The Malaysian Food Manufacturer’s Guide To HACCP Certification

In Malaysia, Hazard Analysis and Critical Control Point (HACCP) certification by the Ministry of Health (MOH) acknowledges that a food manufacturing premises can identify and control food safety hazards at the critical points of its process, as set out in MS 1480.

As among the strictest food safety standards in Malaysia, it requires a serious amount of effort, and below we explain everything businesses need to handle their own application.

Here’s how we’ve broken it down:

• certification fees
• eligibility requirements
• your HACCP manual
• steps in the application process
• the various audits to prepare for
• addressing non-conformities
• validity, renewals, and adding products
• a brief note on the MeSTI-GMP-HACCP link

Of course, you’re welcome to skip the guide and get in touch for help!

Otherwise, let’s begin.

Certification & auditor fees

MOH uses a two-tier fee structure based on industry size for HACCP certification:

Size	Criteria	New HACCP Application Fee
Big Industry (BI)	150 workers and annual turnover RM25 million	RM5,400
Small & Medium Industry (SMI)	<150 workers and annual turnover up to RM25 million	RM4,000

On top of the certification fee, there is also a flat auditor fee of RM3,420 for premises in Peninsular Malaysia and RM4,040 for Sabah, Sarawak, and Labuan.

Payments are strictly non-refundable even if your application is rejected or canceled, so make sure you lay all the groundwork before submitting it.

And finally, keep in mind the numbers above are for one application.

What one HACCP application covers

Unlike the more foundational GMP which certifies an entire premises, HACCP is granted per food category – what you apply for is what you get certified for. MOH defines one HACCP application as either one food category across a maximum of three processes, or various food categories with a single process.

Food categories are set by the Food Regulations 1985, and your final quotation is worked out from how many categories you’re applying for and how complex the processing is.

This means a manufacturer with one product line and a couple of processing steps pays close to the table figure, while a facility running several categories through several processes will be quoted well above it. Finally, only one application can be filed at a time!

Eligibility requirements

The most crucial requirement – and the hardest to meet – is that your HACCP system must be fully implemented for a minimum of three months prior to application.

This must be proven with records that show your CCP monitoring and corrective actions actually happened during this period, so by the time you apply, your facility should already be capable of catching and fixing issues before they reach the consumer.

In addition, your facility must fulfill the following requirements:

• the premises must be registered as a food premise with FoSIM
• valid registration with SSM
• valid PBT composite license
• audited accounts or recent bank statements (for companies less than one year old)
• MOH ice preparation license (if applicable)
• MOH packaged drinking water / natural mineral water license (if applicable) 
• a GMP / PRP system in place and documented against MS 1514

Just to clarify that last requirement, you don’t need a GMP certificate, but you do need to demonstrate GMP practices being implemented.

All that you have learned and put into practice should be documented in your HACCP Manual.

Your HACCP Manual

The HACCP Manual is how you turn MS 1480 into a plan specific to your products and processes – no two facilities are alike so neither are HACCP Manuals, but at the end of the day they all comply with HACCP principles.

Per MOH requirements, your manual must include six mandatory sections:

1. Background: Must provide a comprehensive company profile and detailed plant layouts.
2. Management Responsibility: Must set out your organisation chart, food safety policy and objectives, the scope of the HACCP plan, your HACCP team and their responsibilities, product descriptions with intended consumers, and process flow diagrams.
3. HACCP Plan: Must contain your hazard analysis worksheet and HACCP plan summary, plus validation, internal audit, and management review.
4. Operation and Maintenance of the HACCP System: Must cover control of non-conforming products, traceability, notification and recall, control of measuring equipment and methods, and maintenance.
5. Overall Verification: Must detail your verification activities and the schedule they run on.
6. Summary of Pre-Requisite Programmes: Must summarise the GMP/PRP controls your HACCP plan depends on.

This requires understanding MS 1480 requirements, your process, making necessary changes, and documenting procedures. It’s not something you should rush, or you will spend even more time addressing auditor concerns later on.

This document must be formally signed and dated by management with executive responsibility to signify top-down accountability, and is a supporting document during application submission.

