How to Set Up Halal Control Points (HCP) in Your Factory

A Selangor processed food manufacturer had every reason to feel confident ahead of their SPHM renewal. Their HACCP system was current, their production records were complete, and their Halal Executive had spent months preparing documentation. The JAKIM renewal audit took two days. When the findings letter arrived, it listed two major NCRs.

The first: HCP monitoring records at the receiving bay showed consistent gaps — specifically on Tuesday and Wednesday afternoons over a six-month period. The line operator was performing the checks. Nobody had asked him to record them. The second: a new imported flavouring compound introduced eight months earlier had been assigned to the ingredient verification HCP, but no responsible person had been named for that specific HCP entry. The flavouring had passed through receiving more than 200 times without a formally assigned verifier.

SPHM renewal was delayed eight weeks. The RM cost of the delay — reformulation holds, customer communication, export shipment rescheduling — exceeded RM 40,000.

Both failures were not operational failures. The operator was competent. The flavouring was halal-certified. The failures were documentation and accountability failures at the Halal Control Point level — exactly the category of finding that JAKIM auditors are trained to surface, and exactly the category that MHMS 2020 is designed to prevent.

This guide explains how to set up Halal Control Points correctly, how to structure them for MYeHALAL digital submission, and how to maintain them at a standard that survives genuine scrutiny.

---

What Are Halal Control Points?

A Halal Control Point (HCP) is a stage in your production process where a halal integrity failure can occur, and where a specific, documented control measure can prevent or detect that failure.

The concept is drawn directly from HACCP methodology. If you operate a food safety management system, you already know the logic of Critical Control Points — HCPs apply identical discipline to halal risk specifically. The vocabulary is the same: hazard identification, control measure, monitoring procedure, corrective action, responsible person.

What distinguishes HCPs from CCPs is the nature of the risk. CCPs address food safety hazards — pathogens, chemical contamination, allergens. HCPs address halal integrity hazards — cross-contamination from non-halal materials, use of non-certified ingredients, process deviations that compromise halal status.

HCP vs CCP: What Is the Difference?

A receiving bay is the most common example of overlap: it is a CCP (temperature checks, condition inspection) and an HCP (certificate verification, non-halal contamination check) simultaneously. The monitoring records, however, are separate.

Where HCPs Sit Within MHMS 2020

HCPs belong to Pillar 4 of MHMS 2020, but understanding them in isolation misses their systemic function. HCP failures cascade — a gap at receiving creates a supplier management NCR, which triggers a documentation NCR, which is reviewed in the context of your JKHD meeting records. The diagram below shows all 13 pillars and where Pillar 4 sits within the broader framework:

The 13 Pillars of MHMS 2020

Malaysian Halal Management System — JAKIM

Governance

Organisational accountability & oversight

1

Halal Assurance System (HAS)

MHMS 2020 backbone framework

2

Internal Halal Committee (JKHD)

Halal compliance governance committee

11

Management Review

Top management HAS oversight

Operations

Production controls & integrity points

3

Internal Halal Control System (IHCS)

Internal operational controls

4

Halal Control Points (HCP)

Production integrity checkpoints

6

Halal-Compliant Processing

Production line integrity

7

Cleaning, Sanitation & Sertu

Ritual purification controls

Supply Chain

Ingredient verification & labelling

5

Supplier & Raw Material Verification

Certificate management

12

Labelling & Packaging Compliance

JAKIM-approved usage

People & Assurance

Training, audits & incident response

8

Staff Training & Competency

Role-linked halal training

9

Internal Audit Programme

MHMS 2020-scoped audits

10

NCR & Corrective Action

Non-conformity tracking & closure

13

Crisis Management

Halal integrity response

This matters practically: JAKIM auditors do not audit pillars independently. When they find an HCP monitoring gap, they pull the thread through supplier management (Pillar 5), training records (Pillar 6), and JKHD minutes (Pillar 1) to assess whether the failure is isolated or systemic.

---

Step 1: Map Your Process Flow

Before identifying HCPs, you need a complete, accurate process flow diagram for each product line. This diagram must reflect what actually happens on the production floor — not what your SOPs describe in theory. Walk the line. Observe. Document reality.

For a typical food manufacturer, the process flow covers:

1. Receiving — raw materials and ingredients arrive at your facility
2. Storage — materials are held before use
3. Preparation — weighing, measuring, thawing, mixing
4. Processing — cooking, blending, forming, or other transformation
5. Packaging — product is placed in its final form
6. Finished goods storage — packaged products await dispatch
7. Dispatch — products leave your facility

If you operate multiple product lines with different ingredient profiles or process paths, each requires its own flow. A shared process step (a common blending tank, for example) appears in every relevant flow and is assessed for HCP status in each context.

