HACCP Variance Requirements: When You Need One and How to Apply

A HACCP variance is what a restaurant needs when it wants to run a process the Food Code does not allow by default, such as curing salami, smoking fish for preservation, pickling vegetables to keep them at room temperature, or vacuum packaging in a way the code does not cover. The variance is written permission from your health department. The HACCP plan is the evidence you give them that the process is safe.

This guide covers which processes need a variance under the FDA Food Code 2022, what the application has to contain, how long it can take, and how to keep it once approved. It is written for US restaurants, caterers and small producers. States adopt the Food Code at different times and some add their own rules, so check with your health department first. Everything you prepare is a draft for them to review.

What a HACCP variance is

The Food Code defines a variance as a written document issued by the regulatory authority that authorizes a modification or waiver of one or more code requirements if, in the regulator's opinion, a health hazard or nuisance will not result.

Three parts of the code work together:

• 3-502.11 lists the specialized processes that require a variance.
• 8-103.10 to 8-103.12 set how a variance is granted, what must be documented, and the duty to follow the approved procedures.
• 8-201.13 says when a HACCP plan must be submitted, including when a variance is requested under 3-502.11 and for certain processes under 3-502.12.

The when is a HACCP plan required page explains how these fit together.

Processes that need a variance under 3-502.11

Section 3-502.11 says a food establishment must obtain a variance before:

| Process | Typical restaurant example | |---|---| | Smoking food as a method of preservation rather than flavor enhancement | Cold-smoked salmon, smoked sausage held unrefrigerated | | Curing food | House salami, coppa, bresaola, country ham | | Using food additives or adding components such as vinegar to preserve food or render it non-TCS | Pickled vegetables held at room temperature, acidified sushi rice held out of temperature control | | Packaging TCS food using reduced oxygen packaging, except as allowed in 3-502.12 | Vacuum-packing raw fish, extended shelf life beyond 3-502.12 | | Operating a molluscan shellfish life-support system display tank | Live oyster or lobster tanks where shellfish are sold for eating | | Custom processing animals for personal use, not for sale | Processing a hunter's deer | | Preparing food by another method the regulatory authority decides needs a variance | Novel processes, fermentation programs | | Sprouting seeds or beans | Growing sprouts in house |

Some items in this list overlap with other rules. Sushi rice is the most common: acidifying rice so it can be held without temperature control is covered by 3-502.11(C) in many jurisdictions, and some health departments handle it under time as a public health control instead. See our HACCP plan for sushi rice.

Processes that need a HACCP plan but usually not a variance

Section 3-502.12 lets you do some reduced oxygen packaging without a variance, as long as you have a HACCP plan and follow the conditions:

• Vacuum packaging foods that meet one of the barriers listed, such as aw 0.91 or below, pH 4.6 or below, or raw meat with high competing organisms, with a 30-day refrigerated shelf life limit.
• Cook-chill and sous vide under 3-502.12(D).
• Cheese packaging under 3-502.12(E).

The plan goes to the regulator before you start, but you are not asking for a waiver of a code requirement. See cook-chill HACCP plan, sous vide HACCP plan and the reduced oxygen packaging HACCP plan.

Separately, the Food Code allows serving some foods undercooked, such as rare steak or raw oysters, with a consumer advisory. That is not a variance either.

What a variance request must include

Section 8-103.11 lists the documentation the regulator needs for a variance request. In plain terms:

1. A statement of the proposed variance and the code section it would modify or waive.
2. An analysis of the rationale for how public health hazards and nuisances will be addressed.
3. A HACCP plan if required by 8-201.13, with all the information in 8-201.14.
4. Any other information the regulator asks for.

Section 8-201.14 then sets out what the HACCP plan must contain:

• A categorization of the types of TCS food in the plan.
• A flow diagram by specific food or category identifying CCPs.
• Information on ingredients, materials, equipment, recipes and methods.
• A statement of standard operating procedures, with the CCPs, critical limits, monitoring, corrective actions, and records.
• A copy of the training program.
• Copies of blank records forms.
• Supporting evidence for the process, such as validation studies or a process authority letter.

The HACCP plan template follows this structure.

Scientific support and process authorities

For processes like curing, acidification and smoking, the regulator usually wants proof that your recipe and method produce a safe product. Common forms of support:

• A process authority letter. A food scientist, often at a university extension, reviews your recipe and process and issues a letter stating whether it is safe and under what conditions.
• Published guidance for a defined process, such as standard pH targets for acidified foods.
• Lab testing of your finished product for pH, water activity or salt concentration.
• Challenge studies for unusual products, where a lab inoculates the product with pathogens and measures what happens. These are expensive and rarely needed for standard restaurant processes.