Application steps

An application for HACCP certification has seven main steps.

Two of them are time sensitive, so if you see a time frame, it means you need to follow it or risk automatic cancellation!

Step	Stage	Description
1	Online Registration	Log into the FoSIM portal and register the premises.
2	Submission Protocols	Submit the online form together with the mandatory supporting documents, including SSM documents, licensing documents, audited accounts, and the HACCP Manual.
3	Completeness Check	MOH reviews the submission.  Time frame: Submit amendments within 14 working days of notification to avoid cancellation.
4	Make Payment	Upon approval of documents, MOH issues a quotation.  Time frame: Payment for certification and auditor fees must be made within 1 month.
5	Trust Account Approval	Payment is submitted to the MOH Trust Account for approval before auditors can be appointed.
6	Auditor Appointment	MOH appoints at least two auditors to conduct audits.
7	Committee Evaluation	Following the audit, the final report is reviewed by a formal Committee which determines the application’s approval.

There are two audits you will need to pass between Steps 6 and 7 in this process.

Adequacy audit

Your submitted HACCP and GMP Manuals are reviewed to check it against MOH requirements. The lead auditor collates the team’s comments and sends them to you, and you must respond before or during the on-site audit.

On-site audit

This is a physical, on-site inspection of your manufacturing premises where the two auditors will visit to verify that the HACCP plan documented in your manual is actually being followed.

You must be running actual production within the certification scope on the day – mock production is not allowed, and a facility that can’t demonstrate live processing risks having the audit postponed or the application cancelled outright.

Once any issues raised have been resolved, the lead auditor submits the final report to the Committee for approval and certificate granting.

Addressing non-conformities

No matter how carefully you try to follow HACCP requirements, chances are that auditors will identify areas that need improvement and notify you through Corrective Action Requests (CARs).

These are classified as observation, minor, major, or serious, each with its own required response timeframe:

• within 2 weeks: respond to the CARs following the on-site audit.
• within 2 weeks: serious non-conformities must be satisfactorily corrected and closed – and if they aren’t, your application can be cancelled.
• within 1 year: new applications must resolve and close all other CARs.
• within 6 months: renewal and surveillance applications must resolve and close all CARs

You make the changes as needed, and a follow-up audit or document verification will then be conducted to confirm the corrective actions have been implemented.

If the follow-up audits reveal no further issues, the committee should issue your HACCP certificate, which will be valid for three years – yehaw!

Surveillance audit

Once certified, HACCP-certified premises must pay for a mandatory surveillance audit to verify that the HACCP system continues to be properly implemented and maintained. 

The fee is a flat RM1,800 across both industry sizes and must be conducted at least once during the certificate’s validity period.

Unlike the initial certification, surveillance reports are reviewed and endorsed at State Health Department level – and if compliance is deemed unsatisfactory, the State can recommend that your certificate be suspended or terminated.

Validity, renewal, and adding products

Your certificate is valid for three years, and renewals must be applied for at least six months before expiry. Applications made after the expiry date are rejected outright and must be filed as new applications – at new application prices

The fees are as follows:

• Big Industry (BI): RM4,000
• Small & Medium Industry (SMI): RM3,000

If you want to bring new products under an existing certificate, there will be an additional product application fee of RM2,750 for BI and RM2,550 for SMI, plus auditor expenditure. 

The GMP – MeSTI – HACCP link

Let’s quickly establish what these three food quality standards mean in practical terms:

1. MeSTI is the entry-level
2. GMP is the mid-tier standard
3. HACCP is the most demanding

Because of this, HACCP certification gets you both GMP and MeSTI automatically.

So our advice is to apply for the highest certification you ultimately need. If that’s HACCP, implement GMP properly then apply for HACCP directly rather than certifying twice.

That’s all from us, and we wish you a smooth certification application 😊

Let MISHU assist your HACCP certification application

Directly and through our partners, MISHU regularly assists food operations in Malaysia with applying for various licenses from district and federal agencies. Speak to us today if you’d like help getting your food manufacturing business HACCP-certified!