---

Step 2: Identify HCPs at Each Process Stage

At each stage of your process flow, ask: "Can a halal integrity failure occur here, and can we apply a control to prevent or detect it?"

If the answer to both parts is yes, that stage is an HCP candidate. Common HCPs by process stage:

Receiving

• Halal certificate verification for every incoming raw material delivery
• Visual inspection for non-halal contamination or compromised packaging
• Rejection procedure for materials without valid, current certificates

Storage

• Physical segregation between halal and non-halal materials (where applicable)
• Identification and labelling of halal raw materials
• Prevention of cross-contamination during storage handling

Preparation and Processing

• Ingredient verification against batch recipe card before use in production
• Equipment dedication or validated cleaning protocol between halal and non-halal runs
• Sertu (ritual purification) procedure documentation and verification where required

Packaging

• Halal label verification — correct labelling on correct product
• Packaging material halal compliance verification
• Lot traceability linkage between batch records and labels

Dispatch

• Transport vehicle cleanliness and halal compliance verification
• Segregation during mixed-load transport
• Chain-of-custody documentation for halal goods in transit

---

Step 3: Define Control Measures for Each HCP

For every identified HCP, you must document five elements. Together, they form your HCP definition — the entry in your HCP register that an auditor will examine.

1. The halal hazard — what could go wrong (e.g., "non-halal certified raw material enters production")
2. The control measure — what prevents it (e.g., "certificate verification at receiving, with rejection of any material without a valid, JAKIM-recognised certificate")
3. The monitoring procedure — how you verify the control is working (e.g., "receiving officer checks certificate validity against the approved supplier list for every delivery, records the check in the HCP monitoring log")
4. The corrective action — what happens if the control fails (e.g., "material is quarantined immediately, Halal Executive notified within one hour, NCR raised, material returned to supplier or destroyed")
5. The responsible person — who performs the monitoring and who authorises corrective action

The following worked example shows a complete HCP definition for a receiving bay. This is the level of detail that MHMS 2020 requires and that MYeHALAL portal submission expects:

Every HCP in your register should be defined at this level of specificity. A register that lists "certificate check — receiving" without monitoring procedure, corrective action, and named responsible persons is incomplete and will attract findings.

---

Step 4: Set Up Monitoring Records

HCPs are only as strong as their monitoring records. Every HCP must have a live monitoring log that captures:

These records must be maintained continuously — not reconstructed before an audit. JAKIM auditors cross-reference monitoring log dates with production records, delivery notes, and purchase orders. Gaps, inconsistencies between records, or implausible uniformity (every check "Pass" with identical handwriting) are all flags.

A missing record is treated as equivalent to a failed control. The Selangor manufacturer described at the opening of this article learned this at cost.

---

Step 5: Train Staff at Each HCP

Every person monitoring an HCP must be trained specifically for that role. General halal awareness training is not sufficient. Training for HCP monitoring must cover:

• What the HCP is and why it exists
• What constitutes a pass and a fail for that specific control point
• What corrective action to take immediately if a deviation is detected
• Who to escalate to (typically the Halal Executive)
• How to complete the monitoring record accurately, including what to write when a deviation occurs

Training must be documented. MHMS 2020 requires evidence that staff at HCPs have received role-specific halal training — not just general awareness. Training records must show date, content, trainer, and confirmation of competency.

---

HCP Documentation for MYeHALAL Submission

JAKIM's MYeHALAL portal has changed what "adequate documentation" means in practice. All audit records, NCR responses, and certificate submissions now go through the portal — and the portal expects structured, retrievable data, not scanned paper logs.

For manufacturers still operating paper-based HCP monitoring, MYeHALAL submission creates a specific challenge: paper logs must be digitised, indexed by HCP reference and date range, and uploaded in a format that auditors can navigate. In practice, this means:

• HCP registers should be maintained as structured digital documents, not as sections of a printed manual
• Monitoring logs should be captured digitally at point of activity, or paper logs must be digitised within the same working day
• Corrective action records must be linked to the relevant HCP entry and NCR reference, not held as separate documents
• Certificate records attached to HCP-relevant suppliers should be cross-referenced by HCP reference so auditors can verify the supply chain for a specific control point

Manufacturers who present auditors with ring binders of paper logs are not non-compliant, but they are creating unnecessary audit friction. MYeHALAL-ready documentation means an auditor (or the system itself) can retrieve all monitoring records for HCP-01 for the last 12 months in under two minutes.

---

How MPPHM 2020 Surveillance Audits Affect HCP Risk

The MPPHM 2020 surveillance audit framework allows JAKIM to conduct unannounced post-certification inspections between scheduled renewal audits. For HCP management, this changes the risk profile materially: HCP monitoring gaps that would only surface at the next renewal audit can now surface at any point during the certification period.

