed for a defensible plan:

1. Assemble the HACCP team and identify the scope.
2. Describe the product.
3. Identify its intended use and users.
4. Construct the process flow diagram.
5. Confirm that diagram on site.

Steps 6–12 then apply Principles 1–7 below. They are not twelve additional principles. Walk the process before analysing it, including relevant rework, holding, outsourced stages and material inputs. A diagram that misses part of the operation can produce an incomplete hazard analysis.[4, §19]

Principle 1: analyse hazards and identify control measures

Identify possible biological, chemical and physical hazards at each step, then evaluate which are significant and how they will be controlled. Naming a broad category such as “bacteria” is less useful than identifying the organism or hazard of concern, its source and why the process could allow it to occur.

For an illustrative cencaluk operation, the team might investigate pathogen survival or growth during fermentation, allergens associated with shrimp, the use and declaration of any sulphites, and potentially injurious shell fragments. The significance of each hazard depends on the actual ingredients, process, intended use and evidence. This is an investigation prompt, not a completed hazard analysis.[4, §19.6]

Principle 2: determine critical control points

A critical control point (CCP) is a step where control is essential for a significant food safety hazard. Not every important hygiene task is a CCP. Document the reasoning using the actual process, existing prerequisite controls and an appropriate decision method.

A heat-treatment step in a manufactured teh tarik drink could be a CCP if the hazard analysis establishes that role. The product name alone cannot determine the CCP, and another line’s CCP list is not a substitute for your analysis.[4, §19.7]

Principle 3: establish validated critical limits

Set measurable or observable limits for each CCP and establish evidence that they can control the hazard under your operating conditions. Depending on the control, relevant parameters could include time, temperature, pH or water activity.

A milk processor needs a technically justified treatment appropriate to its product and equipment. Copying a temperature from a general article without considering holding time, flow, formulation and the rest of the process is not validation. Suitable evidence may come from authoritative guidance, relevant scientific literature or appropriately designed studies, provided it applies to the operation.[4, §19.8]

Principle 4: monitor control at CCPs

Specify what to measure or observe, how, when, who is responsible and how the result is recorded and evaluated. The method and frequency must detect loss of control in time to isolate and assess affected product.

Where a thermal process can deviate rapidly, an occasional handwritten temperature entry may not reveal what happened between checks. Select monitoring that fits the process; an hourly check is not a universally adequate rule.[4, §19.9]

Principle 5: establish corrective actions

Plan what happens when a critical limit is not met. Restore control, identify and hold potentially affected product, evaluate its safe disposition, investigate the cause and prevent recurrence as appropriate. Identify who has authority to make those decisions.

For a heat-treatment deviation, do not simply restart the equipment and release the batch. The team needs to establish which product was affected and whether an approved, technically supported disposition is possible. Reprocessing is not automatically safe for every hazard.[4, §19.10]

Principle 6: validate the plan and verify the system

Validation establishes whether the plan and its controls are capable of controlling the significant hazards. Validate the plan before implementation, obtain operational evidence during initial implementation, and revalidate where relevant changes require it.[4, §19.11.1]

Verification checks whether the implemented system is being followed and works as intended. Activities can include reviewing monitoring and corrective-action records, checking measuring equipment, observing operations, internal audits, and suitable sampling and testing. Their frequency needs a reason; weekly calibration or quarterly auditing is not a universal prescription. Codex advises that verification should be performed by someone other than the person responsible for monitoring and corrective action.[4, §19.11.2]

The practical distinction is:

• Monitoring: What does the CCP measurement or observation show during this production run?
• Validation: What evidence supports the control’s ability to manage the hazard in these conditions?
• Verification: What checks show that the system continues to operate as intended?

An internal audit or a satisfactory product-test result does not, by itself, validate every control measure.

Principle 7: document procedures and keep records

Maintain the hazard analysis, CCP decisions, critical-limit justification, procedures, monitoring results, corrective actions and verification evidence appropriate to the operation. Records may be paper or electronic, but they must be accurate, usable and retrievable.[4, §19.12]

A missing record creates an evidence gap and may fail an applicable requirement. It does not prove that an activity never occurred. Investigate the gap and any food safety implications; never invent historical results to make a file appear complete.

