HACCP Principles: The 7 Principles Explained for Restaurants

The HACCP principles are seven steps for controlling food safety hazards before they reach a guest. They were written for factories, but they fit a restaurant line surprisingly well: find what could hurt someone, decide where you can stop it, set a number, check the number, fix it when it is wrong, confirm the system works, and write it down.

This guide is for the second group. It walks through each principle with kitchen examples, shows how the principles turn into a written plan, and points out the mistakes inspectors see most. If you just need to know what HACCP stands for, start with our plain guide to what HACCP means.

The source documents are the NACMCF HACCP principles and application guidelines and the FDA Food Code 2022. Your state adopts the Food Code on its own schedule, so treat any plan you write as a draft for your health department to review.

The 7 HACCP principles at a glance

Swipe the table sideways to see every column.

Before the principles: five preliminary tasks

NACMCF lists five tasks to do first. They are easy to skip, and skipping them causes most of the problems later.

1. Assemble the HACCP team. In a small restaurant, this may be the owner and the chef. In a larger operation, include the kitchen manager and someone who knows the equipment.
2. Describe the food and its distribution. What are you making, how is it stored, and how does it reach the customer? Dine-in, takeout, delivery and catering each change the risks.
3. Describe the intended use and consumers. Is it served to the general public, or to a nursing home? Will it be eaten right away or later at home?
4. Develop a flow diagram. Draw every step from receiving to service.
5. Verify the flow diagram. Walk the kitchen and check that the diagram matches what actually happens.

See HACCP flow diagram examples for diagrams of common processes.

Principle 1: conduct a hazard analysis

A hazard analysis lists the hazards that are reasonably likely to occur at each step of the flow diagram, and the measures that can control them. Hazards fall into three types:

• Biological: bacteria, viruses, parasites. Examples: Salmonella on poultry, Listeria in ready-to-eat food, norovirus from ill workers, parasites in fish served raw.
• Chemical: allergens, cleaning chemicals, histamine in fish, excess nitrite in cured meats.
• Physical: glass, metal, bone fragments, plastic.

For each hazard, ask: how likely is it, and how severe would it be? Hazards that are both reasonably likely and severe need a control.

Restaurant example: For a chili process, the hazard analysis might list Salmonella and E. coli at receiving and cooking; C. perfringens and B. cereus at cooling and hot holding; and allergen cross-contact at prep if the recipe contains wheat or soy.

The most common mistake here is listing every possible hazard at every step. That creates a plan nobody can use. Focus on what is reasonably likely in your kitchen. See hazard analysis examples.

Principle 2: determine critical control points

A critical control point (CCP) is a step where control can be applied and is essential to prevent, eliminate or reduce a hazard to an acceptable level. Not every step that has a control is a CCP. A CCP is the step you cannot skip without the hazard getting through.

NACMCF offers a decision tree to help decide. It asks whether a control measure exists, whether the step is designed to eliminate or reduce the hazard, whether contamination could reach unacceptable levels, and whether a later step will eliminate it.

Restaurant examples of common CCPs:

• cooking raw animal foods
• cooling cooked TCS food
• reheating for hot holding
• hot holding and cold holding
• acidification of sushi rice
• receiving raw molluscan shellfish

Steps like handwashing, cleaning and sanitizing, and pest control are important but are usually handled as prerequisite programs, not CCPs. See critical control point examples.

Principle 3: establish critical limits

A critical limit is the maximum or minimum value that a hazard must be controlled to at a CCP. It must be measurable: temperature, time, pH, water activity, salt concentration.

Restaurant examples from the Food Code:

Swipe the table sideways to see every column.

Critical limits should come from a recognized source: the Food Code, a scientific study, or a process authority. Do not invent them. See the HACCP critical limits chart.

Principle 4: establish monitoring procedures

Monitoring is a planned sequence of observations or measurements to check that a CCP is under control. A good monitoring procedure answers:

• What is measured (internal temperature of chicken)
• How (calibrated probe thermometer in the thickest part)
• When (every batch)
• Who (the cook on the grill station)

Monitoring also creates the record used in verification.

Restaurant example: "The line cook probes the thickest piece of each batch of chicken with a calibrated thermometer and records the temperature on the cooking log."

Monitoring frequency matters. Checking hot holding every 2 hours, instead of once per shift, means a drop below 135°F can usually be fixed by reheating. See the restaurant temperature log.