The most common HCP-related findings in surveillance audits include:

• Supplier certificate currency — if a supplier certificate has expired and the manufacturer's receiving HCP records do not reflect a delivery hold, the inconsistency between portal records and physical evidence is a direct surveillance audit finding
• Ingredient status changes — if an ingredient previously listed as halal has been reclassified or its certifying body has lost JAKIM recognition, manufacturers continuing to receive that ingredient without updated HCP records expose themselves to a Major NCR
• Monitoring record gaps — HCPs without continuous, dated monitoring evidence are treated as failures, regardless of whether a deviation actually occurred

The operational implication is that HCP monitoring gaps are no longer risk only during scheduled audits. Inconsistent monitoring records, certificate tracking failures, and undocumented deviations create persistent exposure under MPPHM 2020 surveillance.

Manufacturers with complete, up-to-date, digitally accessible HCP records are substantially less exposed to surveillance audit findings — and are substantially better positioned to respond on the day of an unannounced visit.

---

When to Review and Update Your HCP Register

Your HCP register is a living document. It must be reviewed and updated whenever any of the following occurs:

• New supplier onboarded — a new supplier introduces a new supply chain risk profile; assess whether new or modified HCPs are required at receiving
• New ingredient introduced — even if sourced from an approved supplier, a new ingredient may require an additional verification step
• Process change — new equipment, changed production sequence, or modified cleaning procedures may create new halal risk points
• Post-NCR — any NCR related to halal integrity should trigger a review of the HCP that was (or should have been) controlling that risk
• Post-audit — both internal and external audit findings should be fed back into the HCP register review cycle
• Certificate expiry or supplier status change — a change to a supplier's certification status may alter the risk profile at receiving and require modified control measures
• Annual review — regardless of the above, all HCPs should be formally reviewed at least annually, with the review date and reviewer recorded in the register

Document every review — including reviews that conclude no changes are needed. The evidence trail shows JAKIM that your HCP register is actively maintained, not static since initial certification.

---

Industry-Specific HCP Examples

Food Manufacturing

• Receiving: Certificate check for every raw material delivery
• Mixing room: Ingredient verification against batch recipe card before production begins
• Shared equipment: Validated cleaning protocol (including sertu if required) between product runs
• Packaging line: Label verification — correct halal marking on correct product

Slaughterhouse

• Pre-slaughter: Animal health inspection and stunning compliance
• Slaughter: Verification that the slaughterman is Muslim, trained, and performing to Islamic requirements
• Post-slaughter: Carcass identification and segregation from non-halal carcasses
• Cold storage: Temperature and segregation monitoring

Restaurant and Food Service

• Procurement: All ingredients sourced from halal-certified, approved suppliers
• Storage: Complete segregation — no non-halal items in the facility
• Kitchen preparation: Dedicated equipment; no alcohol-based cooking ingredients
• Service: No contact with non-halal food items during plating or service

---

Common HCP Implementation Mistakes

Identifying too few HCPs. Some manufacturers identify only the most obvious control points and miss secondary risks — cleaning chemicals that may contain non-halal ingredients, packaging materials from non-verified suppliers, or secondary processing aids added in small quantities.

Identifying too many HCPs. Over-identification creates an unsustainable monitoring burden. Focus on points where a genuine halal integrity failure can occur and where a specific, operable control is both necessary and effective.

Monitoring without recording. Performing checks but not documenting them is equivalent — from an audit perspective — to not performing them at all. The Selangor case at the opening of this article is the precise illustration. No record means no evidence.

Static HCP registers. A register last reviewed at initial certification and unchanged since is a red flag. It signals that the system has not been maintained to reflect operational reality.

No corrective action follow-through. Detecting a deviation at an HCP is only valuable if the corrective action is executed, documented, and the root cause investigated. This links directly to your NCR management process.

NCR Management Workflow — MHMS 2020

1

Identify & Document

Record the non-conformity using exact wording. Log it in the NCR register immediately — never leave it in an email thread.

2

Root Cause Analysis

Identify the system failure behind the finding — not just the surface symptom. Assign to a named owner with a deadline.

3

Define Corrective & Preventive Action

Document both the corrective action (fix the finding) and the preventive action (prevent recurrence). Assign responsibility.

4

Implement & Gather Evidence

Execute the action. Collect proof: updated SOPs, re-training records, process photos, management sign-offs.

5

Verify Effectiveness

An independent reviewer confirms the root cause is resolved — not just the observable symptom. This step is mandatory before closure.

6

Close NCR

NCR formally closed with documented confirmation. Submit through MYeHALAL if externally raised by JAKIM.

When an HCP deviation occurs, it is not a self-contained incident — it is the opening step of a six-stage NCR lifecycle that must run to closure. Manufacturers who quarantine material but never formally raise or close the NCR are building an audit liability with every undocumented deviation.