These principles work together. Monitoring can reveal a deviation, corrective action addresses it, verification checks the response, and review may require changes to the hazard analysis or plan.

Build a competent HACCP team

Bring together people who understand the products and daily operation. Production, QA/QC, engineering or maintenance, sanitation and relevant purchasing or warehouse staff can contribute different knowledge. Management must provide authority, resources and support rather than leave the plan with one QA employee.[4, §§18–19]

MS 1480:2025 addresses team knowledge, role competence, training planning, awareness and evaluation of training effectiveness. Its team provisions include formal HACCP principles-and-application training for the coordinator/team leader and/or a team member. This is not a requirement for every employee to purchase the same external course.[5, §§4.1.2–4.1.3]

Competent internal delivery can address training needs where it meets the applicable requirements. Seek external expertise when the necessary knowledge or resources are unavailable. In Al Barakah Training Solution’s training practice, businesses also seek outside support when internal teams lack time or delivery capacity; that is a practical choice, not proof that internal training is inferior.

An operator assigned to monitoring needs to demonstrate the correct method and response to a deviation. Keep training and experience records, but also assess understanding and performance. Attendance alone does not establish competence.

Which training fits your team and system?

We offer different programmes for different starting points. Choose by both team knowledge and the maturity of the existing system, rather than treating all two-day courses as interchangeable.

For teams without manual-building experience, we normally recommend establishing sound awareness before the initial implementation course. In the existing-system combined programme, day one may include workers alongside the HACCP team; day two concentrates on the team’s technical and manual discussions. Renewal does not automatically make that programme mandatory.

Where the learning need is the relationship between basic manufacturing practices and HACCP, our separate GMP/HACCP Awareness Course addresses that introductory combination. It does not replace an operation-specific plan or the distinct implementation and review programmes above.

The four HACCP programmes in the table issue our Certificates of Attendance. They do not include an examination or an assessed-competency award. These certificates can support training records; they do not certify the premises, independently prove role competence, appoint an official MOH auditor or guarantee acceptance by every auditor. Programme labels such as “Level 1” or “Level 2”, where used in a provider’s pathway, should not be assumed to be national qualifications.

Before booking, confirm the intended audience, applicable technical references, practical work, trainer’s relevant experience and how your organisation will assess learning in the workplace. Confirm any funding eligibility separately.

When consulting support is useful

A team with sufficient expertise and resources can implement HACCP itself. Consulting support is useful when the team needs help resolving technical gaps, organising implementation or coordinating documentation and audit preparation.

Our AKDeVeC framework describes our consulting work, not the government’s application procedure:

• Analysis: establish the scope and assess gaps in operations, facilities and documentation.
• Knowledge: address relevant learning needs so the internal team can operate the system.
• Development: work with the team on the HACCP plan, prerequisite procedures and records.
• Verification: review implementation and use internal or mock-audit findings to identify remaining gaps.
• Certification support: assist with documentation, communication and audit preparation for the chosen route.

Validation of technical controls remains a distinct task; a mock audit cannot replace it. The business retains responsibility for its food safety system, and the certification authority retains the decision to award a certificate.

If you need this support, discuss your products, processes, premises and target scheme through our HACCP consulting service. Establish a written scope, responsibilities, exclusions and realistic programme before committing.

Certificate validity, surveillance and renewal

For the MOH scheme, Rev.7 gives a three-year certificate term, except for certificates obtained through fast-track arrangements. Additional products follow the validity of the existing HACCP certificate; they do not automatically start a fresh three-year term.[2, §§12–13]

MOH specifies at least one surveillance audit during the certification period. Do not replace that with a blanket claim that every MOH certificate requires annual surveillance. Another certification body’s scheme may set a different schedule.[1][2, §4.13]

Apply for MOH renewal at least six months before expiry. Rev.7 also states that renewal can be rejected where surveillance has not been conducted six months before expiry without valid justification or MOH agreement. Applications after expiry are rejected and require a new application. Coordinate surveillance and renewal early rather than assume the printed expiry date is the only deadline.[2, §7]

MOH also provides fast-track arrangements involving GMP/MeSTI certification. Their validity follows the underlying certificate. Its HACCP webpage qualifies GMP fast-track by current HACCP/GMP performance and surveillance findings, so confirm eligibility rather than promise an unconditional additional certificate.[1][2, §12]