Principle 5: establish corrective actions

Corrective actions are what you do when monitoring shows a critical limit was not met. NACMCF guidance says they should:

• determine and correct the cause of the deviation
• determine what happens to the affected product
• record what was done

Restaurant examples:

• chicken at 158°F: continue cooking to 165°F
• chili above 70°F at 2 hours: reheat to 165°F and restart cooling with a faster method, or discard
• soup in steam table at 128°F with unknown time: discard
• walk-in at 47°F overnight: evaluate food under your plan, repair the unit

Write corrective actions in advance for each CCP. See HACCP corrective actions examples.

Principle 6: establish verification procedures

Verification checks that the plan is working and is being followed. It is different from monitoring. Monitoring is the cook checking the chicken. Verification is the manager checking that the cook checked the chicken, that the thermometer is accurate, and that the plan still fits the kitchen.

Restaurant examples:

• manager reviews and signs logs daily or weekly
• thermometers are calibrated on a schedule
• manager observes a cook taking a temperature
• the plan is reviewed when the menu, equipment or process changes
• the plan is reviewed at least once a year

Validation is a part of verification: showing that the critical limits and controls actually work. For Food Code limits, the code itself is usually the validation. For special processes, such as a new cooling method or sous vide times, you may need data. See HACCP verification and record keeping and the thermometer calibration log.

Principle 7: establish record keeping and documentation

Records show that the plan exists and is being followed. They include:

• the HACCP plan itself, with the hazard analysis
• monitoring logs for each CCP
• corrective action records
• verification records, including calibration and log reviews
• training records

Keep records as long as your plan and health department require. For processes under Food Code 3-502.12, records are kept at least 6 months. USDA meat and poultry plants under 9 CFR part 417 have their own record retention rules. Many restaurants keep HACCP records 6 to 12 months.

How the HACCP principles fit together

Each principle depends on the one before. A hazard analysis that misses Listeria leads to no date marking CCP. A CCP without a measurable limit cannot be monitored. Monitoring without corrective actions leaves staff guessing. Corrective actions without verification are never checked. And without records, none of it can be shown to an inspector.

Think of the principles as a loop. Records feed verification. Verification finds problems. Problems lead to changes in the hazard analysis or the CCPs. The plan improves over time.

Walking one item through all seven principles

Item: chicken tortilla soup, made in batches and served from a soup well.

1. Hazard analysis: Salmonella on raw chicken; C. perfringens in cooked soup during cooling and holding; allergen (dairy in the cream garnish).
2. CCPs: cooking, cooling, reheating, hot holding.
3. Critical limits: chicken to 165°F; cool 135°F to 70°F in 2 hours, to 41°F in 6 hours; reheat to 165°F within 2 hours; hold at 135°F or above.
4. Monitoring: cook probes chicken each batch; cooling checked at 2 and 6 hours; reheat temperature recorded; soup well checked every 2 hours.
5. Corrective actions: continue cooking; reheat and restart or discard; continue reheating or discard at 2 hours; reheat if under 2 hours below 135°F, otherwise discard.
6. Verification: manager reviews logs each morning; thermometers calibrated daily; plan reviewed yearly.
7. Records: cooking log, cooling log, reheating and holding log, calibration log, corrective action log.

That is a complete HACCP plan for one item, on one page.

Prerequisite programs: what comes before HACCP

HACCP works only on top of basic good practices, often called prerequisite programs. In a restaurant these include:

• employee health and hygiene
• handwashing
• cleaning and sanitizing
• pest control
• supplier approval
• allergen management
• equipment maintenance
• staff training

These are not CCPs, but without them the CCPs cannot hold. See sanitation SOPs for restaurants and food allergen control plan.

Where the seven principles are required

• USDA FSIS meat and poultry plants under 9 CFR part 417.
• FDA seafood processors under 21 CFR part 123.
• FDA juice processors under 21 CFR part 120.
• Restaurants and retail under the Food Code when a HACCP plan is required, such as for a variance or reduced oxygen packaging.

Many restaurants use the principles voluntarily because they make food safety systematic. See when is a HACCP plan required and HACCP vs FSMA.

Questions to ask yourself at each principle

A simple way to check your own plan is to ask one question per principle.

Hazard analysis: "If someone got sick from this dish, what would most likely be the cause?" If you cannot answer, your hazard analysis is too thin.