---

Expert Insight: The HCP That Passes Every Audit But Fails in Practice

There is a category of HCP failure that does not appear in monitoring logs and does not produce NCRs — because the system exists on paper at Level 1 maturity but has never been tested at Level 2.

Consider a receiving bay HCP: the monitoring record exists, updated each time a delivery arrives. The responsible person is named. The form includes a field for "certificate status." The field is always marked "Valid." The HCP has passed every internal audit for three years.

Now ask a different question: has this HCP ever actually rejected a delivery?

In many operations, the answer is no. Not once. The control exists. The record confirms it. But the receiving officer has never been in a position where they had to quarantine material — either because they do not know they can, because the escalation path has never been practically tested, or because the pressure to keep production running overrides the written procedure when a real deviation occurs.

This is the gap between HAS maturity Level 1 (Documented) and Level 2 (Implemented). The document says the control works. The practice has never confirmed it. When a delivery with a genuinely expired certificate arrives — which eventually it will — the control point fails not because the system was wrong, but because it was never real.

The test for genuine HCP effectiveness is not "do we have a record for every delivery?" but "has this control ever actually been exercised?" Manufacturers who cannot point to at least one corrective action event per active HCP over a 12-month period should treat that as a signal for investigation, not confidence.

---

Conclusion

Halal Control Points are where compliance documentation meets operational reality. Setting them up correctly requires accuracy in process mapping, specificity in control definitions, and discipline in monitoring record maintenance.

Key takeaways:

• Every HCP must have five defined elements: hazard, control measure, monitoring procedure, corrective action, and named responsible person
• Monitoring records must be maintained continuously — gaps are treated as failures, regardless of operational intent
• MYeHALAL submission now expects structured, retrievable digital HCP records, not ring binders
• MPPHM 2020 surveillance audits can be conducted unannounced — manufacturers with undocumented HCP gaps carry persistent audit risk between scheduled inspection cycles
• An HCP register should be reviewed after every process change, supplier change, NCR, or audit — not just annually
• Genuine HCP effectiveness means the control has been exercised and documented, not just defined

TAQYID provides structured HCP management tools — digital monitoring logs, deviation tracking linked to NCR workflows, and MYeHALAL-ready record export — designed to make HCP compliance sustainable at scale.

Explore TAQYID's HCP management tools →

---

Frequently Asked Questions

How many HCPs should a typical food manufacturer have?

There is no fixed number prescribed by MHMS 2020. The right number depends on your process complexity, ingredient profile, and supply chain. A simple single-product manufacturer might have four to six HCPs covering receiving, storage, production, and packaging. A multi-line manufacturer with complex ingredient sourcing might have fifteen or more. The correct approach is thorough process analysis — not targeting a specific count. Under-identification and over-identification are both audit risks.

Do HCPs need to be validated like HACCP CCPs?

MHMS 2020 does not use the term "validation" for HCPs in the same technical sense as HACCP does for CCPs, but the underlying requirement is equivalent: you must demonstrate that your control measure is effective at preventing or detecting the halal hazard it is designed to address. This means your monitoring procedure must be capable of detecting a real failure, your corrective action must be realistic, and your responsible person must be competent to execute the control. A monitoring procedure that cannot actually catch a deviation is not a valid control.

What happens if an HCP deviation is not recorded?

An unrecorded HCP deviation is treated by JAKIM as equivalent to an undetected failure — even if the deviation was identified and resolved operationally. The audit finding will be a documentation NCR at minimum, and potentially a systemic finding depending on the frequency and pattern of gaps. Under MYeHALAL, where records are submitted digitally, gaps in monitoring logs are visible to JAKIM auditors before they arrive on site. Persistent monitoring gaps can also surface during MPPHM 2020 surveillance audits, which may be conducted unannounced.

Can the Halal Executive also be the responsible person for an HCP?

Yes, but with caution. The Halal Executive can be the authorising person for corrective action — the individual who decides what happens when a deviation is detected. However, the monitoring role (performing the daily or per-delivery check) should be assigned to operational staff at that process point. If the Halal Executive is also doing the frontline monitoring, there is no independent verification layer. More importantly, if the Halal Executive is absent, the HCP monitoring may lapse. Name a primary responsible person and a designated backup for every HCP.

When should a new HCP be created rather than modifying an existing one?

Create a new HCP when a genuinely new risk point appears in your process that is not already covered by an existing control. For example, introducing a new ingredient category — such as moving from domestic suppliers to imported flavourings for the first time — may create a new verification requirement at receiving that is distinct from your existing certificate check, particularly if the ingredient requires an additional specification check or a different certifying body standard. Modify an existing HCP when the risk is the same but the control measure, monitoring procedure, or responsible person needs updating. Document both types of change in your HCP register review record.