Maintain the system between audits

Keep monitoring and prerequisite activities running during normal production. Review deviations, complaints, verification results and changes to ingredients, suppliers, equipment, processes or intended use. Update the hazard analysis and plan when those changes affect safety, and revalidate where necessary.[4, §§18–19]

Plan internal audits with appropriate impartiality, follow up corrective actions, and keep documents and records controlled. MS 1480:2025 requires management review at intervals no longer than twelve months; that review includes resource and training needs. It is not an instruction to retrain every worker annually.[5, §§6.4–6.5]

Review training needs and effectiveness periodically and when duties, processes or performance indicate a gap. Check any specific scheme, customer and organisational requirements when setting refresher arrangements. Do not use a premises certificate’s three-year validity as the reason for a training schedule.

Frequently asked questions

Does a HACCP course make my company HACCP-certified?

No. A course addresses learning; premises certification requires assessment of an implemented system under the selected scheme. For the four programmes described above, our certificate records attendance, not an assessed professional qualification or approval of your factory.

How can I get my HACCP certification as an individual?

Choose training appropriate to your role. For the four HACCP programmes in the table, Al Barakah Training Solution issues a Certificate of Attendance, with no examination or assessed-competency award. This records attendance, not independent proof of competence, appointment as an official MOH auditor or certification of food premises. Premises certification follows the separate scheme process.

How much does a HACCP course cost?

For the current course fee, contact us through the course enquiry page. For in-house training, request a customised quotation. Course fees are separate from the MOH premises-certification charges above.

Can a small food business apply directly for MOH HACCP certification?

It can apply if it meets the applicable premises, system, documentation and other scheme requirements. Business size does not replace those requirements. Check the relevant premises category, certified scope and fee classification with MOH; obtaining a different certificate first is not a universal step in the HACCP application process.[2]

Is HACCP the same as halal certification?

No. HACCP addresses food safety hazards and their control. Halal certification addresses a different set of requirements and approval arrangements. MOH describes HACCP as supporting other assurance systems, including halal; one certificate should not be represented as the other.[1]

Can we check whether a supplier holds MOH HACCP certification?

MOH directs users to the FoSIM public-access service to check certificate holders. Match the premises, products and certificate status to what you are buying. A certificate image for another address or an expired scope is not enough.[1]

Does adding a product extend our certificate or permit logo use on everything?

No. MOH provides an additional-product application route, and added products follow the existing HACCP certificate’s validity. Its logo-use conditions limit use to food products produced at the certified premises and listed in FoSIM. Check the treatment of your addition before changing labels or claiming certified status.[1][2, §§13 and 20.6]

Sources

Public scheme webpages were checked on 30 October 2026. The MOH guide below is Rev.7, May 2026, retrieved on 29 October 2026 and linked from the scheme page. Confirm current conditions and payable charges with the issuer when applying.

1. Ministry of Health Malaysia: HACCP certification scheme — scope, application requirements, fees, FoSIM resources, validity, renewal and certificate-holder checks.
2. MOH: Guideline for Malaysian Certification Scheme for HACCP and GMP, MCS-HACCPGMP/REV.7 — especially §§3, 6–13 and 20, and Appendices 1–2. Fee figures are scheme charges, not a quotation for training or consulting.
3. Ministry of Health Malaysia: MeSTI — explanation of the food-manufacturing PJKM duty and the purpose of MeSTI.
4. FAO/WHO: General Principles of Food Hygiene, CXC 1-1969 — revised 2022, published 2023; particularly §§17–19 for HACCP principles and application.
5. Department of Standards Malaysia: MS 1480:2025, Food safety according to the Hazard Analysis and Critical Control Point (HACCP) system — referenced for team competence, training, internal audit and management review (§§4.1.2–4.1.3 and 6.4–6.5). Consult a legitimately obtained copy for the complete requirements; this guide is not a substitute for the standard.
6. LL-C: HACCP certification — the provider’s description of its Codex-based technical reference, not evidence of universal scheme equivalence or buyer acceptance.
7. Ministry of Health Malaysia: transition from MS 1480:2019 to MS 1480:2025 (HACCP) — two-year transition from 24 October 2025 to 24 October 2027, existing audit checklists and update notices; checked on 30 October 2026.