Ask your health department what they accept before paying for anything. Some have a list of process authorities they work with.

Writing the HACCP plan for a variance

A variance plan follows the seven principles described in the NACMCF HACCP principles and application guidelines and the Food Code's Annex 6. For each process:

1. Describe the product and its intended use.
2. Draw a flow diagram with every step.
3. Do a hazard analysis.
4. Identify CCPs. For curing, that might be nitrite and salt weighing, fermentation pH, and drying water activity. For acidified vegetables, it is the final pH.
5. Set critical limits from your scientific support.
6. Set monitoring, with the method, frequency and responsible person.
7. Write corrective actions for each CCP.
8. Plan verification, including calibration of pH meters and scales.
9. List records and how long you keep them.

For worked examples, see critical control point examples and the HACCP critical limits chart.

Example: acidified vegetables held at room temperature

A restaurant wants to keep house pickles on the bar shelf instead of in the cooler. Under 3-502.11(C), that needs a variance.

| Step | CCP? | Critical limit | Monitoring | Corrective action | |---|---|---|---|---| | Brine preparation | No | Recipe followed | Weigh vinegar and salt | Remake brine | | Acidification | Yes | Equilibrium pH 4.6 or below (often a stricter target such as 4.2 set by the process authority) | pH meter on blended sample after equilibration time | Hold under refrigeration; re-acidify or discard | | Labeling | No | Date and batch | Visual check | Relabel |

Equilibrium pH matters: the pH of the vegetable pieces, not just the brine. Your process authority will say how long to wait before testing. The pH meter must be calibrated with buffers each day of use, and the calibration recorded.

Example: dry-cured salami

| CCP | Hazard | Typical limit source | |---|---|---| | Cure weighing | Too little nitrite (botulism) or too much (toxicity) | Regulatory limits and recipe | | Fermentation | Staphylococcus aureus toxin, pathogen growth | Time to reach a target pH, often from published degree-hour guidance or process authority | | Drying | Pathogen survival | Target water activity or weight loss validated for the product |

Curing is one of the more complex variances. See the HACCP plan for cured and smoked foods for detail.

Example: reduced oxygen packaging of fish

The Food Code does not allow fish to be reduced oxygen packaged unless it is frozen before, during and after packaging and the label says to keep it frozen (3-502.12(C)). Anything else, such as vacuum-packing fresh fish for refrigerated storage, needs a variance and strong scientific support because of C. botulinum type E. Most regulators are cautious here.

Example: live shellfish display tanks

A molluscan shellfish life-support tank keeps oysters, clams or mussels alive for sale. The Food Code allows these tanks for display only, or with a variance and a HACCP plan if the shellfish are served. The concerns are water quality, cross-contamination between lots, and losing the shellstock tag trail. A plan usually covers water disinfection and testing, keeping lots separate so tags still match the animals, and cleaning and maintenance of the tank. If you only want a display, ask whether a "display only" sign is enough in your jurisdiction.

Example: sprouting seeds and beans

Sprouts have been linked to many outbreaks because the warm, wet conditions that grow sprouts also grow Salmonella and E. coli. The Food Code requires a variance for sprouting in a food establishment. Few restaurants pursue this; buying sprouts from a supplier is far simpler. If you do want to sprout, expect your regulator to ask for seed disinfection, testing of spent irrigation water, and strict sanitation.

How long approval takes

There is no national timeline. Factors include:

• Whether your health department reviews variances itself or sends them to the state.
• How common the process is in your area.
• Whether you have a process authority letter.
• How complete your first submission is.

Simple, well-documented requests are sometimes approved within weeks. Novel processes can take months. Some health departments charge a fee. Ask before you plan menus or buy equipment.

After approval: keeping the variance

Section 8-103.12 says that if a variance is granted, the permit holder must follow the plans and procedures that were submitted and approved, and keep and make available the records showing it does so. That means:

• Follow the plan exactly. Changing the recipe, the equipment or the process without telling the regulator puts the variance at risk.
• Keep every record listed in the plan.
• Train new staff before they run the process.
• Tell the regulator about changes, and ask whether they need a new review.
• Expect inspections to focus on the variance process and its records.

The variance can be revoked or suspended if you do not comply or if a hazard results.

Records commonly required for variances

• CCP monitoring logs: pH, water activity, weights, temperatures, times.
• Instrument calibration logs: pH meter, thermometers, scales, water activity meter.
• Corrective action records.
• Verification records: manager review, lab results.
• Training records.
• The approved variance letter and the approved plan.

Our free logs include blank forms you can adapt, and the thermometer calibration log post covers calibration.