CCPs: "If we skipped this step, would the hazard reach the customer?" If yes, it is probably a CCP. If a later step would catch it, probably not.

Critical limits: "Could two different cooks measure this and agree whether it passed?" If the limit is a number with a unit and a time, yes.

Monitoring: "Could a new hire read the procedure and do the check correctly on day one?" If not, rewrite it.

Corrective actions: "At 9 p.m. on a Saturday, would the cook know exactly what to do?" If the answer depends on reaching the owner by phone, the corrective action is not written well enough.

Verification: "When did someone last check that the checks are happening?" If nobody can remember, verification is missing.

Records: "If the inspector asked for last Tuesday's cooling log, could we find it in two minutes?" If not, the record system needs work.

These questions are not part of the official framework, but they turn abstract principles into something a kitchen manager can test in an afternoon.

How long it takes to apply the principles

For a small restaurant with one or two processes, a first draft of a HACCP plan built on the seven principles can be written in a few hours if you already know your menu and equipment well. Most of the time goes into the hazard analysis and into writing monitoring procedures staff can follow. Validation of special processes, such as testing a new cooling method, adds days or weeks depending on the process. Health department review times vary widely by jurisdiction. Plan ahead if the plan is tied to opening a new menu item or applying for a variance. See HACCP variance requirements.

HACCP principles and your health inspection

A routine health inspection is not a HACCP audit, but inspectors often look at the same things the principles cover. They probe food to check critical limits, look at logs to check monitoring and records, and ask staff what they would do when a temperature is wrong, which is a corrective action question. A kitchen that runs on the seven principles usually finds inspections more predictable. See the health inspection food safety checklist.

Common mistakes with the principles

• Skipping the preliminary tasks and starting with CCPs.
• Too many CCPs. Making every step a CCP makes the plan unmanageable.
• Vague limits such as "cook thoroughly."
• Monitoring without a named person. If everyone is responsible, nobody is.
• No corrective action for some CCPs.
• Confusing monitoring with verification.
• Records that are filled in later from memory.
• Never updating the plan after menu or equipment changes.

Teaching the principles to staff

Staff do not need to memorize seven principle names. They need to know their part: the temperatures at their station, how to check, what to write, and what to do when a reading is wrong. A short, station-specific card does more than a lecture on HACCP theory. See HACCP training for restaurant staff.

Applying the principles to different operations

Food trucks usually have a short menu and few steps, so a HACCP plan can be very short. The main CCPs are often cooking and hot holding, plus cooling if food is prepared ahead at a commissary. See the food truck HACCP plan.

Caterers cook ahead, transport and serve off site, which adds transport and holding steps. Time control is common. See the catering HACCP plan.

Bakeries usually have few CCPs, mainly around cream fillings and custards. Allergens are a big focus. See the bakery HACCP plan.

Specialized processes such as curing, smoking, sous vide and reduced oxygen packaging require a HACCP plan under the Food Code. Here the principles matter most, and the critical limits often need scientific support. See HACCP plan for cured and smoked foods and the sous vide HACCP plan.

Turning the principles into a plan

The principles are the framework. The plan is the document with your hazards, CCPs, limits, monitoring, corrective actions, verification and records filled in for your menu. See how to write a HACCP plan, the HACCP plan template and a full HACCP plan example. Restaurants should start with our HACCP plan for restaurants guide, which lists the processes that usually trigger a written plan.

Applying the principles to a complex process like curing can be hard; that is when a HACCP consultant earns the fee.

The free HACCP plan builder walks you through the seven principles one process at a time, fills in Food Code limits, monitoring and corrective actions, and gives you printable logs. Your first process is free; the Plan Pack unlocks the rest. The result is a draft for your health department to review, not legal advice.

Frequently asked questions

What are the 7 HACCP principles?

Hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification, and record keeping.

Which HACCP principle comes first?

Hazard analysis. Every later principle depends on naming the right biological, chemical and physical hazards for each menu process.

What is the difference between monitoring and verification?

Monitoring is the routine check at a CCP, like probing a burger. Verification checks that the system works, like a manager reviewing logs weekly and calibrating thermometers.

Do restaurants have to follow the HACCP principles?

A written plan built on the principles is required for Food Code specialized processes and variances, such as curing, reduced oxygen packaging or sous vide. Other kitchens use them voluntarily.