Costs to plan for

Exact costs vary, so get quotes, but a variance project often includes:

• Instruments: a calibrated pH meter with buffers, a probe thermometer, an accurate scale, and for cured products possibly a water activity meter or access to lab testing.
• A process authority review, if your regulator wants one.
• Lab tests on finished product.
• Any health department review fee.
• Staff time for training and record keeping.

Budget for ongoing costs too, such as buffer solutions, calibration, and periodic lab testing that your plan may require.

Changes of ownership, location or menu

A variance is usually tied to the permit holder, the location and the approved process. If you sell the business, move, open a second location, or change the recipe or equipment, ask your health department whether the variance carries over or needs a new review. Do not assume it transfers. When you add a new product to an approved process, such as a new salami recipe, check whether it needs its own approval. Keeping the regulator informed is part of 8-103.12, and it protects you if something goes wrong.

Common reasons variance requests are delayed or denied

• No scientific support for the critical limits.
• Vague monitoring. "Check pH" without saying how, when, with what instrument and who.
• No corrective actions or corrective actions that do not handle the product.
• Missing records forms or training program.
• Process not described clearly enough for an inspector to picture it.
• Requests for fish ROP without strong support.

Checklist before you submit a HACCP variance request

• The process is described step by step, with equipment and recipes.
• Each code section you want modified is named.
• The flow diagram shows every step and marks the CCPs.
• Every critical limit has a source: Food Code, published guidance, process authority letter or lab data.
• Monitoring says what, how, how often and who.
• Corrective actions say what happens to the product and how the cause is fixed.
• Verification includes instrument calibration and manager review.
• Blank copies of every log are attached.
• The training program is attached.
• Contact details for the person responsible are included.

Going through this list before you submit is the easiest way to avoid a round of questions that adds weeks.

What to expect during review

Reviewers often ask follow-up questions, request a site visit to see the equipment, or ask for a trial run with records. Some approve a variance for a limited period and review it again after you have built up records. Treat these requests as part of the process, not a refusal. Answer in writing and keep copies.

Talking to your health department

Before submitting, call or email your inspector and ask:

• Which code edition does your jurisdiction use?
• Does this process need a variance here, or only a HACCP plan?
• Who reviews variance requests, and is there a fee?
• Do you require a process authority letter, and do you have a list?
• Is there a state form or template?

Write down the answers and the person you spoke to. Many health departments publish their own HACCP and variance guidance, which takes priority over anything general.

Keeping variance records organized

Keep one binder or shared folder per variance, holding the approval letter, the approved plan, the process authority letter, current logs and the last 6 to 12 months of completed logs, calibration records, and training sign-offs. An inspector should be able to find any record in under a minute.

Variance vs HACCP plan vs consumer advisory

| Situation | Variance? | HACCP plan? | Consumer advisory? | |---|---|---|---| | Rare burger on menu | No | No | Yes | | Sous vide under 3-502.12(D) | No | Yes | Depends on cooking temperature | | Curing salami | Yes | Yes | No | | Pickles at room temperature | Yes | Yes | No | | Sushi rice held with vinegar, no time control | Usually yes | Yes | No | | Sushi rice with time as a public health control | No | Written procedure | No | | Raw oysters | No | No (but shellstock tags and records) | Yes |

Training staff on a variance process

Variance processes depend on a few people doing the same thing every time. Train each person who runs the process on:

• The critical limits and why they matter.
• How to use and calibrate the measuring instruments.
• How to record results.
• Exactly what to do when a result fails.

Keep a signed record for each person. See HACCP training for restaurant staff.

Build your variance HACCP plan

The HACCP builder creates the plan sections that 8-201.14 asks for: product description, flow diagram, hazard analysis, CCP table with Food Code section numbers, and blank logs. You add the scientific support for your specific process. Your first process is free, and the Plan Pack adds every process. The plan is a draft for your health department to review, and the variance decision is theirs.

Frequently asked questions

What is a variance in the Food Code?

The Food Code defines a variance as a written document issued by the regulatory authority that authorizes a modification or waiver of one or more requirements of the code if, in the opinion of the regulatory authority, a health hazard or nuisance will not result.

Which processes need a variance?

Food Code 2022 section 3-502.11 lists them, including smoking food for preservation, curing, using food additives or components such as vinegar to preserve food or make it non-TCS, reduced oxygen packaging that does not meet 3-502.12, molluscan shellfish life-support tanks, custom processing animals, sprouting seeds and beans, and other methods your regulator decides need one.

How long does it take to get a variance?

It depends on the jurisdiction. Some health departments review within weeks; others send complex requests to a state agency or a process authority, which can take months. Ask your inspector before you plan a launch date.

Can a variance be revoked?

Yes. Under the Food Code the regulator can revoke or suspend a variance if the operation does not follow the approved procedures or if a health hazard results. Keep records showing you follow the plan.